lorenz 0.1.4 → 0.1.6

package/node_modules/@lorenz/mcp/dist/agentEndpoint.js

@@ -1,6 +1,6 @@
 import { httpUrlHost, isRecord, normalizeHttpBindHost, } from "@lorenz/domain";
 import { startMcpServer } from "./server.js";
-import { issueMcpToken, mcpAuthScopeForSettings, revokeMcpToken } from "./auth.js";
+import { issueMcpToken, issueRunMcpToken, mcpAuthScopeForSettings, revokeMcpToken, revokeRunClaim, } from "./auth.js";
 export function trackerMcpServerName(kind) {
     return `lorenz_${(kind ?? "tracker").replace(/[^A-Za-z0-9_]/g, "_")}`;
 }
@@ -8,6 +8,19 @@ const mcpPath = "/mcp";
 const configuredMcpProbeId = "lorenz-configured-mcp-probe";
 const localMcpServers = new Map();
 const localMcpServerLocks = new Map();
+/**
+ * Monotonic generation per host:port slot, surviving entry teardown so a
+ * recreated entry gets a STRICTLY higher generation than the one it replaces.
+ * The fence (re-checked per request via the injected `isRunLive`) rejects any
+ * Token B minted against a prior, now-recycled generation of the same slot.
+ */
+const localMcpServerGenerations = new Map();
+/**
+ * Coarse lifetime cap on a per-run claim (Token B). The claim is primarily
+ * run-lifetime-bound via the injected `isRunLive` re-check; this backstop only
+ * bounds a leaked token that somehow outlives both its run and its generation.
+ */
+const runClaimMaxLifetimeMs = 24 * 60 * 60 * 1000;
 export async function acquireAgentMcpEndpoint(settings, workerHost, tunnels) {
     let endpoint = null;
     let token = null;
@@ -22,6 +35,7 @@ export async function acquireAgentMcpEndpoint(settings, workerHost, tunnels) {
         return {
             url: endpoint.url,
             token,
+            generation: endpoint.generation,
             acpServer: () => ({
                 type: "http",
                 name: trackerMcpServerName(settings.tracker.kind),
@@ -56,18 +70,35 @@ export async function acquireAgentMcpEndpoint(settings, workerHost, tunnels) {
         throw error;
     }
 }
-export async function acquireAgentMcpEndpointForRun(settings, workerHost, runKey, tunnels) {
+export async function acquireAgentMcpEndpointForRun(settings, workerHost, runKey, tunnels, isRunLive) {
+    // Token B is bound to a per-run claim whose `workerHost` is the run's REAL ssh
+    // host (the gateway re-checks `isRunLive(runKey, workerHost, generation)` against
+    // it). An empty `workerHost` denotes a LOCAL/acp run, routed through the per-run
+    // manager's null/local path - it must NEVER reach this minting path. Fail loud:
+    // a local run here would otherwise mint a claim stamped `workerHost: ""` that
+    // `isRunLive` could match against any other local slot, and the per-run claim
+    // model only applies to real remote hosts.
+    if (workerHost.length === 0) {
+        throw new Error("per_run_mcp_endpoint_requires_remote_worker_host");
+    }
     let endpoint = null;
     let token = null;
     let released = false;
     try {
         const configuredToken = issueConfiguredMcpToken(settings);
-        token = configuredToken?.token ?? null;
-        endpoint = await acquirePerRunMcpEndpoint(workerHost, runKey, settings, configuredToken, tunnels);
-        token ??= issueMcpToken(endpoint.authScope);
+        endpoint = await acquirePerRunMcpEndpoint(workerHost, runKey, settings, configuredToken, tunnels, isRunLive);
+        // The per-run lease is scoped solely by Token B (minted below), never by the
+        // settings-wide token, so revoke any configured token immediately.
