ftown 0.20.6 → 0.20.8

package/dist/mcp/oauth.js

@@ -1,311 +0,0 @@
-import { legacyDateTimeSchema } from '../zod-compat.js';
-import { createHash, randomBytes } from "node:crypto";
-import jwt from "jsonwebtoken";
-import { InvalidGrantError, InvalidTokenError, InvalidRequestError, InvalidScopeError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-import { z } from 'zod';
-import { open, parseSecureEnvelope } from '../security/crypto.js';
-const secretToken = () => randomBytes(32).toString("base64url");
-const hash = (s) => createHash("sha256").update(s).digest("hex");
-const now = () => Math.floor(Date.now() / 1000);
-export const MCP_SCOPES = ["mcp:read", "mcp:control"];
-export class FtownOAuthProvider {
-    store;
-    options;
-    keys;
-    resource;
-    constructor(store, options, keys) {
-        this.store = store;
-        this.options = options;
-        this.keys = keys;
-        this.resource = new URL("/mcp", options.publicUrl).href;
-    }
-    currentMachines(subject) {
-        return (this.options.access.find((a) => a.subject === subject)?.machines ?? []);
-    }
-    clientsStore = {
-        getClient: (id) => this.store.transaction((tx) => tx.get("client", id)),
-        registerClient: async (input) => {
-            // Public clients only: PKCE is mandatory; never persist an unneeded client secret.
-            if (input.token_endpoint_auth_method &&
-                input.token_endpoint_auth_method !== "none")
-                throw new InvalidRequestError("Only public PKCE clients are supported");
-            if (input.redirect_uris.length > 10 ||
-                input.redirect_uris.some((uri) => {
-                    const u = new URL(uri);
-                    return (!!(u.hash || u.username || u.password) ||
-                        !(u.protocol === "https:" ||
-                            (u.protocol === "http:" &&
-                                ["127.0.0.1", "[::1]", "localhost"].includes(u.hostname))));
-                }))
-                throw new InvalidRequestError("Redirect URIs require HTTPS or loopback HTTP");
-            const client = {
-                client_id: secretToken(),
-                client_id_issued_at: now(),
-                client_name: input.client_name?.slice(0, 200),
-                redirect_uris: input.redirect_uris,
-                token_endpoint_auth_method: "none",
-                grant_types: ["authorization_code", "refresh_token"],
-                response_types: ["code"],
-            };
-            await this.store.transaction((tx) => tx.put("client", client.client_id, client, now() + 365 * 86400));
-            return client;
-        },
-    };
-    async authorize(client, params, res) {
-        if (params.resource?.href !== this.resource)
-            throw new InvalidRequestError("resource must identify this MCP endpoint");
-        if (!/^[A-Za-z0-9_-]{43}$/.test(params.codeChallenge))
-            throw new InvalidRequestError("S256 PKCE challenge required");
-        const scopes = params.scopes?.length
-            ? [...new Set(params.scopes)]
-            : ["mcp:read"];
-        if (!scopes.includes("mcp:read") ||
-            scopes.some((s) => !MCP_SCOPES.includes(s)))
-            throw new InvalidScopeError("Supported scopes: mcp:read and mcp:control");
-        const id = secretToken();
-        const pending = {
-            clientId: client.client_id,
-            clientName: client.client_name ?? client.client_id,
-            redirectUri: params.redirectUri,
-            challenge: params.codeChallenge,
-            state: params.state,
-            scopes,
-            resource: this.resource,
-            expiresAt: now() + 600,
-        };
-        await this.store.transaction((tx) => tx.put("pending", id, pending, now() + 600));
-        const consent = new URL("/mcp/consent", this.options.loginUrl);
-        consent.searchParams.set("request", id);
-        res.redirect(consent.href);
-    }
-    assertion(token, purpose) {
-        const value = jwt.verify(token, this.options.approvalSecret, {
-            algorithms: ["HS256"],
-            audience: this.options.publicUrl,
-            issuer: this.options.loginUrl,
-            maxAge: "60s",
-        });
-        if (typeof value === "string" ||
-            typeof value.sub !== "string" ||
-            typeof value.request !== "string" ||
-            value.purpose !== purpose)
-            throw new InvalidRequestError("Invalid approval assertion");
-        return value;
-    }
-    async consentDetails(assertion) {
-        const claims = this.assertion(assertion, "inspect");
-        const { pending, owned } = await this.store.transaction(async (tx) => ({
-            pending: await tx.get("pending", claims.request),
-            owned: await tx.ownedMachines(claims.sub),
-        }));
-        if (!pending || pending.resource !== this.resource || !pending.expiresAt || (pending.subject && pending.subject !== claims.sub))
-            throw new InvalidRequestError("Authorization request expired");
-        if (!this.keys)
-            throw new InvalidRequestError('Encrypted MCP identities must be configured');
-        const security = await this.keys.ensurePendingIdentity(claims.request, claims.sub, pending.scopes.includes('mcp:control') ? ['read', 'control'] : ['read']);
-        await this.store.transaction(async (tx) => {
-            const current = await tx.get('pending', claims.request);
-            if (!current || (current.subject && current.subject !== claims.sub))
-                throw new InvalidRequestError('Authorization request expired');
-            await tx.put('pending', claims.request, { ...current, subject: claims.sub, grantId: security.grantId }, current.expiresAt);
-        });
-        return {
-            clientName: pending.clientName,
-            redirectUri: pending.redirectUri,
-            scopes: pending.scopes,
-            machines: this.currentMachines(claims.sub).filter((m) => owned.includes(m)),
-            security,
-        };
-    }
-    async approve(assertion, deny = false) {
-        const claims = this.assertion(assertion, deny ? "deny" : "approve");
-        // Never hold an OAuth pool connection while the key store acquires another.
