ctxr-cli 0.30.0 → 0.32.0

package/dist/core/mcp/oauth.js

@@ -0,0 +1,454 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { BodyTooLargeError, readBody, sendJson, sendText } from './http.js';
+import { MCP_SCOPES, scopesFor } from './members.js';
+/**
+ * serve-the-store-over-mcp design.md D4–D5: `ctxr serve` is the OAuth 2.1
+ * authorisation server for its own `/mcp`, and it stores nothing it issues.
+ * Client ids, authorisation codes and access tokens are HMAC-signed payloads.
+ * Who may sign in is decided by the access proxy's verified identity — the
+ * assertion `change_approval.identity` configures, checked on every
+ * `/authorize` request exactly as the approval routes check it — and by the
+ * `mcp` block the server last loaded, consulted again on every `/mcp`
+ * request, so removing someone there refuses their next call.
+ */
+export const ACCESS_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+export const AUTHORIZATION_CODE_TTL_SECONDS = 10 * 60;
+const MAX_FORM_BYTES = 64 * 1024;
+const MAX_REDIRECT_URIS = 10;
+const MAX_REDIRECT_URI_LENGTH = 2000;
+export const PROTECTED_RESOURCE_METADATA_PATH = '/.well-known/oauth-protected-resource';
+export const AUTHORIZATION_SERVER_METADATA_PATH = '/.well-known/oauth-authorization-server';
+export const OPENID_CONFIGURATION_PATH = '/.well-known/openid-configuration';
+export const REGISTER_PATH = '/register';
+export const AUTHORIZE_PATH = '/authorize';
+export const TOKEN_PATH = '/token';
+/** Every path the OAuth side of the MCP surface answers. */
+export const OAUTH_PATHS = [
+    PROTECTED_RESOURCE_METADATA_PATH,
+    `${PROTECTED_RESOURCE_METADATA_PATH}/mcp`,
+    AUTHORIZATION_SERVER_METADATA_PATH,
+    OPENID_CONFIGURATION_PATH,
+    REGISTER_PATH,
+    AUTHORIZE_PATH,
+    TOKEN_PATH,
+];
+function b64url(buffer) {
+    return buffer.toString('base64url');
+}
+/**
+ * `kind.payload.mac`, the kind inside the MAC so a client id can never be
+ * replayed as a token. Authorisation codes are signed under a key that mixes
+ * in a per-process nonce: a restart invalidates outstanding codes instead of
+ * forgetting which were spent (design.md D5).
+ */
+export class Signer {
+    key;
+    codeKey;
+    constructor(key) {
+        this.key = key;
+        this.codeKey = createHmac('sha256', key).update(`authorization-code:${randomBytes(16).toString('hex')}`).digest();
+    }
+    keyFor(kind) {
+        return kind === 'code' ? this.codeKey : this.key;
+    }
+    sign(kind, payload) {
+        const body = b64url(Buffer.from(JSON.stringify(payload), 'utf8'));
+        const mac = createHmac('sha256', this.keyFor(kind)).update(`${kind}.${body}`).digest();
+        return `${kind}.${body}.${b64url(mac)}`;
+    }
+    verify(kind, token) {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts[0] !== kind)
+            return undefined;
+        const expected = createHmac('sha256', this.keyFor(kind)).update(`${kind}.${parts[1]}`).digest();
+        const actual = Buffer.from(parts[2], 'base64url');
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+            return undefined;
+        try {
+            return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** The OAuth endpoints of the MCP surface. Built per request from the loaded configuration; holds no state of its own. */
+export class AuthorizationServer {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    nowSeconds() {
+        return Math.floor(this.options.now().getTime() / 1000);
+    }
+    get protectedResourceMetadataUrl() {
+        return `${this.options.issuer}${PROTECTED_RESOURCE_METADATA_PATH}/mcp`;
+    }
+    protectedResourceMetadata() {
+        return {
+            resource: this.options.resource,
+            authorization_servers: [this.options.issuer],
+            scopes_supported: [...MCP_SCOPES],
+            bearer_methods_supported: ['header'],
+            resource_name: 'contexture store',
+        };
+    }
+    authorizationServerMetadata() {
+        const issuer = this.options.issuer;
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}${AUTHORIZE_PATH}`,
+            token_endpoint: `${issuer}${TOKEN_PATH}`,
+            registration_endpoint: `${issuer}${REGISTER_PATH}`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            scopes_supported: [...MCP_SCOPES],
+            authorization_response_iss_parameter_supported: true,
+        };
+    }
+    /** Handles every OAuth path; returns false for anything else. */
+    async handle(req, res, pathname) {
+        if (!OAUTH_PATHS.includes(pathname))
+            return false;
+        const method = req.method ?? 'GET';
+        // Browser-based clients (the MCP inspector) read metadata and call registration and the token
+        // endpoint cross-origin; none of them use cookies, so a wildcard origin grants nothing a direct request lacks.
