host-execution-mcp 1.0.1 → 2.0.0

package/CHANGELOG.md

@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-10-22
+
+### Breaking
+
+- Removed tools `context_derive` and `ssh_exec`. Agent selects a machine with YAML `description` + optional `host` (omit `host` = link landing; pass `host` = ssh hop-2 or Paradi TARGET). No `contextKey` on tools.
+- `remote_read_file` / `remote_ps` no longer take `target=landing|context|pod`. Path is on the selected machine; add `namespace`+`pod` to go into a container via kubectl there.
+- `remote_copy_*` endpoints are `target=local|remote|pod` (not landing/context). `remote` is the selected Linux.
+- Env `TARGET_HOST` removed. Use `TARGET_HOSTS` (one host or comma-separated list of IP/hostname). CIDR/glob and JSON array strings are rejected. One TARGET is the default hop-2 / Paradi landing IP to pass as `host`; otherwise pass `host` from context.
+
+### Added
+
+- YAML roster at `~/.agents/host-execution.yaml` (Windows `%USERPROFILE%\.agents\host-execution.yaml`): same GUIDE §2 fields as JSON, unique `description` per link, user+IP identity. YAML wins when at least one real link exists; empty roster + `ACCESS_*` keeps JSON. Empty roster still starts the MCP. Tools take optional exact `description`; 1 link may omit it. Template is MCP Resource `host-execution://guides/yaml`.
+- MCP Resources `host-execution://guides/user` (`docs/GUIDE.md`) and `host-execution://guides/agent` (`docs/AGENT_GUIDE.md`), registered from `src/sources/`. Handshake tells the Agent to read both once; catalog `mcp/host-execution/GUIDE.md` is a pointer.
+
+### Changed
+
+- `TARGET_HOSTS` is only concrete hosts. CIDR/glob no longer sit in the list as notes; they fail at parse. Paradi without a single default no longer creates a `paradi-unselected` Context — omit-host tools fail until `host` is passed.
+- README tool table matches Paradi landing select. `USER_GUIDE.zh-CN.md` no longer duplicates GUIDE or embed credentials. User GUIDE resource audience includes `user`. Unused Catalog screenshot removed.
+- Runtime tools share one machine selector: optional `host` (`shell_exec` / `docker_*` / `k8s_*` / `context_probe` / `remote_*`). `k8s_*` is not a separate landing path.
+- Paradi `remote_copy_*` uses `target=remote` on the selected TARGET landing. Hop-2 `target=host` remains rejected.
+- `remote_*` tool `inputSchema` is a plain Zod object (no `.refine()` / union). MCP `listTools` now exposes `path` / `host` / `target` instead of empty `properties`. Cross-field rules run in the handler.
+- Removed unused `allowContext` schema switch (always on) and the extra copy assert before materialize.
+- `description` is documented as a rewriteable scenario label (not a frozen key).
+
+### Fixed
+
+- Machine pick / select errors (`description` missing, empty roster, Paradi multi-TARGET without `host`) return tool JSON via `formatErrorResult`, not MCP protocol faults.
+- Reloading a YAML link with the same `description` but changed credentials drops the stale `AccessClient` session instead of leaking it.
+
+### Removed
+
+- Internal live-test notes doc that listed real intranet IPs (not for npm / public tree).
+
+### Tests
+
+- Resource-list fixture (GPU-Genius GGN / S5000 OS IPs): multi-host ssh + Paradi select Context; copy follows landing, not hop-2.
+
 ## [1.0.1] - 2026-09-16
 
 ### Changed

package/README.md

@@ -15,20 +15,18 @@ Composable tools:
 | Tool | Purpose |
 |------|---------|
 | `access_check` | Short ACCESS SSH probe (`reachable` / `latencyMs`; not kubectl) |
-| `shell_exec` | Shell on landing Context (optional `contextKey`) |
-| `context_derive` | Derive child Context → `contextKey` (`ACCESS_KIND=ssh` only) |
+| `shell_exec` | Shell on landing, or hop-2 / Paradi TARGET when `host` is set |
 | `context_probe` | Probe docker/kubectl capabilities (unknown ≠ true) |
-| `docker_ps` / `docker_exec` / `docker_logs` | Docker Runtime on landing or derived Context (`contextKey`) |
+| `docker_ps` / `docker_exec` / `docker_logs` | Docker on the selected machine (`host` optional) |
 | `k8s_list_pods` | List pods (`kubectl get pods`) |
 | `k8s_exec` | Run command in pod container |
 | `k8s_logs` | Pod stdout/stderr (`kubectl logs`) |
-| `ssh_exec` | Derive + shell on remote host (`ACCESS_KIND=ssh`) |
-| `remote_read_file` | Read file head/tail (`mode=head\|tail`) on landing/pod/context |
-| `remote_copy_file` | Sync copy between local/landing/pod/context (SFTP for local↔landing; `skipIfComplete` / `totalTimeoutMs` / progress) |
+| `remote_read_file` | Read file head/tail on the selected machine; optional namespace+pod |
+| `remote_copy_file` | Sync copy between local/remote/pod (SFTP for local↔remote; `skipIfComplete` / `totalTimeoutMs` / progress) |
 | `remote_copy_start` | Async copy job — returns `transferId` immediately (prefer for >256MB or ETA>2min) |
 | `remote_copy_status` | Poll async copy job progress |
 | `remote_copy_cancel` | Cancel async copy job |
-| `remote_ps` | List processes on landing/pod/context |
+| `remote_ps` | List processes on the selected machine; optional namespace+pod |
 
