godot-cli 0.16.2 → 0.17.0

package/dist/utils/connection.js

@@ -3,6 +3,7 @@ import * as path from 'path';
 import { verbose } from './ui.js';
 import * as ui from './ui.js';
 import { readCloudToken } from './credentials.js';
+import { readMachineAccessToken } from './machine-credentials.js';
 // --- Godot MCP connection constants (mirror addons/godot_mcp GodotMcpConfig). ---
 /** Default hosted cloud base URL (GodotMcpConfig.DefaultCloudBaseUrl). */
 export const DEFAULT_CLOUD_BASE_URL = 'https://ai-game.dev';
@@ -85,13 +86,10 @@ function isCloudMode() {
  * Token priority:
  *   1. --token flag (explicit override)
  *   2. GODOT_MCP_TOKEN env
- *   3. persisted cloud token from `.godot-mcp/credentials.json` (Cloud mode only,
- *      written by `godot-cli login`)
- *
- * Unlike the Unity CLI, there is NO deterministic project-path→port hash:
- * the Godot plugin is a server-less client whose live config lives in `user://`
- * (outside the project tree). The one project-local surface the CLI DOES own is
- * the `login`-written credentials file, consulted last so `--token`/env still win.
+ *   3. persisted cloud token (Cloud mode only) — the project-local
+ *      `.godot-mcp/credentials.json` (a `--project` login) first, then the shared machine
+ *      store `~/.ai-game-dev/credentials.json` (a default `godot-cli login`), so a
+ *      sign-once-per-machine credential is picked up here too.
  */
 export function resolveConnection(projectPath, options) {
     let url;
@@ -127,10 +125,10 @@ export function resolveConnection(projectPath, options) {
         verbose(`Using ${ENV_TOKEN}`);
     }
     else if (isCloudMode()) {
-        const persisted = readCloudToken(projectPath);
+        const persisted = readCloudToken(projectPath) ?? readMachineAccessToken();
         if (persisted) {
             token = persisted;
-            verbose('Using persisted cloud token from .godot-mcp/credentials.json');
+            verbose('Using persisted cloud token (project store, then machine store)');
         }
     }
     return { url, token };
@@ -155,7 +153,7 @@ export function resolveOpenAuthToken(projectPath, options) {
     }
     const selectedMode = options.mode ?? normalizeEnv(process.env[ENV_CONNECTION_MODE]);
     if (selectedMode !== undefined && selectedMode.toLowerCase() === 'cloud') {
-        return readCloudToken(projectPath);
+        return readCloudToken(projectPath) ?? readMachineAccessToken();
     }
     return undefined;
 }

package/dist/utils/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/utils/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,mFAAmF;AAEnF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,sBAAsB,GAAG,YAAY,EAAE,CAAC;AAExE,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,mFAAmF;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAQnD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAkC,EAAE,OAA0B;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7F,EAAE,CAAC,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,cAAkC,EAAE,OAA0B;IAC1G,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAE7D,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,OAA0B;IAE1B,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,CAAC,SAAS,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO,CAAC,SAAS,aAAa,UAAU,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,WAAW,EAAE,EAAE,CAAC;YACzB,GAAG,GAAG,sBAAsB,CAAC;YAC7B,OAAO,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,mBAAmB,CAAC;YAC1B,OAAO,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,SAAS,CAAC;YAClB,OAAO,CAAC,8DAA8D,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,OAA0C;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,iFAAiF;IACjF,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACzE,OAAO,cAAc,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/utils/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,mFAAmF;AAEnF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,sBAAsB,GAAG,YAAY,EAAE,CAAC;AAExE,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D,mFAAmF;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAQnD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAkC,EAAE,OAA0B;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7F,EAAE,CAAC,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,cAAkC,EAAE,OAA0B;IAC1G,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAE7D,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,OAA0B;IAE1B,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,CAAC,SAAS,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO,CAAC,SAAS,aAAa,UAAU,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,WAAW,EAAE,EAAE,CAAC;YACzB,GAAG,GAAG,sBAAsB,CAAC;YAC7B,OAAO,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,mBAAmB,CAAC;YAC1B,OAAO,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,SAAS,CAAC;YAClB,OAAO,CAAC,iEAAiE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,OAA0C;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,iFAAiF;IACjF,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACzE,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,sBAAsB,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/enroll.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Redeem a D13 **enrollment code** against the cloud AS `POST /api/auth/enroll/redeem`
+ * endpoint (design 05 §Enrollment endpoints) — the agent-first path that plants a
+ * plugin credential with NO browser hop. The code is **burned on the first redeem
+ * attempt** (server-side), and every failure returns the SAME uniform error (no
+ * oracle), so a spent/invalid/expired code is indistinguishable — the CLI surfaces
+ * one clean message.