+        const cors = pathname === AUTHORIZE_PATH ? {} : { 'Access-Control-Allow-Origin': '*' };
+        if (method === 'OPTIONS' && pathname !== AUTHORIZE_PATH) {
+            res.writeHead(204, {
+                ...cors,
+                'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+                'Access-Control-Allow-Headers': 'Content-Type, Authorization, MCP-Protocol-Version',
+                'Access-Control-Max-Age': '86400',
+            });
+            res.end();
+            return true;
+        }
+        try {
+            if (pathname.startsWith('/.well-known/')) {
+                if (method !== 'GET' && method !== 'HEAD')
+                    return methodNotAllowed(res, 'GET');
+                const body = pathname.startsWith(PROTECTED_RESOURCE_METADATA_PATH) ? this.protectedResourceMetadata() : this.authorizationServerMetadata();
+                sendJson(res, 200, body, cors);
+                return true;
+            }
+            if (pathname === REGISTER_PATH) {
+                if (method !== 'POST')
+                    return methodNotAllowed(res, 'POST');
+                await this.register(req, res, cors);
+                return true;
+            }
+            if (pathname === AUTHORIZE_PATH) {
+                if (method === 'GET' || method === 'HEAD')
+                    await this.authorizeForm(req, res);
+                else if (method === 'POST')
+                    await this.authorizeConfirm(req, res);
+                else
+                    return methodNotAllowed(res, 'GET, POST');
+                return true;
+            }
+            if (method !== 'POST')
+                return methodNotAllowed(res, 'POST');
+            await this.token(req, res, cors);
+            return true;
+        }
+        catch (err) {
+            if (err instanceof BodyTooLargeError) {
+                sendText(res, 413, `${err.message}\n`);
+                return true;
+            }
+            throw err;
+        }
+    }
+    // ---- registration (RFC 7591), stateless --------------------------------
+    async register(req, res, cors) {
+        let body;
+        try {
+            body = JSON.parse(await readBody(req, MAX_FORM_BYTES));
+        }
+        catch (err) {
+            if (err instanceof BodyTooLargeError)
+                throw err;
+            sendJson(res, 400, { error: 'invalid_client_metadata', error_description: 'The registration body is not JSON.' }, cors);
+            return;
+        }
+        const metadata = (typeof body === 'object' && body !== null ? body : {});
+        const uris = metadata.redirect_uris;
+        const hosts = Array.isArray(uris) ? uris.map((u) => { try {
+            return new URL(String(u)).host || String(u);
+        }
+        catch {
+            return String(u).slice(0, 60);
+        } }) : [];
+        this.options.log?.(`mcp register "${String(metadata.client_name ?? '').slice(0, 60)}" auth=${String(metadata.token_endpoint_auth_method ?? '-')} ` +
+            `grants=${Array.isArray(metadata.grant_types) ? metadata.grant_types.join(',') : '-'} redirects=${hosts.join(',') || '-'}`);
+        if (!Array.isArray(uris) || uris.length === 0 || uris.length > MAX_REDIRECT_URIS || !uris.every((u) => typeof u === 'string' && acceptableRedirectUri(u))) {
+            sendJson(res, 400, { error: 'invalid_redirect_uri', error_description: `Register 1–${MAX_REDIRECT_URIS} absolute redirect URIs: https, loopback http, or an application scheme.` }, cors);
+            return;
+        }
+        const grantTypes = metadata.grant_types;
+        if (Array.isArray(grantTypes) && !grantTypes.includes('authorization_code')) {
+            sendJson(res, 400, { error: 'invalid_client_metadata', error_description: 'This server grants authorization_code only.' }, cors);
+            return;
+        }
+        const name = typeof metadata.client_name === 'string' ? metadata.client_name.slice(0, 100) : undefined;
+        const payload = { r: uris, ...(name ? { n: name } : {}) };
+        sendJson(res, 201, {
+            client_id: this.options.signer.sign('client', payload),
+            client_id_issued_at: this.nowSeconds(),
+            redirect_uris: payload.r,
+            ...(name ? { client_name: name } : {}),
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code'],
+            response_types: ['code'],
+        }, cors);
+    }
+    // ---- authorization --------------------------------------------------------
+    /**
+     * Until the client and redirect URI are known good, an error is shown and
+     * never redirected — redirecting to an unverified URI is how an open
+     * redirector is built.
