brainferno-mcp-bridge 0.1.0

package/dist/bridge/socket.js

@@ -0,0 +1,424 @@
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { WebSocketServer } from "ws";
+import { APPS } from "@brainferno/mcp-bridge-protocol";
+import { log } from "../logging.js";
+import { removeHandshake, writeHandshake } from "./handshake.js";
+import { PROTOCOL_VERSION, parsePanelFrame, } from "@brainferno/mcp-bridge-protocol";
+import { AppDisconnectedError, AppNotConnectedError, EvalTimeoutError, ScriptError, } from "./types.js";
+const SERVER_VERSION = "0.1.0";
+const DEFAULT_AUTH_DEADLINE_MS = 3_000;
+const FAST_TIMEOUT_MS = 10_000;
+const MAX_MISSED_PINGS = 2;
+/** Even a "render" gets a ceiling so a silent panel cannot wedge its app queue
+ * forever; the job registry (a later phase) will own long renders properly. */
+const RENDER_CEILING_MS = 30 * 60_000;
+/** Cap on concurrent sockets, so a local/web peer cannot exhaust FDs by churn. */
+const DEFAULT_MAX_CONNECTIONS = 64;
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1"]);
+/**
+ * Accepts panel connections and routes commands to whichever application each
+ * panel authenticated as. One panel per application; a second authenticated
+ * connection for the same application replaces the first.
+ *
+ * Security posture (a localhost WebSocket is reachable by any local process and,
+ * because browsers exempt WebSockets from the same-origin policy, by any web
+ * page the user visits): the upgrade is Origin/Host-validated; every socket must
+ * present a valid token in its hello within a short deadline before any other
+ * frame is honored; and results are matched per-socket so one panel can never
+ * settle another's in-flight call.
+ */
+export class BridgeServer {
+    options;
+    wss;
+    panels = new Map();
+    states = new Map();
+    /** Serializes commands per app: one script/modal scope per host at a time. */
+    appQueues = new Map();
+    token;
+    insecure;
+    heartbeatIntervalMs;
+    authDeadlineMs;
+    allowedOrigins;
+    maxConnections;
+    heartbeat;
+    constructor(options) {
+        this.options = options;
+        this.insecure = options.insecure === true;
+        // Resolve the effective token: an explicit one wins; otherwise generate a
+        // per-process secret so the bridge is never unauthenticated by default.
+        this.token = this.insecure
+            ? ""
+            : options.token !== ""
+                ? options.token
+                : randomBytes(32).toString("hex");
+        this.heartbeatIntervalMs = options.heartbeatIntervalMs ?? 15_000;
+        this.authDeadlineMs = options.authDeadlineMs ?? DEFAULT_AUTH_DEADLINE_MS;
+        this.allowedOrigins = new Set(options.allowedOrigins ?? []);
+        this.maxConnections = options.maxConnections ?? DEFAULT_MAX_CONNECTIONS;
+        this.wss = this.listen(options.port);
+        if (this.heartbeatIntervalMs > 0) {
+            this.heartbeat = setInterval(() => this.pingAll(), this.heartbeatIntervalMs);
+            this.heartbeat.unref();
+        }
+    }
+    listen(port) {
+        const wss = new WebSocketServer({
+            port,
+            host: this.options.host ?? "127.0.0.1",
+            verifyClient: (info, done) => this.verifyUpgrade(info.req, done),
+        });
+        wss.on("connection", (socket) => this.onConnection(socket));
+        wss.on("listening", () => this.onListening());
+        return wss;
+    }
+    /**
+     * Resolves once a listening socket is bound. If the preferred port is taken
+     * (typically a stale server instance still holding it), falls back to an
+     * OS-assigned port: panels discover the real port from the handshake file,
+     * so a fixed port is a preference, not a requirement.
