contextos-mcp 0.4.0

package/dist/plugins/core/grants.d.ts

@@ -0,0 +1,22 @@
+/**
+ * ContextOS Script Execution Capability Grants & Invalidation Engine
+ * Section 20.6 & Threat Model Hardening
+ */
+import type { AuthorizationResult, GrantOptions } from "./types.js";
+export declare class ScriptGrantManager {
+    readonly grantsFilePath: string;
+    private grants;
+    constructor(grantsFilePath: string);
+    private _load;
+    private _save;
+    /**
+     * Grants execution permission to a specific script by its content hash.
+     * Binds both to plugin identity and content hash.
+     */
+    grant(scriptPath: string, options?: GrantOptions): void;
+    /**
+     * Verifies if a script is authorized to run.
+     * Invalidates grant immediately if script was altered.
+     */
+    checkAuthorization(scriptPath: string, options?: GrantOptions): AuthorizationResult;
+}

package/dist/plugins/core/grants.js

@@ -0,0 +1,90 @@
+/**
+ * ContextOS Script Execution Capability Grants & Invalidation Engine
+ * Section 20.6 & Threat Model Hardening
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { sha256 } from "./digest.js";
+export class ScriptGrantManager {
+    grantsFilePath;
+    grants;
+    constructor(grantsFilePath) {
+        this.grantsFilePath = path.resolve(grantsFilePath);
+        this.grants = this._load();
+    }
+    _load() {
+        if (!fs.existsSync(this.grantsFilePath))
+            return {};
+        try {
+            return JSON.parse(fs.readFileSync(this.grantsFilePath, "utf8"));
+        }
+        catch {
+            return {};
+        }
+    }
+    _save() {
+        fs.mkdirSync(path.dirname(this.grantsFilePath), { recursive: true });
+        fs.writeFileSync(this.grantsFilePath, JSON.stringify(this.grants, null, 2), "utf8");
+    }
+    /**
+     * Grants execution permission to a specific script by its content hash.
+     * Binds both to plugin identity and content hash.
+     */
+    grant(scriptPath, options = {}) {
+        const resolved = path.resolve(scriptPath);
+        const content = fs.readFileSync(resolved);
+        const hash = sha256(content);
+        const record = {
+            hash,
+            grantedAt: Date.now(),
+            pluginId: options.pluginId,
+            relPath: options.relPath,
+        };
+        if (options.pluginId) {
+            const idKey = `plugin:${options.pluginId}:${options.relPath || path.basename(scriptPath)}`;
+            this.grants[idKey] = record;
+        }
+        // Also register by resolved file path for local execution and compatibility
+        this.grants[resolved] = record;
+        this._save();
+    }
+    /**
+     * Verifies if a script is authorized to run.
+     * Invalidates grant immediately if script was altered.
+     */
+    checkAuthorization(scriptPath, options = {}) {
+        const resolved = path.resolve(scriptPath);
+        if (!fs.existsSync(resolved)) {
+            return { authorized: false, reason: "Script file not found." };
+        }
+        let record;
+        if (options.pluginId) {
+            const idKey = `plugin:${options.pluginId}:${options.relPath || path.basename(scriptPath)}`;
+            record = this.grants[idKey] || this.grants[resolved];
+        }
+        else {
+            record = this.grants[resolved];
+        }
+        if (!record) {
+            return {
+                authorized: false,
+                reason: "Script execution is disabled by default. Requires explicit user grant.",
+            };
+        }
+        const currentHash = sha256(fs.readFileSync(resolved));
+        if (currentHash !== record.hash) {
+            // Invalidate immediately upon tampering
+            delete this.grants[resolved];
+            if (options.pluginId) {
+                delete this.grants[`plugin:${options.pluginId}:${options.relPath || path.basename(scriptPath)}`];
+            }
+            this._save();
+            return {
+                authorized: false,
+                reason: "Script content has been modified since grant was issued. Grant invalidated.",
+            };
+        }
+        return { authorized: true, reason: "Authorized" };
+    }
+}
+//# sourceMappingURL=grants.js.map