+ *
+ * Injectable `fetch` so the round-trip is fully unit-testable with no live network.
+ * Never throws past its boundary — returns a discriminated union.
+ */
+/** The redeem-endpoint success body (mirrors AGS `EnrollRedeemResponse`). */
+export interface EnrollRedeemSuccessBody {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+    /** The server target the code was minted for (the plugin boots against this hub). */
+    server_url: string;
+}
+export type EnrollRedeemResult = {
+    success: true;
+    credential: EnrollRedeemSuccessBody;
+} | {
+    success: false;
+    message: string;
+};
+export interface RedeemEnrollmentOptions {
+    /** The enrollment code to redeem. */
+    code: string;
+    /** Cloud AS base URL (default https://ai-game.dev). */
+    baseUrl: string;
+    /** Injectable fetch for tests (defaults to global fetch). */
+    fetchImpl?: typeof fetch;
+    /** Request timeout in ms (default 30000). */
+    timeoutMs?: number;
+}
+export declare function redeemEnrollment(options: RedeemEnrollmentOptions): Promise<EnrollRedeemResult>;

package/dist/utils/enroll.js

@@ -0,0 +1,66 @@
+import { verbose } from './ui.js';
+export async function redeemEnrollment(options) {
+    const code = (options.code ?? '').trim();
+    if (code.length === 0) {
+        return { success: false, message: 'No enrollment code supplied.' };
+    }
+    const baseUrl = (options.baseUrl ?? '').replace(/\/$/, '');
+    const redeemUrl = `${baseUrl}/api/auth/enroll/redeem`;
+    const doFetch = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 30000;
+    verbose(`POST ${redeemUrl}`);
+    let response;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        response = await doFetch(redeemUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ enroll_code: code }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes('ECONNREFUSED') || message.includes('fetch failed')) {
+            return { success: false, message: `Cannot reach the enrollment server at ${baseUrl}.` };
+        }
+        if (message.toLowerCase().includes('abort')) {
+            return { success: false, message: `Enrollment request to ${baseUrl} timed out.` };
+        }
+        return { success: false, message: `Enrollment request failed: ${message}` };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        // Uniform-error contract: the server returns the same {error, error_description}
+        // for any invalid/expired/used/mismatched code. Surface one clean message.
+        let description;
+        try {
+            const body = (await response.json());
+            description = body.error_description ?? body.error;
+        }
+        catch {
+            description = undefined;
+        }
+        verbose(`Redeem failed: HTTP ${response.status} — ${description ?? ''}`);
+        return {
+            success: false,
+            message: description ??
+                `Enrollment code could not be redeemed (HTTP ${response.status}). The code may be invalid, expired, or already used.`,
+        };
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        return { success: false, message: 'The enrollment server returned an unreadable response.' };
+    }
+    if (typeof body.access_token !== 'string' || body.access_token.length === 0 || typeof body.server_url !== 'string') {
+        return { success: false, message: 'The enrollment server returned an incomplete credential.' };
+    }
+    return { success: true, credential: body };
+}
+//# sourceMappingURL=enroll.js.map

package/dist/utils/enroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../../src/utils/enroll.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAwClC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IACrE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,OAAO,yBAAyB,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAM,CAAC;IAE9C,OAAO,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC;IAE7B,IAAI,QAAkB,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC3C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,OAAO,GAAG,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,OAAO,aAAa,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,OAAO,EAAE,EAAE,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iFAAiF;QACjF,2EAA2E;QAC3E,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmD,CAAC;YACvF,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,uBAAuB,QAAQ,CAAC,MAAM,MAAM,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EACL,WAAW;gBACX,+CAA+C,QAAQ,CAAC,MAAM,uDAAuD;SACxH,CAAC;IACJ,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;IACjG,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC"}

package/dist/utils/machine-credentials.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The shared **machine credential store** at `~/.ai-game-dev/` — a single per-machine home for the
+ * ai-game.dev account credential (`credentials.json`). Engines, CLIs, and the local server all read
+ * this store, so **sign-in happens once per machine** (design `06-engine-plugins.md` / D12).
