ftown 0.19.52 → 0.19.54

package/dist/mcp/oauth.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
 import jwt from "jsonwebtoken";
 import { InvalidGrantError, InvalidTokenError, InvalidRequestError, InvalidScopeError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { z } from 'zod';
+import { open, parseSecureEnvelope } from '../security/crypto.js';
 const secretToken = () => randomBytes(32).toString("base64url");
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 const now = () => Math.floor(Date.now() / 1000);
@@ -8,10 +10,12 @@ export const MCP_SCOPES = ["mcp:read", "mcp:control"];
 export class FtownOAuthProvider {
     store;
     options;
+    keys;
     resource;
-    constructor(store, options) {
+    constructor(store, options, keys) {
         this.store = store;
         this.options = options;
+        this.keys = keys;
         this.resource = new URL("/mcp", options.publicUrl).href;
     }
     currentMachines(subject) {
@@ -66,6 +70,7 @@ export class FtownOAuthProvider {
             state: params.state,
             scopes,
             resource: this.resource,
+            expiresAt: now() + 600,
         };
         await this.store.transaction((tx) => tx.put("pending", id, pending, now() + 600));
         const consent = new URL("/mcp/consent", this.options.loginUrl);
@@ -92,45 +97,100 @@ export class FtownOAuthProvider {
             pending: await tx.get("pending", claims.request),
             owned: await tx.ownedMachines(claims.sub),
         }));
-        if (!pending || pending.resource !== this.resource)
+        if (!pending || pending.resource !== this.resource || !pending.expiresAt || (pending.subject && pending.subject !== claims.sub))
             throw new InvalidRequestError("Authorization request expired");
+        if (!this.keys)
+            throw new InvalidRequestError('Encrypted MCP identities must be configured');
+        const security = await this.keys.ensurePendingIdentity(claims.request, claims.sub, pending.scopes.includes('mcp:control') ? ['read', 'control'] : ['read']);
+        await this.store.transaction(async (tx) => {
+            const current = await tx.get('pending', claims.request);
+            if (!current || (current.subject && current.subject !== claims.sub))
+                throw new InvalidRequestError('Authorization request expired');
+            await tx.put('pending', claims.request, { ...current, subject: claims.sub, grantId: security.grantId }, current.expiresAt);
+        });
         return {
             clientName: pending.clientName,
             redirectUri: pending.redirectUri,
             scopes: pending.scopes,
             machines: this.currentMachines(claims.sub).filter((m) => owned.includes(m)),
+            security,
         };
     }
     async approve(assertion, deny = false) {
         const claims = this.assertion(assertion, deny ? "deny" : "approve");
-        return this.store.transaction(async (tx) => {
-            const pending = await tx.take("pending", claims.request);
-            if (!pending || pending.resource !== this.resource)
-                throw new InvalidRequestError("Authorization request expired or already handled");
-            const redirect = new URL(pending.redirectUri);
-            if (pending.state !== undefined)
-                redirect.searchParams.set("state", pending.state);
-            redirect.searchParams.set("iss", this.options.publicUrl);
-            if (deny) {
-                redirect.searchParams.set("error", "access_denied");
-                return redirect.href;
-            }
-            const machines = claims.machines;
-            const owned = await tx.ownedMachines(claims.sub);
-            const allowed = this.currentMachines(claims.sub).filter((m) => owned.includes(m));
-            if (!Array.isArray(machines) ||
-                !machines.length ||
-                machines.some((m) => typeof m !== "string" || !allowed.includes(m)))
-                throw new InvalidRequestError("No authorized machines selected");
-            const code = secretToken();
-            await tx.put("code", hash(code), {
-                ...pending,
-                subject: claims.sub,
-                machines: [...new Set(machines)],
-            }, now() + 120);
-            redirect.searchParams.set("code", code);
+        // Never hold an OAuth pool connection while the key store acquires another.