 Async job state: `~/.agent-compose/remote-copy/jobs/<transferId>.json` — see [docs/REMOTE_COPY_JOB_API.md](docs/REMOTE_COPY_JOB_API.md).
 
@@ -72,9 +70,11 @@ MCP config uses local path:
 "args": ["<ABS_PATH>/packages/mcp/host-execution/dist/index.js"]
 ```
 
-### Minimal env
+### YAML roster or minimal env
 
-Only `ACCESS_HOST` and `ACCESS_USER` are required. Configure any SSH auth you use (key path, default `~/.ssh` keys, SSH agent, and/or `ACCESS_PASSWORD`); the client tries each until one works. If your IDE exposes an empty SSH agent, set `ACCESS_PASSWORD` and it will be used after agent/key attempts fail. See [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
+Preferred when you have more than one ACCESS/TARGET pair: write links to `~/.agents/host-execution.yaml` (Windows `%USERPROFILE%\.agents\host-execution.yaml`). mcp.json can stay empty of `ACCESS_*`. Template: MCP Resource `host-execution://guides/yaml`.
+
+JSON/env still works when the roster has no real links. Then `ACCESS_HOST` and `ACCESS_USER` are required. Configure any SSH auth you use (key path, default `~/.ssh` keys, SSH agent, and/or `ACCESS_PASSWORD`); the client tries each until one works. If your IDE exposes an empty SSH agent, set `ACCESS_PASSWORD` and it will be used after agent/key attempts fail. See [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
 
 ## Publishing (maintainers)
 
@@ -85,8 +85,10 @@ npm publish          # or --registry for private npm
 
 ## Documentation
 
-- [使用教程（中文）](docs/USER_GUIDE.zh-CN.md) — Node.js 安装、MCP 配置、Agent 实用话术
-- [Agent usage guide](docs/AGENT_GUIDE.md) — for LLM agents after MCP handshake
+- [GUIDE.md](docs/GUIDE.md) — 用户用法（期望能力）；MCP Resource `host-execution://guides/user`
+- YAML 名册模板 — MCP Resource `host-execution://guides/yaml`（`docs/host-execution.yaml`）
+- [使用教程（中文）](docs/USER_GUIDE.zh-CN.md) — Codex 接法、旧包迁移、场景示例；用法以 GUIDE 为准
+- [Agent usage guide](docs/AGENT_GUIDE.md) — 操作说明；MCP Resource `host-execution://guides/agent`
 - [Configuration](docs/CONFIGURATION.md) — env vars, auth, client setup
 - [SECURITY.md](SECURITY.md) — trust boundaries, credentials, sshpass notes
 - [CHANGELOG.md](CHANGELOG.md)

package/SECURITY.md

@@ -39,7 +39,7 @@ There is **no direct path** from the MCP client machine to cluster pods or worke
 
 ## sshpass and process visibility
 
-When `ssh_exec` / `context_derive` use a password (or `TARGET_PASSWORD`), the ACCESS landing runs:
+When tools pass `host` with a password (or `TARGET_PASSWORD`), the ACCESS landing runs:
 
 ```bash
 sshpass -p '<password>' ssh ...
@@ -56,8 +56,8 @@ Remote host SSH uses `-o StrictHostKeyChecking=accept-new`. On first connect, un
 `ALLOWED_NAMESPACES` restricts **kubectl tools only** (`k8s_list_pods`, `k8s_exec`, `k8s_logs`, and `remote_*` with `target=pod`). It does **not** restrict:
 
 - `shell_exec` — arbitrary shell on the ACCESS landing Context, including `kubectl` against any namespace
-- `ssh_exec` — SSH derive from ACCESS to any reachable host
-- `remote_*` with `target=landing` or materialized `target=context`
+- `shell_exec` / `docker_*` / `remote_*` with `host` — SSH from ACCESS to that host
+- `remote_*` on the selected machine (`target=remote` after materialize)
 
 For defense in depth, combine namespace whitelist with bastion RBAC, kubeconfig permissions, and limiting who can run the MCP server.
 

