impreza-mcp 0.40.0 → 0.42.0

package/README.md

@@ -230,7 +230,10 @@ you opening a browser:
   rather than per account.
 - **Tor is a deployment target, not an add-on.** `impreza_add_onion` gives a
   deployment a `.onion` address in one call, so an agent can publish a hidden
-  service the same way it publishes a normal site.
+  service the same way it publishes a normal site. `impreza_onion_auth_*`
+  manage Tor v3 restricted discovery (client authorization): private keys
+  never leave the customer's Tor client unless they ask the server to
+  generate a keypair — and then the private key is shown once, never stored.
 - **No API key in your config.** The hosted connector authenticates over OAuth.
 
 If none of that matters for your project, a mainstream provider is a perfectly
@@ -431,6 +434,13 @@ and `impreza_api_search` finds anything not named here.
 | `impreza_restart_deployment` | `POST .../restart` |
 | `impreza_redeploy_deployment` | `POST .../custom/{id}/redeploy` (in-place rebuild, same domain) |
 | `impreza_add_onion` | `POST .../onion/add` |
+| `impreza_set_onion_profile` | `POST .../onion/profile` (`standard` / `hardened` / `max` hardening tiers) |
+| `impreza_export_onion_key` | `POST .../onion/export` (sealed to your X25519 key; plaintext never transits) |
+| `impreza_fetch_onion_key_export` | `GET .../onion/export/{command_id}` (read-once — the blob is burned) |
+| `impreza_rotate_onion_key` | `POST .../onion/rotate` (new .onion; the old address dies) |
+| `impreza_onion_auth_list` | `GET .../onion/clients` |
+| `impreza_onion_auth_add` | `POST .../onion/clients` (`pubkey`, or `generate:true` → `private_key` shown once) |
+| `impreza_onion_auth_revoke` | `DELETE .../onion/clients/{name}` |
 | `impreza_change_domain` | `POST .../domain` |
 | `impreza_git_webhook_status` | `GET .../custom/{id}/git-webhook` |
 | `impreza_git_webhook_connect` | `POST .../custom/{id}/git-webhook/connect` |
@@ -583,6 +593,42 @@ The IP of the machine running this MCP server (almost always your
 laptop) must be on the API key's whitelist. Manage the whitelist in
 your Impreza clientarea.
 
+## Using over Tor
+
+The MCP server can route every API call through a local Tor daemon, so
+API requests use the configured proxy. Your network provider can still observe
+your connection to Tor; this option does not hide that you are using Tor.
+
+  1. Install and start Tor (the `tor` daemon, or Tor Browser — both
+     commonly expose a SOCKS5 listener on `127.0.0.1:9050` for the daemon
+     or `127.0.0.1:9150` for Tor Browser; check your local configuration).
+  2. Add `IMPREZA_PROXY` to the MCP config env:
+
+     ```json
+     "env": {
+       "IMPREZA_API_KEY": "imp_...",
+       "IMPREZA_API_SECRET": "...",
+       "IMPREZA_PROXY": "socks5://127.0.0.1:9050"
+     }
+     ```
+
+Every API request then exits through Tor, and the API hostname is
+resolved by Tor itself (remote DNS) — nothing is resolved locally, so
+no DNS leak. The transport fails closed: if the proxy is unreachable
+or refuses the connection, the request fails — it never silently falls
+back to a direct clearnet connection.
+
+Optionally point `IMPREZA_BASE_URL` at the API's `.onion` mirror —
+`http://` is accepted only for v3 `.onion` hosts, since Tor authenticates and
+encrypts onion connections. Clearnet hosts require `https://`. An onion URL
+also requires an explicit `IMPREZA_PROXY`; the client refuses direct DNS and
+connections even when the onion URL uses HTTPS. Proxy requests refuse redirects,
+use a bounded request deadline and accept response bodies up to 16 MiB.
+
+One account-side adjustment: Tor exit IPs rotate constantly, so a
+fixed-IP whitelist on the API key cannot work. Set the key's IP factor
+to `tofu` or `keyonly` in the clientarea.
+
 ## PHP deployments
 