+        const { pending, owned } = await this.store.transaction(async (tx) => ({
+            pending: await tx.get('pending', claims.request),
+            owned: deny ? [] : await tx.ownedMachines(claims.sub),
+        }));
+        if (!pending || pending.resource !== this.resource)
+            throw new InvalidRequestError('Authorization request expired or already handled');
+        const redirect = new URL(pending.redirectUri);
+        if (pending.state !== undefined)
+            redirect.searchParams.set('state', pending.state);
+        redirect.searchParams.set('iss', this.options.publicUrl);
+        if (deny) {
+            await this.store.transaction(async (tx) => {
+                if (!await tx.take('pending', claims.request))
+                    throw new InvalidRequestError('Authorization request expired or already handled');
+            });
+            redirect.searchParams.set('error', 'access_denied');
             return redirect.href;
+        }
+        if (!this.keys || pending.subject !== claims.sub || !pending.grantId)
+            throw new InvalidRequestError('Inspect and approve the encrypted endpoint before continuing');
+        const machines = claims.machines;
+        const allowed = this.currentMachines(claims.sub).filter(machine => owned.includes(machine));
+        if (!Array.isArray(machines) || !machines.length || machines.some(machine => typeof machine !== 'string' || !allowed.includes(machine)))
+            throw new InvalidRequestError('No authorized machines selected');
+        const selected = [...new Set(machines)];
+        if (selected.length > 64)
+            throw new InvalidRequestError('Select at most 64 computers');
+        const identity = await this.keys.loadByRequest(claims.sub, claims.request);
+        if (identity.grantId !== pending.grantId || identity.state !== 'pending' || Date.parse(identity.pendingExpiresAt) <= Date.now())
+            throw new InvalidRequestError('Encrypted endpoint approval expired');
+        const pins = await this.approvalPins(claims.approvals, selected, identity);
+        // The row-locked transition permits one winner. If code persistence fails,
+        // the orphan approval has no usable OAuth token and fresh consent is required.
+        await this.keys.approve(claims.sub, claims.request, pins);
+        const code = secretToken();
+        await this.store.transaction(async (tx) => {
+            const current = await tx.take('pending', claims.request);
+            if (!current || current.subject !== claims.sub || current.grantId !== identity.grantId || JSON.stringify(current) !== JSON.stringify(pending))
+                throw new InvalidRequestError('Authorization request expired or already handled');
+            const currentOwned = await tx.ownedMachines(claims.sub);
+            if (selected.some(machine => !currentOwned.includes(machine) || !this.currentMachines(claims.sub).includes(machine)))
+                throw new InvalidRequestError('Machine access revoked');
+            await tx.put('code', hash(code), { ...current, subject: claims.sub, machines: selected, grantId: identity.grantId, activeExpiresAt: identity.activeExpiresAt }, now() + 120);
         });
+        redirect.searchParams.set('code', code);
+        return redirect.href;
+    }
+    async approvalPins(value, machines, identity) {
+        const endpoint = z.object({ version: z.literal(1), id: z.string().regex(/^[A-Za-z0-9_-]{43}$/), ownerId: z.string().uuid(), kind: z.literal('bridge'), publicKey: z.string().regex(/^[A-Za-z0-9_-]{87}$/) }).strict();
+        const approvals = z.array(z.object({ bridgeId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/), bridge: endpoint, receipt: z.unknown() }).strict()).min(1).max(64).safeParse(value);
+        if (!approvals.success || approvals.data.length !== machines.length || new Set(approvals.data.map(approval => approval.bridgeId)).size !== machines.length)
+            throw new InvalidRequestError('Every selected bridge must return encrypted approval');
+        const pins = [];
+        for (const approval of approvals.data) {
+            if (!machines.includes(approval.bridgeId) || approval.bridge.ownerId !== identity.ownerId)
+                throw new InvalidRequestError('Bridge approval does not match this account');
+            let receipt;
+            try {
+                const envelope = parseSecureEnvelope(approval.receipt);
+                receipt = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(await open(identity.identity, approval.bridge, envelope, { ownerId: identity.ownerId, bridgeId: approval.bridgeId, channel: `mcp-approval:${approval.bridgeId}:${identity.requestId}`, recipientId: identity.identity.endpoint.id, purpose: 'mcp-approval' })));
+            }
+            catch {
+                throw new InvalidRequestError('Bridge encrypted approval could not be verified');
+            }
+            const parsed = z.object({ type: z.literal('mcp-approval'), approvalId: z.string().min(1).max(200), requestId: z.literal(identity.requestId), ownerId: z.literal(identity.ownerId), grantId: z.literal(identity.grantId), candidateEndpointId: z.literal(identity.identity.endpoint.id), bridgeId: z.literal(approval.bridgeId), bridge: endpoint, permissions: z.array(z.enum(['read', 'control'])).min(1).max(2), expiresAt: z.string().datetime(), activeExpiresAt: z.literal(identity.activeExpiresAt) }).strict().safeParse(receipt);
+            if (!parsed.success || parsed.data.bridge.id !== approval.bridge.id || parsed.data.bridge.publicKey !== approval.bridge.publicKey