+        revokeMcpToken(configuredToken?.token);
+        // Mint Token B: an opaque per-run token bound to a server-side claim. The
+        // claim's generation was captured BEFORE the `openForRun` await (see
+        // `acquirePerRunMcpEndpoint`), so a host recycle that bumps the slot's
+        // generation strands this token at the per-request liveness fence.
+        token = issueRunMcpToken(runClaimForLease(endpoint, settings, workerHost, runKey));
         return {
             url: endpoint.url,
             token,
+            generation: endpoint.generation,
             acpServer: () => ({
                 type: "http",
                 name: trackerMcpServerName(settings.tracker.kind),
@@ -78,7 +109,7 @@ export async function acquireAgentMcpEndpointForRun(settings, workerHost, runKey
                 if (released)
                     return;
                 released = true;
-                revokeMcpToken(token);
+                revokeRunClaim(token);
                 tunnels.closeForRun(workerHost, runKey);
                 if (endpoint?.localServer)
                     await releaseLocalMcpServer(endpoint.localServer);
@@ -86,13 +117,32 @@ export async function acquireAgentMcpEndpointForRun(settings, workerHost, runKey
         };
     }
     catch (error) {
-        revokeMcpToken(token);
+        revokeRunClaim(token);
         tunnels.closeForRun(workerHost, runKey);
         if (endpoint?.localServer)
             await releaseLocalMcpServer(endpoint.localServer);
         throw error;
     }
 }
+/**
+ * Build the server-side per-run claim (Token B) for a freshly-acquired per-run
+ * endpoint. `runKey` is the issue-scoped `${issueId}#${slotIndex}` the
+ * coordinator mints, so `issueId` is recovered as the part before the first
+ * `#`. The generation is the endpoint's captured-before-`openForRun` value, and
+ * `allowedTools` is left unset (the rest of the claim - liveness + generation +
+ * expiry - gates the run; per-tool scoping is layered in later).
+ */
+function runClaimForLease(endpoint, settings, workerHost, runKey) {
+    const issueId = runKey.split("#", 1)[0] ?? runKey;
+    return {
+        runKey,
+        workerHost,
+        issueId,
+        generation: endpoint.generation,
+        expiresAt: Date.now() + runClaimMaxLifetimeMs,
+        settingsScope: endpoint.authScope,
+    };
+}
 async function localMcpEndpoint(settings, configuredToken) {
     const localServer = await ensureLocalMcpServer(settings, configuredToken);
     const serverHost = normalizeHttpBindHost(settings.server.host);
@@ -102,6 +152,7 @@ async function localMcpEndpoint(settings, configuredToken) {
         authScope: configuredToken?.authScope ??
             localServer?.handle.authScope ??
             mcpAuthScopeForSettings(settings, serverHost, configuredPort),
+        generation: localServer?.generation ?? 1,
         localServer: localServer ?? undefined,
     };
 }
@@ -121,6 +172,7 @@ async function acquireRemoteMcpEndpoint(workerHost, settings, configuredToken, t
             authScope: configuredToken?.authScope ??
                 localServer?.handle.authScope ??
                 mcpAuthScopeForSettings(settings, normalizeHttpBindHost(settings.server.host), localPort),
+            generation: localServer?.generation ?? 1,
             releaseTunnel: () => tunnels.releaseRemoteMcpTunnel(tunnel),
             localServer: localServer ?? undefined,
         };
@@ -131,14 +183,24 @@ async function acquireRemoteMcpEndpoint(workerHost, settings, configuredToken, t
         throw error;
     }
 }
-async function acquirePerRunMcpEndpoint(workerHost, runKey, settings, configuredToken, tunnels) {
+async function acquirePerRunMcpEndpoint(workerHost, runKey, settings, configuredToken, tunnels, isRunLive) {
     // The refcounted local MCP server is acquired BEFORE the per-run tunnel is
     // opened. If anything after this point throws (notably `openForRun` failing
     // to spawn the reverse tunnel), this function rejects before returning an
     // McpEndpoint, so the caller never sees `localServer` and cannot release it.