+     */
+    validateAuthorizeRequest(params) {
+        const clientId = params.get('client_id') ?? '';
+        const client = this.options.signer.verify('client', clientId);
+        if (client === undefined || !Array.isArray(client.r)) {
+            return { kind: 'fatal', message: 'This sign-in link names a client this store never registered. Start connecting again from your app.' };
+        }
+        const requestedRedirect = params.get('redirect_uri');
+        const redirectUri = requestedRedirect ?? (client.r.length === 1 ? client.r[0] : '');
+        if (!client.r.includes(redirectUri))
+            return { kind: 'fatal', message: 'This sign-in link names a redirect address the client did not register.' };
+        const state = params.get('state');
+        const fail = (error, description) => ({ kind: 'redirect-error', redirectUri, state, error, description });
+        if (params.get('response_type') !== 'code')
+            return fail('unsupported_response_type', 'Only response_type=code is supported.');
+        const challenge = params.get('code_challenge') ?? '';
+        if (params.get('code_challenge_method') !== 'S256' || !/^[A-Za-z0-9_-]{43}$/.test(challenge)) {
+            return fail('invalid_request', 'PKCE with code_challenge_method=S256 is required.');
+        }
+        const resource = params.get('resource');
+        if (resource !== null && !sameResource(resource, this.options.resource))
+            return fail('invalid_target', `This server issues tokens only for ${this.options.resource}.`);
+        let requested = null;
+        const scope = params.get('scope');
+        if (scope !== null && scope.trim().length > 0) {
+            const words = scope.split(/\s+/);
+            const known = MCP_SCOPES.filter((s) => words.includes(s));
+            if (known.length === 0)
+                return fail('invalid_scope', `Request any of: ${MCP_SCOPES.join(' ')}.`);
+            requested = known;
+        }
+        return { kind: 'ok', request: { clientId, clientName: client.n ?? 'An app', redirectUri, state, challenge, scopes: requested } };
+    }
+    /** The verified member and the scopes this request would grant, or why there is none. */
+    async member(req, request) {
+        const verified = await this.options.verifier.verify(req.headers[this.options.identityHeader.toLowerCase()]);
+        if (!verified.ok)
+            return { kind: 'refused', status: 401, message: 'Open this page through the store’s sign-in (its access proxy), then try connecting again.' };
+        const held = scopesFor(verified.email, this.options.mcp());
+        if (held.length === 0)
+            return { kind: 'refused', status: 403, message: `${verified.email} may not connect apps to this store. Ask whoever runs it to add you.` };
+        const requested = request.scopes;
+        const scopes = requested === null ? held : held.filter((s) => requested.includes(s));
+        return scopes.length === 0 ? { kind: 'no-scope' } : { kind: 'member', email: verified.email, scopes };
+    }
+    hiddenFieldsFor(params) {
+        const fields = {};
+        for (const key of ['response_type', 'client_id', 'redirect_uri', 'code_challenge', 'code_challenge_method', 'state', 'scope', 'resource']) {
+            const value = params.get(key);
+            if (value !== null)
+                fields[key] = value;
+        }
+        return fields;
+    }
+    async authorizeForm(req, res) {
+        const params = new URL(req.url ?? '/', 'http://localhost').searchParams;
+        const verdict = this.validateAuthorizeRequest(params);
+        if (verdict.kind === 'fatal')
+            return sendText(res, 400, `${verdict.message}\n`);
+        if (verdict.kind === 'redirect-error')
+            return redirectWithError(res, verdict, this.options.issuer);
+        const who = await this.member(req, verdict.request);
+        if (who.kind === 'refused')
+            return sendText(res, who.status, `${who.message}\n`);