-        const { pending, owned } = await this.store.transaction(async (tx) => ({
-            pending: await tx.get('pending', claims.request),
-            owned: deny ? [] : await tx.ownedMachines(claims.sub),
-        }));
-        if (!pending || pending.resource !== this.resource)
-            throw new InvalidRequestError('Authorization request expired or already handled');
-        const redirect = new URL(pending.redirectUri);
-        if (pending.state !== undefined)
-            redirect.searchParams.set('state', pending.state);
-        redirect.searchParams.set('iss', this.options.publicUrl);
-        if (deny) {
-            await this.store.transaction(async (tx) => {
-                if (!await tx.take('pending', claims.request))
-                    throw new InvalidRequestError('Authorization request expired or already handled');
-            });
-            redirect.searchParams.set('error', 'access_denied');
-            return redirect.href;
-        }
-        if (!this.keys || pending.subject !== claims.sub || !pending.grantId)
-            throw new InvalidRequestError('Inspect and approve the encrypted endpoint before continuing');
-        const machines = claims.machines;
-        const allowed = this.currentMachines(claims.sub).filter(machine => owned.includes(machine));
-        if (!Array.isArray(machines) || !machines.length || machines.some(machine => typeof machine !== 'string' || !allowed.includes(machine)))
-            throw new InvalidRequestError('No authorized machines selected');
-        const selected = [...new Set(machines)];
-        if (selected.length > 64)
-            throw new InvalidRequestError('Select at most 64 computers');
-        const identity = await this.keys.loadByRequest(claims.sub, claims.request);
-        if (identity.grantId !== pending.grantId || identity.state !== 'pending' || Date.parse(identity.pendingExpiresAt) <= Date.now())
-            throw new InvalidRequestError('Encrypted endpoint approval expired');
-        const pins = await this.approvalPins(claims.approvals, selected, identity);
-        // The row-locked transition permits one winner. If code persistence fails,
-        // the orphan approval has no usable OAuth token and fresh consent is required.