+ *
+ * This is the TypeScript peer of the shared C# `MachineCredentialStore`
+ * (`MCP-Plugin-dotnet/McpPlugin/src/AgentConfig/MachineCredentialStore.cs`). The on-disk contract is
+ * matched byte-for-byte so a credential written by `godot-cli login` is read by the engine plugin
+ * (which auto-adopts it on editor boot) and vice-versa:
+ *
+ * - **POSIX** — `credentials.json` is written plaintext with `0600` permissions inside a `0700`
+ *   directory.
+ * - **Windows** — the file content is **DPAPI-encrypted** with the current user's key
+ *   (`CryptProtectData`, `CurrentUser` scope, no entropy) so the on-disk bytes are never plaintext.
+ *   Node has no built-in DPAPI, so we interop via PowerShell's `System.Security.Cryptography.
+ *   ProtectedData`, which is a managed wrapper over the very same `CryptProtectData`/
+ *   `CryptUnprotectData` calls the C# store uses — the blobs are cross-readable.
+ *
+ * Credentials are NEVER written to a project file / VCS. The optional `--project` per-project override
+ * (project-local `.godot-mcp/credentials.json`, gitignored) is handled by `credentials.ts`, not here.
+ */
+/** Directory name under the user home that holds the store (matches C# `MachineCredentialStore.DirectoryName`). */
+export declare const MACHINE_STORE_DIR_NAME = ".ai-game-dev";
+/** File name of the secret credential document. */
+export declare const MACHINE_CREDENTIALS_FILE_NAME = "credentials.json";
+/**
+ * Optional env override for the store directory (advanced use / tests). When set, this exact
+ * directory is used verbatim; otherwise the store lives at `~/.ai-game-dev`. The DEFAULT matches the
+ * C# store so cross-tool interop holds — the override never changes the production path.
+ */
+export declare const MACHINE_STORE_DIR_ENV = "AI_GAME_DEV_CREDENTIALS_DIR";
+/**
+ * The secret credential material persisted per machine (mirrors the C# `MachineCredentials` document,
+ * camelCase field names). Unknown fields are ignored on read so the schema can grow forwards.
+ */
+export interface MachineCredentials {
+    /** Schema version of the persisted document (currently 1). */
+    version?: number;
+    /** The current short-lived JWT access token (the cloud bearer token). */
+    accessToken?: string;
+    /** The rotating refresh token used to mint a new access token before `expiresAt`. */
+    refreshToken?: string;
+    /** Absolute expiry of `accessToken` (ISO 8601); used to schedule proactive refresh. */
+    expiresAt?: string;
+    /** The server target the credential was issued for (hosted `https://ai-game.dev` or a local URL). */
+    serverTarget?: string;
+    /** The account id (`sub`) the credential resolves to. Audit/diagnostic only. */
+    subject?: string;
+}
+/** Absolute path of the store directory (honoring the env override). */
+export declare function getMachineStoreDir(baseDirOverride?: string): string;
+/** Absolute path of the secret credential file. */
+export declare function getMachineCredentialsPath(baseDirOverride?: string): string;
+/** True when a credential file exists in the store. */
+export declare function machineCredentialsExist(baseDirOverride?: string): boolean;
+/**
+ * Read and (on Windows) decrypt the stored credentials, or `null` when none are present / empty.
+ * Throws on a decryption failure or malformed JSON (a corrupt or foreign-user credential); callers on
+ * a hot path should use {@link readMachineAccessToken}, which swallows those.
+ */
+export declare function readMachineCredentials(baseDirOverride?: string): MachineCredentials | null;
+/**
+ * Encrypt (Windows) / restrict (POSIX) and write `credentials` to the store, creating the store
+ * directory with owner-only permissions if needed.
+ */
+export declare function writeMachineCredentials(credentials: MachineCredentials, baseDirOverride?: string): void;
+/**
+ * Convenience reader for the persisted access token. Swallows a missing / malformed / undecryptable
+ * file (returns undefined) so a broken store can never crash a command; `login` re-authenticates and
+ * overwrites it.
+ */
+export declare function readMachineAccessToken(baseDirOverride?: string): string | undefined;
+/** Delete the stored credentials (sign-out). No-op when none exist. */
+export declare function deleteMachineCredentials(baseDirOverride?: string): void;

package/dist/utils/machine-credentials.js

@@ -0,0 +1,182 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { execFileSync } from 'child_process';
+/**
+ * The shared **machine credential store** at `~/.ai-game-dev/` — a single per-machine home for the
+ * ai-game.dev account credential (`credentials.json`). Engines, CLIs, and the local server all read
+ * this store, so **sign-in happens once per machine** (design `06-engine-plugins.md` / D12).