+                || [...parsed.data.permissions].sort().join(' ') !== [...identity.permissions].sort().join(' ')
+                || Date.parse(parsed.data.expiresAt) <= Date.now() || Date.parse(parsed.data.expiresAt) > Date.parse(identity.pendingExpiresAt))
+                throw new InvalidRequestError('Bridge approval does not match this consent');
+            pins.push({ bridgeId: approval.bridgeId, endpoint: approval.bridge, permissions: parsed.data.permissions });
+        }
+        return pins;
     }
     async challengeForAuthorizationCode(client, code) {
         const record = await this.store.transaction((tx) => tx.get("code", hash(code)));
@@ -151,22 +211,26 @@ export class FtownOAuthProvider {
         };
     }
     async exchangeAuthorizationCode(client, code, _verifier, redirectUri, resource) {
+        const prepared = await this.store.transaction(tx => tx.get('code', hash(code)));
+        if (!prepared || prepared.clientId !== client.client_id || prepared.redirectUri !== redirectUri || prepared.resource !== this.resource || resource?.href !== this.resource)
+            throw new InvalidGrantError('Invalid code, redirect URI or resource');
+        if (!this.keys || !prepared.grantId || !prepared.activeExpiresAt)
+            throw new InvalidGrantError('Renew consent to authorize an encrypted endpoint');
+        const identity = await this.keys.loadGrantIdentity(prepared.subject, prepared.grantId);
+        if (identity.state !== 'approved' || identity.activeExpiresAt !== prepared.activeExpiresAt)
+            throw new InvalidGrantError('Encrypted endpoint consent is unavailable');
         return this.store.transaction(async (tx) => {
-            const record = await tx.take("code", hash(code));
-            if (!record ||
-                record.clientId !== client.client_id ||
-                record.redirectUri !== redirectUri ||
-                record.resource !== this.resource ||
-                resource?.href !== this.resource)
-                throw new InvalidGrantError("Invalid code, redirect URI or resource");
-            const grantId = secretToken();
+            const record = await tx.take('code', hash(code));
+            if (!record || JSON.stringify(record) !== JSON.stringify(prepared))
+                throw new InvalidGrantError('Invalid or already used authorization code');
+            const grantId = record.grantId;
             const grant = {
                 resource: this.resource,
                 subject: record.subject,
                 machines: record.machines,
                 scopes: record.scopes,
                 clientId: client.client_id,
-                expiresAt: now() + 30 * 86400,
+                expiresAt: Math.floor(Date.parse(record.activeExpiresAt) / 1000),
                 revoked: false,
             };
             await tx.put("grant", grantId, grant, grant.expiresAt);
@@ -201,7 +265,7 @@ export class FtownOAuthProvider {
         return result;
     }
     async verifyAccessToken(token) {
-        return this.store.transaction(async (tx) => {
+        const result = await this.store.transaction(async (tx) => {
             const record = await tx.get("access", hash(token));
             const grant = record && (await tx.get("grant", record.grantId));
             if (!record || !grant || grant.revoked || grant.resource !== this.resource)
@@ -216,9 +280,19 @@ export class FtownOAuthProvider {
                 scopes: record.scopes,
                 expiresAt: record.expiresAt,
                 resource: new URL(this.resource),
-                extra: { subject: grant.subject, machines },
+                extra: { subject: grant.subject, machines, grantId: record.grantId },
             };
         });
+        if (!this.keys)
+            throw new InvalidTokenError('Renew consent to authorize an encrypted endpoint');
+        let identity;
+        try {
+            identity = await this.keys.loadGrantIdentity(result.extra.subject, result.extra.grantId);
+        }
+        catch {
+            throw new InvalidTokenError('Encrypted endpoint approval expired or requires renewed consent');
+        }
+        return { ...result, extra: { ...result.extra, endpointId: identity.identity.endpoint.id } };
     }
     async revokeToken(client, request) {
         await this.store.transaction(async (tx) => {

package/dist/mcp/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,GAAG,MAAM,cAAc,CAAC;AAW/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AAIzD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAoCtD,MAAM,OAAO,kBAAkB;IAGlB;IACA;IAHF,QAAQ,CAAS;IAC1B,YACW,KAAiB,EACjB,OAAqB;QADrB,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAc;QAE9B,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC;IACQ,YAAY,GAAG;QACtB,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CACxB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,EAAE,CAAC,GAAG,CAA6B,QAAQ,EAAE,EAAE,CAAC,CACjD;QACH,cAAc,EAAE,KAAK,EACnB,KAGC,EACoC,EAAE;YACvC,mFAAmF;YACnF,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,KAAK,MAAM;gBAE3C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E,IACE,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;gBAC/B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,OAAO,CACL,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;wBACtC,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;4BACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;gCACrB,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,CACF,CAAC;gBACJ,CAAC,CAAC;gBAEF,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;YACJ,MAAM,MAAM,GAA+B;gBACzC,SAAS,EAAE,WAAW,EAAE;gBACxB,mBAAmB,EAAE,GAAG,EAAE;