     // Drop the ref here so repeated tunnel-spawn failures don't leak refcounted
-    // local MCP servers / their listeners.
-    const localServer = await ensureLocalMcpServer(settings, configuredToken);
+    // local MCP servers / their listeners. The per-run server is mounted with the
+    // injected `isRunLive` oracle so its Token B middleware enforces the owner
+    // re-check + generation fence on every request. `requireOwnedServer: true`
+    // refuses to attach to a foreign server lorenz cannot enforce that fence over
+    // (see `ensureLocalMcpServer`).
+    const localServer = await ensureLocalMcpServer(settings, configuredToken, isRunLive, true);
+    // Capture the shared local server's generation BEFORE the `openForRun` await.
+    // The event loop is single-writer only BETWEEN awaits, so stamping the claim
+    // with the generation live at this point (not re-read after the await, when a
+    // recycle may have bumped it) makes a stale token fail the per-request liveness
+    // fence instead of silently inheriting a generation it was never minted against.
+    const generation = localServer?.generation ?? 1;
     try {
         const localHost = "127.0.0.1";
         const localPort = localServer?.handle.port ?? settings.server.port;
@@ -151,6 +213,7 @@ async function acquirePerRunMcpEndpoint(workerHost, runKey, settings, configured
             authScope: configuredToken?.authScope ??
                 localServer?.handle.authScope ??
                 mcpAuthScopeForSettings(settings, normalizeHttpBindHost(settings.server.host), localPort),
+            generation,
             localServer: localServer ?? undefined,
         };
     }
@@ -160,7 +223,7 @@ async function acquirePerRunMcpEndpoint(workerHost, runKey, settings, configured
         throw error;
     }
 }
-async function ensureLocalMcpServer(settings, configuredToken) {
+async function ensureLocalMcpServer(settings, configuredToken, isRunLive, requireOwnedServer = false) {
     const configuredPort = settings.server.port;
     const serverHost = normalizeHttpBindHost(settings.server.host);
     if (typeof configuredPort === "number" && configuredPort > 0) {
@@ -176,21 +239,39 @@ async function ensureLocalMcpServer(settings, configuredToken) {
                     throw new Error("configured_mcp_server_conflict");
                 }
                 existing.refCount += 1;
-                return { key, handle: existing.handle };
+                return { key, handle: existing.handle, generation: existing.generation };
             }
-            if (await configuredMcpServerReachable(settings, configuredToken.token))
+            if (await configuredMcpServerReachable(settings, configuredToken.token)) {
+                // A foreign MCP server is already reachable on the configured port. The
+                // ACP/local path ATTACHES to it (returns null); but the per-run claim path
+                // sets `requireOwnedServer` because lorenz cannot enforce its Token B owner
+                // re-check / generation fence against a server it does not own - attaching
+                // would silently bypass the per-run claim model. Refuse loudly instead.
+                if (requireOwnedServer) {
+                    throw new Error("per_run_mcp_endpoint_requires_lorenz_owned_server");
+                }
                 return null;
+            }
             const handle = await startMcpServer(settings, {
                 host: serverHost,
                 port: configuredPort,
                 authScope: identity,
+                isRunLive,
             });
-            localMcpServers.set(key, { handle, identity, refCount: 1 });
-            return { key, handle };
+            // Bump the slot's generation when a brand-new entry replaces a torn-down
+            // one. The first entry for a key gets generation 1; each recycle is
+            // strictly higher, so any Token B stamped with the prior generation is
+            // fenced out by the per-request liveness re-check.