package/dist/access/index.d.ts

@@ -16,31 +16,43 @@ export type ContextSummary = {
  */
 export declare class AccessRuntime {
     private readonly config;
-    readonly accessContext: HostExecutionContext;
+    /** Landing Context when one exists (ssh ACCESS, or Paradi with exactly one TARGET_HOSTS). */
+    readonly accessContext?: HostExecutionContext;
     readonly pool: SessionPool;
     private readonly sshTransport;
+    private readonly paradiTransport;
     /** Capability cache by context.key (derive may recreate descriptor objects). */
     private readonly capsByKey;
     /** Live Context descriptors by key (landing + derived). */
     private readonly contexts;
     constructor(config: AppConfig, accessClient: AccessClient);
-    /** Landing Context key (ACCESS for ssh; TARGET for paradi). */
+    /** Landing Context key (ACCESS for ssh; TARGET for paradi with one default). */
     get landingKey(): string;
+    hasContext(contextKey: string): boolean;
     summarize(ctx?: HostExecutionContext): ContextSummary;
     /**
-     * Resolve Runtime Context by key. Omit / empty → landing.
-     * Unknown keys throw (must context_derive first).
+     * Agent-facing pick: omit host = this link's landing; pass host =
+     * ssh hop-2 from ACCESS, or Paradi TARGET landing select.
+     */
+    selectMachine(args?: {
+        host?: string;
+        user?: string;
+        password?: string;
+    }): HostExecutionContext;
+    /**
+     * Resolve Runtime Context by key. Omit / empty → the only landing Context
+     * (ssh ACCESS, or Paradi when TARGET_HOSTS has exactly one host).
      */
     requireContext(contextKey?: string): HostExecutionContext;
-    /** Shell on a Context (default landing). */
+    /** Shell on a Context (omit contextKey = the only landing, if one exists). */
     shellExec(command: string, opts?: {
         contextKey?: string;
         timeoutMs?: number;
         cwd?: string;
     }): Promise<ExecOutput>;
     /**
-     * Derive a child Context (ACCESS_KIND=ssh only). Returns summary with contextKey.
-     * Omitting host uses config TARGET_* as default derive selector.
+     * Derive a child Context (ssh hop-2) or select a Paradi TARGET landing.
+     * Omitting host uses the single TARGET_HOSTS entry when there is one.
      */
     deriveContext(args?: {
         host?: string;
@@ -49,8 +61,7 @@ export declare class AccessRuntime {
         useTarget?: boolean;
     }): ContextSummary;
     /**
-     * deriveContext + shellExec — ACCESS_KIND=ssh only.
-     * Also returns the derived contextKey via summarize after exec (caller should use derive for key-only).
+     * deriveContext + shellExec. Returns the derived contextKey after exec.
      */
     sshExec(args: {
         host?: string;
@@ -102,7 +113,7 @@ export declare class AccessRuntime {
         user?: string;
         password?: string;
     };
-    private assertDeriveAllowed;
+    private requireLanding;
     private remember;
     private withCachedCaps;
     private resolveHostContext;