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7C,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,CAChE,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YACzC,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM;YAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3C,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAY;YACvB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS;YAClD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,OAAuC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAC3D,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC7B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,KAAK,OAAO;YAEzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAChD,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB;SACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAI,GAAG,KAAK;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAChD,MAAM,IAAI,mBAAmB,CAC3B,kDAAkD,CACnD,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC7B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBACpD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB,CAAC;YACF,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACxB,CAAC,QAAQ,CAAC,MAAM;gBAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEnE,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,GAAG,CACV,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,EACV;gBACE,GAAG,OAAO;gBACV,OAAO,EAAE,MAAM,CAAC,GAAI;gBACpB,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;aAClB,EAChB,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;YACF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YACjD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACO,KAAK,CAAC,MAAM,CAClB,EAAoB,EACpB,OAAe,EACf,KAAY,EACZ,MAAgB;QAEhB,MAAM,MAAM,GAAG,WAAW,EAAE,EAC1B,OAAO,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,EACZ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EACrE,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;QACF,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,EACb,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EACzE,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,IAAY,EACZ,SAAkB,EAClB,WAAoB,EACpB,QAAc;QAEd,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IACE,CAAC,MAAM;gBACP,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACpC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAClC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACjC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;gBAEhC,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAU;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,KAAK;aACf,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,KAAa,EACb,MAAiB,EACjB,QAAc;QAEd,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAClC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACjD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC7D,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,uDAAuD;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;YAC1C,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEjD,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,EACX,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EACzB,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACxE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAClB,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACxC,MAAM,MAAM,GACV,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC5D,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3C,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,GAAG,MAAM,cAAc,CAAC;AAW/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIlE,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAyCtD,MAAM,OAAO,kBAAkB;IAGlB;IACA;IACA;IAJF,QAAQ,CAAS;IAC1B,YACW,KAAiB,EACjB,OAAqB,EACrB,IAAuB;QAFvB,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAc;QACrB,SAAI,GAAJ,IAAI,CAAmB;QAEhC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC;IACQ,YAAY,GAAG;QACtB,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CACxB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,EAAE,CAAC,GAAG,CAA6B,QAAQ,EAAE,EAAE,CAAC,CACjD;QACH,cAAc,EAAE,KAAK,EACnB,KAGC,EACoC,EAAE;YACvC,mFAAmF;YACnF,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,KAAK,MAAM;gBAE3C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E,IACE,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;gBAC/B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,OAAO,CACL,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;wBACtC,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;4BACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;gCACrB,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,CACF,CAAC;gBACJ,CAAC,CAAC;gBAEF,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;YACJ,MAAM,MAAM,GAA+B;gBACzC,SAAS,EAAE,WAAW,EAAE;gBACxB,mBAAmB,EAAE,GAAG,EAAE;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7C,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,CAChE,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YACzC,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM;YAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3C,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAY;YACvB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS;YAClD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG;SACvB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,OAAuC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAC3D,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC7B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,KAAK,OAAO;YAEzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC;YAC7H,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAI,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7J,