package/dist/plugins/core/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/plugins/core/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,MAAM,OAAO,kBAAkB;IACrB,cAAc,CAAS;IACxB,MAAM,CAA8B;IAE5C,YAAY,cAAsB;QACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK;QACZ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAEO,KAAK;QACZ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAkB,EAAE,UAAwB,EAAE;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAgB;YAC3B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC;QAEF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,UAAU,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;QAC7B,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,UAAkB,EAAE,UAAwB,EAAE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,MAA+B,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,UAAU,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3F,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO;gBACN,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,wEAAwE;aAChF,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,IAAI,WAAW,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,wCAAwC;YACxC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;YAEb,OAAO;gBACN,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,6EAA6E;aACrF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;CACD"}

package/dist/plugins/core/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * ContextOS Plugin Supply Chain Core
+ * ADR-002 Canonical Core Entrypoint
+ */
+export * from "./archive.js";
+export * from "./digest.js";
+export * from "./grants.js";
+export * from "./pinning.js";
+export * from "./types.js";
+export * from "./updater.js";

package/dist/plugins/core/index.js

@@ -0,0 +1,11 @@
+/**
+ * ContextOS Plugin Supply Chain Core
+ * ADR-002 Canonical Core Entrypoint
+ */
+export * from "./archive.js";
+export * from "./digest.js";
+export * from "./grants.js";
+export * from "./pinning.js";
+export * from "./types.js";
+export * from "./updater.js";
+//# sourceMappingURL=index.js.map

package/dist/plugins/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/core/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/plugins/core/pinning.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ContextOS Source Pinning & Integrity Enforcement
+ * Section 20.1 & Threat Model Hardening
+ */
+import { type PinningValidationOptions, type PinningValidationResult, type PluginSourceSpec } from "./types.js";
+/**
+ * Validates plugin source pinning compliance.
+ * Requires 40-char SHA for GitHub and exact semver + sha512 integrity for npm.
+ * Fails closed on any unknown source types.
+ */
+export declare function validatePluginPinning(sourceSpec?: PluginSourceSpec, options?: PinningValidationOptions): PinningValidationResult;
+/**
+ * Verifies that a downloaded npm tarball buffer matches the package's dist.integrity hash.
+ */
+export declare function verifyNpmTarballIntegrity(tarballBuffer: Buffer, expectedIntegrity: string): boolean;