+     */
+    ready() {
+        return this.waitListening(this.wss).catch((error) => {
+            if (error.code !== "EADDRINUSE" || this.options.port === 0)
+                throw error;
+            log.warn(`port ${this.options.port} is in use (a stale server instance?) — falling back to an OS-assigned port`);
+            this.wss = this.listen(0);
+            return this.waitListening(this.wss);
+        });
+    }
+    waitListening(wss) {
+        return new Promise((resolve, reject) => {
+            if (wss.address() !== null) {
+                resolve();
+                return;
+            }
+            const onError = (error) => reject(error);
+            wss.once("listening", () => {
+                wss.off("error", onError);
+                wss.on("error", (e) => log.error("bridge server error", e));
+                resolve();
+            });
+            wss.once("error", onError);
+        });
+    }
+    /** The bound port, or 0 before the server is listening. */
+    port() {
+        const address = this.wss.address();
+        return address !== null && typeof address === "object" ? address.port : 0;
+    }
+    bridgeFor(appId) {
+        return {
+            appId,
+            isConnected: () => this.panels.has(appId),
+            execute: (name, params, options) => this.execute(appId, name, params, options),
+            evaluate: (script, options) => this.execute(appId, "eval", { script }, options),
+            close: async () => {
+                this.panels.get(appId)?.close();
+                this.panels.delete(appId);
+            },
+        };
+    }
+    connectedApps() {
+        return [...this.panels.keys()];
+    }
+    onListening() {
+        const host = this.options.host ?? "127.0.0.1";
+        log.info(`bridge listening on ${host}:${this.port()}`);
+        if (this.insecure) {
+            log.warn("bridge authentication is DISABLED (insecure mode) — with auth off the Origin/Host checks are the only " +
+                "gate, so any local process (and a web page via a null-origin frame) could run script in your apps; " +
+                "use only for local debugging");
+            return;
+        }
+        if (this.options.handshakeFilePath !== undefined) {
+            try {
+                writeHandshake(this.options.handshakeFilePath, {
+                    protocolVersion: PROTOCOL_VERSION,
+                    port: this.port(),
+                    token: this.token,
+                    pid: process.pid,
+                });
+                log.info(`handshake written to ${this.options.handshakeFilePath}`);
+            }
+            catch (error) {
+                log.error("failed to write handshake file", error);
+            }
+        }
+    }
+    verifyUpgrade(req, done) {
+        if (this.states.size >= this.maxConnections) {
+            log.warn(`rejecting upgrade: ${this.states.size} connections already open`);
+            done(false, 503, "too many connections");
+            return;
+        }
+        // Loopback binding alone does not stop a browser (WebSockets are exempt from
+        // the same-origin policy). Allowlist the Origin — an absent one (UXP panels
+        // send none) and a loopback one are fine; a web page's Origin is always a
+        // real web origin or the literal "null" (sandboxed/file/data documents),
+        // neither of which is loopback, so both are rejected.
+        if (!this.originAllowed(req.headers.origin)) {
+            log.warn(`rejecting upgrade from origin ${JSON.stringify(req.headers.origin)}`);
+            done(false, 403, "forbidden origin");
+            return;
+        }
+        // Host must be loopback too (DNS-rebinding guard: a rebinding page sends the
+        // attacker hostname here, not the resolved IP).
+        const host = req.headers.host;
+        if (typeof host === "string" && !/^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/.test(host)) {
+            log.warn(`rejecting upgrade with non-loopback host ${host}`);
+            done(false, 403, "forbidden host");
+            return;
+        }
+        done(true);
+    }
+    originAllowed(origin) {
+        if (origin === undefined)
+            return true; // UXP panels send no Origin header.
+        // UXP panels (Photoshop 2026 on Windows, verified) send the literal
+        // "file://". Browsers never send that for a local document — they send the
+        // word "null" — so accepting it does not reopen the drive-by hole; the
+        // token remains the real gate.
+        if (origin === "file://")
+            return true;
+        if (this.allowedOrigins.has(origin))
+            return true;
+        try {
+            return LOOPBACK_HOSTNAMES.has(new URL(origin).hostname);
+        }
+        catch {
+            return false; // "null", "file://", or malformed — reject.
+        }
+    }
+    onConnection(socket) {
+        const state = {
+            authed: false,
+            pending: new Map(),
+            missedPings: 0,
+            authTimer: setTimeout(() => {
+                if (!state.authed) {
+                    log.warn("closing socket that did not authenticate in time");
+                    socket.close(4001, "authentication timeout");
+                }
+            }, this.authDeadlineMs),
+        };
+        state.authTimer.unref?.();
+        this.states.set(socket, state);
+        socket.on("message", (data) => this.onMessage(socket, state, data.toString()));
+        socket.on("close", () => this.onClose(socket, state));
+        socket.on("error", (error) => log.warn("panel socket error", error));
+    }
+    onMessage(socket, state, raw) {
+        let frame;
+        try {
+            frame = parsePanelFrame(raw);
+        }
+        catch (error) {
+            log.warn("dropping malformed frame from panel", error);
+            return;
+        }
+        // Any inbound frame is a sign of life.