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;YACpI,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAI,GAAG,KAAK;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,4EAA4E;QAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SACvD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;QACtI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;YAC5I,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpD,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,8DAA8D,CAAC,CAAC;QACpK,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;QAC1M,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAa,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;QACtM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;YACjO,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YAC/K,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAiB,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;QAC/L,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,QAAkB,EAAE,QAAgE;QAC7H,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACtN,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/K,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;QAClP,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;YACxK,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACvD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;YACxU,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;YAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzgB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,CAAC,SAAS;mBAC5H,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;mBAC5F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;YAChN,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YACjD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACO,KAAK,CAAC,MAAM,CAClB,EAAoB,EACpB,OAAe,EACf,KAAY,EACZ,MAAgB;QAEhB,MAAM,MAAM,GAAG,WAAW,EAAE,EAC1B,OAAO,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,EACZ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EACrE,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;QACF,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,EACb,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EACzE,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,IAAY,EACZ,SAAkB,EAClB,WAAoB,EACpB,QAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;QAClP,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,CAAC,CAAC;QACrK,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;YAC9I,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,MAAM,KAAK,GAAU;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBAChE,OAAO,EAAE,KAAK;aACf,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,KAAa,EACb,MAAiB,EACjB,QAAc;QAEd,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAClC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACjD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC7D,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,uDAAuD;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;YAC1C,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEjD,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,EACX,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EACzB,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACxE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAClB,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAChG,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,CAAC;YAAC,MAAM,IAAI,iBAAiB,CAAC,iEAAiE,CAAC,CAAC;QAAC,CAAC;QACzG,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAC9F,CAAC;IACD,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACxC,MAAM,MAAM,GACV,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC5D,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3C,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/mcp/relay-handler.d.ts

@@ -1 +1,2 @@
-export declare function createRelayHandler(port: number, token: string): (id: string, payload: Record<string, unknown>) => Promise<unknown>;
+/** Legacy plaintext relay has no execution capability. Native ciphertext uses the verified dispatcher. */
+export declare function createRelayHandler(_port: number, _token: string): (_id: string, _payload: Record<string, unknown>) => Promise<never>;

package/dist/mcp/relay-handler.js

@@ -1,43 +1,8 @@
-import { createHash } from "node:crypto";
-import { requestSchema, httpRequest, errorResult, FleetError, } from "./fleet.js";
-export function createRelayHandler(port, token) {
-    const recent = new Map();
-    return async (id, payload) => {
-        const request = requestSchema.parse(payload.request);
-        if (typeof payload.expiresAt !== "number" ||
-            payload.expiresAt <= Date.now() ||
-            payload.expiresAt > Date.now() + 65000)
-            throw new Error("Expired relay request");
-        const fingerprint = createHash("sha256")
-            .update(JSON.stringify(request))
-            .digest("hex");
-        const existing = recent.get(id);
-        if (existing) {
-            if (existing.fingerprint !== fingerprint)
-                throw new Error("Request ID already used");
-            return existing.promise;
-        }
-        for (const [key, value] of recent)
-            if (value.expires < Date.now())
-                recent.delete(key);
-        if (recent.size >= 10000)
-            throw new Error("Relay request capacity reached");
-        const promise = (async () => {
-            try {
-                const data = await httpRequest(`http://127.0.0.1:${port}`, token, {
-                    ...request,
-                    timeoutMs: Math.max(1000, Math.min(request.timeoutMs, payload.expiresAt - Date.now())),
-                });