 Use `impreza_prepare_project` with `composer_json` and optionally `php_document_root` to review a PHP app. Deploy with `impreza_deploy_custom`, `mode: "dockerfile"` and `build_strategy: "php_composer"`, using Git, a local directory or a retained upload. The PHP 8.4/Apache recipe installs production dependencies from `composer.json` and a matching `composer.lock`, without Composer scripts or plugins, and checks actual platform requirements. Choose `project_dir` for the application and `php_document_root` for its public subfolder containing `index.php` (default `public`). Apache runs as a non-root user on `target_port` (default 8080, minimum 1024); it serves public files and sends missing paths to `index.php`.
@@ -670,3 +716,32 @@ The custom deploy and preparation tools also support `static_files` and
 `go_build`. Metrics and MariaDB bindings require agent 0.6.17 or newer.
 See [configuration, metrics and recovery](https://docs.imprezahost.com/customer-workflows.html)
 for permissions, examples and limits. No automatic server update occurs.
+
+### Isolated runtime through Tor (0.42.0)
+
+Custom image and source deployments can opt in with `tor_egress: true` through
+`impreza_deploy_custom` and saved deployment preparation. This option needs an
+agent advertising `tor-egress-v1`, Docker Engine 28+, and a SOCKS5h-capable
+application. The runtime has no direct outbound fallback. Source downloads,
+image pulls and builds retain the server's normal network connection. Catalog
+installs, imported manifests and external service bindings are unsupported.
+See the [Tor runtime guide](https://docs.imprezahost.com/onion-services.html#runtime-egress)
+for availability and verification. This option is separate from using Tor to
+connect the MCP client itself and from publishing an inbound onion address.
+
+## Private onion previews and retained identities (0.42.0)
+
+Preview creation supports `private: true`; optionally supply one or more `onion_clients`.
+Supplied reviewers use a name and X25519 public key. Without supplied clients, a reviewer keypair is generated and the private key is shown once. This mode requires agent
+0.6.20 with `onion-private-preview-v1`; reviewer authorization is installed
+before the first onion publication. Repeated deploys preserve later revocations.
+Do not combine this option with password-protected HTTPS previews.
+
+`impreza_purge_onion_key` requires the exact old onion address and explicit
+confirmation. Queued work is not proof of deletion: inspect its completed
+result. Active addresses are refused. Purge removes retained copies on that
+server; exports and backups elsewhere remain. Releasing a reservation for an
+uninstalled application does not delete key material.
+
+See the [onion guide](https://docs.imprezahost.com/onion-services.html)
+for permissions, customer update steps and supported limitations.

package/dist/client.d.ts

@@ -4,12 +4,19 @@ export interface ImprezaConfig {
     apiSecret: string;
     /** Wall-clock budget per HTTP call. Default 60s. */
     timeoutMs?: number;
+    /**
+     * Optional `socks5://host:port` proxy (typically a local Tor daemon) that
+     * EVERY API call is routed through. Fail-closed: when set and the proxy is
+     * unreachable, requests fail — there is no silent fallback to clearnet.
+     */
+    proxy?: string;
 }
 export declare class ImprezaClient {
     private readonly baseURL;
     private readonly apiKey;
     private readonly apiSecret;
     private readonly timeoutMs;
+    private readonly proxy;
     constructor(cfg: ImprezaConfig);
     /**
      * Authenticated GET. Decodes the standard envelope ({success, data,
@@ -47,6 +54,15 @@ export declare class ImprezaClient {
      */
     postRaw<T>(path: string, contentType: string, bytes: Uint8Array): Promise<T>;
     private fetch;
+    /**
+     * fetch() equivalent routed through the configured SOCKS5 proxy. The proxy
+     * resolves the target hostname (remote DNS — no local lookup, no leak) and
+     * TLS, when the URL is https, is layered on top of the proxied socket. Uses
+     * node:http with a per-request `createConnection` (the one form Node honors
+     * — an Agent-constructor option is silently ignored), so no dependency is
+     * needed. Any proxy/handshake failure throws: fail closed, never direct.
+     */
+    private proxiedFetch;
     private parseEnvelope;
 }
 import { VERSION } from './version.js';