package/dist/plugins/core/pinning.js

@@ -0,0 +1,86 @@
+/**
+ * ContextOS Source Pinning & Integrity Enforcement
+ * Section 20.1 & Threat Model Hardening
+ */
+import * as crypto from "node:crypto";
+import { THREAT_CODES, } from "./types.js";
+const EXACT_COMMIT_SHA = /^[0-9a-f]{40}$/i;
+const EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+/**
+ * Validates plugin source pinning compliance.
+ * Requires 40-char SHA for GitHub and exact semver + sha512 integrity for npm.
+ * Fails closed on any unknown source types.
+ */
+export function validatePluginPinning(sourceSpec = { type: "" }, options = {}) {
+    if (!sourceSpec || typeof sourceSpec !== "object" || !sourceSpec.type) {
+        return {
+            valid: false,
+            code: THREAT_CODES.UNKNOWN_SOURCE_TYPE,
+            error: "Missing or invalid plugin source specification",
+        };
+    }
+    const { type } = sourceSpec;
+    const allowFloating = options.allowFloating || false;
+    if (type === "github") {
+        const commit = sourceSpec.commit;
+        if (!commit || !EXACT_COMMIT_SHA.test(commit)) {
+            if (!allowFloating) {
+                return {
+                    valid: false,
+                    code: THREAT_CODES.FLOATING_SOURCE_BLOCKED,
+                    error: "GitHub plugin source must be pinned to an exact 40-character commit SHA. Floating branch or tag is prohibited without --allow-floating.",
+                };
+            }
+        }
+    }
+    else if (type === "npm") {
+        const version = sourceSpec.version;
+        const integrity = sourceSpec.integrity;
+        if (!version ||
+            version === "latest" ||
+            version.startsWith("^") ||
+            version.startsWith("~") ||
+            version.includes(">") ||
+            version.includes("<") ||
+            version.includes("*") ||
+            !EXACT_SEMVER.test(version)) {
+            return {
+                valid: false,
+                code: THREAT_CODES.IMPLICIT_LATEST_BLOCKED,
+                error: 'npm plugin source must be pinned to an exact version (e.g. "1.2.3"). Ranges and "latest" are prohibited.',
+            };
+        }
+        if (!integrity || !integrity.startsWith("sha512-")) {
+            return {
+                valid: false,
+                code: THREAT_CODES.MISSING_INTEGRITY,
+                error: "npm plugin source requires dist.integrity verification (sha512-...).",
+            };
+        }
+    }
+    else {
+        return {
+            valid: false,
+            code: THREAT_CODES.UNKNOWN_SOURCE_TYPE,
+            error: `Unknown or unsupported plugin source type: "${type}". Only "github" and "npm" are permitted.`,
+        };
+    }
+    return { valid: true };
+}
+/**
+ * Verifies that a downloaded npm tarball buffer matches the package's dist.integrity hash.
+ */
+export function verifyNpmTarballIntegrity(tarballBuffer, expectedIntegrity) {
+    if (!expectedIntegrity.startsWith("sha512-")) {
+        return false;
+    }
+    const expectedHash = expectedIntegrity.slice("sha512-".length);
+    const computedHash = crypto.createHash("sha512").update(tarballBuffer).digest("base64");
+    const bufA = Buffer.from(computedHash, "utf8");
+    const bufB = Buffer.from(expectedHash, "utf8");
+    if (bufA.length !== bufB.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+//# sourceMappingURL=pinning.js.map

package/dist/plugins/core/pinning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinning.js","sourceRoot":"","sources":["../../../src/plugins/core/pinning.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAIN,YAAY,GACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAC3C,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAEhF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACpC,aAA+B,EAAE,IAAI,EAAE,EAAE,EAAE,EAC3C,UAAoC,EAAE;IAEtC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,YAAY,CAAC,mBAAmB;YACtC,KAAK,EAAE,gDAAgD;SACvD,CAAC;IACH,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAC5B,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IAErD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,MAAM,GAAI,UAAkC,CAAC,MAAM,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO;oBACN,KAAK,EAAE,KAAK;oBACZ,IAAI,EAAE,YAAY,CAAC,uBAAuB;oBAC1C,KAAK,EACJ,yIAAyI;iBAC1I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,UAAmC,CAAC,OAAO,CAAC;QAC7D,MAAM,SAAS,GAAI,UAAqC,CAAC,SAAS,CAAC;QAEnE,IACC,CAAC,OAAO;YACR,OAAO,KAAK,QAAQ;YACpB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;YACF,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,YAAY,CAAC,uBAAuB;gBAC1C,KAAK,EACJ,0GAA0G;aAC3G,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,YAAY,CAAC,iBAAiB;gBACpC,KAAK,EAAE,sEAAsE;aAC7E,CAAC;QACH,CAAC;IACF,CAAC;SAAM,CAAC;QACP,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,YAAY,CAAC,mBAAmB;YACtC,KAAK,EAAE,+CAA+C,IAAI,2CAA2C;SACrG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,aAAqB,EAAE,iBAAyB;IACzF,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAExF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/plugins/core/types.d.ts