package/dist/access/index.js

@@ -10,9 +10,11 @@ import * as docker from "./docker-runtime.js";
  */
 export class AccessRuntime {
     config;
+    /** Landing Context when one exists (ssh ACCESS, or Paradi with exactly one TARGET_HOSTS). */
     accessContext;
     pool;
     sshTransport = new SshAccessTransport();
+    paradiTransport = new ParadiAccessTransport();
     /** Capability cache by context.key (derive may recreate descriptor objects). */
     capsByKey = new Map();
     /** Live Context descriptors by key (landing + derived). */
@@ -20,19 +22,28 @@ export class AccessRuntime {
     constructor(config, accessClient) {
         this.config = config;
         this.pool = new SessionPool(accessClient);
-        this.accessContext =
-            config.accessKind === "paradi-gateway"
-                ? new ParadiAccessTransport().createContext(config)
-                : this.sshTransport.createAccessContext(config);
-        this.pool.bindAccess(this.accessContext);
-        this.remember(this.accessContext);
-    }
-    /** Landing Context key (ACCESS for ssh; TARGET for paradi). */
+        if (config.accessKind === "paradi-gateway") {
+            if (config.targetHost?.trim()) {
+                this.accessContext = this.paradiTransport.createContext(config);
+                this.pool.bindParadiLanding(this.accessContext, config.targetHost.trim());
+                this.remember(this.accessContext);
+            }
+        }
+        else {
+            this.accessContext = this.sshTransport.createAccessContext(config);
+            this.pool.bindAccess(this.accessContext);
+            this.remember(this.accessContext);
+        }
+    }
+    /** Landing Context key (ACCESS for ssh; TARGET for paradi with one default). */
     get landingKey() {
-        return this.accessContext.key;
+        return this.requireLanding().key;
     }
-    summarize(ctx = this.accessContext) {
-        const withCaps = this.withCachedCaps(ctx);
+    hasContext(contextKey) {
+        return this.contexts.has(contextKey.trim());
+    }
+    summarize(ctx) {
+        const withCaps = this.withCachedCaps(ctx ?? this.requireLanding());
         return {
             contextKey: withCaps.key,
             endpoint: withCaps.endpoint,
@@ -41,41 +52,49 @@ export class AccessRuntime {
         };
     }
     /**
-     * Resolve Runtime Context by key. Omit / empty → landing.
-     * Unknown keys throw (must context_derive first).
+     * Agent-facing pick: omit host = this link's landing; pass host =
+     * ssh hop-2 from ACCESS, or Paradi TARGET landing select.
+     */
+    selectMachine(args = {}) {
+        const host = args.host?.trim();
+        if (!host) {
+            return this.requireLanding();
+        }
+        return this.resolveHostContext(host, args.user, args.password);
+    }
+    /**
+     * Resolve Runtime Context by key. Omit / empty → the only landing Context
+     * (ssh ACCESS, or Paradi when TARGET_HOSTS has exactly one host).
      */
     requireContext(contextKey) {
         const key = contextKey?.trim();
         if (!key) {
-            return this.withCachedCaps(this.accessContext);
+            return this.withCachedCaps(this.requireLanding());
         }
         const ctx = this.contexts.get(key);
         if (!ctx) {
-            throw new Error(`Unknown contextKey=${key}. Call context_derive first (or omit contextKey for landing).`);
+            throw new Error(`Unknown contextKey=${key}. Pass host on the tool (or omit host for landing).`);
         }
         return this.withCachedCaps(ctx);
     }
-    /** Shell on a Context (default landing). */
+    /** Shell on a Context (omit contextKey = the only landing, if one exists). */
     shellExec(command, opts = {}) {
         const ctx = this.requireContext(opts.contextKey);
         return this.pool.exec(ctx, command, opts.timeoutMs, opts.cwd);
     }
     /**
-     * Derive a child Context (ACCESS_KIND=ssh only). Returns summary with contextKey.
-     * Omitting host uses config TARGET_* as default derive selector.
+     * Derive a child Context (ssh hop-2) or select a Paradi TARGET landing.
+     * Omitting host uses the single TARGET_HOSTS entry when there is one.
      */
     deriveContext(args = {}) {
-        this.assertDeriveAllowed();
         const host = args.useTarget ? undefined : args.host;
         const ctx = this.resolveHostContext(host, args.user, args.password);
         return this.summarize(ctx);
     }
     /**
-     * deriveContext + shellExec — ACCESS_KIND=ssh only.
-     * Also returns the derived contextKey via summarize after exec (caller should use derive for key-only).
+     * deriveContext + shellExec. Returns the derived contextKey after exec.
      */
     async sshExec(args) {
-        this.assertDeriveAllowed();
         const ctx = this.resolveHostContext(args.host, args.user, args.password);
         const out = await this.pool.exec(ctx, args.command, args.timeoutMs);
         return { ...out, contextKey: ctx.key, endpoint: ctx.endpoint };
@@ -119,6 +138,9 @@ export class AccessRuntime {
         if (!entry) {
             throw new Error(`No SessionPool binding for context key=${ctx.key}`);
         }
+        if (entry.kind === "paradi-landing") {
+            return { target: "landing", path: endpoint.path, host: entry.host };
+        }
         if (entry.kind === "access") {
             return { target: "landing", path: endpoint.path };
         }
@@ -130,10 +152,11 @@ export class AccessRuntime {
             password: entry.password,
         };
     }
-    assertDeriveAllowed() {
-        if (this.config.accessKind === "paradi-gateway") {
-            throw new Error("ACCESS_KIND=paradi-gateway already lands on TARGET - context_derive / ssh_exec are unsupported by current Paradi AccessTransport. Use shell_exec, docker_*, or k8s_* on the landing Context (omit contextKey).");
+    requireLanding() {
+        if (!this.accessContext) {
+            throw new Error("host required — TARGET_HOSTS has no single default; pass a host from user context");
         }
+        return this.accessContext;
     }
     remember(ctx) {
         this.contexts.set(ctx.key, ctx);
@@ -152,7 +175,12 @@ export class AccessRuntime {
     }
     resolveHostContext(host, user, password) {
         const spec = this.resolveDeriveSpec(host, user, password);
-        const child = this.sshTransport.deriveContext(this.accessContext, spec);
+        if (this.config.accessKind === "paradi-gateway") {
+            const landing = this.paradiTransport.createContext(this.config, spec.host);
+            this.pool.bindParadiLanding(landing, spec.host);
+            return this.withCachedCaps(landing);
+        }
+        const child = this.sshTransport.deriveContext(this.requireLanding(), spec);
         this.pool.bindDerived(child, spec);
         return this.withCachedCaps(child);
     }
@@ -160,7 +188,7 @@ export class AccessRuntime {
         const defaultSpec = this.sshTransport.defaultDeriveSpec(this.config);
         const resolvedHost = host?.trim() || defaultSpec?.host;
         if (!resolvedHost) {
-            throw new Error("host required, or set TARGET_HOST / pass useTarget with TARGET_* configured");
+            throw new Error("host required — TARGET_HOSTS has no single default; pass a host from user context");
         }
         const resolvedUser = resolveRemoteUser(user, this.config.targetUser ?? defaultSpec?.user);
         const resolvedPassword = resolveRemotePassword(password, this.config.targetPassword ?? defaultSpec?.password);