package/dist/client.js

@@ -2,25 +2,38 @@
 // OpenAPI surface in impreza-platform/specs/openapi-platform.yaml.
 //
 // Auth: standard X-API-Key + X-API-Secret headers, sourced from env.
-// Network: native fetch (Node ≥ 20 has it). No retry / circuit-breaker
-// in v1 — the AI client retries the tool call if it cares.
+// Network: native fetch (Node ≥ 20 has it), or a hand-rolled no-auth SOCKS5
+// transport over node:net/node:http when `proxy` is configured (Tor usage —
+// see socks5.ts). No retry / circuit-breaker in v1 — the AI client retries
+// the tool call if it cares.
 import { createHash } from 'node:crypto';
+import { once } from 'node:events';
 import { readFile, stat } from 'node:fs/promises';
+import http from 'node:http';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createWriteStream } from 'node:fs';
+import tls from 'node:tls';
 import { unlink } from 'node:fs/promises';
 import * as tar from 'tar';
+import { parseSocksProxy, socks5Connect } from './socks5.js';
+import { isOnionHost } from './env.js';
 export class ImprezaClient {
     baseURL;
     apiKey;
     apiSecret;
     timeoutMs;
+    proxy;
     constructor(cfg) {
         this.baseURL = cfg.baseURL.replace(/\/+$/, '');
         this.apiKey = cfg.apiKey;
         this.apiSecret = cfg.apiSecret;
         this.timeoutMs = cfg.timeoutMs ?? 60_000;
+        this.proxy = cfg.proxy ? parseSocksProxy(cfg.proxy) : undefined;
+        const host = new URL(this.baseURL).hostname;
+        if (host.endsWith('.onion') && (!isOnionHost(host) || !this.proxy)) {
+            throw new Error('An onion API requires a valid v3 hostname and an explicit SOCKS5 proxy; no direct connection is allowed.');
+        }
     }
     /**
      * Authenticated GET. Decodes the standard envelope ({success, data,
@@ -106,25 +119,26 @@ export class ImprezaClient {
     async fetch(url, init) {
         const ctrl = new AbortController();
         const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+        const headers = {
+            Accept: 'application/json',
+            'X-API-Key': this.apiKey,
+            'X-API-Secret': this.apiSecret,
+            'User-Agent': `impreza-mcp/${VERSION}`,
+            // All callers pass plain objects — cast keeps HeadersInit's array/Headers
+            // variants from poisoning the merged shape.
+            ...(init.headers ?? {}),
+        };
         try {
-            const res = await fetch(url, {
-                ...init,
-                headers: {
-                    Accept: 'application/json',
-                    'X-API-Key': this.apiKey,
-                    'X-API-Secret': this.apiSecret,
-                    'User-Agent': `impreza-mcp/${VERSION}`,
-                    ...(init.headers ?? {}),
-                },
-                // The credentials above are CUSTOM headers. Fetch strips Authorization,
-                // Cookie and Proxy-Authorization when a redirect crosses to another
-                // origin — it has no idea ours are credentials, so it would carry the
-                // customer's key and secret to whatever host a 3xx names. The API
-                // answers JSON on every endpoint and never redirects, so we take the
-                // redirect ourselves and refuse it.
-                redirect: 'manual',
-                signal: ctrl.signal,
-            });
+            // The credentials above are CUSTOM headers. Fetch strips Authorization,
+            // Cookie and Proxy-Authorization when a redirect crosses to another
+            // origin — it has no idea ours are credentials, so it would carry the
+            // customer's key and secret to whatever host a 3xx names. The API
+            // answers JSON on every endpoint and never redirects, so we take the
+            // redirect ourselves and refuse it. (node:http never follows redirects
+            // at all, so the proxied path is equally strict by construction.)
+            const res = this.proxy
+                ? await this.proxiedFetch(url, init, headers, ctrl.signal)
+                : await fetch(url, { ...init, headers, redirect: 'manual', signal: ctrl.signal });
             if (res.status >= 300 && res.status < 400) {
                 throw new Error(`UNEXPECTED_REDIRECT: the API answered HTTP ${res.status} for ${url.pathname}. ` +
                     'Refusing to resend your API credentials to the redirect target. ' +