-                if (Buffer.byteLength(JSON.stringify(data)) > 400000)
-                    throw new FleetError("response_too_large", "Relay result is too large; request a smaller page", request.method !== "GET");
-                return { data };
-            }
-            catch (e) {
-                return { error: errorResult(e) };
-            }
-        })();
-        recent.set(id, { fingerprint, expires: Date.now() + 120000, promise });
-        return promise;
+import { FleetError } from './fleet.js';
+/** Legacy plaintext relay has no execution capability. Native ciphertext uses the verified dispatcher. */
+export function createRelayHandler(_port, _token) {
+    return async (_id, _payload) => {
+        throw new FleetError('upgrade_required', 'Encrypted endpoint approval is required');
     };
 }
 //# sourceMappingURL=relay-handler.js.map

package/dist/mcp/relay-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-handler.js","sourceRoot":"","sources":["../../src/mcp/relay-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IACJ,OAAO,KAAK,EAAE,EAAU,EAAE,OAAgC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,IACE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAEtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;aAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;gBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM;YAC/B,IAAI,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,oBAAoB,IAAI,EAAE,EAAE,KAAK,EAAE;oBAChE,GAAG,OAAO;oBACV,SAAS,EAAE,IAAI,CAAC,GAAG,CACjB,IAAI,EACJ,IAAI,CAAC,GAAG,CACN,OAAO,CAAC,SAAS,EAChB,OAAO,CAAC,SAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAC3C,CACF;iBACF,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM;oBAClD,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,mDAAmD,EACnD,OAAO,CAAC,MAAM,KAAK,KAAK,CACzB,CAAC;gBACJ,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"relay-handler.js","sourceRoot":"","sources":["../../src/mcp/relay-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc;IAC9D,OAAO,KAAK,EAAE,GAAW,EAAE,QAAiC,EAAkB,EAAE;QAC9E,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yCAAyC,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp/relay.d.ts

@@ -1,13 +1,13 @@
 import { type BridgeRequest } from "./fleet.js";
-/** One renewable owner-scoped relay connection per account, shared by all its MCP requests. */
+import { type McpRequestContext } from "./secure-client.js";
+/** Renewable routing connections carry ciphertext only; identities stay request-bound. */
 export declare class FleetRelay {
     private url;
     private tokenSecret;
     private clients;
     constructor(url: string, tokenSecret: string);
     private connection;
-    request(userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal): Promise<any>;
-    private unwrap;
-    private rpc;
+    request(userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal, context?: McpRequestContext): Promise<unknown>;
+    private exchange;
     close(): void;
 }

package/dist/mcp/relay.js

@@ -1,10 +1,10 @@
-import { randomUUID } from "node:crypto";
 import { Centrifuge } from "centrifuge";
 import WebSocket from "ws";
 import jwt from "jsonwebtoken";
 import { FleetError, requestSchema } from "./fleet.js";
-import { legacyRelayCommand } from "./legacy-relay.js";
-/** One renewable owner-scoped relay connection per account, shared by all its MCP requests. */
+import { parseSecureEnvelope } from "../security/crypto.js";
+import { SecureMcpClient } from "./secure-client.js";
+/** Renewable routing connections carry ciphertext only; identities stay request-bound. */
 export class FleetRelay {
     url;
     tokenSecret;
@@ -17,25 +17,18 @@ export class FleetRelay {
         const cached = this.clients.get(userId);
         if (cached)
             return cached;
-        const mint = () => jwt.sign({}, this.tokenSecret, {
-            subject: userId,
-            audience: "ftown:centrifugo",
-            expiresIn: "10m",
-        });
-        const client = new Centrifuge(this.url, {
-            websocket: WebSocket,
-            token: mint(),
-            getToken: async () => mint(),
-            timeout: 10000,
-        });
+        const mint = () => jwt.sign({}, this.tokenSecret, { subject: userId, audience: "ftown:centrifugo", expiresIn: "10m" });
+        const client = new Centrifuge(this.url, { websocket: WebSocket, token: mint(), getToken: async () => mint(), timeout: 10000 });
         const sub = client.newSubscription(`commands:rpc#${userId}`);
         const pending = new Map();
-        sub.on("publication", (ctx) => {
-            // Same fail-closed publisher check as the existing bridge transport.
-            if (ctx.info?.user !== userId || ctx.data?.type !== "command_response")
+        sub.on("publication", ctx => {
+            if (ctx.info?.user !== userId)
                 return;
-            const response = ctx.data.response;
-            pending.get(response?.requestId)?.(response);
+            try {
+                const packet = parseSecureEnvelope(ctx.data);
+                pending.get(packet.messageId)?.accept(packet);
+            }
+            catch { /* Plaintext/unknown/oversized traffic never enters the application. */ }
         });
         sub.subscribe();
         client.connect();
@@ -43,60 +36,21 @@ export class FleetRelay {
         this.clients.set(userId, entry);
         return entry;
     }
-    async request(userId, machineId, request, signal) {
-        request = requestSchema.parse(request);
-        const deadline = Date.now() + request.timeoutMs;
-        const mutation = request.method !== "GET";
-        const response = await this.rpc(userId, machineId, "mcp_request", {