+            const generation = (localMcpServerGenerations.get(key) ?? 0) + 1;
+            localMcpServerGenerations.set(key, generation);
+            localMcpServers.set(key, { handle, identity, refCount: 1, generation });
+            return { key, handle, generation };
         });
     }
-    const handle = await startMcpServer(settings, { host: serverHost, port: 0 });
-    return { key: null, handle };
+    const handle = await startMcpServer(settings, { host: serverHost, port: 0, isRunLive });
+    // Ephemeral (port 0) servers are not shared/refcounted, so each lease is its
+    // own generation-1 slot stopped on release; nothing recycles it in place.
+    return { key: null, handle, generation: 1 };
 }
 function issueConfiguredMcpToken(settings) {
     const configuredPort = settings.server.port;
@@ -227,6 +308,13 @@ async function releaseLocalMcpServer(lease) {
         const entry = localMcpServers.get(key);
         if (!entry)
             return;
+        // Generation fence: this lease was taken against an OLDER entry that has
+        // since been fully torn down and recreated (host recycle bumped the slot's
+        // generation). A fresh owner holds the live entry's ref, so a late release
+        // from the prior generation must NOT decrement the new entry's refcount and
+        // tear down a server that is still in use.
+        if (lease.generation < entry.generation)
+            return;
         if (entry.refCount > 1) {
             entry.refCount -= 1;
             return;

package/node_modules/@lorenz/mcp/dist/agentEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentEndpoint.js","sourceRoot":"","sources":["../src/agentEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,QAAQ,EACR,qBAAqB,GAGtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAkC,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEnF,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,OAAO,UAAU,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AA6DD,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,UAA0B,EAC1B,OAAkC;IAElC,IAAI,QAAQ,GAAuB,IAAI,CAAC;IACxC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,KAAK,GAAG,eAAe,EAAE,KAAK,IAAI,IAAI,CAAC;QACvC,QAAQ,GAAG,UAAU;YACnB,CAAC,CAAC,MAAM,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC;YAChF,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtD,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK;YACL,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjD,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;aAC/D,CAAC;YACF,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,cAAc,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACH,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;gBAC9B,CAAC;wBAAS,CAAC;oBACT,IAAI,QAAQ,EAAE,WAAW;wBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;QACD,IAAI,QAAQ,EAAE,WAAW;YAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,OAAiC;IAEjC,IAAI,QAAQ,GAAuB,IAAI,CAAC;IACxC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,KAAK,GAAG,eAAe,EAAE,KAAK,IAAI,IAAI,CAAC;QACvC,QAAQ,GAAG,MAAM,wBAAwB,CACvC,UAAU,EACV,MAAM,EACN,QAAQ,EACR,eAAe,EACf,OAAO,CACR,CAAC;QACF,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK;YACL,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjD,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;aAC/D,CAAC;YACF,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,cAAc,CAAC,KAAK,CAAC,CAAC;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACxC,IAAI,QAAQ,EAAE,WAAW;oBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/E,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,WAAW;YAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB,EAClB,eAAsC;IAEtC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,OAAO;QACL,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QACpF,SAAS,EACP,eAAe,EAAE,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC;QAC/D,WAAW,EAAE,WAAW,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,QAAkB,EAClB,eAAsC,EACtC,OAA6C;IAE7C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC;QAC9B,MAAM,SAAS,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACtF,OAAO;YACL,GAAG,EAAE,oBAAoB,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE;YACtD,SAAS,EACP,eAAe,EAAE,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,SAAS;gBAC7B,uBAAuB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;YAC3F,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC;YAC3D,WAAW,EAAE,WAAW,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW;YAAE,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,MAAc,EACd,QAAkB,EAClB,eAAsC,EACtC,OAAiC;IAEjC,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC;QAC9B,MAAM,SAAS,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAClF,OAAO;YACL,GAAG,EAAE,oBAAoB,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE;YACtD,SAAS,EACP,eAAe,EAAE,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,SAAS;gBAC7B,uBAAuB