+        if (who.kind === 'no-scope')
+            return redirectWithError(res, { ...verdict.request, error: 'invalid_scope', description: 'You hold none of the requested scopes.' }, this.options.issuer);
+        const html = await this.options.renderConsentPage({
+            clientName: verdict.request.clientName,
+            redirectHost: new URL(verdict.request.redirectUri).host || verdict.request.redirectUri,
+            email: who.email,
+            scopes: who.scopes,
+            hiddenFields: this.hiddenFieldsFor(params),
+        });
+        sendPage(res, html);
+    }
+    /** The member's confirmation: only from a page this server rendered (`Origin`), only for a verified member. */
+    async authorizeConfirm(req, res) {
+        if (req.headers.origin !== this.options.issuer)
+            return sendText(res, 403, 'This confirmation did not come from this store’s own page.\n');
+        const params = new URLSearchParams(await readBody(req, MAX_FORM_BYTES));
+        const verdict = this.validateAuthorizeRequest(params);
+        if (verdict.kind === 'fatal')
+            return sendText(res, 400, `${verdict.message}\n`);
+        if (verdict.kind === 'redirect-error')
+            return redirectWithError(res, verdict, this.options.issuer);
+        const request = verdict.request;
+        const who = await this.member(req, request);
+        if (who.kind === 'refused')
+            return sendText(res, who.status, `${who.message}\n`);
+        if (who.kind === 'no-scope')
+            return redirectWithError(res, { ...request, error: 'invalid_scope', description: 'You hold none of the requested scopes.' }, this.options.issuer);
+        if (params.get('decision') !== 'allow') {
+            return redirectWithError(res, { ...request, error: 'access_denied', description: 'The member declined to connect this app.' }, this.options.issuer);
+        }
+        const code = this.options.signer.sign('code', {
+            c: digest(request.clientId),
+            r: request.redirectUri,
+            cc: request.challenge,
+            rs: this.options.resource,
+            e: who.email,
+            s: who.scopes,
+            x: this.nowSeconds() + AUTHORIZATION_CODE_TTL_SECONDS,
+            n: randomBytes(16).toString('hex'),
+        });
+        const target = new URL(request.redirectUri);
+        target.searchParams.set('code', code);
+        if (request.state !== null)
+            target.searchParams.set('state', request.state);
+        target.searchParams.set('iss', this.options.issuer);
+        res.writeHead(302, { Location: target.toString(), 'Cache-Control': 'no-store' });
+        res.end();
+    }
+    // ---- token endpoint -------------------------------------------------------
+    async token(req, res, cors) {
+        const text = await readBody(req, MAX_FORM_BYTES);
+        let params;
+        if ((req.headers['content-type'] ?? '').includes('application/json')) {
+            try {
+                params = new URLSearchParams(Object.entries(JSON.parse(text)).map(([k, v]) => [k, String(v)]));
+            }
+            catch {
+                return sendJson(res, 400, { error: 'invalid_request', error_description: 'The token request body is not JSON.' }, cors);
+            }
+        }
+        else {
+            params = new URLSearchParams(text);
+        }
+        const refuse = (error, description) => sendJson(res, 400, { error, error_description: description }, cors);
+        if (params.get('grant_type') !== 'authorization_code')
+            return refuse('unsupported_grant_type', 'Only grant_type=authorization_code is supported.');
+        const code = this.options.signer.verify('code', params.get('code') ?? '');
+        if (code === undefined || code.x <= this.nowSeconds())
+            return refuse('invalid_grant', 'The authorization code is invalid or has expired.');
+        // Spent before any other check and before any await: two redemptions racing for one code cannot both pass.