-            request, expiresAt: deadline,
-        }, deadline, mutation, signal);
-        if (response.success)
-            return this.unwrap(response.data);
-        // Only this rejection proves the operation was not executed. Never fall
-        // back after a timeout, connection failure or ambiguous execution error.
-        if (response.error !== "Unknown command type: mcp_request")
-            throw new FleetError("bridge_error", "Bridge could not execute the relay request", mutation);
-        const lifecycle = request.method === "POST"
-            ? /^\/api\/sessions\/([a-zA-Z0-9_-]+)\/(stop|retry)$/.exec(request.path) : null;
-        const type = lifecycle ? `${lifecycle[2]}_session` : "bridge_exec";
-        const payload = lifecycle ? { sessionId: lifecycle[1] } : {
-            command: legacyRelayCommand(machineId, request, deadline),
-            timeout: Math.max(1, deadline - Date.now()),
-        };
-        const legacy = await this.rpc(userId, machineId, type, payload, deadline, mutation, signal);
-        if (!legacy.success) {
-            if (legacy.error === "bridge_exec disabled (FTOWN_DISABLE_BRIDGE_EXEC=1)")
-                throw new FleetError("bridge_upgrade_required", "Upgrade this bridge to enable native MCP support; legacy execution is disabled");
-            throw new FleetError("bridge_error", "Bridge rejected the compatibility request", mutation);
-        }
-        if (lifecycle)
-            return legacy.data;
-        if (legacy.data?.exitCode !== 0)
-            throw new FleetError("bridge_error", "Legacy bridge helper failed; check Node availability or upgrade this bridge", mutation);
-        let result;
-        try {
-            result = JSON.parse(legacy.data.stdout);
-        }
-        catch {
-            throw new FleetError("bridge_error", "Legacy bridge returned an invalid result", mutation);
-        }
-        return this.unwrap(result);
-    }
-    unwrap(result) {
-        if (result?.error)
-            throw new FleetError(result.error.code, result.error.message, result.error.outcomeUnknown, result.error.status);
-        return result?.data;
+    async request(userId, machineId, request, signal, context) {
+        if (!context)
+            throw new FleetError("approval_required", "An encrypted MCP grant is required");
+        const client = new SecureMcpClient(context, machineId, `commands:rpc#${userId}`, (packet, deadline, mutating, abort) => this.exchange(userId, packet, deadline, mutating, abort));
+        return client.request(requestSchema.parse(request), signal);
     }
-    async rpc(userId, machineId, type, payload, deadline, mutation, signal) {
+    async exchange(userId, packet, deadline, mutating, signal) {
         if (Date.now() >= deadline)
-            throw new FleetError("timeout", "Request expired before publication");
+            throw new FleetError("timeout", "Encrypted request expired before publication");
         if (signal?.aborted)
-            throw new FleetError("cancelled", "Relay request cancelled");
+            throw new FleetError("cancelled", "Encrypted request cancelled");
         const { sub, pending } = this.connection(userId);
-        const id = randomUUID();
+        const id = packet.messageId;
         return new Promise((resolve, reject) => {
-            let sent = false;
-            let settled = false;
+            let sent = false, settled = false;
             const finish = (error, value) => {
                 if (settled)
                     return;
@@ -106,37 +60,33 @@ export class FleetRelay {
                 signal?.removeEventListener("abort", cancel);
                 if (error)
                     reject(error);
-                else
+                else if (value)
                     resolve(value);
             };
-            const cancel = () => finish(new FleetError("cancelled", "Relay request cancelled", sent && mutation));
-            const timer = setTimeout(() => finish(new FleetError("timeout", "Bridge did not respond before the deadline", sent && mutation)), Math.max(1, deadline - Date.now()));
+            const cancel = () => finish(new FleetError("cancelled", "Encrypted relay request cancelled", sent && mutating));
+            const timer = setTimeout(() => finish(new FleetError("timeout", "Encrypted bridge did not respond before the deadline", sent && mutating)), Math.max(1, deadline - Date.now()));
             signal?.addEventListener("abort", cancel, { once: true });
             if (signal?.aborted) {
                 cancel();
                 return;
             }
-            pending.set(id, (response) => finish(undefined, response));
-            void sub
-                .ready(Math.max(1, deadline - Date.now()))
-                .then(async () => {
+            pending.set(id, { accept: value => {
+                    // Other concurrent gateways/endpoints can publish the same visible ID; only accept the exact route here.
+                    if (value.senderId === packet.recipientId && value.recipientId === packet.senderId && value.ownerId === packet.ownerId && value.bridgeId === packet.bridgeId && value.channel === packet.channel)
+                        finish(undefined, value);
+                }, reject: () => finish(new FleetError("connection_error", "Encrypted relay is closing", sent && mutating)) });
+            void sub.ready(Math.max(1, deadline - Date.now())).then(async () => {
                 if (settled)
                     return;
-                // No retries: publication failure may still mean the request was delivered.
