ftown 0.20.6 → 0.20.7

package/dist/mcp/http.js

@@ -1,350 +0,0 @@
-import express from "express";
-import { rateLimit } from "express-rate-limit";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { mcpAuthRouter, createOAuthMetadata, } from "@modelcontextprotocol/sdk/server/auth/router.js";
-import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-import { z } from "zod";
-import { configSchema, Fleet, FleetError } from "./fleet.js";
-import { createMcpServer } from "./server.js";
-import { MCP_SCOPES } from "./oauth.js";
-import { randomUUID } from 'node:crypto';
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { errorResult } from './fleet.js';
-import { READ_MCP_TOOLS, safeTool, safeFailureCode, securityOutcome, finishSecurityEvent } from './security-events.js';
-const httpsOrigin = z
-    .string()
-    .url()
-    .refine((s) => {
-    const u = new URL(s);
-    return u.protocol === "https:" && u.origin === s;
-}, "An HTTPS origin without a trailing slash is required");
-export const gatewayConfigSchema = z
-    .object({
-    publicUrl: httpsOrigin,
-    loginUrl: httpsOrigin,
-    allowedOrigins: z.array(httpsOrigin).default([]),
-    fleet: configSchema,
-    access: z
-        .array(z
-        .object({
-        subject: z.string().min(1),
-        machines: z.array(z.string()).min(1),
-    })
-        .strict())
-        .min(1),
-})
-    .strict()
-    .superRefine((c, ctx) => {
-    if (new Set(c.access.map((a) => a.subject)).size !== c.access.length)
-        ctx.addIssue({ code: "custom", message: "Duplicate account subject" });
-    for (const a of c.access)
-        if (a.machines.some((id) => !c.fleet.machines.some((m) => m.id === id)))
-            ctx.addIssue({
-                code: "custom",
-                message: "Access references an unknown machine",
-            });
-});
-export function createGateway(config, provider, relay, audit) {
-    const app = express();
-    const rootFleet = new Fleet(config.fleet, relay
-        ? (user, id, request, signal, context) => relay.request(user, id, request, signal, context)
-        : undefined);
-    const actions = new AsyncLocalStorage();
-    const states = new WeakMap();
-    const finish = (state, outcome) => finishSecurityEvent(audit, state, outcome);
-    const admission = async (req, res) => {
-        if (!audit || !provider.keys)
-            throw new FleetError('security_setup_required', 'Encrypted MCP storage and security audit must be configured');
-        const subject = String(req.auth.extra.subject);
-        const tool = req.body?.method === 'tools/call' ? safeTool(req.body?.params?.name)
-            : req.body?.method === 'initialize' ? 'initialize' : req.body?.method === 'tools/list' ? 'tools_list'
-                : req.body?.method === 'resources/list' ? 'resources_list' : req.body?.method === 'resources/read' ? 'resources_read'
-                    : req.body?.id === undefined ? 'protocol_notification' : 'protocol_request';
-        const target = req.body?.params?.arguments;
-        const allowed = req.auth.extra.machines;
-        const actionId = randomUUID();
-        const action = { actionId, parentActionId: null, clientId: req.auth.clientId, grantId: String(req.auth.extra.grantId), tool, operation: null };
-        const event = {
-            version: 1, id: actionId, actionId, parentActionId: null, ownerId: subject, source: 'gateway',
-            bridgeId: typeof target?.machine === 'string' && allowed.includes(target.machine) ? target.machine : null,
-            clientId: action.clientId, grantId: action.grantId, endpointId: String(req.auth.extra.endpointId), tool, operation: null,
-            sessionId: typeof target?.sessionId === 'string' && /^[A-Za-z0-9_-]{1,200}$/.test(target.sessionId) ? target.sessionId : null,
-            startedAt: new Date().toISOString(), finishedAt: null, status: 'started', errorCode: null,
-            mutating: req.body?.method === 'tools/call' && !READ_MCP_TOOLS.has(tool),
-        };
-        await audit.admit(event);
-        const state = { event, action, finished: false, dispatched: false };
-        states.set(req, state);
-        res.once('close', () => {
-            if (!state.finished)
-                void finish(state, { status: state.dispatched ? 'unknown' : 'rejected', errorCode: state.dispatched ? 'outcome_unknown' : res.statusCode >= 400 ? 'invalid_request' : 'cancelled' }).catch(() => { });
-        });
-        return state;
-    };
-    app.disable("x-powered-by");
-    // Fly's edge is the sole HTTP ingress; forwarded headers are not used for authorization.