+        state.missedPings = 0;
+        if (!state.authed) {
+            if (frame.type !== "hello") {
+                log.warn(`dropping ${frame.type} frame from unauthenticated socket`);
+                socket.close(4001, "expected hello");
+                return;
+            }
+            this.handleHello(socket, state, frame);
+            return;
+        }
+        switch (frame.type) {
+            case "result":
+                this.settle(state, frame.id, frame.ok, frame.value, frame.error);
+                return;
+            case "progress":
+                log.debug(`progress ${frame.id}: ${frame.message ?? ""} ${frame.progress ?? ""}`);
+                return;
+            case "ping":
+                this.send(socket, { type: "ping", ts: Date.now() });
+                return;
+            case "pong":
+                return;
+            case "bye":
+                log.info(`panel for "${state.appId}" said bye: ${frame.reason ?? ""}`);
+                socket.close(1000, "bye");
+                return;
+            case "hello":
+                // Already authenticated; a second hello is ignored.
+                return;
+        }
+    }
+    handleHello(socket, state, frame) {
+        if (!this.insecure && !this.tokenMatches(frame.token)) {
+            log.warn(`rejecting panel for "${frame.appId}": bad or missing token`);
+            socket.close(4001, "unauthorized");
+            return;
+        }
+        if (!(frame.appId in APPS)) {
+            socket.close(4002, "unknown appId");
+            return;
+        }
+        if (frame.protocolVersion !== PROTOCOL_VERSION) {
+            log.warn(`panel for "${frame.appId}" speaks protocol v${frame.protocolVersion}, ` +
+                `this server speaks v${PROTOCOL_VERSION}`);
+            socket.close(4003, "protocol version mismatch");
+            return;
+        }
+        clearTimeout(state.authTimer);
+        state.authed = true;
+        state.appId = frame.appId;
+        // Replace any earlier panel for this app (reconnect after a restart).
+        const existing = this.panels.get(frame.appId);
+        if (existing !== undefined && existing !== socket) {
+            existing.close(4004, "replaced by newer connection");
+        }
+        this.panels.set(frame.appId, socket);
+        this.send(socket, {
+            type: "welcome",
+            protocolVersion: PROTOCOL_VERSION,
+            serverVersion: SERVER_VERSION,
+            heartbeatIntervalMs: this.heartbeatIntervalMs,
+        });
+        const version = frame.hostVersion ? ` (${frame.hostVersion})` : "";
+        log.info(`panel connected: ${frame.appId}${version}`);
+    }
+    tokenMatches(provided) {
+        if (this.token === "")
+            return true; // insecure mode has no token
+        if (provided === undefined)
+            return false;
+        const a = Buffer.from(provided);
+        const b = Buffer.from(this.token);
+        // Constant-time, and length-guarded (timingSafeEqual throws on a mismatch).
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    settle(state, id, ok, value, error) {
+        const waiting = state.pending.get(id);
+        if (waiting === undefined) {
+            log.debug(`result for unknown or already-settled call ${id}`);
+            return;
+        }
+        state.pending.delete(id);
+        if (waiting.timer !== undefined)
+            clearTimeout(waiting.timer);
+        if (ok) {
+            waiting.resolve((value ?? null));
+        }
+        else {
+            const appId = state.appId ?? "after_effects";
+            waiting.reject(new ScriptError(appId, error?.message ?? "script failed without a message", error?.line));
+        }
+    }
+    onClose(socket, state) {
+        clearTimeout(state.authTimer);
+        if (state.appId !== undefined && this.panels.get(state.appId) === socket) {
+            this.panels.delete(state.appId);
+            log.info(`panel disconnected: ${state.appId}`);
+        }
+        // Fail any in-flight calls rather than letting them hang to their timeout.