package/dist/access/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAW9C;;;GAGG;AACH,MAAM,OAAO,aAAa;IAUL;IATV,aAAa,CAAuB;IACpC,IAAI,CAAc;IACV,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACzD,gFAAgF;IAC/D,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpE,2DAA2D;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,YACmB,MAAiB,EAClC,YAA0B;QADT,WAAM,GAAN,MAAM,CAAW;QAGlC,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,UAAU,KAAK,gBAAgB;gBACpC,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,SAAS,CAAC,MAA4B,IAAI,CAAC,aAAa;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,GAAG;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,UAAmB;QAChC,MAAM,GAAG,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,+DAA+D,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,4CAA4C;IAC5C,SAAS,CACP,OAAe,EACf,OAAkE,EAAE;QAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAKV,EAAE;QACJ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAMb;QACC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAoD,EAAE;QAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO;YACL,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC;IACJ,CAAC;IAED,QAAQ,CACN,OAMI,EAAE;QAEN,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAMV;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAOV;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,QAIvB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,gNAAgN,CACjN,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAyB;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAEO,cAAc,CAAC,GAAyB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,kBAAkB,CACxB,IAAwB,EACxB,IAAwB,EACxB,QAA4B;QAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,iBAAiB,CACvB,IAAwB,EACxB,IAAwB,EACxB,QAA4B;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,IAAI,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1F,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,EAAE,QAAQ,CACpD,CAAC;QACF,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,gBAAgB;SAC3B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAW9C;;;GAGG;AACH,MAAM,OAAO,aAAa;IAYL;IAXnB,6FAA6F;IACpF,aAAa,CAAwB;IACrC,IAAI,CAAc;IACV,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACxC,eAAe,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC/D,gFAAgF;IAC/D,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpE,2DAA2D;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,YACmB,MAAiB,EAClC,YAA0B;QADT,WAAM,GAAN,MAAM,CAAW;QAGlC,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAChE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,UAAkB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,GAA0B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,GAAG;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CACX,OAA4D,EAAE;QAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,UAAmB;QAChC,MAAM,GAAG,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,qDAAqD,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CACP,OAAe,EACf,OAAkE,EAAE;QAEpE,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAKV,EAAE;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAMb;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAoD,EAAE;QAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO;YACL,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC;IACJ,CAAC;IAED,QAAQ,CACN,OAMI,EAAE;QAEN,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAMV;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAOV;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,QAIvB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,QAAQ,CAAC,GAAyB;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAEO,cAAc,CAAC,GAAyB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,kBAAkB,CACxB,IAAwB,EACxB,IAAwB,EACxB,QAA4B;QAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,iBAAiB,CACvB,IAAwB,EACxB,IAAwB,EACxB,QAA4B;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,IAAI,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1F,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,EAAE,QAAQ,CACpD,CAAC;QACF,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,gBAAgB;SAC3B,CAAC;IACJ,CAAC;CACF"}

package/dist/access/paradi-auth.d.ts

@@ -1,8 +1,8 @@
 /**
  * Paradi gateway SSH auth encodings (customer never chooses Mode names in mcp.json by default).
  *
- * - slash:    username = ACCESS_USER/TARGET_HOST/TARGET_USER, password = ACCESS_PASSWORD
- * - compound: username = ACCESS_USER, password = ACCESS_PASSWORD@##@TARGET_HOST:SSH:22:TARGET_USER
+ * - slash:    username = ACCESS_USER/<landing-ip>/TARGET_USER, password = ACCESS_PASSWORD
+ * - compound: username = ACCESS_USER, password = ACCESS_PASSWORD@##@<landing-ip>:SSH:22:TARGET_USER
  * - auto:     try slash then compound on AUTH_FAILED; pin winner for this MCP process
  */
 import type { AppConfig } from "../config.js";
@@ -28,6 +28,6 @@ export declare function parseParadiAuthSetting(raw: string | undefined): ParadiA
 export declare function resolveParadiAuthModesToTry(config: AppConfig): ParadiAuthMode[];
 export declare function buildParadiCompoundPassword(accessPassword: string, targetHost: string, targetUser: string, targetSshPort?: number): string;
 /** Build username+password for one Paradi auth mode (TCP still to ACCESS_HOST). */
-export declare function resolveParadiConnectParams(config: AppConfig, mode: ParadiAuthMode): ParadiConnectParams;
+export declare function resolveParadiConnectParams(config: AppConfig, mode: ParadiAuthMode, landingHost?: string): ParadiConnectParams;
 /** True when failure is auth-only (safe to try the other Paradi mode). */
 export declare function isParadiAuthFailureMessage(message: string): boolean;