-    app.set("trust proxy", 1);
-    app.get("/healthz", (_req, res) => {
-        res.json({ ok: true });
-    });
-    app.use((req, res, next) => {
-        res.setHeader("Cache-Control", "no-store");
-        res.setHeader("X-Content-Type-Options", "nosniff");
-        res.setHeader("Referrer-Policy", "no-referrer");
-        res.setHeader("Strict-Transport-Security", "max-age=31536000");
-        if (req.headers.host !== new URL(config.publicUrl).host) {
-            res.status(421).end();
-            return;
-        }
-        if (req.headers["x-forwarded-proto"] &&
-            req.headers["x-forwarded-proto"] !== "https") {
-            res.status(400).end();
-            return;
-        }
-        next();
-    });
-    // Keep issuer spelling identical across discovery and authorization responses.
-    app.get("/.well-known/oauth-authorization-server", (_req, res) => {
-        res.setHeader("Access-Control-Allow-Origin", "*");
-        res.json({
-            ...createOAuthMetadata({
-                provider,
-                issuerUrl: new URL(config.publicUrl),
-                scopesSupported: MCP_SCOPES,
-            }),
-            issuer: config.publicUrl,
-            token_endpoint_auth_methods_supported: ["none"],
-            revocation_endpoint_auth_methods_supported: ["none"],
-            authorization_response_iss_parameter_supported: true,
-        });
-    });
-    app.get([
-        "/.well-known/oauth-protected-resource/mcp",
-        "/.well-known/oauth-protected-resource",
-    ], (_req, res) => {
-        res.setHeader("Access-Control-Allow-Origin", "*");
-        res.json({
-            resource: provider.resource,
-            authorization_servers: [config.publicUrl],
-            scopes_supported: MCP_SCOPES,
-            bearer_methods_supported: ["header"],
-            resource_name: "ftown agent fleet",
-        });
-    });
-    app.use(mcpAuthRouter({
-        provider,
-        issuerUrl: new URL(config.publicUrl),
-        resourceServerUrl: new URL(provider.resource),
-        scopesSupported: MCP_SCOPES,
-        resourceName: "ftown agent fleet",
-    }));
-    app.use("/consent", rateLimit({
-        windowMs: 60000,
-        limit: 60,
-        standardHeaders: true,
-        legacyHeaders: false,
-    }), express.json({ limit: "512kb" }));
-    app.post("/consent/:action", async (req, res) => {
-        try {
-            if (typeof req.body?.assertion !== "string") {
-                res.status(400).json({ error: "invalid_request" });
-                return;
-            }
-            if (req.params.action === "details")
-                res.json(await provider.consentDetails(req.body.assertion));
-            else if (req.params.action === "approve" || req.params.action === "deny")
-                res.json({
-                    redirect: await provider.approve(req.body.assertion, req.params.action === "deny"),
-                });
-            else
-                res.status(404).end();
-        }
-        catch {
-            res.status(400).json({ error: "Invalid or expired consent request" });
-        }
-    });
-    app.use("/mcp", (req, res, next) => {
-        const origin = req.headers.origin;
-        if (origin &&
-            ![config.loginUrl, ...config.allowedOrigins].includes(origin)) {
-            res.status(403).json({ error: "Origin not allowed" });
-            return;
-        }
-        if (origin) {
-            res.setHeader("Access-Control-Allow-Origin", origin);
-            res.setHeader("Vary", "Origin");
-        }
-        res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id, Last-Event-ID");
-        res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, MCP-Session-Id, MCP-Protocol-Version");
-        res.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
-        if (req.method === "OPTIONS") {
-            res.status(204).end();
-            return;
-        }
-        next();
-    });
-    app.use("/mcp", requireBearerAuth({
-        verifier: provider,
-        requiredScopes: ["mcp:read"],
-        resourceMetadataUrl: new URL("/.well-known/oauth-protected-resource/mcp", config.publicUrl).href,
-    }));
-    app.use('/mcp', express.json({ limit: '1mb' }));
-    app.use('/mcp', async (req, res, next) => {
-        try {
-            await admission(req, res);
-            next();
-        }
-        catch {
-            res.status(503).json({ error: 'Security audit or encrypted endpoint is unavailable' });
-        }
-    });
-    app.use("/mcp", rateLimit({