-        await this.keys.approve(claims.sub, claims.request, pins);
-        const code = secretToken();
-        await this.store.transaction(async (tx) => {
-            const current = await tx.take('pending', claims.request);
-            if (!current || current.subject !== claims.sub || current.grantId !== identity.grantId || JSON.stringify(current) !== JSON.stringify(pending))
-                throw new InvalidRequestError('Authorization request expired or already handled');
-            const currentOwned = await tx.ownedMachines(claims.sub);
-            if (selected.some(machine => !currentOwned.includes(machine) || !this.currentMachines(claims.sub).includes(machine)))
-                throw new InvalidRequestError('Machine access revoked');
-            await tx.put('code', hash(code), { ...current, subject: claims.sub, machines: selected, grantId: identity.grantId, activeExpiresAt: identity.activeExpiresAt }, now() + 120);
-        });
-        redirect.searchParams.set('code', code);
-        return redirect.href;
-    }
-    async approvalPins(value, machines, identity) {
-        const endpoint = z.object({ version: z.literal(1), id: z.string().regex(/^[A-Za-z0-9_-]{43}$/), ownerId: z.string().guid(), kind: z.literal('bridge'), publicKey: z.string().regex(/^[A-Za-z0-9_-]{87}$/) }).strict();
-        const approvals = z.array(z.object({ bridgeId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/), bridge: endpoint, receipt: z.unknown().optional() }).strict()).min(1).max(64).safeParse(value);
-        if (!approvals.success || approvals.data.length !== machines.length || new Set(approvals.data.map(approval => approval.bridgeId)).size !== machines.length)
-            throw new InvalidRequestError('Every selected bridge must return encrypted approval');
-        const pins = [];
-        for (const approval of approvals.data) {
-            if (!machines.includes(approval.bridgeId) || approval.bridge.ownerId !== identity.ownerId)
-                throw new InvalidRequestError('Bridge approval does not match this account');
-            let receipt;
-            try {
-                const envelope = parseSecureEnvelope(approval.receipt);
-                receipt = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(await open(identity.identity, approval.bridge, envelope, { ownerId: identity.ownerId, bridgeId: approval.bridgeId, channel: `mcp-approval:${approval.bridgeId}:${identity.requestId}`, recipientId: identity.identity.endpoint.id, purpose: 'mcp-approval' })));
-            }
-            catch {
-                throw new InvalidRequestError('Bridge encrypted approval could not be verified');
-            }
-            const parsed = z.object({ type: z.literal('mcp-approval'), approvalId: z.string().min(1).max(200), requestId: z.literal(identity.requestId), ownerId: z.literal(identity.ownerId), grantId: z.literal(identity.grantId), candidateEndpointId: z.literal(identity.identity.endpoint.id), bridgeId: z.literal(approval.bridgeId), bridge: endpoint, permissions: z.array(z.enum(['read', 'control'])).min(1).max(2), expiresAt: legacyDateTimeSchema, activeExpiresAt: z.literal(identity.activeExpiresAt) }).strict().safeParse(receipt);
-            if (!parsed.success || parsed.data.bridge.id !== approval.bridge.id || parsed.data.bridge.publicKey !== approval.bridge.publicKey
-                || [...parsed.data.permissions].sort().join(' ') !== [...identity.permissions].sort().join(' ')
-                || Date.parse(parsed.data.expiresAt) <= Date.now() || Date.parse(parsed.data.expiresAt) > Date.parse(identity.pendingExpiresAt))
-                throw new InvalidRequestError('Bridge approval does not match this consent');
-            pins.push({ bridgeId: approval.bridgeId, endpoint: approval.bridge, permissions: parsed.data.permissions });
-        }
-        return pins;
-    }
-    async challengeForAuthorizationCode(client, code) {
-        const record = await this.store.transaction((tx) => tx.get("code", hash(code)));
-        if (!record || record.clientId !== client.client_id)
-            throw new InvalidGrantError("Invalid authorization code");
-        return record.challenge;
-    }
-    async tokens(tx, grantId, grant, scopes) {
-        const access = secretToken(), refresh = secretToken();
-        await tx.put("access", hash(access), { grantId, clientId: grant.clientId, expiresAt: now() + 900, scopes }, now() + 900);
-        await tx.put("refresh", hash(refresh), { grantId, clientId: grant.clientId, expiresAt: grant.expiresAt, scopes }, grant.expiresAt);
-        return {
-            access_token: access,
-            token_type: "Bearer",
-            expires_in: 900,
-            refresh_token: refresh,
-            scope: scopes.join(" "),
-        };
-    }
-    async exchangeAuthorizationCode(client, code, _verifier, redirectUri, resource) {
-        const prepared = await this.store.transaction(tx => tx.get('code', hash(code)));
-        if (!prepared || prepared.clientId !== client.client_id || prepared.redirectUri !== redirectUri || prepared.resource !== this.resource || resource?.href !== this.resource)
-            throw new InvalidGrantError('Invalid code, redirect URI or resource');
-        if (!this.keys || !prepared.grantId || !prepared.activeExpiresAt)
-            throw new InvalidGrantError('Renew consent to authorize an encrypted endpoint');
-        const identity = await this.keys.loadGrantIdentity(prepared.subject, prepared.grantId);
-        if (identity.state !== 'approved' || identity.activeExpiresAt !== prepared.activeExpiresAt)
-            throw new InvalidGrantError('Encrypted endpoint consent is unavailable');
-        return this.store.transaction(async (tx) => {
-            const record = await tx.take('code', hash(code));
-            if (!record || JSON.stringify(record) !== JSON.stringify(prepared))
-                throw new InvalidGrantError('Invalid or already used authorization code');
-            const grantId = record.grantId;
-            const grant = {
-                resource: this.resource,
-                subject: record.subject,
-                machines: record.machines,
-                scopes: record.scopes,
-                clientId: client.client_id,
-                expiresAt: Math.floor(Date.parse(record.activeExpiresAt) / 1000),
-                revoked: false,
-            };
-            await tx.put("grant", grantId, grant, grant.expiresAt);
-            return this.tokens(tx, grantId, grant, grant.scopes);
-        });
-    }
-    async exchangeRefreshToken(client, token, scopes, resource) {
-        if (resource?.href !== this.resource)
-            throw new InvalidGrantError("Wrong resource");
-        const result = await this.store.transaction(async (tx) => {
-            const record = await tx.get("refresh", hash(token));
-            if (!record || record.clientId !== client.client_id)
-                throw new InvalidGrantError("Invalid refresh token");
-            await tx.lock(record.grantId);
-            const current = await tx.get("refresh", hash(token));
-            const grant = await tx.get("grant", record.grantId);
-            if (!grant || grant.revoked || grant.resource !== this.resource)
-                throw new InvalidGrantError("Grant revoked or expired");
-            if (current?.used) {
-                await tx.put("grant", record.grantId, { ...grant, revoked: true }, grant.expiresAt);
-                return null; // Commit replay revocation before returning the error.