@@ -0,0 +1,105 @@
+/**
+ * ContextOS Plugin Supply Chain Types & Threat Model Definitions
+ * ADR-002 Canonical Core
+ */
+export type PluginSourceType = "github" | "npm";
+export interface GitHubSourceSpec {
+    type: "github";
+    owner: string;
+    repo: string;
+    commit?: string;
+    gitRef?: string;
+    subPath?: string;
+    raw?: string;
+}
+export interface NpmSourceSpec {
+    type: "npm";
+    package: string;
+    version?: string;
+    integrity?: string;
+    raw?: string;
+}
+export type PluginSourceSpec = GitHubSourceSpec | NpmSourceSpec | {
+    type: string;
+    [key: string]: unknown;
+};
+export interface PinningValidationOptions {
+    allowFloating?: boolean;
+}
+export interface PinningValidationResult {
+    valid: boolean;
+    code?: string;
+    error?: string;
+}
+export type ArchiveEntryType = "file" | "directory" | "symlink" | "hardlink" | "socket" | "fifo" | "characterDevice" | "blockDevice";
+export interface ArchiveEntryLimits {
+    currentCount?: number;
+    maxFiles?: number;
+    currentTotalBytes?: number;
+    maxTotalBytes?: number;
+    compressedSize?: number;
+    uncompressedSize?: number;
+    maxRatio?: number;
+    seenPaths?: Set<string>;
+    linkTarget?: string;
+    entryType?: ArchiveEntryType;
+}
+export interface ArchiveValidationResult {
+    valid: boolean;
+    code?: string;
+    error?: string;
+}
+export type TreeEntryType = "file" | "directory" | "symlink";
+export interface TreeFileEntry {
+    relativePath: string;
+    size: number;
+    mode: number;
+    sha256: string;
+    type: TreeEntryType;
+}
+export interface TreeDigestResult {
+    treeDigest: string;
+    files: TreeFileEntry[];
+}
+export interface TreeDigestOptions {
+    includeDirectories?: boolean;
+}
+export interface GrantRecord {
+    hash: string;
+    grantedAt: number;
+    pluginId?: string;
+    relPath?: string;
+}
+export interface AuthorizationResult {
+    authorized: boolean;
+    reason: string;
+}
+export interface GrantOptions {
+    pluginId?: string;
+    relPath?: string;
+}
+export interface AtomicUpdateOptions {
+    expectedOldTreeDigest?: string;
+    force?: boolean;
+}
+export interface AtomicUpdateResult {
+    success: boolean;
+    treeDigest: string;
+}
+export declare const THREAT_CODES: {
+    readonly UNKNOWN_SOURCE_TYPE: "CTX_PLUGIN_UNKNOWN_SOURCE_TYPE";
+    readonly FLOATING_SOURCE_BLOCKED: "CTX_PLUGIN_FLOATING_SOURCE_BLOCKED";
+    readonly IMPLICIT_LATEST_BLOCKED: "CTX_PLUGIN_IMPLICIT_LATEST_BLOCKED";
+    readonly MISSING_INTEGRITY: "CTX_PLUGIN_MISSING_INTEGRITY";
+    readonly INVALID_PATH: "CTX_ARCHIVE_INVALID_PATH";
+    readonly ABSOLUTE_PATH: "CTX_ARCHIVE_ABSOLUTE_PATH";
+    readonly PATH_TRAVERSAL: "CTX_ARCHIVE_PATH_TRAVERSAL";
+    readonly RESERVED_NAME: "CTX_ARCHIVE_RESERVED_NAME";
+    readonly MAX_FILES_EXCEEDED: "CTX_ARCHIVE_MAX_FILES_EXCEEDED";
+    readonly MAX_SIZE_EXCEEDED: "CTX_ARCHIVE_MAX_SIZE_EXCEEDED";
+    readonly RATIO_EXCEEDED: "CTX_ARCHIVE_RATIO_EXCEEDED";
+    readonly CASE_COLLISION: "CTX_ARCHIVE_CASE_COLLISION";
+    readonly SYMLINK_ESCAPE: "CTX_ARCHIVE_SYMLINK_ESCAPE";
+    readonly SPECIAL_FILE: "CTX_ARCHIVE_SPECIAL_FILE";
+    readonly MODIFIED_LOCALLY: "CTX_PLUGIN_MODIFIED_LOCALLY";
+};