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;YAC3F,WAAW,EAAE,WAAW,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW;YAAE,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAkB,EAClB,eAAsC;IAEtC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/E,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBACD,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,MAAM,4BAA4B,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE;gBAC5C,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAkB;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAChF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAI,GAAW,EAAE,MAAwB;IAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACnE,IAAI,OAAoB,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAA0B;IAC7D,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,QAAkB,EAAE,KAAa;IAC3E,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,oBAAoB;gBACxB,MAAM,EAAE,YAAY;aACrB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,EAAE,KAAK,oBAAoB,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAkB;IAC/C,OAAO,UAAU,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;AACzF,CAAC"}
+{"version":3,"file":"agentEndpoint.js","sourceRoot":"","sources":["../src/agentEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,QAAQ,EACR,qBAAqB,GAGtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAkD,MAAM,aAAa,CAAC;AAC7F,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,GAEf,MAAM,WAAW,CAAC;AAEnB,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,OAAO,UAAU,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AA6FD,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAC7D;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,UAA0B,EAC1B,OAAkC;IAElC,IAAI,QAAQ,GAAuB,IAAI,CAAC;IACxC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,KAAK,GAAG,eAAe,EAAE,KAAK,IAAI,IAAI,CAAC;QACvC,QAAQ,GAAG,UAAU;YACnB,CAAC,CAAC,MAAM,wBAAwB,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC;YAChF,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtD,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK;YACL,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjD,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;aAC/D,CAAC;YACF,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,cAAc,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACH,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;gBAC9B,CAAC;wBAAS,CAAC;oBACT,IAAI,QAAQ,EAAE,WAAW;wBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;QACD,IAAI,QAAQ,EAAE,WAAW;YAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,OAAiC,EACjC,SAAqB;IAErB,+EAA+E;IAC/E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,2CAA2C;IAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,GAAuB,IAAI,CAAC;IACxC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,QAAQ,GAAG,MAAM,wBAAwB,CACvC,UAAU,EACV,MAAM,EACN,QAAQ,EACR,eAAe,EACf,OAAO,EACP,SAAS,CACV,CAAC;QACF,6EAA6E;QAC7E,mEAAmE;QACnE,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACvC,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,KAAK,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACnF,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK;YACL,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjD,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;aAC/D,CAAC;YACF,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,cAAc,CAAC,KAAK,CAAC,CAAC;gBACtB,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACxC,IAAI,QAAQ,EAAE,WAAW;oBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/E,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,WAAW;YAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,QAAkB,EAClB,UAAkB,EAClB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAClD,OAAO;QACL,MAAM;QACN,UAAU;QACV,OAAO;QACP,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;QAC7C,aAAa,EAAE,QAAQ,CAAC,SAAS;KAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB,EAClB,eAAsC;IAEtC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,OAAO;QACL,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QACpF,SAAS,EACP,eAAe,EAAE,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC;QAC/D,UAAU,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;QACxC,WAAW,EAAE,WAAW,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,QAAkB,EAClB,eAAsC,EACtC,OAA6C;IAE7C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC;QAC9B,MAAM,SAAS,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACtF,OAAO;YACL,GAAG,EAAE,oBAAoB,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE;YACtD,SAAS,EACP,eAAe,EAAE,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,SAAS;gBAC7B,uBAAuB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;YAC3F,UAAU,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;YACxC,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC;YAC3D,WAAW,EAAE,WAAW,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW;YAAE,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,MAAc,EACd,QAAkB,EAClB,eAAsC,EACtC,OAAiC,EACjC,SAAqB;IAErB,