-            }
-            const requested = scopes ?? record.scopes;
-            if (!requested.includes("mcp:read") ||
-                requested.some((s) => !record.scopes.includes(s)))
-                throw new InvalidScopeError("Refresh cannot expand scope");
-            await tx.put("refresh", hash(token), { ...record, used: true }, record.expiresAt);
-            return this.tokens(tx, record.grantId, grant, requested);
-        });
-        if (!result)
-            throw new InvalidGrantError("Refresh token reused; authorization revoked");
-        return result;
-    }
-    async verifyAccessToken(token) {
-        const result = await this.store.transaction(async (tx) => {
-            const record = await tx.get("access", hash(token));
-            const grant = record && (await tx.get("grant", record.grantId));
-            if (!record || !grant || grant.revoked || grant.resource !== this.resource)
-                throw new InvalidTokenError("Invalid, expired or revoked access token");
-            const owned = await tx.ownedMachines(grant.subject);
-            const machines = grant.machines.filter((m) => this.currentMachines(grant.subject).includes(m) && owned.includes(m));
-            if (!machines.length)
-                throw new InvalidTokenError("Machine access revoked");
-            return {
-                token,
-                clientId: record.clientId,
-                scopes: record.scopes,
-                expiresAt: record.expiresAt,
-                resource: new URL(this.resource),
-                extra: { subject: grant.subject, machines, grantId: record.grantId },
-            };
-        });
-        if (!this.keys)
-            throw new InvalidTokenError('Renew consent to authorize an encrypted endpoint');
-        let identity;
-        try {
-            identity = await this.keys.loadGrantIdentity(result.extra.subject, result.extra.grantId);
-        }
-        catch {
-            throw new InvalidTokenError('Encrypted endpoint approval expired or requires renewed consent');
-        }
-        return { ...result, extra: { ...result.extra, endpointId: identity.identity.endpoint.id } };
-    }
-    async revokeToken(client, request) {
-        await this.store.transaction(async (tx) => {
-            const record = (await tx.get("access", hash(request.token))) ??
-                (await tx.get("refresh", hash(request.token)));
-            if (!record || record.clientId !== client.client_id)
-                return;
-            await tx.lock(record.grantId);
-            const grant = await tx.get("grant", record.grantId);
-            if (grant && grant.resource === this.resource)
-                await tx.put("grant", record.grantId, { ...grant, revoked: true }, grant.expiresAt);
-        });
-    }
-}
-//# sourceMappingURL=oauth.js.map

package/dist/mcp/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,GAAG,MAAM,cAAc,CAAC;AAW/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIlE,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAyCtD,MAAM,OAAO,kBAAkB;IAGlB;IACA;IACA;IAJF,QAAQ,CAAS;IAC1B,YACW,KAAiB,EACjB,OAAqB,EACrB,IAAuB;QAFvB,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAc;QACrB,SAAI,GAAJ,IAAI,CAAmB;QAEhC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC;IACQ,YAAY,GAAG;QACtB,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CACxB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,EAAE,CAAC,GAAG,CAA6B,QAAQ,EAAE,EAAE,CAAC,CACjD;QACH,cAAc,EAAE,KAAK,EACnB,KAGC,EACoC,EAAE;YACvC,mFAAmF;YACnF,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,KAAK,MAAM;gBAE3C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E,IACE,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;gBAC/B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,OAAO,CACL,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;wBACtC,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;4BACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;gCACrB,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,CACF,CAAC;gBACJ,CAAC,CAAC;gBAEF,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;YACJ,MAAM,MAAM,GAA+B;gBACzC,SAAS,EAAE,WAAW,EAAE;gBACxB,mBAAmB,EAAE,GAAG,EAAE;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7C,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,CAChE,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YACzC,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM;YAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3C,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAY;YACvB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS;YAClD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG;SACvB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,OAAuC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAC3D,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC7B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,KAAK,OAAO;YAEzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC;YAC7H,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAI,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7J,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;YACpI,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAI,GAAG,KAAK;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,4EAA4E;QAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