+        for (const [, pending] of state.pending) {
+            if (pending.timer !== undefined)
+                clearTimeout(pending.timer);
+            pending.reject(new AppDisconnectedError(state.appId ?? "after_effects", "socket closed"));
+        }
+        state.pending.clear();
+        this.states.delete(socket);
+    }
+    pingAll() {
+        for (const [socket, state] of this.states) {
+            if (!state.authed)
+                continue;
+            if (state.missedPings >= MAX_MISSED_PINGS) {
+                log.warn(`panel for "${state.appId}" missed ${state.missedPings} pings — terminating`);
+                socket.terminate();
+                continue;
+            }
+            state.missedPings += 1;
+            this.send(socket, { type: "ping", ts: Date.now() });
+        }
+    }
+    execute(appId, name, params, options) {
+        if (!this.panels.has(appId)) {
+            return Promise.reject(new AppNotConnectedError(appId, this.connectHint(appId)));
+        }
+        // Chain behind any in-flight command for this app; look the socket up when
+        // the task actually runs, so a mid-queue reconnect is handled correctly.
+        const prior = this.appQueues.get(appId) ?? Promise.resolve();
+        const run = prior.catch(() => { }).then(() => this.dispatch(appId, name, params, options));
+        this.appQueues.set(appId, run.catch(() => { }));
+        return run;
+    }
+    dispatch(appId, name, params, options) {
+        const socket = this.panels.get(appId);
+        const state = socket ? this.states.get(socket) : undefined;
+        if (socket === undefined || state === undefined) {
+            return Promise.reject(new AppNotConnectedError(appId, this.connectHint(appId)));
+        }
+        const id = randomUUID();
+        const timeoutClass = options?.timeoutClass ?? "slow";
+        const timeoutMs = this.resolveTimeout(options, timeoutClass);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                state.pending.delete(id);
+                reject(new EvalTimeoutError(appId, timeoutMs));
+            }, timeoutMs);
+            state.pending.set(id, { resolve, reject, timer });
+            try {
+                this.send(socket, { type: "cmd", id, name, params: params ?? null, timeoutClass });
+            }
+            catch (error) {
+                clearTimeout(timer);
+                state.pending.delete(id);
+                reject(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+    }
+    resolveTimeout(options, timeoutClass) {
+        if (options?.timeoutMs !== undefined)
+            return options.timeoutMs;
+        switch (timeoutClass) {
+            case "fast":
+                return FAST_TIMEOUT_MS;
+            case "slow":
+                return this.options.defaultTimeoutMs;
+            case "render":
+                // Renders run for minutes, but keep a generous ceiling so a silent panel
+                // cannot wedge the app's command queue forever; the job registry (a
+                // later phase) will own long-render lifecycles properly.
+                return RENDER_CEILING_MS;
+        }
+    }
+    connectHint(appId) {
+        const app = APPS[appId];
+        if (app.lane === "os-script") {
+            return `Open ${app.displayName}; it is driven directly and needs no panel.`;
+        }
+        const menu = app.panel === "uxp" ? "Plugins" : "Window > Extensions";
+        return `Open ${app.displayName} and launch the brainferno-mcp-bridge panel from its ${menu} menu.`;
+    }
+    send(socket, frame) {
+        socket.send(JSON.stringify(frame));
+    }
+    async close() {
+        if (this.heartbeat !== undefined)
+            clearInterval(this.heartbeat);
+        for (const state of this.states.values()) {
+            clearTimeout(state.authTimer);
+            for (const [, pending] of state.pending) {
+                if (pending.timer !== undefined)
+                    clearTimeout(pending.timer);
+                pending.reject(new AppDisconnectedError(state.appId ?? "after_effects", "bridge shutting down"));
+            }
+            state.pending.clear();
+        }
+        for (const socket of this.panels.values())
+            socket.close();
+        this.panels.clear();
+        this.states.clear();
+        if (!this.insecure && this.options.handshakeFilePath !== undefined) {
+            removeHandshake(this.options.handshakeFilePath);
+        }
+        await new Promise((resolve) => this.wss.close(() => resolve()));
+    }
+}
+//# sourceMappingURL=socket.js.map

package/dist/bridge/socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../src/bridge/socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AAGrD,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,eAAe,GAGhB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,GAIZ,MAAM,YAAY,CAAC;AAEpB,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B;+EAC+E;AAC/E,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AACtC,kFAAkF;AAClF,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAuCtE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAY;IAcM;IAbrB,GAAG,CAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IACrC,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5D,8EAA8E;IAC7D,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,KAAK,CAAS;IACd,QAAQ,CAAU;IAClB,mBAAmB,CAAS;IAC5B,cAAc,CAAS;IACvB,cAAc,CAAc;IAC5B,cAAc,CAAS;IAChC,SAAS,CAAkB;IAEnC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC1C,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE;gBACpB,CAAC,CAAC,OAAO,CAAC,KAAK;gBACf,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAAC;QACjE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC;QAExE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;YACtC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;SACjE,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YACzE,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,6EAA6E,CAAC,CAAC;YACjH,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,GAAoB;QACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBACzB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5D,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,CAAC,KAAY;QACpB,OAAO;YACL,KAAK;YACL,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;YAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC;YAC/E,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC;IACJ,CAAC;IAED,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAEO,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CACN,wGAAwG;gBACtG,qGAAqG;gBACrG,8BAA8B,CACjC,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;oBAC7C,eAAe,EAAE,gBAAgB;oBACjC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa,CACnB,GAAoB,EACpB,IAA4D;QAE5D,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,2BAA2B,CAAC,CAAC;YAC5E,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC;IAEO,aAAa,CAAC,MAA0B;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,4CAA4C;QAC5D,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAiB;QACpC,MAAM,KAAK,GAAgB;YACzB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;oBAC7D,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;SACxB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAEO,SAAS,CAAC,MAAiB,EAAE,KAAkB,EAAE,GAAW;QAClE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;QAEtB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,oCAAoC,CAAC,CAAC;gBACrE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,QAAQ;gBACX,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjE,OAAO;YACT,KAAK,UAAU;gBACb,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;gBAClF,OAAO;YACT,KAAK,MAAM;gBACT,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,KAAK,MAAM;gBACT,OAAO;YACT,KAAK,KAAK;gBACR,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,KAAK,eAAe,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;gBACvE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,KAAK,OAAO;gBACV,oDAAoD;gBACpD,OAAO;QACX,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,MAAiB,EACjB,KAAkB,EAClB,KAAqE;QAErE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,KAAK,yBAAyB,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,gBAAgB,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CACN,cAAc,KAAK,CAAC,KAAK,sBAAsB,KAAK,CAAC,eAAe,IAAI;gBACtE,uBAAuB,gBAAgB,EAAE,CAC5C,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAE1B,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClD,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,SAAS;YACf,eAAe,EAAE,gBAAgB;YACjC,aAAa,EAAE,cAAc;YAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IAEO,YAAY,CAAC,QAA4B;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;QACjE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,4EAA4E;QAC5E,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAEO,MAAM,CACZ,KAAkB,EAClB,EAAU,EACV,EAAW,EACX,KAAc,EACd,KAAqD;QAErD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAc,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,iCAAiC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,MAAiB,EAAE,KAAkB;QACnD,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,2EAA2E;QAC3E,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAEO,OAAO;QACb,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,IAAI,KAAK,CAAC,WAAW,IAAI,gBAAgB,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,WAAW,sBAAsB,CAAC,CAAC;gBACvF,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEO,OAAO,CACb,KAAY,EACZ,IAAY,EACZ,MAA6B,EAC7B,OAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CACd,KAAY,EACZ,IAAY,EACZ,MAA6B,EAC7B,OAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,YAAY,GAAiB,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAE7D,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACjD,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,OAAgC,EAAE,YAA0B;QACjF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,SAAS,CAAC;QAC/D,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,OAAO,eAAe,CAAC;YACzB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACvC,KAAK,QAAQ;gBACX,yEAAyE;gBACzE,oEAAoE;gBACpE,yDAAyD;gBACzD,OAAO,iBAAiB,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,KAAY;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,QAAQ,GAAG,CAAC,WAAW,6CAA6C,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACrE,OAAO,QAAQ,GAAG,CAAC,WAAW,wDAAwD,IAAI,QAAQ,CAAC;IACrG,CAAC;IAEO,IAAI,CAAC,MAAiB,EAAE,KAAkB;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACnG,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACnE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/bridge/types.d.ts

@@ -0,0 +1,49 @@
+import type { AppId } from "@brainferno/mcp-bridge-protocol";
+import type { TimeoutClass } from "@brainferno/mcp-bridge-protocol";
+/** A JSON value, as returned across the bridge from a host application. */
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export interface EvalOptions {
+    /** Override the configured timeout for this one call. */
+    timeoutMs?: number;
+    /** Command weight class, selecting a default deadline. Defaults to "slow". */
+    timeoutClass?: TimeoutClass;
+}
+/**
+ * A live connection to one running Creative Cloud application.