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3F,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,UAAU,GAAG,WAAW,EAAE,UAAU,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC;QAC9B,MAAM,SAAS,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAClF,OAAO;YACL,GAAG,EAAE,oBAAoB,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE;YACtD,SAAS,EACP,eAAe,EAAE,SAAS;gBAC1B,WAAW,EAAE,MAAM,CAAC,SAAS;gBAC7B,uBAAuB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;YAC3F,UAAU;YACV,WAAW,EAAE,WAAW,IAAI,SAAS;SACtC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW;YAAE,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAkB,EAClB,eAAsC,EACtC,SAAqB,EACrB,kBAAkB,GAAG,KAAK;IAE1B,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/E,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBACD,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC3E,CAAC;YACD,IAAI,MAAM,4BAA4B,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,wEAAwE;gBACxE,2EAA2E;gBAC3E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,wEAAwE;gBACxE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE;gBAC5C,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,QAAQ;gBACnB,SAAS;aACV,CAAC,CAAC;YACH,yEAAyE;YACzE,oEAAoE;YACpE,uEAAuE;YACvE,mDAAmD;YACnD,MAAM,UAAU,GAAG,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC/C,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,6EAA6E;IAC7E,0EAA0E;IAC1E,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAkB;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAChF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAI,GAAW,EAAE,MAAwB;IAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACnE,IAAI,OAAoB,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAA0B;IAC7D,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,2CAA2C;QAC3C,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU;YAAE,OAAO;QAChD,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,QAAkB,EAAE,KAAa;IAC3E,MAAM,GAAG,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,oBAAoB;gBACxB,MAAM,EAAE,YAAY;aACrB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,EAAE,KAAK,oBAAoB,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAkB;IAC/C,OAAO,UAAU,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;AACzF,CAAC"}

package/node_modules/@lorenz/mcp/dist/auth.d.ts

@@ -4,4 +4,92 @@ export declare function mcpAuthScopeForSettings(settings: Settings, host: string
 export declare function issueMcpToken(scope?: string): string;
 export declare function revokeMcpToken(token: string | null | undefined): void;
 export declare function validMcpToken(token: string | null | undefined, scope?: string): boolean;
+/**
+ * The server-side claim record a per-run MCP token (Token B) resolves to.
+ *
+ * The token bytes stay opaque (`randomBytes(32)`); all scope lives here, in a
+ * daemon-minted Map that is the sole authority. This is an unguessable-bearer
+ * property, NOT platform attestation: the worker only ever presents its token
+ * and the daemon resolves the claim. `runKey` is therefore resolved
+ * server-side from the token and a self-reported `runKey` header is never
+ * trusted.
+ */
+export interface RunClaim {
+    /** The run this token authorizes. Resolved server-side; never self-reported. */
+    runKey: string;
+    /** The worker host the run is pinned to. Empty string means a local/acp run. */
+    workerHost: string;
+    /** The issue the run is working. */
+    issueId: string;
+    /**
+     * Monotonic generation of the shared endpoint this claim was minted against.
+     * Bumped on host recycle; a request whose claim generation no longer matches
+     * the live endpoint is a late/torn-down token and must be rejected.
+     */
+    generation: number;
+    /**
+     * Coarse safety cap on the claim's lifetime (epoch millis). The claim is
+     * primarily run-lifetime-bound via the injected `isRunLive` re-check; this is
+     * only a backstop so a leaked token cannot live forever.
+     */
+    expiresAt: number;
+    /**
+     * The coarse settings fingerprint (Token A side, `mcpAuthScopeForSettings`).
+     * Kept as a cheap pre-filter; it does NOT carry per-run identity.
+     */
+    settingsScope: string;
+    /**
+     * Per-operation allowlist: the tool names this run may call. `undefined`
+     * means no restriction beyond the rest of the claim (every mounted tool).
+     */
+    allowedTools?: readonly string[];
+}
+/**
+ * Mint an opaque per-run token (Token B) bound to {@link claim}. The token
+ * bytes carry no scope; the returned claim is resolved server-side on every
+ * request via {@link resolveRunClaim}.
+ */
+export declare function issueRunMcpToken(claim: RunClaim): string;
+/**
+ * Resolve the claim for an opaque per-run token. This is the ONLY source of a
+ * request's `runKey`; callers must never trust a self-reported header. Returns
+ * `undefined` for unknown/revoked tokens (fail closed at the call site).