package/dist/plugins/core/types.js

@@ -0,0 +1,22 @@
+/**
+ * ContextOS Plugin Supply Chain Types & Threat Model Definitions
+ * ADR-002 Canonical Core
+ */
+export const THREAT_CODES = {
+    UNKNOWN_SOURCE_TYPE: "CTX_PLUGIN_UNKNOWN_SOURCE_TYPE",
+    FLOATING_SOURCE_BLOCKED: "CTX_PLUGIN_FLOATING_SOURCE_BLOCKED",
+    IMPLICIT_LATEST_BLOCKED: "CTX_PLUGIN_IMPLICIT_LATEST_BLOCKED",
+    MISSING_INTEGRITY: "CTX_PLUGIN_MISSING_INTEGRITY",
+    INVALID_PATH: "CTX_ARCHIVE_INVALID_PATH",
+    ABSOLUTE_PATH: "CTX_ARCHIVE_ABSOLUTE_PATH",
+    PATH_TRAVERSAL: "CTX_ARCHIVE_PATH_TRAVERSAL",
+    RESERVED_NAME: "CTX_ARCHIVE_RESERVED_NAME",
+    MAX_FILES_EXCEEDED: "CTX_ARCHIVE_MAX_FILES_EXCEEDED",
+    MAX_SIZE_EXCEEDED: "CTX_ARCHIVE_MAX_SIZE_EXCEEDED",
+    RATIO_EXCEEDED: "CTX_ARCHIVE_RATIO_EXCEEDED",
+    CASE_COLLISION: "CTX_ARCHIVE_CASE_COLLISION",
+    SYMLINK_ESCAPE: "CTX_ARCHIVE_SYMLINK_ESCAPE",
+    SPECIAL_FILE: "CTX_ARCHIVE_SPECIAL_FILE",
+    MODIFIED_LOCALLY: "CTX_PLUGIN_MODIFIED_LOCALLY",
+};
+//# sourceMappingURL=types.js.map

package/dist/plugins/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/plugins/core/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6GH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,mBAAmB,EAAE,gCAAgC;IACrD,uBAAuB,EAAE,oCAAoC;IAC7D,uBAAuB,EAAE,oCAAoC;IAC7D,iBAAiB,EAAE,8BAA8B;IACjD,YAAY,EAAE,0BAA0B;IACxC,aAAa,EAAE,2BAA2B;IAC1C,cAAc,EAAE,4BAA4B;IAC5C,aAAa,EAAE,2BAA2B;IAC1C,kBAAkB,EAAE,gCAAgC;IACpD,iBAAiB,EAAE,+BAA+B;IAClD,cAAc,EAAE,4BAA4B;IAC5C,cAAc,EAAE,4BAA4B;IAC5C,cAAc,EAAE,4BAA4B;IAC5C,YAAY,EAAE,0BAA0B;IACxC,gBAAgB,EAAE,6BAA6B;CACtC,CAAC"}

package/dist/plugins/core/updater.d.ts

@@ -0,0 +1,16 @@
+/**
+ * ContextOS Atomic Plugin Updater & Local Modification Protection
+ * Section 20.7 & Threat Model Hardening
+ */
+import { type AtomicUpdateOptions, type AtomicUpdateResult } from "./types.js";
+export declare class AtomicPluginUpdater {
+    /**
+     * Checks if local plugin has been modified since it was installed/recorded in lockfile.
+     */
+    static isModifiedLocally(pluginDir: string, expectedTreeDigest: string): boolean;
+    /**
+     * Atomically installs or updates a plugin directory with rollback.
+     * Rejects updates when local uncommitted user modifications exist unless forced.
+     */
+    static applyUpdate(targetDir: string, stagedDir: string, options?: AtomicUpdateOptions): AtomicUpdateResult;
+}