SACvD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;QACtI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;YAC5I,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpD,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,8DAA8D,CAAC,CAAC;QACpK,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;QAC1M,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAa,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;QACtM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;YACjO,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YAC/K,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAiB,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;QAC/L,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,QAAkB,EAAE,QAAgE;QAC7H,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACtN,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1L,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;QAClP,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;YACxK,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACvD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;YACxU,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;YAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxgB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,CAAC,SAAS;mBAC5H,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;mBAC5F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;YAChN,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YACjD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACO,KAAK,CAAC,MAAM,CAClB,EAAoB,EACpB,OAAe,EACf,KAAY,EACZ,MAAgB;QAEhB,MAAM,MAAM,GAAG,WAAW,EAAE,EAC1B,OAAO,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,EACZ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EACrE,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;QACF,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,EACb,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EACzE,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,IAAY,EACZ,SAAkB,EAClB,WAAoB,EACpB,QAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;QAClP,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,CAAC,CAAC;QACrK,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;YAC9I,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,MAAM,KAAK,GAAU;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBAChE,OAAO,EAAE,KAAK;aACf,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,KAAa,EACb,MAAiB,EACjB,QAAc;QAEd,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAClC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACjD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC7D,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,uDAAuD;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;YAC1C,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEjD,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,EACX,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EACzB,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACxE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAClB,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAChG,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,CAAC;YAAC,MAAM,IAAI,iBAAiB,CAAC,iEAAiE,CAAC,CAAC;QAAC,CAAC;QACzG,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAC9F,CAAC;IACD,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACxC,MAAM,MAAM,GACV,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC5D,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3C,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/mcp/relay-handler.d.ts

@@ -1,2 +0,0 @@
-/** Legacy plaintext relay has no execution capability. Native ciphertext uses the verified dispatcher. */
-export declare function createRelayHandler(_port: number, _token: string): (_id: string, _payload: Record<string, unknown>) => Promise<never>;

package/dist/mcp/relay-handler.js

@@ -1,8 +0,0 @@
-import { FleetError } from './fleet.js';
-/** Legacy plaintext relay has no execution capability. Native ciphertext uses the verified dispatcher. */
-export function createRelayHandler(_port, _token) {
-    return async (_id, _payload) => {
-        throw new FleetError('upgrade_required', 'Encrypted endpoint approval is required');
-    };
-}
-//# sourceMappingURL=relay-handler.js.map

package/dist/mcp/relay-handler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"relay-handler.js","sourceRoot":"","sources":["../../src/mcp/relay-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc;IAC9D,OAAO,KAAK,EAAE,GAAW,EAAE,QAAiC,EAAkB,EAAE;QAC9E,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yCAAyC,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp/relay.d.ts

@@ -1,13 +0,0 @@
-import { type BridgeRequest } from "./fleet.js";
-import { type McpRequestContext } from "./secure-client.js";
-/** Renewable routing connections carry ciphertext only; identities stay request-bound. */
-export declare class FleetRelay {
-    private url;
-    private tokenSecret;
-    private clients;
-    constructor(url: string, tokenSecret: string);
-    private connection;
-    request(userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal, context?: McpRequestContext): Promise<unknown>;
-    private exchange;
-    close(): void;
-}

package/dist/mcp/relay.js

@@ -1,95 +0,0 @@
-import { Centrifuge } from "centrifuge";
-import WebSocket from "ws";