+ */
+export declare function resolveRunClaim(token: string | null | undefined): RunClaim | undefined;
+/** Revoke a per-run token, dropping its claim. Safe no-op on unknown input. */
+export declare function revokeRunClaim(token: string | null | undefined): void;
+/** Inputs to {@link checkRunClaim}: what the request is asking to do. */
+export interface RunClaimRequest {
+    /** The tool being invoked (`tools/call` name), if this is a tool request. */
+    toolName?: string | null;
+    /**
+     * Read-only liveness oracle injected from the composition root. Returns false
+     * once the run is settled/recycled/superseded. The generation argument lets
+     * liveness be paired with the generation fence so a momentary liveness lie
+     * still fails on a stale generation.
+     */
+    isRunLive: (runKey: string, workerHost: string, generation: number) => boolean;
+    /** Wall clock, injected for testability. Defaults to {@link Date.now}. */
+    now?: () => number;
+}
+/** Outcome of {@link checkRunClaim}. `ok` is true only when every check passes. */
+export type RunClaimDecision = {
+    ok: true;
+    claim: RunClaim;
+} | {
+    ok: false;
+    reason: "expired" | "tool-not-allowed" | "not-live";
+};
+/**
+ * Authoritative per-request owner re-check for a resolved {@link RunClaim},
+ * ordered expiry-first, allowlist-before-secret, fail-closed:
+ *
+ *   1. `expiresAt > now`            - coarse lifetime cap.
+ *   2. tool in `allowedTools`       - per-operation allowlist (before liveness).
+ *   3. `isRunLive(runKey, host, generation)` - the run is still live AND the
+ *      generation matches the live endpoint.
+ *
+ * Never falls back to the settings-wide scope; any miss denies.
+ */
+export declare function checkRunClaim(claim: RunClaim, request: RunClaimRequest): RunClaimDecision;
 //# sourceMappingURL=auth.d.ts.map

package/node_modules/@lorenz/mcp/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAkBR;AAoBD,wBAAgB,aAAa,CAAC,KAAK,SAAsB,GAAG,MAAM,CAIjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAErE;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,KAAK,SAAsB,GAC1B,OAAO,CAET"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAkBR;AAoBD,wBAAgB,aAAa,CAAC,KAAK,SAAsB,GAAG,MAAM,CAIjE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAErE;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,KAAK,SAAsB,GAC1B,OAAO,CAET;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAKD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAIxD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAGtF;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAErE;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/E,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,kBAAkB,GAAG,UAAU,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,GAAG,gBAAgB,CAgBzF"}

package/node_modules/@lorenz/mcp/dist/auth.js

@@ -45,4 +45,57 @@ export function revokeMcpToken(token) {
 export function validMcpToken(token, scope = defaultMcpAuthScope) {
     return typeof token === "string" && activeTokens.get(token) === scope;
 }
+/** Opaque per-run token (Token B) -> daemon-minted claim. The sole authority. */
+const runClaims = new Map();
+/**
+ * Mint an opaque per-run token (Token B) bound to {@link claim}. The token
+ * bytes carry no scope; the returned claim is resolved server-side on every
+ * request via {@link resolveRunClaim}.
+ */
+export function issueRunMcpToken(claim) {
+    const token = randomBytes(32).toString("base64url");
+    runClaims.set(token, claim);
+    return token;
+}
+/**
+ * Resolve the claim for an opaque per-run token. This is the ONLY source of a
+ * request's `runKey`; callers must never trust a self-reported header. Returns
+ * `undefined` for unknown/revoked tokens (fail closed at the call site).