+ *
+ * The primitive is {@link execute}: it delivers a *named* command and its
+ * params to the host and resolves with whatever the host returned, parsed as
+ * JSON. {@link evaluate} is a convenience for the generic `eval` command.
+ */
+export interface AppBridge {
+    readonly appId: AppId;
+    /** Whether a host is currently reachable through this bridge. */
+    isConnected(): boolean;
+    /** Send a named command to the host and resolve with its result. */
+    execute(name: string, params?: JsonValue, options?: EvalOptions): Promise<JsonValue>;
+    /** Convenience wrapper for the generic `eval` command (params `{script}`). */
+    evaluate(script: string, options?: EvalOptions): Promise<JsonValue>;
+    close(): Promise<void>;
+}
+/** Raised when no host is reachable for the requested application. */
+export declare class AppNotConnectedError extends Error {
+    readonly appId: AppId;
+    constructor(appId: AppId, hint: string);
+}
+/** Raised when a panel disconnected while a command was in flight. */
+export declare class AppDisconnectedError extends Error {
+    readonly appId: AppId;
+    constructor(appId: AppId, reason: string);
+}
+/** Raised when the host received the command but the script itself threw. */
+export declare class ScriptError extends Error {
+    readonly appId: AppId;
+    readonly scriptLine?: number | undefined;
+    constructor(appId: AppId, message: string, scriptLine?: number | undefined);
+}
+/** Raised when the host never answered within the timeout. */
+export declare class EvalTimeoutError extends Error {
+    constructor(appId: AppId, timeoutMs: number);
+}

package/dist/bridge/types.js

@@ -0,0 +1,38 @@
+/** Raised when no host is reachable for the requested application. */
+export class AppNotConnectedError extends Error {
+    appId;
+    constructor(appId, hint) {
+        super(`No running host connected for "${appId}". ${hint}`);
+        this.appId = appId;
+        this.name = "AppNotConnectedError";
+    }
+}
+/** Raised when a panel disconnected while a command was in flight. */
+export class AppDisconnectedError extends Error {
+    appId;
+    constructor(appId, reason) {
+        super(`The "${appId}" panel disconnected before the command completed (${reason}).`);
+        this.appId = appId;
+        this.name = "AppDisconnectedError";
+    }
+}
+/** Raised when the host received the command but the script itself threw. */
+export class ScriptError extends Error {
+    appId;
+    scriptLine;
+    constructor(appId, message, scriptLine) {
+        super(message);
+        this.appId = appId;
+        this.scriptLine = scriptLine;
+        this.name = "ScriptError";
+    }
+}
+/** Raised when the host never answered within the timeout. */
+export class EvalTimeoutError extends Error {
+    constructor(appId, timeoutMs) {
+        super(`"${appId}" did not return a result within ${timeoutMs}ms. ` +
+            `A modal dialog open in the application will block scripting until dismissed.`);
+        this.name = "EvalTimeoutError";
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/bridge/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/bridge/types.ts"],"names":[],"mappings":"AA+BA,sEAAsE;AACtE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACjB;IAA5B,YAA4B,KAAY,EAAE,IAAY;QACpD,KAAK,CAAC,kCAAkC,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;QADjC,UAAK,GAAL,KAAK,CAAO;QAEtC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAE3B;IADlB,YACkB,KAAY,EAC5B,MAAc;QAEd,KAAK,CAAC,QAAQ,KAAK,sDAAsD,MAAM,IAAI,CAAC,CAAC;QAHrE,UAAK,GAAL,KAAK,CAAO;QAI5B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,WAAY,SAAQ,KAAK;IAElB;IAEA;IAHlB,YACkB,KAAY,EAC5B,OAAe,EACC,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,UAAK,GAAL,KAAK,CAAO;QAEZ,eAAU,GAAV,UAAU,CAAS;QAGnC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAY,EAAE,SAAiB;QACzC,KAAK,CACH,IAAI,KAAK,oCAAoC,SAAS,MAAM;YAC1D,8EAA8E,CACjF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/config.d.ts

@@ -0,0 +1,87 @@
+/** Runtime configuration, read once at startup from the environment. */
+export declare const DEFAULT_ILLUSTRATOR_MCP_URL = "http://localhost:18412/v1/mcp";
+export type LogLevel = "error" | "warn" | "info" | "debug";
+/** Read BRAINFERNO_MCP_X, falling back to the pre-rename ADOBE_CC_MCP_X with a one-time warning. */
+export declare function envValue(name: string): string | undefined;
+/** Settings live in ~/.brainferno-mcp-bridge; copy config.json from the pre-rename ~/.adobe-cc-mcp once. */
+export declare function migrateLegacyUserDir(home?: string): string | null;
+export interface Config {
+    /** TCP port the in-app panels dial back to (0 lets the OS pick one). */
+    bridgePort: number;
+    /**
+     * Explicit shared secret panels must present. Empty means "generate a random
+     * one at startup" unless {@link bridgeInsecure} is set.