package/dist/access/paradi-auth.js

@@ -48,16 +48,16 @@ export function buildParadiCompoundPassword(accessPassword, targetHost, targetUs
     const h = targetHost.trim();
     const u = targetUser.trim();
     if (!h || !u) {
-        throw new Error("paradi compound password requires TARGET_HOST and TARGET_USER");
+        throw new Error("paradi compound password requires a concrete TARGET_HOSTS landing IP and TARGET_USER");
     }
     return `${p}@##@${h}:SSH:${targetSshPort}:${u}`;
 }
 /** Build username+password for one Paradi auth mode (TCP still to ACCESS_HOST). */
-export function resolveParadiConnectParams(config, mode) {
-    const targetHost = config.targetHost?.trim();
+export function resolveParadiConnectParams(config, mode, landingHost) {
+    const targetHost = landingHost?.trim() || config.targetHost?.trim();
     const targetUser = config.targetUser?.trim();
     if (!targetHost || !targetUser) {
-        throw new Error("paradi-gateway requires TARGET_HOST and TARGET_USER");
+        throw new Error("paradi-gateway requires a concrete landing host (TARGET_HOSTS default or pass host) and TARGET_USER");
     }
     const host = config.accessHost;
     const port = config.accessPort;

package/dist/access/paradi-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"paradi-auth.js","sourceRoot":"","sources":["../../src/access/paradi-auth.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAc9D,kEAAkE;AAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE1D,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,OAAO,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,IAAoB;IACnE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mEAAmE,GAAG,IAAI,CAC3E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,cAAsB,EACtB,UAAkB,EAClB,UAAkB,EAClB,aAAa,GAAG,EAAE;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,aAAa,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CACxC,MAAiB,EACjB,IAAoB;IAEpB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE7C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;YAC3E,QAAQ,EAAE,cAAc;YACxB,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,UAAU;QAC3B,QAAQ,EAAE,2BAA2B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC;QAC7E,IAAI;KACL,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,mIAAmI,CAAC,IAAI,CAC7I,OAAO,CACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"paradi-auth.js","sourceRoot":"","sources":["../../src/access/paradi-auth.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAc9D,kEAAkE;AAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE1D,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,OAAO,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,IAAoB;IACnE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,mBAAmB;IACjC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mEAAmE,GAAG,IAAI,CAC3E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,cAAsB,EACtB,UAAkB,EAClB,UAAkB,EAClB,aAAa,GAAG,EAAE;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,aAAa,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CACxC,MAAiB,EACjB,IAAoB,EACpB,WAAoB;IAEpB,MAAM,UAAU,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE7C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;YAC3E,QAAQ,EAAE,cAAc;YACxB,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,UAAU;QAC3B,QAAQ,EAAE,2BAA2B,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC;QAC7E,IAAI;KACL,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,mIAAmI,CAAC,IAAI,CAC7I,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/access/paradi-transport.d.ts

@@ -6,5 +6,5 @@ export { buildParadiSshUsername } from "./paradi-username.js";
  * Runtime must not branch on Paradi; only Transport encodes gateway identity.
  */
 export declare class ParadiAccessTransport {
-    createContext(config: AppConfig): HostExecutionContext;
+    createContext(config: AppConfig, landingHost?: string): HostExecutionContext;
 }

package/dist/access/paradi-transport.js

@@ -6,14 +6,14 @@ export { buildParadiSshUsername } from "./paradi-username.js";
  * Runtime must not branch on Paradi; only Transport encodes gateway identity.
  */
 export class ParadiAccessTransport {
-    createContext(config) {
+    createContext(config, landingHost) {
         if (config.accessKind !== "paradi-gateway") {
             throw new Error(`ParadiAccessTransport only supports ACCESS_KIND=paradi-gateway (got ${config.accessKind})`);
         }
-        const targetHost = config.targetHost?.trim();
+        const targetHost = landingHost?.trim() || config.targetHost?.trim();
         const targetUser = config.targetUser?.trim();
         if (!targetHost || !targetUser) {
-            throw new Error("paradi-gateway requires TARGET_HOST and TARGET_USER (landing Context is the target host)");
+            throw new Error("paradi-gateway requires a concrete landing host (TARGET_HOSTS default or pass host) and TARGET_USER");
         }
         const sshUsername = buildParadiSshUsername(config.accessUser, targetHost, targetUser);
         return {