@@ -136,6 +150,91 @@ export class ImprezaClient {
             clearTimeout(timer);
         }
     }
+    /**
+     * fetch() equivalent routed through the configured SOCKS5 proxy. The proxy
+     * resolves the target hostname (remote DNS — no local lookup, no leak) and
+     * TLS, when the URL is https, is layered on top of the proxied socket. Uses
+     * node:http with a per-request `createConnection` (the one form Node honors
+     * — an Agent-constructor option is silently ignored), so no dependency is
+     * needed. Any proxy/handshake failure throws: fail closed, never direct.
+     */
+    async proxiedFetch(url, init, headers, signal) {
+        if (!this.proxy)
+            throw new Error('proxiedFetch without a configured proxy');
+        const isTls = url.protocol === 'https:';
+        const port = url.port ? Number(url.port) : isTls ? 443 : 80;
+        let socket;
+        const onAbort = () => socket?.destroy(new Error('Proxied request aborted'));
+        signal.addEventListener('abort', onAbort);
+        try {
+            signal.throwIfAborted();
+            socket = await socks5Connect(this.proxy, url.hostname, port, this.timeoutMs, signal);
+            signal.throwIfAborted();
+            if (isTls) {
+                const tlsSocket = tls.connect({ socket, servername: url.hostname });
+                // Abort removes once() listeners before destroy(error) emits. Keep a
+                // sink for that late event; the awaited handshake/request still rejects.
+                tlsSocket.on('error', () => { });
+                socket = tlsSocket;
+                await once(tlsSocket, 'secureConnect', { signal });
+            }
+            const established = socket;
+            const body = init.body;
+            const reqHeaders = { ...headers };
+            if (body !== undefined) {
+                reqHeaders['Content-Length'] = String(typeof body === 'string' ? Buffer.byteLength(body) : body.byteLength);
+            }
+            return await new Promise((resolve, reject) => {
+                const req = http.request({
+                    method: init.method ?? 'GET',
+                    host: url.hostname,
+                    port,
+                    path: url.pathname + url.search,
+                    headers: reqHeaders,
+                    createConnection: () => established,
+                }, (res) => {
+                    const chunks = [];
+                    let bytes = 0;
+                    res.on('data', (c) => {
+                        bytes += c.length;
+                        if (bytes > 16 * 1024 * 1024) {
+                            req.destroy(new Error('Proxied response exceeds 16 MiB'));
+                            return;
+                        }
+                        chunks.push(c);
+                    });
+                    res.on('end', () => {
+                        try {
+                            const resHeaders = new Headers();
+                            for (let i = 0; i + 1 < res.rawHeaders.length; i += 2) {
+                                resHeaders.append(res.rawHeaders[i], res.rawHeaders[i + 1]);
+                            }
+                            resolve(new Response([204, 205, 304].includes(res.statusCode ?? 0) ? null : Buffer.concat(chunks), {
+                                status: res.statusCode ?? 502,
+                                statusText: res.statusMessage ?? '',
+                                headers: resHeaders,
+                            }));
+                        }
+                        catch (err) {
+                            reject(err);
+                        }
+                    });
+                    res.on('error', reject);
+                    res.on('aborted', () => reject(new Error('Proxied response was truncated')));
+                });
+                req.setTimeout(this.timeoutMs, () => req.destroy(new Error(`proxied request timed out after ${this.timeoutMs}ms`)));
+                req.on('error', reject);
+                if (body !== undefined)
+                    req.write(body);
+                req.end();
+                established.resume();
+            });
+        }
+        finally {
+            signal.removeEventListener('abort', onAbort);
+            socket?.destroy();
+        }
+    }
     async parseEnvelope(res) {
         const text = await res.text();
         let env;