+ *
+ * This is the TypeScript peer of the shared C# `MachineCredentialStore`
+ * (`MCP-Plugin-dotnet/McpPlugin/src/AgentConfig/MachineCredentialStore.cs`). The on-disk contract is
+ * matched byte-for-byte so a credential written by `godot-cli login` is read by the engine plugin
+ * (which auto-adopts it on editor boot) and vice-versa:
+ *
+ * - **POSIX** — `credentials.json` is written plaintext with `0600` permissions inside a `0700`
+ *   directory.
+ * - **Windows** — the file content is **DPAPI-encrypted** with the current user's key
+ *   (`CryptProtectData`, `CurrentUser` scope, no entropy) so the on-disk bytes are never plaintext.
+ *   Node has no built-in DPAPI, so we interop via PowerShell's `System.Security.Cryptography.
+ *   ProtectedData`, which is a managed wrapper over the very same `CryptProtectData`/
+ *   `CryptUnprotectData` calls the C# store uses — the blobs are cross-readable.
+ *
+ * Credentials are NEVER written to a project file / VCS. The optional `--project` per-project override
+ * (project-local `.godot-mcp/credentials.json`, gitignored) is handled by `credentials.ts`, not here.
+ */
+/** Directory name under the user home that holds the store (matches C# `MachineCredentialStore.DirectoryName`). */
+export const MACHINE_STORE_DIR_NAME = '.ai-game-dev';
+/** File name of the secret credential document. */
+export const MACHINE_CREDENTIALS_FILE_NAME = 'credentials.json';
+/**
+ * Optional env override for the store directory (advanced use / tests). When set, this exact
+ * directory is used verbatim; otherwise the store lives at `~/.ai-game-dev`. The DEFAULT matches the
+ * C# store so cross-tool interop holds — the override never changes the production path.
+ */
+export const MACHINE_STORE_DIR_ENV = 'AI_GAME_DEV_CREDENTIALS_DIR';
+// Schema version of the persisted document (matches C# `MachineCredentials.Version`).
+const SCHEMA_VERSION = 1;
+/** Absolute path of the store directory (honoring the env override). */
+export function getMachineStoreDir(baseDirOverride) {
+    if (baseDirOverride)
+        return baseDirOverride;
+    const envDir = process.env[MACHINE_STORE_DIR_ENV];
+    if (envDir && envDir.trim().length > 0)
+        return envDir;
+    return path.join(os.homedir(), MACHINE_STORE_DIR_NAME);
+}
+/** Absolute path of the secret credential file. */
+export function getMachineCredentialsPath(baseDirOverride) {
+    return path.join(getMachineStoreDir(baseDirOverride), MACHINE_CREDENTIALS_FILE_NAME);
+}
+/** True when a credential file exists in the store. */
+export function machineCredentialsExist(baseDirOverride) {
+    return fs.existsSync(getMachineCredentialsPath(baseDirOverride));
+}
+/**
+ * Read and (on Windows) decrypt the stored credentials, or `null` when none are present / empty.
+ * Throws on a decryption failure or malformed JSON (a corrupt or foreign-user credential); callers on
+ * a hot path should use {@link readMachineAccessToken}, which swallows those.
+ */
+export function readMachineCredentials(baseDirOverride) {
+    const credentialsPath = getMachineCredentialsPath(baseDirOverride);
+    if (!fs.existsSync(credentialsPath)) {
+        return null;
+    }
+    const raw = fs.readFileSync(credentialsPath);
+    if (raw.length === 0) {
+        return null;
+    }
+    const plaintext = isWindows() ? unprotectDpapi(raw) : raw;
+    const json = plaintext.toString('utf8');
+    if (json.trim().length === 0) {
+        return null;
+    }
+    const parsed = JSON.parse(json);
+    return parsed;
+}
+/**
+ * Encrypt (Windows) / restrict (POSIX) and write `credentials` to the store, creating the store
+ * directory with owner-only permissions if needed.
+ */
+export function writeMachineCredentials(credentials, baseDirOverride) {
+    const dir = getMachineStoreDir(baseDirOverride);
+    const credentialsPath = path.join(dir, MACHINE_CREDENTIALS_FILE_NAME);
+    ensureStoreDirectory(dir);
+    const json = serialize(credentials);
+    const plaintext = Buffer.from(json, 'utf8');
+    const bytes = isWindows() ? protectDpapi(plaintext) : plaintext;
+    fs.writeFileSync(credentialsPath, bytes, { mode: 0o600 });
+    setPosixPermissions(credentialsPath, 0o600);
+}
+/**
+ * Convenience reader for the persisted access token. Swallows a missing / malformed / undecryptable
+ * file (returns undefined) so a broken store can never crash a command; `login` re-authenticates and
+ * overwrites it.