+        this.pruneSpent();
+        if (this.options.spentCodes.has(code.n))
+            return refuse('invalid_grant', 'The authorization code has already been used.');
+        this.options.spentCodes.set(code.n, code.x);
+        const clientId = params.get('client_id');
+        if (clientId === null || digest(clientId) !== code.c)
+            return refuse('invalid_grant', 'The authorization code was issued to another client.');
+        if (params.get('redirect_uri') !== null && params.get('redirect_uri') !== code.r)
+            return refuse('invalid_grant', 'redirect_uri does not match the authorization request.');
+        const verifier = params.get('code_verifier') ?? '';
+        if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier) || b64url(createHash('sha256').update(verifier).digest()) !== code.cc) {
+            return refuse('invalid_grant', 'The PKCE code_verifier does not match the code_challenge.');
+        }
+        const resource = params.get('resource');
+        if (resource !== null && !sameResource(resource, code.rs))
+            return refuse('invalid_target', `This server issues tokens only for ${code.rs}.`);
+        const held = scopesFor(code.e, this.options.mcp());
+        const scopes = code.s.filter((s) => held.includes(s));
+        if (scopes.length === 0)
+            return refuse('invalid_grant', 'The member this code was issued to may no longer connect.');
+        const accessToken = this.options.signer.sign('token', { e: code.e, s: scopes, rs: code.rs, x: this.nowSeconds() + ACCESS_TOKEN_TTL_SECONDS });
+        sendJson(res, 200, { access_token: accessToken, token_type: 'Bearer', expires_in: ACCESS_TOKEN_TTL_SECONDS, scope: scopes.join(' ') }, { ...cors, Pragma: 'no-cache' });
+    }
+    pruneSpent() {
+        const now = this.nowSeconds();
+        for (const [nonce, expiry] of this.options.spentCodes)
+            if (expiry <= now)
+                this.options.spentCodes.delete(nonce);
+    }
+    // ---- bearer verification ----------------------------------------------------
+    /** remote-access spec: every `/mcp` request carries a token this server issued, narrowed to what its email holds now. */
+    async authenticate(req) {
+        const match = /^Bearer\s+(\S+)$/i.exec(req.headers.authorization ?? '');
+        const challenge = (error) => ({
+            'WWW-Authenticate': `Bearer resource_metadata="${this.protectedResourceMetadataUrl}"${error ? `, error="${error}"` : ''}`,
+        });
+        if (match === null) {
+            return { kind: 'refused', status: 401, headers: challenge(), body: { error: 'invalid_token', error_description: 'This store needs you to sign in.' } };
+        }
+        const principal = this.principalFor(match[1]);
+        if (principal === undefined) {
+            return { kind: 'refused', status: 401, headers: challenge('invalid_token'), body: { error: 'invalid_token', error_description: 'The token is invalid or expired, or its member may no longer connect.' } };
+        }
+        return { kind: 'admitted', principal };
+    }
+    principalFor(token) {
+        const payload = this.options.signer.verify('token', token);
+        if (payload === undefined || payload.x <= this.nowSeconds() || !sameResource(payload.rs, this.options.resource))
+            return undefined;
+        const held = scopesFor(payload.e, this.options.mcp());
+        const scopes = payload.s.filter((s) => held.includes(s));
+        return scopes.length === 0 ? undefined : { email: payload.e, scopes };
+    }
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 32);
+}
+function sameResource(a, b) {
+    return a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
+}
+const FORBIDDEN_SCHEMES = new Set(['javascript:', 'data:', 'file:', 'vbscript:', 'blob:']);
+function acceptableRedirectUri(uri) {
+    if (uri.length > MAX_REDIRECT_URI_LENGTH)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.hash !== '' || FORBIDDEN_SCHEMES.has(parsed.protocol))
+        return false;
+    if (parsed.protocol === 'http:')
+        return ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname);
+    return true;
+}
+function redirectWithError(res, verdict, issuer) {
+    const target = new URL(verdict.redirectUri);
+    target.searchParams.set('error', verdict.error);
+    target.searchParams.set('error_description', verdict.description);
+    if (verdict.state !== null)
+        target.searchParams.set('state', verdict.state);
+    target.searchParams.set('iss', issuer);
+    res.writeHead(302, { Location: target.toString(), 'Cache-Control': 'no-store' });
+    res.end();
+}
+/** The consent page: never framed, never scripted, never cached. */
+function sendPage(res, html) {
+    const buffer = Buffer.from(html, 'utf8');
+    res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Length': buffer.length,
+        'Cache-Control': 'no-store',
+        'X-Frame-Options': 'DENY',
+        // No form-action: browsers apply it to the redirect that follows the submit, which must reach the client's callback.