package/dist/plugins/core/updater.js

@@ -0,0 +1,64 @@
+/**
+ * ContextOS Atomic Plugin Updater & Local Modification Protection
+ * Section 20.7 & Threat Model Hardening
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { calculateTreeDigest } from "./digest.js";
+import { THREAT_CODES } from "./types.js";
+export class AtomicPluginUpdater {
+    /**
+     * Checks if local plugin has been modified since it was installed/recorded in lockfile.
+     */
+    static isModifiedLocally(pluginDir, expectedTreeDigest) {
+        if (!fs.existsSync(pluginDir))
+            return false;
+        const current = calculateTreeDigest(pluginDir);
+        return current.treeDigest !== expectedTreeDigest;
+    }
+    /**
+     * Atomically installs or updates a plugin directory with rollback.
+     * Rejects updates when local uncommitted user modifications exist unless forced.
+     */
+    static applyUpdate(targetDir, stagedDir, options = {}) {
+        const { expectedOldTreeDigest, force = false } = options;
+        const resolvedTarget = path.resolve(targetDir);
+        const resolvedStaged = path.resolve(stagedDir);
+        if (fs.existsSync(resolvedTarget) && expectedOldTreeDigest && !force) {
+            if (AtomicPluginUpdater.isModifiedLocally(resolvedTarget, expectedOldTreeDigest)) {
+                const err = new Error(`Plugin in "${resolvedTarget}" has local modifications. Update aborted to prevent overwriting user changes. Pass --force to overwrite.`);
+                err.code = THREAT_CODES.MODIFIED_LOCALLY;
+                throw err;
+            }
+        }
+        const backupDir = `${resolvedTarget}.bak-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        let hasBackup = false;
+        try {
+            if (fs.existsSync(resolvedTarget)) {
+                fs.renameSync(resolvedTarget, backupDir);
+                hasBackup = true;
+            }
+            fs.renameSync(resolvedStaged, resolvedTarget);
+            // Verify new directory digest
+            const digest = calculateTreeDigest(resolvedTarget);
+            // Clean up backup upon success
+            if (hasBackup) {
+                fs.rmSync(backupDir, { recursive: true, force: true });
+            }
+            return { success: true, treeDigest: digest.treeDigest };
+        }
+        catch (err) {
+            // Rollback on failure
+            if (hasBackup && !fs.existsSync(resolvedTarget)) {
+                try {
+                    fs.renameSync(backupDir, resolvedTarget);
+                }
+                catch {
+                    // Ignore rollback rename failure to preserve original error
+                }
+            }
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=updater.js.map

package/dist/plugins/core/updater.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater.js","sourceRoot":"","sources":["../../../src/plugins/core/updater.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAqD,YAAY,EAAE,MAAM,YAAY,CAAC;AAE7F,MAAM,OAAO,mBAAmB;IAC/B;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,SAAiB,EAAE,kBAA0B;QACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,UAAU,KAAK,kBAAkB,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,UAA+B,EAAE;QACzF,MAAM,EAAE,qBAAqB,EAAE,KAAK,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;YACtE,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,cAAc,EAAE,qBAAqB,CAAC,EAAE,CAAC;gBAClF,MAAM,GAAG,GAAG,IAAI,KAAK,CACpB,cAAc,cAAc,2GAA2G,CAC3G,CAAC;gBAC9B,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC;gBACzC,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,cAAc,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClG,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC;YACJ,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBACzC,SAAS,GAAG,IAAI,CAAC;YAClB,CAAC;YAED,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;YAE9C,8BAA8B;YAC9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;YAEnD,+BAA+B;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACf,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sBAAsB;YACtB,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACJ,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACR,4DAA4D;gBAC7D,CAAC;YACF,CAAC;YACD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;CACD"}