+ */
+export function readMachineAccessToken(baseDirOverride) {
+    let credentials;
+    try {
+        credentials = readMachineCredentials(baseDirOverride);
+    }
+    catch {
+        return undefined;
+    }
+    const token = credentials?.accessToken;
+    return typeof token === 'string' && token.trim().length > 0 ? token : undefined;
+}
+/** Delete the stored credentials (sign-out). No-op when none exist. */
+export function deleteMachineCredentials(baseDirOverride) {
+    const credentialsPath = getMachineCredentialsPath(baseDirOverride);
+    if (fs.existsSync(credentialsPath)) {
+        fs.rmSync(credentialsPath, { force: true });
+    }
+}
+// ── Serialization ────────────────────────────────────────────────────────────────────────────────
+function serialize(credentials) {
+    // Mirror the C# store's camelCase + WhenWritingNull: always emit `version`, omit null/undefined
+    // optional fields. Indentation is cosmetic (the reader is whitespace-insensitive).
+    const doc = { version: credentials.version ?? SCHEMA_VERSION };
+    if (credentials.accessToken != null)
+        doc.accessToken = credentials.accessToken;
+    if (credentials.refreshToken != null)
+        doc.refreshToken = credentials.refreshToken;
+    if (credentials.expiresAt != null)
+        doc.expiresAt = credentials.expiresAt;
+    if (credentials.serverTarget != null)
+        doc.serverTarget = credentials.serverTarget;
+    if (credentials.subject != null)
+        doc.subject = credentials.subject;
+    return JSON.stringify(doc, null, 2) + '\n';
+}
+// ── Filesystem permissions ───────────────────────────────────────────────────────────────────────
+function ensureStoreDirectory(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    setPosixPermissions(dir, 0o700);
+}
+function setPosixPermissions(target, mode) {
+    if (isWindows())
+        return; // chmod is a no-op on Windows; DPAPI provides at-rest protection there.
+    try {
+        fs.chmodSync(target, mode);
+    }
+    catch {
+        // Best-effort only — never fail persistence over a chmod (e.g. exotic filesystems).
+    }
+}
+// ── Windows DPAPI via PowerShell (System.Security.Cryptography.ProtectedData) ───────────────────────
+// ProtectedData.Protect/Unprotect wrap CryptProtectData/CryptUnprotectData with the SAME CurrentUser
+// scope + null entropy the C# MachineCredentialStore uses, so the on-disk blobs are cross-readable.
+function isWindows() {
+    return process.platform === 'win32';
+}
+const DPAPI_PROTECT_SCRIPT = "Add-Type -AssemblyName System.Security; " +
+    "$in = [Console]::In.ReadToEnd().Trim(); " +
+    "$bytes = [Convert]::FromBase64String($in); " +
+    "$prot = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, 'CurrentUser'); " +
+    "[Console]::Out.Write([Convert]::ToBase64String($prot))";
+const DPAPI_UNPROTECT_SCRIPT = "Add-Type -AssemblyName System.Security; " +
+    "$in = [Console]::In.ReadToEnd().Trim(); " +
+    "$bytes = [Convert]::FromBase64String($in); " +
+    "$plain = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, 'CurrentUser'); " +
+    "[Console]::Out.Write([Convert]::ToBase64String($plain))";
+function protectDpapi(plaintext) {
+    return runDpapi(DPAPI_PROTECT_SCRIPT, plaintext, 'encrypt');
+}
+function unprotectDpapi(cipher) {
+    return runDpapi(DPAPI_UNPROTECT_SCRIPT, cipher, 'decrypt');
+}
+function runDpapi(script, input, op) {
+    try {
+        const out = execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+            input: input.toString('base64'),
+            encoding: 'utf8',
+            windowsHide: true,
+        });
+        return Buffer.from(out.trim(), 'base64');
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to ${op} the machine credential store via DPAPI: ${message}`);
+    }
+}
+//# sourceMappingURL=machine-credentials.js.map

package/dist/utils/machine-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-credentials.js","sourceRoot":"","sources":["../../src/utils/machine-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,mHAAmH;AACnH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAErD,mDAAmD;AACnD,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAEnE,sFAAsF;AACtF,MAAM,cAAc,GAAG,CAAC,CAAC;AAqBzB,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,eAAwB;IACzD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACzD,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,yBAAyB,CAAC,eAAwB;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,6BAA6B,CAAC,CAAC;AACvF,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,eAAwB;IAC9D,OAAO,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC7D,MAAM,eAAe,