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,mEAAmE;AACnE,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,2DAA2D;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAU3B,MAAM,OAAO,aAAa;IACP,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAEnC,YAAY,GAAkB;QAC5B,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAA8B;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAa;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;QACvC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,WAAmB,EAAE,KAAiB;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;YACxC,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAQ,EAAE,IAAiB;QAC7C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,WAAW,EAAE,IAAI,CAAC,MAAM;oBACxB,cAAc,EAAE,IAAI,CAAC,SAAS;oBAC9B,YAAY,EAAE,eAAe,OAAO,EAAE;oBACtC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;iBACxB;gBACD,wEAAwE;gBACxE,oEAAoE;gBACpE,sEAAsE;gBACtE,kEAAkE;gBAClE,qEAAqE;gBACrE,oCAAoC;gBACpC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAQ,IAAI;oBAC9E,kEAAkE;oBAClE,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAI,GAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAiH,CAAC;QACtH,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,wBAAwB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,wBAAwB,GAAG,CAAC,MAAM,GAAG,CAAC;YACxE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAQ,GAAG,CAAC,IAAU,IAAK,SAA0B,CAAC;IACxD,CAAC;CACF;AAED,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,CAAC;AA+EnB,wEAAwE;AACxE,2DAA2D;AAC3D,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qBAAqB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjH,0DAA0D;IAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1B,GAAG;aACA,MAAM,CACL;YACE,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,UAAU;YACf,0DAA0D;YAC1D,gEAAgE;YAChE,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;SAC5C,EACD,CAAC,GAAG,CAAC,CACN;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO;QACL,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3H,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhF,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,mEAAmE;AACnE,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,6BAA6B;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAgBvC,MAAM,OAAO,aAAa;IACP,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,KAAK,CAAyB;IAE/C,YAAY,GAAkB;QAC5B,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC9H,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAA8B;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAa;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;QACvC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,WAAmB,EAAE,KAAiB;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;YACxC,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAQ,EAAE,IAAiB;QAC7C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,cAAc,EAAE,IAAI,CAAC,SAAS;YAC9B,YAAY,EAAE,eAAe,OAAO,EAAE;YACtC,0EAA0E;YAC1E,4CAA4C;YAC5C,GAAG,CAAE,IAAI,CAAC,OAA8C,IAAI,EAAE,CAAC;SAChE,CAAC;QACF,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK;gBACpB,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;gBAC1D,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAQ,IAAI;oBAC9E,kEAAkE;oBAClE,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CACxB,GAAQ,EACR,IAAiB,EACjB,OAA+B,EAC/B,MAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,MAA8C,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrF,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpE,qEAAqE;gBACrE,yEAAyE;gBACzE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAChC,MAAM,GAAG,SAAS,CAAC;gBACnB,MAAM,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAuC,CAAC;YAC1D,MAAM,UAAU,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,UAAU,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;oBACE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;oBAC5B,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,IAAI;oBACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;oBAC/B,OAAO,EAAE,UAAU;oBACnB,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW;iBACpC,EACD,CAAC,GAAG,EAAE,EAAE;oBACN,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;oBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;wBAC3B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;wBAClB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;4BAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;4BAAC,OAAO;wBAAC,CAAC;wBACpG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjB,CAAC,CAAC,CAAC;oBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;wBACjB,IAAI,CAAC;4BACL,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;4BACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gCACtD,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;4BAClF,CAAC;4BACD,OAAO,CACL,IAAI,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gCACzF,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG;gCAC7B,UAAU,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;gCACnC,OAAO,EAAE,UAAU;6BACpB,CAAC,CACH,CAAC;wBACF,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,CAAC;oBAChC,CAAC,CAAC,CAAC;oBACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBACxB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC;gBAC/E,CAAC,CACF,CAAC;gBACF,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxB,IAAI,IAAI,KAAK,SAAS;oBAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,WAAW,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAI,GAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAiH,CAAC;QACtH,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,wBAAwB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,wBAAwB,GAAG,CAAC,MAAM,GAAG,CAAC;YACxE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAQ,GAAG,CAAC,IAAU,IAAK,SAA0B,CAAC;IACxD,CAAC;CACF;AAED,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,CAAC;AA+EnB,wEAAwE;AACxE,2DAA2D;AAC3D,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qBAAqB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjH,0DAA0D;IAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1B,GAAG;aACA,MAAM,CACL;YACE,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,UAAU;YACf,0DAA0D;YAC1D,gEAAgE;YAChE,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;SAC5C,EACD,CAAC,GAAG,CAAC,CACN;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO;QACL,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3H,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhF,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const isOnionHost: (host: string) => boolean;
+export declare const IMPREZA_BASE_URL_SCHEMA: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
+export declare const IMPREZA_PROXY_SCHEMA: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+export declare const envSchema: z.ZodEffects<z.ZodObject<{
+    IMPREZA_API_KEY: z.ZodString;
+    IMPREZA_API_SECRET: z.ZodString;
+    IMPREZA_BASE_URL: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
+    IMPREZA_PROXY: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strip", z.ZodTypeAny, {
+    IMPREZA_API_KEY: string;
+    IMPREZA_API_SECRET: string;
+    IMPREZA_BASE_URL: string;
+    IMPREZA_PROXY?: string | undefined;
+}, {
+    IMPREZA_API_KEY: string;
+    IMPREZA_API_SECRET: string;
+    IMPREZA_BASE_URL?: string | undefined;
+    IMPREZA_PROXY?: string | undefined;
+}>, {
+    IMPREZA_API_KEY: string;
+    IMPREZA_API_SECRET: string;
+    IMPREZA_BASE_URL: string;
+    IMPREZA_PROXY?: string | undefined;
+}, {
+    IMPREZA_API_KEY: string;
+    IMPREZA_API_SECRET: string;
+    IMPREZA_BASE_URL?: string | undefined;
+    IMPREZA_PROXY?: string | undefined;
+}>;