package/dist/plugins/loader.d.ts

@@ -0,0 +1,65 @@
+/**
+ * ContextOS MCP Plugin Loader
+ * Typed orchestration layer connecting MCP to the canonical supply-chain core.
+ */
+import { ScriptGrantManager } from "./core/index.js";
+import type { ArchiveEntryType, ArchiveValidationResult, AtomicUpdateOptions, AtomicUpdateResult, AuthorizationResult, GrantOptions, PinningValidationOptions, PinningValidationResult, PluginSourceSpec, TreeDigestResult } from "./core/types.js";
+export interface ArchiveManifestEntry {
+    path: string;
+    size?: number;
+    compressedSize?: number;
+    type?: ArchiveEntryType;
+    linkTarget?: string;
+}
+export interface InstalledPluginRecord {
+    name: string;
+    ref: string;
+    type: string;
+    sha256?: string;
+    treeDigest?: string;
+    installedAt?: string;
+    verified?: boolean;
+}
+export declare class PluginLoader {
+    /**
+     * Validates a plugin source specification according to pinning rules.
+     */
+    static validateSource(sourceSpec: PluginSourceSpec, options?: PinningValidationOptions): PinningValidationResult;
+    /**
+     * Verifies tree integrity of an installed plugin directory against expected digest.
+     */
+    static verifyPluginDigest(pluginDir: string, expectedTreeDigest: string): boolean;
+    /**
+     * Calculates the deterministic tree digest of a plugin directory.
+     */
+    static computeDigest(pluginDir: string): TreeDigestResult;
+    /**
+     * Pre-scans a full archive manifest before extraction.
+     * Enforces traversal, symlink escapes, ratio bombs, and case collisions.
+     */
+    static validateArchive(entries: ArchiveManifestEntry[], options?: {
+        maxFiles?: number;
+        maxTotalBytes?: number;
+        maxRatio?: number;
+    }): ArchiveValidationResult;
+    /**
+     * Instantiates a ScriptGrantManager for a given grants file.
+     */
+    static getGrantManager(grantsFilePath: string): ScriptGrantManager;
+    /**
+     * Verifies whether a plugin script is authorized.
+     */
+    static checkScriptAuthorization(grantsFilePath: string, scriptPath: string, options?: GrantOptions): AuthorizationResult;
+    /**
+     * Atomically updates a plugin directory with backup and rollback.
+     */
+    static applyAtomicUpdate(targetDir: string, stagedDir: string, options?: AtomicUpdateOptions): AtomicUpdateResult;
+    /**
+     * Loads installed plugins recorded in plugins.json and verifies their tree digests.
+     */
+    static loadInstalledPlugins(agentsDir: string): InstalledPluginRecord[];
+    /**
+     * Verifies npm package tarball integrity.
+     */
+    static verifyNpmIntegrity(tarballBuffer: Buffer, expectedIntegrity: string): boolean;
+}