-import jwt from "jsonwebtoken";
-import { FleetError, requestSchema } from "./fleet.js";
-import { parseSecureEnvelope } from "../security/crypto.js";
-import { SecureMcpClient } from "./secure-client.js";
-/** Renewable routing connections carry ciphertext only; identities stay request-bound. */
-export class FleetRelay {
-    url;
-    tokenSecret;
-    clients = new Map();
-    constructor(url, tokenSecret) {
-        this.url = url;
-        this.tokenSecret = tokenSecret;
-    }
-    connection(userId) {
-        const cached = this.clients.get(userId);
-        if (cached)
-            return cached;
-        const mint = () => jwt.sign({}, this.tokenSecret, { subject: userId, audience: "ftown:centrifugo", expiresIn: "10m" });
-        const client = new Centrifuge(this.url, { websocket: WebSocket, token: mint(), getToken: async () => mint(), timeout: 10000 });
-        const sub = client.newSubscription(`commands:rpc#${userId}`);
-        const pending = new Map();
-        sub.on("publication", ctx => {
-            if (ctx.info?.user !== userId)
-                return;
-            try {
-                const packet = parseSecureEnvelope(ctx.data);
-                pending.get(packet.messageId)?.accept(packet);
-            }
-            catch { /* Plaintext/unknown/oversized traffic never enters the application. */ }
-        });
-        sub.subscribe();
-        client.connect();
-        const entry = { client, sub, pending };
-        this.clients.set(userId, entry);
-        return entry;
-    }
-    async request(userId, machineId, request, signal, context) {
-        if (!context)
-            throw new FleetError("approval_required", "An encrypted MCP grant is required");
-        const client = new SecureMcpClient(context, machineId, `commands:rpc#${userId}`, (packet, deadline, mutating, abort) => this.exchange(userId, packet, deadline, mutating, abort));
-        return client.request(requestSchema.parse(request), signal);
-    }
-    async exchange(userId, packet, deadline, mutating, signal) {
-        if (Date.now() >= deadline)
-            throw new FleetError("timeout", "Encrypted request expired before publication");
-        if (signal?.aborted)
-            throw new FleetError("cancelled", "Encrypted request cancelled");
-        const { sub, pending } = this.connection(userId);
-        const id = packet.messageId;
-        return new Promise((resolve, reject) => {
-            let sent = false, settled = false;
-            const finish = (error, value) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                pending.delete(id);
-                signal?.removeEventListener("abort", cancel);
-                if (error)
-                    reject(error);
-                else if (value)
-                    resolve(value);
-            };
-            const cancel = () => finish(new FleetError("cancelled", "Encrypted relay request cancelled", sent && mutating));
-            const timer = setTimeout(() => finish(new FleetError("timeout", "Encrypted bridge did not respond before the deadline", sent && mutating)), Math.max(1, deadline - Date.now()));
-            signal?.addEventListener("abort", cancel, { once: true });
-            if (signal?.aborted) {
-                cancel();
-                return;
-            }
-            pending.set(id, { accept: value => {
-                    // Other concurrent gateways/endpoints can publish the same visible ID; only accept the exact route here.
-                    if (value.senderId === packet.recipientId && value.recipientId === packet.senderId && value.ownerId === packet.ownerId && value.bridgeId === packet.bridgeId && value.channel === packet.channel)
-                        finish(undefined, value);
-                }, reject: () => finish(new FleetError("connection_error", "Encrypted relay is closing", sent && mutating)) });
-            void sub.ready(Math.max(1, deadline - Date.now())).then(async () => {
-                if (settled)
-                    return;
-                sent = true;
-                await sub.publish(packet);
-            }).catch(() => finish(new FleetError("connection_error", "Encrypted relay connection unavailable", sent && mutating)));
-        });
-    }
-    close() {
-        for (const entry of this.clients.values()) {
-            for (const pending of [...entry.pending.values()])
-                pending.reject();
-            entry.client.disconnect();
-        }
-        this.clients.clear();
-    }
-}
-//# sourceMappingURL=relay.js.map