                 sent = true;
-                await sub.publish({
-                    type,
-                    requestId: id,
-                    payload: { ...payload, bridgeId: machineId },
-                });
-            })
-                .catch(() => finish(new FleetError("connection_error", "Relay connection unavailable", sent && mutation)));
+                await sub.publish(packet);
+            }).catch(() => finish(new FleetError("connection_error", "Encrypted relay connection unavailable", sent && mutating)));
         });
     }
     close() {
         for (const entry of this.clients.values()) {
-            for (const finish of [...entry.pending.values()])
-                finish({ success: false });
+            for (const pending of [...entry.pending.values()])
+                pending.reject();
             entry.client.disconnect();
         }
         this.clients.clear();

package/dist/mcp/relay.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/mcp/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,+FAA+F;AAC/F,MAAM,OAAO,UAAU;IAUX;IACA;IAVF,OAAO,GAAG,IAAI,GAAG,EAOtB,CAAC;IACJ,YACU,GAAW,EACX,WAAmB;QADnB,QAAG,GAAH,GAAG,CAAQ;QACX,gBAAW,GAAX,WAAW,CAAQ;IAC1B,CAAC;IACI,UAAU,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;YAC7B,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,kBAAkB;YAC5B,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACL,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;YACtC,SAAS,EAAE,SAAS;YACpB,KAAK,EAAE,IAAI,EAAE;YACb,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;YAC5B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;QACvD,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,qEAAqE;YACrE,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,kBAAkB;gBACpE,OAAO;YACT,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,OAAO,CACX,MAAc,EACd,SAAiB,EACjB,OAAsB,EACtB,MAAoB;QAEpB,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE;YAChE,OAAO,EAAE,SAAS,EAAE,QAAQ;SAC7B,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxD,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,QAAQ,CAAC,KAAK,KAAK,mCAAmC;YACxD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,4CAA4C,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM;YACzC,CAAC,CAAC,mDAAmD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;QACnE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC;YACzD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;SAC5C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,KAAK,KAAK,oDAAoD;gBACvE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,gFAAgF,CAAC,CAAC;YACpI,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,2CAA2C,EAAE,QAAQ,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,SAAS;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC;YAC7B,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,6EAA6E,EAAE,QAAQ,CAAC,CAAC;QAChI,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAChD,MAAM,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,0CAA0C,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QACrG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACO,MAAM,CAAC,MAAW;QACxB,IAAI,MAAM,EAAE,KAAK;YACf,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClH,OAAO,MAAM,EAAE,IAAI,CAAC;IACtB,CAAC;IACO,KAAK,CAAC,GAAG,CACf,MAAc,EAAE,SAAiB,EAAE,IAAY,EAAE,OAAgC,EACjF,QAAgB,EAAE,QAAiB,EAAE,MAAoB;QAEzD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QAClG,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,KAAe,EAAE,EAAE;gBAClD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,OAAO,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,MAAM,CACJ,IAAI,UAAU,CACZ,WAAW,EACX,yBAAyB,EACzB,IAAI,IAAI,QAAQ,CACjB,CACF,CAAC;YACJ,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,MAAM,CACJ,IAAI,UAAU,CACZ,SAAS,EACT,4CAA4C,EAC5C,IAAI,IAAI,QAAQ,CACjB,CACF,EACH,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CACnC,CAAC;YACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,KAAK,GAAG;iBACL,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;iBACzC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,OAAO;oBAAE,OAAO;gBACpB,4EAA4E;gBAC5E,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,IAAI;oBACJ,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,UAAU,CACZ,kBAAkB,EAClB,8BAA8B,EAC9B,IAAI,IAAI,QAAQ,CACjB,CACF,CACF,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/mcp/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAE7E,0FAA0F;AAC1F,MAAM,OAAO,UAAU;IAED;IAAqB;IADjC,OAAO,GAAG,IAAI,GAAG,EAA6I,CAAC;IACvK,YAAoB,GAAW,EAAU,WAAmB;QAAxC,QAAG,GAAH,GAAG,CAAQ;QAAU,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IACxD,UAAU,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/H,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4E,CAAC;QACpG,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE;YAC1B,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;gBAAE,OAAO;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAC,uEAAuE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,EAAE,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAsB,EAAE,MAAoB,EAAE,OAA2B;QACxH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE,EAC7E,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACO,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,MAAsB,EAAE,QAAgB,EAAE,QAAiB,EAAE,MAAoB;QACtH,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAE,KAAsB,EAAE,EAAE;gBAC5D,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtG,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;qBAAM,IAAI,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC;YAChH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,sDAAsD,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChL,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;oBAChC,yGAAyG;oBACzG,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;wBAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7N,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/G,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACjE,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/mcp/secure-client.d.ts

@@ -0,0 +1,23 @@
+import type { McpActionContext, SecureEnvelope } from '../security/protocol.js';
+import type { McpGrantIdentity } from './mcp-key-store.js';
+import { type BridgeRequest } from './fleet.js';
+export interface McpRequestContext {
+    grant: McpGrantIdentity;
+    action: McpActionContext;
+    revalidate?: () => Promise<void>;
+}
+export type SecureExchange = (envelope: SecureEnvelope, deadline: number, mutating: boolean, signal?: AbortSignal) => Promise<SecureEnvelope>;
+/** Both endpoint adapters use the same semantic allowlist. */
+export declare function isMcpMutation(request: Pick<BridgeRequest, 'method' | 'path'>): boolean;
+/** An immutable grant-bound endpoint; no state is shared across callers or grants. */
+export declare class SecureMcpClient {
+    private context;
+    private bridgeId;
+    private channel;
+    private exchange;
+    constructor(context: McpRequestContext, bridgeId: string, channel: string, exchange: SecureExchange);
+    private pin;
+    private header;
+    private send;
+    request(request: BridgeRequest, signal?: AbortSignal): Promise<unknown>;
+}