package/dist/plugins/loader.js

@@ -0,0 +1,110 @@
+/**
+ * ContextOS MCP Plugin Loader
+ * Typed orchestration layer connecting MCP to the canonical supply-chain core.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { AtomicPluginUpdater, calculateTreeDigest, ScriptGrantManager, validateArchiveEntry, validatePluginPinning, verifyNpmTarballIntegrity, } from "./core/index.js";
+export class PluginLoader {
+    /**
+     * Validates a plugin source specification according to pinning rules.
+     */
+    static validateSource(sourceSpec, options = {}) {
+        return validatePluginPinning(sourceSpec, options);
+    }
+    /**
+     * Verifies tree integrity of an installed plugin directory against expected digest.
+     */
+    static verifyPluginDigest(pluginDir, expectedTreeDigest) {
+        if (!fs.existsSync(pluginDir))
+            return false;
+        const digest = calculateTreeDigest(pluginDir);
+        return digest.treeDigest === expectedTreeDigest;
+    }
+    /**
+     * Calculates the deterministic tree digest of a plugin directory.
+     */
+    static computeDigest(pluginDir) {
+        return calculateTreeDigest(pluginDir);
+    }
+    /**
+     * Pre-scans a full archive manifest before extraction.
+     * Enforces traversal, symlink escapes, ratio bombs, and case collisions.
+     */
+    static validateArchive(entries, options = {}) {
+        const seenPaths = new Set();
+        let currentTotalBytes = 0;
+        for (let i = 0; i < entries.length; i++) {
+            const entry = entries[i];
+            const uncompressedSize = entry.size ?? 0;
+            currentTotalBytes += uncompressedSize;
+            const limits = {
+                currentCount: i,
+                maxFiles: options.maxFiles ?? 1000,
+                currentTotalBytes,
+                maxTotalBytes: options.maxTotalBytes ?? 50 * 1024 * 1024,
+                uncompressedSize,
+                compressedSize: entry.compressedSize,
+                maxRatio: options.maxRatio ?? 100,
+                seenPaths,
+                linkTarget: entry.linkTarget,
+                entryType: entry.type,
+            };
+            const result = validateArchiveEntry(entry.path, limits);
+            if (!result.valid) {
+                return result;
+            }
+        }
+        return { valid: true };
+    }
+    /**
+     * Instantiates a ScriptGrantManager for a given grants file.
+     */
+    static getGrantManager(grantsFilePath) {
+        return new ScriptGrantManager(grantsFilePath);
+    }
+    /**
+     * Verifies whether a plugin script is authorized.
+     */
+    static checkScriptAuthorization(grantsFilePath, scriptPath, options = {}) {
+        const manager = new ScriptGrantManager(grantsFilePath);
+        return manager.checkAuthorization(scriptPath, options);
+    }
+    /**
+     * Atomically updates a plugin directory with backup and rollback.
+     */
+    static applyAtomicUpdate(targetDir, stagedDir, options = {}) {
+        return AtomicPluginUpdater.applyUpdate(targetDir, stagedDir, options);
+    }
+    /**
+     * Loads installed plugins recorded in plugins.json and verifies their tree digests.
+     */
+    static loadInstalledPlugins(agentsDir) {
+        const pluginsJsonPath = path.join(agentsDir, "plugins.json");
+        if (!fs.existsSync(pluginsJsonPath)) {
+            return [];
+        }
+        try {
+            const data = JSON.parse(fs.readFileSync(pluginsJsonPath, "utf8"));
+            const plugins = Array.isArray(data.plugins) ? data.plugins : [];
+            return plugins.map((plugin) => {
+                const pluginDir = path.join(agentsDir, "plugins", plugin.name);
+                if (!plugin.treeDigest || !fs.existsSync(pluginDir)) {
+                    return { ...plugin, verified: false };
+                }
+                const isClean = PluginLoader.verifyPluginDigest(pluginDir, plugin.treeDigest);
+                return { ...plugin, verified: isClean };
+            });
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Verifies npm package tarball integrity.
+     */
+    static verifyNpmIntegrity(tarballBuffer, expectedIntegrity) {
+        return verifyNpmTarballIntegrity(tarballBuffer, expectedIntegrity);
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/plugins/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/plugins/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACN,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GACzB,MAAM,iBAAiB,CAAC;AAiCzB,MAAM,OAAO,YAAY;IACxB;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,UAA4B,EAAE,UAAoC,EAAE;QACzF,OAAO,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,SAAiB,EAAE,kBAA0B;QACtE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,UAAU,KAAK,kBAAkB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,SAAiB;QACrC,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,eAAe,CACrB,OAA+B,EAC/B,UAA4E,EAAE;QAE9E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;YACzC,iBAAiB,IAAI,gBAAgB,CAAC;YAEtC,MAAM,MAAM,GAAuB;gBAClC,YAAY,EAAE,CAAC;gBACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;gBAClC,iBAAiB;gBACjB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;gBACxD,gBAAgB;gBAChB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;gBACjC,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,IAAI;aACrB,CAAC;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YACf,CAAC;QACF,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,eAAe,CAAC,cAAsB;QAC5C,OAAO,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAC9B,cAAsB,EACtB,UAAkB,EAClB,UAAwB,EAAE;QAE1B,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACvB,SAAiB,EACjB,SAAiB,EACjB,UAA+B,EAAE;QAEjC,OAAO,mBAAmB,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,SAAiB;QAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;QACX,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAA4B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBACvC,CAAC;gBACD,MAAM,OAAO,GAAG,YAAY,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC9E,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACzC,CAAC,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,aAAqB,EAAE,iBAAyB;QACzE,OAAO,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACpE,CAAC;CACD"}