+        'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'",
+        // Not no-referrer: under it a browser submits the consent form with `Origin: null`, which the confirmation's
+        // origin check must refuse. same-origin sends the real origin to this server and nothing to the client's site.
+        'Referrer-Policy': 'same-origin',
+    });
+    res.end(buffer);
+}
+function methodNotAllowed(res, allow) {
+    sendText(res, 405, 'method not allowed\n', { Allow: allow });
+    return true;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/core/mcp/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/core/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInF,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAiB,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,CAAC;AACtD,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AACxF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,CAAC;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAEnC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,gCAAgC;IAChC,GAAG,gCAAgC,MAAM;IACzC,kCAAkC;IAClC,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,UAAU;CACX,CAAC;AAQF,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,MAAM;IAGY,GAAG;IAFf,OAAO,CAAS;IAEjC,YAA6B,GAAW;mBAAX,GAAG;QAC9B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,sBAAsB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpH,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,OAAe;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,CAAI,IAAY,EAAE,KAAa;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAChG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9F,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AA0ED,0HAA0H;AAC1H,MAAM,OAAO,mBAAmB;IACD,OAAO;IAApC,YAA6B,OAAqB;uBAArB,OAAO;IAAiB,CAAC;IAE9C,UAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,4BAA4B;QAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,gCAAgC,MAAM,CAAC;IACzE,CAAC;IAED,yBAAyB;QACvB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,qBAAqB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5C,gBAAgB,EAAE,CAAC,GAAG,UAAU,CAAC;YACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,kBAAkB;SAClC,CAAC;IACJ,CAAC;IAED,2BAA2B;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,OAAO;YACL,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,cAAc,EAAE;YACpD,cAAc,EAAE,GAAG,MAAM,GAAG,UAAU,EAAE;YACxC,qBAAqB,EAAE,GAAG,MAAM,GAAG,aAAa,EAAE;YAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,gBAAgB,EAAE,CAAC,GAAG,UAAU,CAAC;YACjC,8CAA8C,EAAE,IAAI;SACrD,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB;QACtE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,8FAA8F;QAC9F,+GAA+G;QAC/G,MAAM,IAAI,GAA2B,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;QAC/G,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,GAAG,IAAI;gBACP,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,mDAAmD;gBACnF,wBAAwB,EAAE,OAAO;aAClC,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACzC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBAC3I,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/B,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;oBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;qBACzE,IAAI,MAAM,KAAK,MAAM;oBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;oBAC7D,OAAO,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBACvC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAA4B;QAC5F,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB;gBAAE,MAAM,GAAG,CAAC;YAChD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,EAAE,IAAI,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QACpG,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5J,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAChB,iBAAiB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,0BAA0B,IAAI,GAAG,CAAC,GAAG;YAC7H,UAAU,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAC7H,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1J,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,cAAc,iBAAiB,0EAA0E,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1L,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,6CAA6C,EAAE,EAAE,IAAI,CAAC,CAAC;YACjI,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,OAAO,GAAkB,EAAE,CAAC,EAAE,IAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrF,QAAQ,CACN,GAAG,EACH,GAAG,EACH;YACE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;YACtD,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE;YACtC,aAAa,EAAE,OAAO,CAAC,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,wBAAwB,CAAC,MAAuB;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAgB,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qGAAqG,EAAE,CAAC;QAC3I,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC;QAElJ,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5I,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;QAC9H,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,sCAAsC,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAEvK,IAAI,SAAS,GAAsB,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,mBAAmB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjG,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;IACnI,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,OAAyB;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5G,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;QAChK,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