-        windowMs: 60000,
-        limit: 600,
-        keyGenerator: (req) => String(req.auth?.extra?.subject),
-        standardHeaders: true,
-        legacyHeaders: false,
-        handler: (req, res) => {
-            const state = states.get(req);
-            void (state ? finish(state, { status: 'rejected', errorCode: 'capacity_exceeded' }) : Promise.resolve()).catch(() => { }).finally(() => res.status(429).json({ error: 'MCP request limit exceeded' }));
-        },
-    }));
-    app.post("/mcp", async (req, res) => {
-        const state = states.get(req);
-        let identity;
-        try {
-            identity = await provider.keys.loadGrantIdentity(state.event.ownerId, state.action.grantId);
-            await provider.keys.markActive(identity.ownerId, identity.requestId);
-        }
-        catch {
-            await finish(state, { status: 'rejected', errorCode: 'approval_required' });
-            res.status(403).json({ error: 'Renew encrypted bridge consent' });
-            return;
-        }
-        const allowed = req.auth.extra.machines;
-        const fleet = {
-            config: {
-                ...config.fleet,
-                machines: config.fleet.machines.filter((m) => allowed.includes(m.id)),
-            },
-            request: (id, ...args) => {
-                if (!allowed.includes(id))
-                    return Promise.reject(new FleetError("forbidden", "Machine is not authorized for this grant"));
-                state.dispatched = true;
-                return rootFleet.scoped({ grant: identity, action: actions.getStore() ?? state.action, revalidate: async () => {
-                        const current = await provider.verifyAccessToken(req.auth.token);
-                        if (!(current.extra?.machines).includes(id) || (state.event.mutating && !current.scopes.includes('mcp:control')))
-                            throw new FleetError('forbidden', 'MCP access changed before dispatch');
-                    } }).request(id, ...args);
-            },
-        };
-        const server = createMcpServer(fleet, {
-            readOnly: !req.auth.scopes.includes("mcp:control"),
-            caller: { subject: String(req.auth.extra.subject), clientId: req.auth.clientId, scopes: [...req.auth.scopes] },
-            revalidate: async (machines) => {
-                let current;
-                try {
-                    current = await provider.verifyAccessToken(req.auth.token);
-                }
-                catch {
-                    throw new FleetError("forbidden", "Access expired or was revoked during this request");
-                }
-                const authorized = current.extra?.machines;
-                if (machines.some((machine) => !authorized.includes(machine)))
-                    throw new FleetError("forbidden", "Machine access was revoked during this request");
-            },
-            runChild: async (name, args, run) => {
-                const actionId = randomUUID();
-                const child = {
-                    ...state.event, id: actionId, actionId, parentActionId: state.event.actionId, tool: safeTool(name), operation: safeTool(name),
-                    bridgeId: typeof args.machine === 'string' && allowed.includes(args.machine) ? args.machine : null,
-                    sessionId: typeof args.sessionId === 'string' && /^[A-Za-z0-9_-]{1,200}$/.test(args.sessionId) ? args.sessionId : null,
-                    startedAt: new Date().toISOString(), mutating: !READ_MCP_TOOLS.has(name),
-                };
-                await audit.admit(child);
-                const action = { ...state.action, actionId, parentActionId: state.event.actionId, tool: child.tool, operation: child.operation };
-                let outcome;
-                try {
-                    const result = await actions.run(action, run);
-                    outcome = securityOutcome(result);
-                    await audit.finish(child, outcome);
-                    return result;
-                }
-                catch (error) {
-                    const failure = errorResult(error);
-                    await audit.finish(child, { status: failure.outcomeUnknown ? 'unknown' : ['forbidden', 'permission_denied'].includes(failure.code) ? 'rejected' : 'failed', errorCode: safeFailureCode(failure.code) });
-                    throw error;
-                }
-            },
-        });
-        // Stateless transport: every request is authenticated and reconstructs its own scoped tool surface.