package/dist/access/paradi-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"paradi-transport.js","sourceRoot":"","sources":["../../src/access/paradi-transport.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IAChC,aAAa,CAAC,MAAiB;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,UAAU,GAAG,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CACxC,MAAM,CAAC,UAAU,EACjB,UAAU,EACV,UAAU,CACX,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,MAAM,CAAC,UAAU;gBACvB,YAAY,EAAE,WAAW;aAC1B,CAAC;YACF,SAAS,EAAE,gBAAgB;YAC3B,iEAAiE;YACjE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1D,YAAY,EAAE;gBACZ,GAAG,mBAAmB,CAAC,IAAI,CAAC;gBAC5B,8EAA8E;gBAC9E,IAAI,EAAE,UAAU;gBAChB,oBAAoB,EAAE,IAAI;aAC3B;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"paradi-transport.js","sourceRoot":"","sources":["../../src/access/paradi-transport.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IAChC,aAAa,CAAC,MAAiB,EAAE,WAAoB;QACnD,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,UAAU,GAAG,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CACxC,MAAM,CAAC,UAAU,EACjB,UAAU,EACV,UAAU,CACX,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,MAAM,CAAC,UAAU;gBACvB,YAAY,EAAE,WAAW;aAC1B,CAAC;YACF,SAAS,EAAE,gBAAgB;YAC3B,iEAAiE;YACjE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1D,YAAY,EAAE;gBACZ,GAAG,mBAAmB,CAAC,IAAI,CAAC;gBAC5B,8EAA8E;gBAC9E,IAAI,EAAE,UAAU;gBAChB,oBAAoB,EAAE,IAAI;aAC3B;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/access/paradi-username.d.ts

@@ -1,5 +1,5 @@
 /**
  * Paradi Mode A identity encoding (user never puts this string in mcp.json).
- * sshUsername = ACCESS_USER/TARGET_HOST/TARGET_USER
+ * sshUsername = ACCESS_USER/<landing-ip>/TARGET_USER
  */
 export declare function buildParadiSshUsername(accessUser: string, targetHost: string, targetUser: string): string;

package/dist/access/paradi-username.js

@@ -1,13 +1,13 @@
 /**
  * Paradi Mode A identity encoding (user never puts this string in mcp.json).
- * sshUsername = ACCESS_USER/TARGET_HOST/TARGET_USER
+ * sshUsername = ACCESS_USER/<landing-ip>/TARGET_USER
  */
 export function buildParadiSshUsername(accessUser, targetHost, targetUser) {
     const a = accessUser.trim();
     const h = targetHost.trim();
     const u = targetUser.trim();
     if (!a || !h || !u) {
-        throw new Error("paradi-gateway requires ACCESS_USER, TARGET_HOST, and TARGET_USER to build SSH username");
+        throw new Error("paradi-gateway requires ACCESS_USER, a concrete TARGET_HOSTS landing IP, and TARGET_USER to build SSH username");
     }
     return `${a}/${h}/${u}`;
 }

package/dist/access/paradi-username.js.map

@@ -1 +1 @@
-{"version":3,"file":"paradi-username.js","sourceRoot":"","sources":["../../src/access/paradi-username.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,UAAkB,EAClB,UAAkB;IAElB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"paradi-username.js","sourceRoot":"","sources":["../../src/access/paradi-username.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,UAAkB,EAClB,UAAkB;IAElB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1B,CAAC"}

package/dist/access/session-pool.d.ts

@@ -8,6 +8,9 @@ type PoolEntry = {
     host: string;
     user: string;
     password?: string;
+} | {
+    kind: "paradi-landing";
+    host: string;
 };
 /**
  * Session pool keyed by context.key. Context itself never holds clients.
@@ -19,6 +22,8 @@ export declare class SessionPool {
     constructor(accessClient: AccessClient);
     bindAccess(ctx: HostExecutionContext): void;
     bindDerived(ctx: HostExecutionContext, spec: DeriveSpec): void;
+    /** Paradi: selected TARGET landing (new gateway identity, not hop-2 from ACCESS). */
+    bindParadiLanding(ctx: HostExecutionContext, host: string): void;
     getEntry(contextKey: string): PoolEntry | undefined;
     exec(ctx: HostExecutionContext, command: string, timeoutMs?: number, cwd?: string): Promise<ExecOutput>;
 }

package/dist/access/session-pool.js

@@ -24,6 +24,10 @@ export class SessionPool {
             password: spec.password,
         });
     }
+    /** Paradi: selected TARGET landing (new gateway identity, not hop-2 from ACCESS). */
+    bindParadiLanding(ctx, host) {
+        this.entries.set(ctx.key, { kind: "paradi-landing", host });
+    }
     getEntry(contextKey) {
         return this.entries.get(contextKey);
     }
@@ -35,6 +39,9 @@ export class SessionPool {
         if (entry.kind === "access") {
             return this.accessClient.exec(command, timeoutMs, cwd);
         }
+        if (entry.kind === "paradi-landing") {
+            return this.accessClient.exec(command, timeoutMs, cwd, undefined, entry.host);
+        }
         // Derived host: wrap command in ssh from ACCESS (accessClient) session.
         const remoteCommand = cwd
             ? `cd ${bashSingleQuote(cwd)} && ${command}`