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAA+B,EAAE,eAAwB;IAC/F,MAAM,GAAG,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAEtE,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhE,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,mBAAmB,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAAwB;IAC7D,IAAI,WAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,WAAW,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,EAAE,WAAW,CAAC;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CAAC,eAAwB;IAC/D,MAAM,eAAe,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,oGAAoG;AAEpG,SAAS,SAAS,CAAC,WAA+B;IAChD,gGAAgG;IAChG,mFAAmF;IACnF,MAAM,GAAG,GAA4B,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACxF,IAAI,WAAW,CAAC,WAAW,IAAI,IAAI;QAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;IAC/E,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI;QAAE,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAClF,IAAI,WAAW,CAAC,SAAS,IAAI,IAAI;QAAE,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IACzE,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI;QAAE,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAClF,IAAI,WAAW,CAAC,OAAO,IAAI,IAAI;QAAE,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;IACnE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7C,CAAC;AAED,oGAAoG;AAEpG,SAAS,oBAAoB,CAAC,GAAW;IACvC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,IAAY;IACvD,IAAI,SAAS,EAAE;QAAE,OAAO,CAAC,wEAAwE;IACjG,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AAEpG,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACtC,CAAC;AAED,MAAM,oBAAoB,GACxB,0CAA0C;IAC1C,0CAA0C;IAC1C,6CAA6C;IAC7C,+FAA+F;IAC/F,wDAAwD,CAAC;AAE3D,MAAM,sBAAsB,GAC1B,0CAA0C;IAC1C,0CAA0C;IAC1C,6CAA6C;IAC7C,kGAAkG;IAClG,yDAAyD,CAAC;AAE5D,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,QAAQ,CAAC,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,QAAQ,CAAC,sBAAsB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa,EAAE,EAAyB;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;YAC5F,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,4CAA4C,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/utils/project-identity.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The single canonical derivation of a project's **routing pin** and its
+ * **deterministic local port** from the project root path — the TypeScript port of the
+ * shared 7.0 library `com.IvanMurzak.McpPlugin.AgentConfig.ProjectIdentity`
+ * (`MCP-Plugin-dotnet/McpPlugin/src/AgentConfig/ProjectIdentity.cs`), which the Godot addon
+ * consumes via `GodotProjectIdentity`. Every runtime (Unity/Godot/Unreal plugins, the .NET
+ * sidecar, and the engine CLIs) derives identical values with no shared state and no probing,
+ * so an agent session launched in a project folder routes strictly to that project's engine
+ * instance (design `06-engine-plugins.md` § D14/D15).
+ *
+ * Algorithm (kept verbatim from the shipped Unity `GeneratePortFromDirectory` / the C# reference):
+ *   1. Trim trailing directory separators (`/` and `\`) so `/a/b` and `/a/b/` are the same project.
+ *      Separators are NOT converted — `C:\a` and `C:/a` hash differently (do NOT `path.normalize`).
+ *   2. Lowercase with an invariant fold (`ToLowerInvariant`-equivalent — see {@link toLowerInvariant}).
+ *   3. UTF-8 encode, then SHA-256 hash.
+ *   4. pin  = the first 4 bytes of the hash as 8 lowercase hex chars.
+ *   5. port = 20000 + (littleEndianUInt32(first 4 bytes) % 10000).  Range 20000-29999.
+ *
+ * Cross-language parity (C# vs TS) is pinned by the committed golden-vector file
+ * (`ProjectIdentity.GoldenVectors.json`) and reproduced byte-for-byte by
+ * `tests/project-identity.test.ts`.
+ */
+/** Inclusive lower bound of the deterministic local-port range. */
+export declare const MIN_PORT = 20000;
+/** Inclusive upper bound of the deterministic local-port range. */
+export declare const MAX_PORT = 29999;
+/** Number of ports in the deterministic range (10000). */
+export declare const PORT_RANGE: number;
+/** Number of hex characters in the routing pin (first 4 bytes of the hash). */
+export declare const PIN_LENGTH = 8;
+/** The resolved identity for a project root. */
+export interface ProjectIdentity {
+    /** The routing pin: first 8 lowercase hex chars of the SHA-256 of the normalized project root. */
+    pin: string;
+    /** The resolved local port — the hash-derived port unless an explicit override was supplied. */
+    port: number;
+    /** True when {@link port} came from an explicit user override rather than the hash. */
+    portIsOverridden: boolean;
+}
+/**
+ * Invariant lowercasing that matches C# `string.ToLowerInvariant()`.