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            // Only a bounded attention_wait call opens a request-scoped SSE stream.
-            // No GET stream/session map or unsolicited server notifications are advertised.
-            enableJsonResponse: !(req.body?.method === "tools/call" && req.body?.params?.name === "attention_wait"),
-        });
-        const send = transport.send.bind(transport);
-        transport.send = async (message, options) => {
-            if ('id' in message && message.id === req.body?.id && ('result' in message || 'error' in message)) {
-                let outcome = 'error' in message ? { status: 'rejected', errorCode: message.error.code === -32602 ? 'invalid_arguments' : message.error.code === -32601 ? 'unknown_tool' : 'invalid_request' } : securityOutcome(message.result);
-                if (state.event.mutating && !req.auth.scopes.includes('mcp:control'))
-                    outcome = { status: 'rejected', errorCode: 'permission_denied' };
-                try {
-                    await finish(state, outcome);
-                }
-                catch {
-                    await finish(state, { status: 'unknown', errorCode: 'outcome_unknown' }).catch(() => { });
-                    await send({ jsonrpc: '2.0', id: message.id, error: { code: -32603, message: 'Operation outcome is unknown because final audit storage failed', data: { code: 'outcome_unknown', outcomeUnknown: true } } }, options);
-                    return;
-                }
-            }
-            await send(message, options);
-        };
-        res.on("close", () => {
-            void server.close();
-        });
-        try {
-            await server.connect(transport);
-            await actions.run(state.action, () => transport.handleRequest(req, res, req.body));
-            if (!state.finished && res.statusCode >= 400)
-                await finish(state, { status: 'rejected', errorCode: 'invalid_request' });
-            else if (!state.finished && req.body?.id === undefined)
-                await finish(state, { status: 'succeeded', errorCode: null });
-        }
-        catch {
-            if (!state.finished)
-                await finish(state, { status: state.dispatched && state.event.mutating ? 'unknown' : 'failed', errorCode: state.dispatched && state.event.mutating ? 'outcome_unknown' : 'internal_error' }).catch(() => { });
-            if (!res.headersSent)
-                res.status(500).json({ error: "MCP request failed" });
-        }
-    });
-    app.all("/mcp", async (_req, res) => {
-        const state = states.get(_req);
-        if (state)
-            await finish(state, { status: 'rejected', errorCode: 'invalid_request' }).catch(() => { });
-        res.setHeader("Allow", "POST, OPTIONS");
-        res.status(405).end();
-    });
-    app.use(async (error, _req, res, _next) => {
-        const status = typeof error === "object" &&
-            error !== null &&
-            "status" in error &&
-            error.status === 413
-            ? 413
-            : 400;
-        if (_req.auth) {
-            try {
-                const state = states.get(_req) ?? await admission(_req, res);
-                await finish(state, { status: 'rejected', errorCode: 'invalid_request' });
-            }
-            catch {
-                res.status(503).json({ error: 'Security audit storage is unavailable' });
-                return;
-            }
-        }
-        res.status(status).json({ error: "Invalid request" });
-    });
-    return app;
-}
-//# sourceMappingURL=http.js.map

package/dist/mcp/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,aAAa,EACb,mBAAmB,GACpB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACnG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAsB,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAsB,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAwD,MAAM,sBAAsB,CAAC;AAGjM,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;IACZ,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACnD,CAAC,EAAE,sDAAsD,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,WAAW;IACrB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM;QAClE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;QACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;AACT,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,QAA4B,EAC5B,KAAkB,EAClB,KAAoD;IAEpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,KAAK,CACzB,MAAM,CAAC,KAAK,EACZ,KAAK;QACH,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC3F,CAAC,CAAC,SAAS,CACd,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAoB,CAAC;IAE1D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAiC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,OAAwB,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAyB,EAAE;QAC7F,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,6DAA6D,CAAC,CAAC;QAC7I,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAK,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;YAC/E,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY;gBACrG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;oBACrH,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAK,CAAC,KAAM,CAAC,QAAoB,CAAC;QACtD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAK,CAAC,KAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACpK,MAAM,KAAK,GAAkB;YAC3B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;YAC7F,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzG,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,IAAK,CAAC,KAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;YAC1H,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC7H,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI;YACzF,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;SACzE,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5N,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,yFAAyF;IACzF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IACE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAChC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,EAC5C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,mBAAmB,CAAC;gBACrB,QAAQ;gBACR,SAAS,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;gBACpC,eAAe,EAAE,UAAU;aAC5B,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,0CAA0C,EAAE,CAAC,MAAM,CAAC;YACpD,8CAA8C,EAAE,IAAI;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL;QACE,2CAA2C;QAC3C,uCAAuC;KACxC,EACD,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACZ,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,qBAAqB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;YACzC,gBAAgB,EAAE,UAAU;YAC5B,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CACL,aAAa,CAAC;QACZ,QAAQ;QACR,SAAS,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;QACpC,iBAAiB,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,eAAe,EAAE,UAAU;QAC3B,YAAY,EAAE,mBAAmB;KAClC,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CACL,UAAU,EACV,SAAS,CAAC;QACR,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;KACrB,CAAC,EACF,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CACjC,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;gBACjC,GAAG,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;iBACzD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;gBACtE,GAAG,CAAC,IAAI,CAAC;oBACP,QAAQ,EAAE,MAAM,QAAQ,CAAC,OAAO,CAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,EAClB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAC7B;iBACF,CAAC,CAAC;;gBACA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IACE,MAAM;YACN,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC7D,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,kFAAkF,CACnF,CAAC;QACF,GAAG,CAAC,SAAS,CACX,+BAA+B,EAC/B,wDAAwD,CACzD,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,MAAM,EACN,iBAAiB,CAAC;QAChB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,CAAC,UAAU,CAAC;QAC5B,mBAAmB,EAAE,IAAI,GAAG,CAC1B,2CAA2C,EAC3C,MAAM,CAAC,SAAS,CACjB,CAAC,IAAI;KACP,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAC1C,MAAM,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC,CAAC;QAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,MAAM,EACN,SAAS,CAAC;QACR,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,GAAG;QACV,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;QACvD,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;QACxM,CAAC;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7F,MAAM,QAAQ,CAAC,IAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAAC,OAAO;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAK,CAAC,KAAM,CAAC,QAAoB,CAAC;QACtD,MAAM,KAAK,GAAsC;YAC/C,MAAM,EAAE;gBACN,GAAG,MAAM,CAAC,KAAK;gBACf,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACtE;YACD,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE;gBACvB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,UAAU,CACZ,WAAW,EACX,0CAA0C,CAC3C,CACF,CAAC;gBACJ,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxB,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;wBAC5G,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC;wBAClE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAqB,CAAA,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;4BAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC;oBACxM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE;YACpC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YACnD,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAK,CAAC,KAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC,EAAE;YAClH,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC7B,IAAI,OAAO,CAAC;gBACZ,IAAI,CAAC;oBAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;gBACpE,MAAM,CAAC;oBAAC,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,mDAAmD,CAAC,CAAC;gBAAC,CAAC;gBACjG,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE,QAAoB,CAAC;gBACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,gDAAgD,CAAC,CAAC;YACrJ,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;gBAClC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAkB;oBAC3B,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;oBAC7H,QAAQ,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;oBAClG,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBACtH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;iBACzE,CAAC;gBACF,MAAM,KAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACjI,IAAI,OAAwB,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBAC9C,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;oBAClC,MAAM,KAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBACpC,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;oBACnC,MAAM,KAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzM,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,oGAAoG;QACpG,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,wEAAwE;YACxE,gFAAgF;YAChF,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,gBAAgB,CAAC;SACxG,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,SAAS,CAAC,IAAI,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;YAC1C,IAAI,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;gBAClG,IAAI,OAAO,GAAoB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClP,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAAE,OAAO,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;gBACxI,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAAC,CAAC;gBACrC,MAAM,CAAC;oBACL,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACzF,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iEAAiE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;oBACtN,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;iBACnH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClO,IAAI,CAAC,GAAG,CAAC,WAAW;gBAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,KAAK,EACH,KAAc,EACd,IAAqB,EACrB,GAAqB,EACrB,KAA2B,EAC3B,EAAE;QACF,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,QAAQ,IAAI,KAAK;YACjB,KAAK,CAAC,MAAM,KAAK,GAAG;YAClB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC;QACV,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7D,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;QAC/F,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxD,CAAC,CACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mcp/legacy-relay.d.ts

@@ -1,3 +0,0 @@
-import { type BridgeRequest } from "./fleet.js";
-/** Kept only to fail explicitly for callers of the removed plaintext helper. */
-export declare function legacyRelayCommand(_machineId: string, _request: BridgeRequest, _deadline: number): never;

package/dist/mcp/legacy-relay.js

@@ -1,6 +0,0 @@
-import { FleetError } from "./fleet.js";
-/** Kept only to fail explicitly for callers of the removed plaintext helper. */
-export function legacyRelayCommand(_machineId, _request, _deadline) {
-    throw new FleetError("upgrade_required", "Plaintext legacy MCP execution is no longer supported; approve an encrypted endpoint");
-}
-//# sourceMappingURL=legacy-relay.js.map

package/dist/mcp/legacy-relay.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacy-relay.js","sourceRoot":"","sources":["../../src/mcp/legacy-relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,YAAY,CAAC;AAE5D,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAuB,EAAE,SAAiB;IAC/F,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sFAAsF,CAAC,CAAC;AACnI,CAAC"}

package/dist/mcp/mcp-key-store.d.ts

@@ -1,52 +0,0 @@
-import type { Pool } from 'pg';
-import { importEndpoint } from '../security/crypto.js';
-import type { ApprovedBridge, McpConsentSecurity, McpKeyEncryptionConfig } from '../security/protocol.js';
-export interface McpGrantIdentity {
-    ownerId: string;
-    requestId: string;
-    grantId: string;
-    identity: Awaited<ReturnType<typeof importEndpoint>>;
-    bridges: ApprovedBridge[];
-    permissions: ('read' | 'control')[];
-    pendingExpiresAt: string;
-    activeExpiresAt: string;
-    state: 'pending' | 'approved' | 'active' | 'revoked';
-}
-export interface McpIdentityStore {
-    ensurePendingIdentity(requestId: string, ownerId: string, permissions: ('read' | 'control')[]): Promise<McpConsentSecurity>;
-    loadByRequest(ownerId: string, requestId: string): Promise<McpGrantIdentity>;
-    loadGrantIdentity(ownerId: string, grantId: string): Promise<McpGrantIdentity>;
-    approve(ownerId: string, requestId: string, bridges: ApprovedBridge[]): Promise<McpGrantIdentity>;
-    markActive(ownerId: string, requestId: string): Promise<void>;
-    revoke(ownerId: string, requestId: string): Promise<void>;
-}
-/** All columns used as context are authenticated, including lookup and expiry metadata. */
-export interface EncryptedMcpIdentity {
-    version: 1;
-    ownerId: string;
-    requestId: string;
-    grantId: string;
-    endpointId: string;
-    expiresAt: string;
-    keyId: string;
-    nonce: string;
-    ciphertext: string;
-}
-export declare function encryptMcpIdentity(identity: McpGrantIdentity, privateKey: JsonWebKey, config: McpKeyEncryptionConfig): Promise<EncryptedMcpIdentity>;
-export declare function decryptMcpIdentity(row: EncryptedMcpIdentity, config: McpKeyEncryptionConfig): Promise<McpGrantIdentity>;
-/** Uses the gateway's existing pool; no second connection-string/secret source. */
-export declare class McpKeyStore implements McpIdentityStore {
-    readonly pool: Pool;
-    private readonly now;
-    private readonly config;
-    constructor(pool: Pool, config: McpKeyEncryptionConfig, now?: () => number);
-    checkSchema(): Promise<void>;
-    ensurePendingIdentity(requestId: string, ownerId: string, permissions: ('read' | 'control')[]): Promise<McpConsentSecurity>;
-    loadByRequest(ownerId: string, requestId: string): Promise<McpGrantIdentity>;
-    loadGrantIdentity(ownerId: string, grantId: string): Promise<McpGrantIdentity>;
-    /** Caller must verify exact bridge Auth receipts before supplying these pins. */
-    approve(ownerId: string, requestId: string, bridges: ApprovedBridge[]): Promise<McpGrantIdentity>;
-    markActive(ownerId: string, requestId: string): Promise<void>;
-    revoke(ownerId: string, requestId: string): Promise<void>;
-    private update;
-}