package/dist/env.js

@@ -0,0 +1,67 @@
+// Env validation for the MCP server, extracted from server.ts so the rules
+// can be unit-tested without booting the server itself.
+import { z } from 'zod';
+import { parseSocksProxy } from './socks5.js';
+// IMPREZA_BASE_URL must be https:// — the API key + secret travel in request
+// headers on every call, so an http:// (or otherwise downgraded) base URL
+// would expose them in cleartext. Refusing non-https here prevents an
+// attacker who can influence the environment from pointing the client at a
+// malicious or plaintext endpoint to harvest credentials.
+//
+// The single exception is a .onion host: onion circuits are end-to-end
+// encrypted by Tor itself, so http:// to a .onion never crosses the network
+// in cleartext. A proxy is mandatory for either scheme on an onion host.
+export const isOnionHost = (host) => /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z2-7]{56}\.onion$/i.test(host);
+export const IMPREZA_BASE_URL_SCHEMA = z
+    .string()
+    .url()
+    .refine((u) => {
+    let url;
+    try {
+        url = new URL(u);
+    }
+    catch {
+        return false;
+    }
+    if (url.username || url.password || url.search || url.hash)
+        return false;
+    if (url.hostname.endsWith('.onion') && !isOnionHost(url.hostname))
+        return false;
+    if (url.protocol === 'https:')
+        return true;
+    return url.protocol === 'http:' && isOnionHost(url.hostname);
+}, 'IMPREZA_BASE_URL must be an https:// URL — http:// is accepted only for .onion hosts')
+    .default('https://api.imprezahost.com');
+// IMPREZA_PROXY routes every API call through a local SOCKS5 proxy (typically
+// the Tor daemon). Format checked with the same parser the client uses, so a
+// value that validates here cannot fail at request time.
+export const IMPREZA_PROXY_SCHEMA = z
+    .string()
+    .refine((v) => {
+    try {
+        parseSocksProxy(v);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, 'IMPREZA_PROXY must be a socks5://host:port URL (e.g. socks5://127.0.0.1:9050)')
+    .optional();
+export const envSchema = z.object({
+    IMPREZA_API_KEY: z.string().min(8, 'IMPREZA_API_KEY must be set (starts with imp_)'),
+    IMPREZA_API_SECRET: z.string().min(16, 'IMPREZA_API_SECRET must be set'),
+    IMPREZA_BASE_URL: IMPREZA_BASE_URL_SCHEMA,
+    IMPREZA_PROXY: IMPREZA_PROXY_SCHEMA,
+}).superRefine((cfg, ctx) => {
+    let host;
+    try {
+        host = new URL(cfg.IMPREZA_BASE_URL).hostname;
+    }
+    catch {
+        return;
+    }
+    if (host.endsWith('.onion') && !cfg.IMPREZA_PROXY) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['IMPREZA_PROXY'], message: 'An onion API requires IMPREZA_PROXY; direct DNS and connections are refused.' });
+    }
+});
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,6EAA6E;AAC7E,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrI,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;IACZ,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC,EAAE,sFAAsF,CAAC;KACzF,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;IACZ,IAAI,CAAC;QACH,eAAe,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EAAE,+EAA+E,CAAC;KAClF,QAAQ,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,gDAAgD,CAAC;IACpF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,gCAAgC,CAAC;IACxE,gBAAgB,EAAE,uBAAuB;IACzC,aAAa,EAAE,oBAAoB;CACpC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;IAClK,CAAC;AACH,CAAC,CAAC,CAAC"}