,sEAAsE,EAAE,CAAC;QACjK,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACxG,CAAC;IAEO,eAAe,CAAC,MAAuB;QAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1I,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACjF,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,wCAAwC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvL,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;YACtC,YAAY,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW;YACtF,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;SAC3C,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,+GAA+G;IACvG,KAAK,CAAC,gBAAgB,CAAC,GAAoB,EAAE,GAAmB;QACtE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,8DAA8D,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACjF,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,wCAAwC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/K,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,0CAA0C,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;YAC5C,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC3B,CAAC,EAAE,OAAO,CAAC,WAAW;YACtB,EAAE,EAAE,OAAO,CAAC,SAAS;YACrB,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YACzB,CAAC,EAAE,GAAG,CAAC,KAAK;YACZ,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,8BAA8B;YACrD,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACb,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAA4B;QACzF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9I,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1H,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAE3H,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB;YAAE,OAAO,MAAM,CAAC,wBAAwB,EAAE,kDAAkD,CAAC,CAAC;QACnJ,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAc,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;QAE3I,2GAA2G;QAC3G,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QACzH,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC7I,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;QAC3K,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACtH,OAAO,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAE7I,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAErH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,wBAAwB,EAAyB,CAAC,CAAC;QACrK,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1K,CAAC;IAEO,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClH,CAAC;IAED,gFAAgF;IAEhF,yHAAyH;IACzH,KAAK,CAAC,YAAY,CAAC,GAAoB;QACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,CAAC,KAAc,EAA0B,EAAE,CAAC,CAAC;YAC7D,kBAAkB,EAAE,6BAA6B,IAAI,CAAC,4BAA4B,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SAC1H,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,EAAE,CAAC;QACzJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uEAAuE,EAAE,EAAE,CAAC;QAC7M,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAe,OAAO,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAClI,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,GAAG,CAAC,MAAM,GAAG,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAmB,EACnB,OAA0F,EAC1F,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,0BAA0B;QAC1C,gBAAgB,EAAE,MAAM,CAAC,MAAM;QAC/B,eAAe,EAAE,UAAU;QAC3B,iBAAiB,EAAE,MAAM;QACzB,qHAAqH;QACrH,yBAAyB,EAAE,uEAAuE;QAClG,6GAA6G;QAC7G,+GAA+G;QAC/G,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IAC1D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/mcp/pages.d.ts

@@ -0,0 +1,3 @@
+import type { ConsentPageView } from './oauth.js';
+export declare function renderConsentPage(storeName: string, view: ConsentPageView): Promise<string>;
+//# sourceMappingURL=pages.d.ts.map

package/dist/core/mcp/pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/pages.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAqBlD,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBjG"}

package/dist/core/mcp/pages.js

@@ -0,0 +1,41 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { escapeHtml } from '../browse/render.js';
+/**
+ * The consent page is markup, not a markdown fragment, so it is read the way
+ * `browse/templates.ts` reads the serve shell rather than through
+ * `packagedTemplate()`. Every substituted value is escaped here; the template
+ * carries no script.
+ */
+function templatesDir() {
+    return fileURLToPath(new URL('../../../templates/mcp', import.meta.url));
+}
+let cached;
+/** What each scope lets an app do, in the member's terms. */
+const SCOPE_TEXT = {
+    read: 'search and read the store’s notes',
+    capture: 'save material into the store’s inbox, where it waits for approval before it lands',
+    edit: 'edit and create notes in a draft that lands only once someone approves it',
+};
+export async function renderConsentPage(storeName, view) {
+    cached ??= await readFile(path.join(templatesDir(), 'consent.html'), 'utf8');
+    const replacements = {
+        __STORE_NAME__: escapeHtml(storeName),
+        __CLIENT_NAME__: escapeHtml(view.clientName),
+        __EMAIL__: escapeHtml(view.email),
+        __REDIRECT_HOST__: escapeHtml(view.redirectHost),
+        __SCOPE_ITEMS__: view.scopes.map((s) => `<li>${escapeHtml(SCOPE_TEXT[s])}</li>`).join('\n'),
+        __HIDDEN_FIELDS__: Object.entries(view.hiddenFields)
+            .map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`)
+            .join('\n'),
+    };
+    // One pass, so a substituted value that happens to contain a token is never substituted again.