package/dist/mcp/relay.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/mcp/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAE7E,0FAA0F;AAC1F,MAAM,OAAO,UAAU;IAED;IAAqB;IADjC,OAAO,GAAG,IAAI,GAAG,EAA6I,CAAC;IACvK,YAAoB,GAAW,EAAU,WAAmB;QAAxC,QAAG,GAAH,GAAG,CAAQ;QAAU,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IACxD,UAAU,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/H,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4E,CAAC;QACpG,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE;YAC1B,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;gBAAE,OAAO;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAC,uEAAuE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,EAAE,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAsB,EAAE,MAAoB,EAAE,OAA2B;QACxH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE,EAC7E,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACO,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,MAAsB,EAAE,QAAgB,EAAE,QAAiB,EAAE,MAAoB;QACtH,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAE,KAAsB,EAAE,EAAE;gBAC5D,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtG,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;qBAAM,IAAI,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC;YAChH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,sDAAsD,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChL,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;oBAChC,yGAAyG;oBACzG,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;wBAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7N,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/G,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACjE,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/mcp/secure-client.d.ts

@@ -1,23 +0,0 @@
-import type { McpActionContext, SecureEnvelope } from '../security/protocol.js';
-import type { McpGrantIdentity } from './mcp-key-store.js';
-import { type BridgeRequest } from './fleet.js';
-export interface McpRequestContext {
-    grant: McpGrantIdentity;
-    action: McpActionContext;
-    revalidate?: () => Promise<void>;
-}
-export type SecureExchange = (envelope: SecureEnvelope, deadline: number, mutating: boolean, signal?: AbortSignal) => Promise<SecureEnvelope>;
-/** Both endpoint adapters use the same semantic allowlist. */
-export declare function isMcpMutation(request: Pick<BridgeRequest, 'method' | 'path'>): boolean;
-/** An immutable grant-bound endpoint; no state is shared across callers or grants. */
-export declare class SecureMcpClient {
-    private context;
-    private bridgeId;
-    private channel;
-    private exchange;
-    constructor(context: McpRequestContext, bridgeId: string, channel: string, exchange: SecureExchange);
-    private pin;
-    private header;
-    private send;
-    request(request: BridgeRequest, signal?: AbortSignal): Promise<unknown>;
-}

package/dist/mcp/secure-client.js

@@ -1,124 +0,0 @@
-import { randomBytes, randomUUID } from 'node:crypto';
-import { z } from 'zod';
-import { seal, open, SecurityError } from '../security/crypto.js';
-import { FleetError } from './fleet.js';
-import { classifyHttp } from '../security/bridge/permissions.js';
-/** Both endpoint adapters use the same semantic allowlist. */
-export function isMcpMutation(request) {
-    try {
-        return classifyHttp(request.method, request.path).mutating;
-    }
-    catch {
-        throw new FleetError('permission_denied', 'MCP request is outside the bridge semantic allowlist');
-    }
-}
-const responseSchema = z.object({ type: z.literal('application'), route: z.object({ kind: z.literal('response'), requestId: z.string() }).strict(), data: z.unknown().optional(), mcp: z.unknown().nullable().optional() }).strict();
-const welcomeSchema = z.object({ type: z.literal('welcome'), challenge: z.string(), receiverEpoch: z.string().regex(/^[A-Za-z0-9_-]{1,128}$/) }).strict();
-function json(bytes) {
-    try {
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
-    }
-    catch {
-        throw new SecurityError('invalid_envelope', 'Bridge returned an invalid encrypted response');
-    }
-}
-function applicationJson(value, depth = 0) {
-    if (depth > 32)
-        throw new FleetError('invalid_request', 'MCP request nesting exceeds the encrypted transport limit');
-    if (value === null || typeof value === 'boolean' || typeof value === 'string')
-        return value;
-    if (typeof value === 'number' && Number.isFinite(value))
-        return value;
-    if (Array.isArray(value))
-        return value.map(item => applicationJson(item, depth + 1));
-    if (typeof value === 'object' && value !== null)
-        return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).map(([key, item]) => [key, applicationJson(item, depth + 1)]));
-    throw new FleetError('invalid_request', 'MCP request must contain JSON values');
-}
-/** An immutable grant-bound endpoint; no state is shared across callers or grants. */
-export class SecureMcpClient {
-    context;
-    bridgeId;
-    channel;
-    exchange;
-    constructor(context, bridgeId, channel, exchange) {
-        this.context = context;
-        this.bridgeId = bridgeId;
-        this.channel = channel;
-        this.exchange = exchange;
-    }
-    pin() {
-        const pin = this.context.grant.bridges.find(candidate => candidate.bridgeId === this.bridgeId);
-        if (!pin || pin.endpoint.ownerId !== this.context.grant.ownerId || !pin.permissions.includes('read'))
-            throw new FleetError('approval_required', 'Bridge encryption approval is required; configure machine.id as the actual bridgeId and use label for aliases');
-        if (Date.parse(this.context.grant.activeExpiresAt) <= Date.now())
-            throw new FleetError('expired', 'Bridge encryption approval has expired');
-        return pin;
-    }
-    header(id, purpose, epoch, deadline) {
-        return {
-            type: 'ftown_encrypted', version: 1, senderId: this.context.grant.identity.endpoint.id,
-            recipientId: this.pin().endpoint.id, ownerId: this.context.grant.ownerId, bridgeId: this.bridgeId,