+     */
+    bridgeToken: string;
+    /**
+     * Disable panel authentication entirely (no token, no handshake file). For
+     * local debugging and tests only — never run this on a shared machine, since
+     * the bridge evaluates arbitrary script inside your Adobe applications.
+     */
+    bridgeInsecure: boolean;
+    /** Default deadline for a "slow" script result before rejecting. */
+    evalTimeoutMs: number;
+    /** How often the bridge pings each panel to detect a dead connection. */
+    heartbeatIntervalMs: number;
+    /**
+     * Whether to register the raw-script escape-hatch tool (`cc_eval_script`).
+     * Off by default: it is arbitrary code execution at user privilege.
+     */
+    allowRawScripts: boolean;
+    /** Where to write the port+token handshake file panels read. */
+    handshakeFilePath: string;
+    /**
+     * Extra WebSocket Origins to accept on the upgrade, beyond loopback origins
+     * and the no-Origin case (UXP panels send none). Fill in a panel's actual
+     * Origin here once a spike establishes what it sends.
+     */
+    allowedOrigins: string[];
+    /** Adobe's official Illustrator (Beta) MCP endpoint the delegate lane dials. */
+    illustratorMcpUrl: string;
+    /**
+     * Bearer key for Adobe's Illustrator (Beta) MCP server. Empty disables the
+     * delegate lane. A capability key to the user's local Illustrator — never log
+     * it or put it in an error message.
+     */
+    illustratorMcpKey: string;
+    /** ffmpeg / ffprobe executables for the audio process lane (name on PATH or absolute path). */
+    ffmpegPath: string;
+    ffprobePath: string;
+    /** ame_webservice_console(.exe) path; "" = auto-detect the newest Media Encoder. */
+    ameWebServicePath: string;
+    /** Port of the AME web service; 0 = read it from the ini beside the console. */
+    amePort: number;
+    /** Stop the AME web service after this idle time; 0 = keep it running. */
+    ameIdleMs: number;
+    /**
+     * Remote mode: also serve MCP over Streamable HTTP on this port (0 = off).
+     * Requires {@link httpToken}. Set by the installer's "shared on my network" choice.
+     */
+    httpPort: number;
+    /** Address to bind in remote mode: 127.0.0.1 (this computer) or 0.0.0.0 (network). */
+    httpHost: string;
+    /** Bearer token every remote request must present. */
+    httpToken: string;
+    /** Which applications get their tools registered (installer choice; env BRAINFERNO_MCP_APPS overrides). */
+    enabledApps: InstallableApp[];
+    logLevel: LogLevel;
+}
+/** Keys the installer may write to `~/.brainferno-mcp-bridge/config.json` (mode 600). */
+/** Everything the installer can switch on or off. */
+export declare const INSTALLABLE_APPS: readonly ["photoshop", "after_effects", "premiere", "illustrator", "audition", "media_encoder"];
+export type InstallableApp = (typeof INSTALLABLE_APPS)[number];
+export declare function parseApps(raw: string | undefined, fallback?: readonly InstallableApp[]): InstallableApp[];
+export interface UserConfigFile {
+    /** Apps whose tools are registered; missing = all. */
+    enabledApps?: InstallableApp[];
+    illustratorKey?: string;
+    /** Adobe's Illustrator MCP endpoint; override when the shipping release moves it. */
+    illustratorUrl?: string;
+    httpPort?: number;
+    httpHost?: string;
+    httpToken?: string;
+}
+export declare function userConfigPath(): string;
+/** The user config file, or {} when missing/malformed. */
+export declare function readUserConfig(): UserConfigFile;
+export declare function loadConfig(): Config;