+ *
+ * JS `String.prototype.toLowerCase()` and C# `ToLowerInvariant()` disagree on some Unicode
+ * characters. The one that matters for real project paths — and the one the golden-vector file
+ * explicitly pins (`unicodeDivergence`) — is **U+0130 LATIN CAPITAL LETTER I WITH DOT ABOVE**:
+ * C# `ToLowerInvariant` leaves it unchanged, whereas a naive JS `toLowerCase()` folds it to
+ * `i` + U+0307 (COMBINING DOT ABOVE), producing a DIFFERENT hash. Preserve U+0130 so the TS
+ * derivation reproduces the canonical C# value byte-for-byte; every other character lowercases
+ * identically under both implementations.
+ */
+export declare function toLowerInvariant(value: string): string;
+/**
+ * The exact string that is UTF-8/SHA-256 hashed: the project root with trailing directory
+ * separators trimmed, then invariant-lowercased. Exposed so callers/tests can reproduce the
+ * pre-hash string.
+ */
+export declare function normalize(projectRoot: string): string;
+/** The routing pin only (first 8 lowercase hex chars of the hash). Never affected by overrides. */
+export declare function derivePin(projectRoot: string): string;
+/**
+ * The pure hash-derived port (ignores any override). Byte-for-byte equivalent of the shipped
+ * Unity `GeneratePortFromDirectory` when given the same directory string.
+ */
+export declare function derivePort(projectRoot: string): number;
+/**
+ * The FULL project-path hash: the complete 64-char lowercase hex SHA-256 of the normalized
+ * project root — the `projectPathHash` an engine plugin sends in its hub instance-metadata
+ * handshake. The routing pin is a case-insensitive prefix of this value by construction.
+ */
+export declare function deriveProjectPathHash(projectRoot: string): string;
+/**
+ * Derive the identity for `projectRoot`. When `portOverride` is non-null (the user's explicit
+ * override from the project marker) it always wins for {@link ProjectIdentity.port}; the
+ * {@link ProjectIdentity.pin} is always hash-derived.
+ */
+export declare function deriveProjectIdentity(projectRoot: string, portOverride?: number | null): ProjectIdentity;

package/dist/utils/project-identity.js

@@ -0,0 +1,111 @@
+import { createHash } from 'crypto';
+/**
+ * The single canonical derivation of a project's **routing pin** and its
+ * **deterministic local port** from the project root path — the TypeScript port of the
+ * shared 7.0 library `com.IvanMurzak.McpPlugin.AgentConfig.ProjectIdentity`
+ * (`MCP-Plugin-dotnet/McpPlugin/src/AgentConfig/ProjectIdentity.cs`), which the Godot addon
+ * consumes via `GodotProjectIdentity`. Every runtime (Unity/Godot/Unreal plugins, the .NET
+ * sidecar, and the engine CLIs) derives identical values with no shared state and no probing,
+ * so an agent session launched in a project folder routes strictly to that project's engine
+ * instance (design `06-engine-plugins.md` § D14/D15).
+ *
+ * Algorithm (kept verbatim from the shipped Unity `GeneratePortFromDirectory` / the C# reference):
+ *   1. Trim trailing directory separators (`/` and `\`) so `/a/b` and `/a/b/` are the same project.
+ *      Separators are NOT converted — `C:\a` and `C:/a` hash differently (do NOT `path.normalize`).
+ *   2. Lowercase with an invariant fold (`ToLowerInvariant`-equivalent — see {@link toLowerInvariant}).
+ *   3. UTF-8 encode, then SHA-256 hash.
+ *   4. pin  = the first 4 bytes of the hash as 8 lowercase hex chars.
+ *   5. port = 20000 + (littleEndianUInt32(first 4 bytes) % 10000).  Range 20000-29999.
+ *
+ * Cross-language parity (C# vs TS) is pinned by the committed golden-vector file
+ * (`ProjectIdentity.GoldenVectors.json`) and reproduced byte-for-byte by
+ * `tests/project-identity.test.ts`.
+ */
+/** Inclusive lower bound of the deterministic local-port range. */
+export const MIN_PORT = 20000;
+/** Inclusive upper bound of the deterministic local-port range. */
+export const MAX_PORT = 29999;
+/** Number of ports in the deterministic range (10000). */
+export const PORT_RANGE = MAX_PORT - MIN_PORT + 1;
+/** Number of hex characters in the routing pin (first 4 bytes of the hash). */
+export const PIN_LENGTH = 8;
+const SEPARATOR_FORWARD = '/';
+const SEPARATOR_BACK = String.fromCharCode(92); // backslash
+/**
+ * Invariant lowercasing that matches C# `string.ToLowerInvariant()`.