-            channel: this.channel, purpose, messageId: id, createdAt: Date.now(), expiresAt: Math.min(deadline, Date.now() + 120_000), receiverEpoch: epoch,
-        };
-    }
-    async send(header, value, mutating, deadline, signal) {
-        if (signal?.aborted || Date.now() >= deadline)
-            throw new FleetError('cancelled', 'Encrypted request cancelled before dispatch');
-        const packet = await seal(this.context.grant.identity, this.pin().endpoint, header, new TextEncoder().encode(JSON.stringify(value)));
-        const reply = await this.exchange(packet, deadline, mutating, signal);
-        if (reply.messageId !== header.messageId)
-            throw new FleetError('bridge_error', 'Bridge response correlation failed', mutating);
-        const expected = { ownerId: this.context.grant.ownerId, bridgeId: this.bridgeId, channel: this.channel, recipientId: this.context.grant.identity.endpoint.id, purpose: header.purpose === 'hello' ? 'welcome' : 'application' };
-        try {
-            return json(await open(this.context.grant.identity, this.pin().endpoint, reply, expected));
-        }
-        catch {
-            throw new FleetError('authentication_failed', 'Bridge encrypted response authentication failed', mutating);
-        }
-    }
-    async request(request, signal) {
-        await this.context.revalidate?.();
-        const deadline = Date.now() + request.timeoutMs;
-        const pin = this.pin();
-        const mutating = isMcpMutation(request);
-        if (mutating && (!pin.permissions.includes('control') || !this.context.grant.permissions.includes('control')))
-            throw new FleetError('permission_denied', 'This MCP grant cannot control the bridge');
-        const challenge = randomBytes(32).toString('base64url');
-        const hello = await this.send(this.header(randomUUID(), 'hello', null, deadline), { type: 'hello', challenge }, false, deadline, signal);
-        const welcome = welcomeSchema.safeParse(hello);
-        if (!welcome.success || welcome.data.challenge !== challenge)
-            throw new FleetError('authentication_failed', 'Bridge encryption handshake failed');
-        const activationId = randomUUID();
-        const activation = {
-            type: 'application', route: { kind: 'command', command: 'security_activate_mcp', requestId: activationId, sessionId: null },
-            data: { type: 'security_activate_mcp', requestId: activationId, payload: { bridgeId: this.bridgeId, grantId: this.context.grant.grantId } }, mcp: this.context.action,
-        };
-        const activated = responseSchema.safeParse(await this.send(this.header(activationId, 'application', welcome.data.receiverEpoch, deadline), activation, false, deadline, signal));
-        if (!activated.success || activated.data.route.requestId !== activationId)
-            throw new FleetError('bridge_error', 'Bridge activation response is invalid');
-        const activationResponse = z.object({ type: z.literal('command_response'), response: z.object({ requestId: z.literal(activationId), success: z.boolean(), error: z.string().optional(), data: z.unknown().optional() }) }).safeParse(activated.data.data);
-        if (!activationResponse.success || !activationResponse.data.response.success)
-            throw new FleetError('approval_required', 'Bridge MCP approval could not be activated');
-        await this.context.revalidate?.();
-        const requestId = randomUUID();
-        const application = {
-            type: 'application', route: { kind: 'http', requestId, method: request.method, path: request.path },
-            data: applicationJson({ timeoutMs: Math.max(1000, deadline - Date.now()), ...(request.body === undefined ? {} : { body: request.body }) }), mcp: this.context.action,
-        };
-        const result = responseSchema.safeParse(await this.send(this.header(requestId, 'application', welcome.data.receiverEpoch, deadline), application, mutating, deadline, signal));
-        if (!result.success || result.data.route.requestId !== requestId)
-            throw new FleetError('bridge_error', 'Bridge response is invalid', mutating);
-        const http = z.object({ status: z.number().int().min(100).max(599), body: z.unknown().optional() }).strict().safeParse(result.data.data);
-        if (!http.success)
-            throw new FleetError('bridge_error', 'Bridge HTTP response is invalid', mutating);
-        if (http.data.status < 200 || http.data.status >= 300) {
-            const error = z.object({ code: z.string().optional(), outcomeUnknown: z.boolean().optional() }).passthrough().safeParse(http.data.body);
-            const allowed = ['unknown_session', 'invalid_cursor', 'unknown_attention', 'permission_denied', 'endpoint_revoked', 'upgrade_required', 'audit_unavailable', 'outcome_unknown'];
-            const code = error.success && error.data.code && allowed.includes(error.data.code) ? error.data.code : 'bridge_error';
-            throw new FleetError(code, 'Bridge rejected the encrypted request', mutating && (http.data.status >= 500 || (error.success && error.data.outcomeUnknown === true)), http.data.status);
-        }
-        return http.data.body;
-    }
-}
-//# sourceMappingURL=secure-client.js.map