+    return cached.replace(/__[A-Z_]+__/g, (token) => {
+        const value = replacements[token];
+        if (value === undefined)
+            throw new Error(`templates/mcp/consent.html carries an unknown placeholder ${token}`);
+        return value;
+    });
+}
+//# sourceMappingURL=pages.js.map

package/dist/core/mcp/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../../src/core/mcp/pages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD;;;;;GAKG;AACH,SAAS,YAAY;IACnB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,IAAI,MAA0B,CAAC;AAE/B,6DAA6D;AAC7D,MAAM,UAAU,GAAuC;IACrD,IAAI,EAAE,mCAAmC;IACzC,OAAO,EAAE,mFAAmF;IAC5F,IAAI,EAAE,2EAA2E;CAClF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAqB;IAC9E,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,YAAY,GAA2B;QAC3C,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;QAChD,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3F,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;aACvG,IAAI,CAAC,IAAI,CAAC;KACd,CAAC;IACF,+FAA+F;IAC/F,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,KAAK,EAAE,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/mcp/ripgrep.d.ts

@@ -0,0 +1,48 @@
+/**
+ * serve-the-store-over-mcp design.md D12: the one module that spawns
+ * ripgrep, for the MCP surface's `Grep` and `Glob`. Claude Code's own Grep
+ * parameters map onto ripgrep's flags one for one, so they are passed through
+ * as an argument vector — never a shell — with `--` ahead of the pattern, so
+ * no pattern is ever read as a flag. Ripgrep's engine runs in time linear in
+ * its input, so no pattern can hang the server; the time and output limits
+ * here bound everything else.
+ */
+export declare const RIPGREP_TIMEOUT_MS = 5000;
+export declare const RIPGREP_MAX_OUTPUT_BYTES: number;
+export interface GrepParams {
+    pattern: string;
+    path?: string;
+    glob?: string;
+    type?: string;
+    output_mode?: 'content' | 'files_with_matches' | 'count';
+    '-i'?: boolean;
+    '-n'?: boolean;
+    '-A'?: number;
+    '-B'?: number;
+    '-C'?: number;
+    context?: number;
+    multiline?: boolean;
+}
+/**
+ * One output entry: the file it belongs to, and the rest of ripgrep's line after the path (null for a bare path).
+ * Read from `--null` output, where a NUL ends every path, so a path containing `:` or `-` is never split wrongly. A
+ * context-group separator (`--`) has no path.
+ */
+export interface RipgrepEntry {
+    path: string | null;
+    rest: string | null;
+}
+export type RipgrepOutcome = {
+    kind: 'ok';
+    entries: RipgrepEntry[];
+} | {
+    kind: 'no-match';
+} | {
+    kind: 'error';
+    message: string;
+};
+/** Claude Code's Grep, mapped flag for flag. `searchPath` is store-relative, already confined to the store. */
+export declare function grep(cwd: string, params: GrepParams, searchPath: string | null, hidden: readonly string[]): Promise<RipgrepOutcome>;
+/** Claude Code's Glob: files matching `pattern`, under `searchPath`, sorted by path. */
+export declare function glob(cwd: string, pattern: string, searchPath: string | null, hidden: readonly string[]): Promise<RipgrepOutcome>;
+//# sourceMappingURL=ripgrep.d.ts.map

package/dist/core/mcp/ripgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ripgrep.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/ripgrep.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AACxC,eAAO,MAAM,wBAAwB,QAAkB,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,GAAG,oBAAoB,GAAG,OAAO,CAAC;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AA8CjI,+GAA+G;AAC/G,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAqBnI;AAED,wFAAwF;AACxF,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAKhI"}