package/dist/access/session-pool.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-pool.js","sourceRoot":"","sources":["../../src/access/session-pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAajF;;;GAGG;AACH,MAAM,OAAO,WAAW;IAGO;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAExD,YAA6B,YAA0B;QAA1B,iBAAY,GAAZ,YAAY,CAAc;IAAG,CAAC;IAE3D,UAAU,CAAC,GAAyB;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,GAAyB,EAAE,IAAgB;QACrD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;YACxB,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAyB,EACzB,OAAe,EACf,SAAkB,EAClB,GAAY;QAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,wEAAwE;QACxE,MAAM,aAAa,GAAG,GAAG;YACvB,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE;YAC5C,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,UAAU,GAAG,qBAAqB,CACtC,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,EACV,aAAa,EACb,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"session-pool.js","sourceRoot":"","sources":["../../src/access/session-pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAiBjF;;;GAGG;AACH,MAAM,OAAO,WAAW;IAGO;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAExD,YAA6B,YAA0B;QAA1B,iBAAY,GAAZ,YAAY,CAAc;IAAG,CAAC;IAE3D,UAAU,CAAC,GAAyB;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,GAAyB,EAAE,IAAgB;QACrD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;YACxB,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,iBAAiB,CAAC,GAAyB,EAAE,IAAY;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAyB,EACzB,OAAe,EACf,SAAkB,EAClB,GAAY;QAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,wEAAwE;QACxE,MAAM,aAAa,GAAG,GAAG;YACvB,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE;YAC5C,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,UAAU,GAAG,qBAAqB,CACtC,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,EACV,aAAa,EACb,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/access/ssh-transport.d.ts

@@ -1,4 +1,4 @@
-import type { AppConfig } from "../config.js";
+import { type AppConfig } from "../config.js";
 import { type DeriveSpec, type HostExecutionContext } from "./types.js";
 /**
  * SSH AccessTransport: produce HostExecutionContext only (no sessions).

package/dist/access/ssh-transport.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { defaultTargetHost } from "../config.js";
 import { buildContextKey, initialCapabilities, } from "./types.js";
 function deriveAuthIdentity(spec) {
     if (!spec.password) {
@@ -56,13 +57,13 @@ export class SshAccessTransport {
     }
     /** Default derive target from config (selector only ??does not create a Context). */
     defaultDeriveSpec(config) {
-        const host = config.targetHost?.trim();
+        const host = config.targetHost?.trim() || defaultTargetHost(config.targetHosts ?? []);
         if (!host) {
             return undefined;
         }
         const user = config.targetUser?.trim();
         if (!user) {
-            throw new Error("TARGET_HOST is set but TARGET_USER is missing");
+            throw new Error("TARGET_HOSTS is set but TARGET_USER is missing");
         }
         return {
             host,

package/dist/access/ssh-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-transport.js","sourceRoot":"","sources":["../../src/access/ssh-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,mBAAmB,GAGpB,MAAM,YAAY,CAAC;AAEpB,SAAS,kBAAkB,CAAC,IAAgB;IAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAC7B,mBAAmB,CAAC,MAAiB;QACnC,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,yDAAyD,MAAM,CAAC,UAAU,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,IAAI;gBACJ,IAAI,EAAE,MAAM,CAAC,UAAU;gBACvB,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE;YACjD,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,MAA4B,EAAE,IAAgB;QAC1D,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC;aACvC,CAAC;YACF,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;YACrE,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,iBAAiB,CAAC,MAAiB;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,cAAc;SAChC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"ssh-transport.js","sourceRoot":"","sources":["../../src/access/ssh-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAkB,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,eAAe,EACf,mBAAmB,GAGpB,MAAM,YAAY,CAAC;AAEpB,SAAS,kBAAkB,CAAC,IAAgB;IAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAC7B,mBAAmB,CAAC,MAAiB;QACnC,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,yDAAyD,MAAM,CAAC,UAAU,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,IAAI;gBACJ,IAAI,EAAE,MAAM,CAAC,UAAU;gBACvB,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE;YACjD,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,MAA4B,EAAE,IAAgB;QAC1D,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO;YACL,GAAG,EAAE,eAAe,CAAC;gBACnB,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC;aACvC,CAAC;YACF,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;YACrE,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,iBAAiB,CAAC,MAAiB;QACjC,MAAM,IAAI,GACR,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,cAAc;SAChC,CAAC;IACJ,CAAC;CACF"}