+ *
+ * JS `String.prototype.toLowerCase()` and C# `ToLowerInvariant()` disagree on some Unicode
+ * characters. The one that matters for real project paths — and the one the golden-vector file
+ * explicitly pins (`unicodeDivergence`) — is **U+0130 LATIN CAPITAL LETTER I WITH DOT ABOVE**:
+ * C# `ToLowerInvariant` leaves it unchanged, whereas a naive JS `toLowerCase()` folds it to
+ * `i` + U+0307 (COMBINING DOT ABOVE), producing a DIFFERENT hash. Preserve U+0130 so the TS
+ * derivation reproduces the canonical C# value byte-for-byte; every other character lowercases
+ * identically under both implementations.
+ */
+export function toLowerInvariant(value) {
+    let result = '';
+    for (const ch of value) {
+        result += ch === 'İ' ? ch : ch.toLowerCase();
+    }
+    return result;
+}
+/**
+ * The exact string that is UTF-8/SHA-256 hashed: the project root with trailing directory
+ * separators trimmed, then invariant-lowercased. Exposed so callers/tests can reproduce the
+ * pre-hash string.
+ */
+export function normalize(projectRoot) {
+    return toLowerInvariant(trimTrailingSeparators(projectRoot));
+}
+/** The routing pin only (first 8 lowercase hex chars of the hash). Never affected by overrides. */
+export function derivePin(projectRoot) {
+    return hashOf(projectRoot).subarray(0, PIN_LENGTH / 2).toString('hex');
+}
+/**
+ * The pure hash-derived port (ignores any override). Byte-for-byte equivalent of the shipped
+ * Unity `GeneratePortFromDirectory` when given the same directory string.
+ */
+export function derivePort(projectRoot) {
+    return portFromHash(hashOf(projectRoot));
+}
+/**
+ * The FULL project-path hash: the complete 64-char lowercase hex SHA-256 of the normalized
+ * project root — the `projectPathHash` an engine plugin sends in its hub instance-metadata
+ * handshake. The routing pin is a case-insensitive prefix of this value by construction.
+ */
+export function deriveProjectPathHash(projectRoot) {
+    return hashOf(projectRoot).toString('hex');
+}
+/**
+ * Derive the identity for `projectRoot`. When `portOverride` is non-null (the user's explicit
+ * override from the project marker) it always wins for {@link ProjectIdentity.port}; the
+ * {@link ProjectIdentity.pin} is always hash-derived.
+ */
+export function deriveProjectIdentity(projectRoot, portOverride) {
+    const hash = hashOf(projectRoot);
+    const pin = hash.subarray(0, PIN_LENGTH / 2).toString('hex');
+    if (portOverride !== undefined && portOverride !== null) {
+        return { pin, port: portOverride, portIsOverridden: true };
+    }
+    return { pin, port: portFromHash(hash), portIsOverridden: false };
+}
+function hashOf(projectRoot) {
+    if (projectRoot === null || projectRoot === undefined) {
+        throw new TypeError('projectRoot must be a string');
+    }
+    return createHash('sha256').update(Buffer.from(normalize(projectRoot), 'utf8')).digest();
+}
+function portFromHash(hash) {
+    // First 4 bytes as an explicit little-endian uint32 — matches the C# byte-shift
+    // (`hash[0] | hash[1]<<8 | hash[2]<<16 | hash[3]<<24`) and is CPU-endianness independent.
+    const value = hash.readUInt32LE(0);
+    return MIN_PORT + (value % PORT_RANGE);
+}
+function trimTrailingSeparators(path) {
+    let end = path.length;
+    while (end > 1 && (path[end - 1] === SEPARATOR_FORWARD || path[end - 1] === SEPARATOR_BACK)) {
+        end--;
+    }
+    return end === path.length ? path : path.slice(0, end);
+}
+//# sourceMappingURL=project-identity.js.map

package/dist/utils/project-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-identity.js","sourceRoot":"","sources":["../../src/utils/project-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAE9B,mEAAmE;AACnE,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAE9B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC;AAElD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY;AAY5D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,gBAAgB,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,YAA4B;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,MAAM,CAAC,WAAmB;IACjC,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,gFAAgF;IAChF,0FAA0F;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,QAAQ,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,iBAAiB,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,cAAc,CAAC,EAAE,CAAC;QAC5F,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC"}