+ */
+export function resolveRunClaim(token) {
+    if (typeof token !== "string")
+        return undefined;
+    return runClaims.get(token);
+}
+/** Revoke a per-run token, dropping its claim. Safe no-op on unknown input. */
+export function revokeRunClaim(token) {
+    if (token)
+        runClaims.delete(token);
+}
+/**
+ * Authoritative per-request owner re-check for a resolved {@link RunClaim},
+ * ordered expiry-first, allowlist-before-secret, fail-closed:
+ *
+ *   1. `expiresAt > now`            - coarse lifetime cap.
+ *   2. tool in `allowedTools`       - per-operation allowlist (before liveness).
+ *   3. `isRunLive(runKey, host, generation)` - the run is still live AND the
+ *      generation matches the live endpoint.
+ *
+ * Never falls back to the settings-wide scope; any miss denies.
+ */
+export function checkRunClaim(claim, request) {
+    const now = request.now ?? Date.now;
+    if (claim.expiresAt <= now()) {
+        return { ok: false, reason: "expired" };
+    }
+    if (request.toolName != null &&
+        claim.allowedTools !== undefined &&
+        !claim.allowedTools.includes(request.toolName)) {
+        return { ok: false, reason: "tool-not-allowed" };
+    }
+    if (!request.isRunLive(claim.runKey, claim.workerHost, claim.generation)) {
+        return { ok: false, reason: "not-live" };
+    }
+    return { ok: true, claim };
+}
 //# sourceMappingURL=auth.js.map

package/node_modules/@lorenz/mcp/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,IAAY,EACZ,IAAwB;IAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI;QACJ,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC;YACzC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B;KACF,CAAC,CAAC;IACH,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CAAC,MAA+B;IACtD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,oBAAoB,CAC3B,WAAoD;IAEpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAK,GAAG,mBAAmB;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,IAAI,KAAK;QAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAgC,EAChC,KAAK,GAAG,mBAAmB;IAE3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;AACxE,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItD,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,IAAY,EACZ,IAAwB;IAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI;QACJ,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC;YACzC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B;KACF,CAAC,CAAC;IACH,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CAAC,MAA+B;IACtD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,oBAAoB,CAC3B,WAAoD;IAEpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAK,GAAG,mBAAmB;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,IAAI,KAAK;QAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAgC,EAChC,KAAK,GAAG,mBAAmB;IAE3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;AACxE,CAAC;AA2CD,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAe;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAgC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,IAAI,KAAK;QAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAe,EAAE,OAAwB;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,IACE,OAAO,CAAC,QAAQ,IAAI,IAAI;QACxB,KAAK,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC9C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/node_modules/@lorenz/mcp/dist/index.d.ts

@@ -1,7 +1,8 @@
-export { createMcpAuthScope, issueMcpToken, mcpAuthScopeForSettings, revokeMcpToken, validMcpToken, } from "./auth.js";
+export { checkRunClaim, createMcpAuthScope, issueMcpToken, issueRunMcpToken, mcpAuthScopeForSettings, resolveRunClaim, revokeMcpToken, revokeRunClaim, validMcpToken, } from "./auth.js";
+export type { RunClaim } from "./auth.js";
 export { executeTool, mountedSkillSources, toolSpecs } from "./tools.js";
 export { acquireAgentMcpEndpoint, acquireAgentMcpEndpointForRun, trackerMcpServerName, } from "./agentEndpoint.js";
 export type { AgentMcpEndpointLease, RemoteMcpTunnelTransport } from "./agentEndpoint.js";
 export { mountMcp, startMcpServer, mcpResponse } from "./server.js";
-export type { ObservabilityServerHandle } from "./server.js";
+export type { IsRunLive, ObservabilityServerHandle } from "./server.js";
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@lorenz/mcp/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC"}

package/node_modules/@lorenz/mcp/dist/index.js

@@ -1,4 +1,4 @@
-export { createMcpAuthScope, issueMcpToken, mcpAuthScopeForSettings, revokeMcpToken, validMcpToken, } from "./auth.js";
+export { checkRunClaim, createMcpAuthScope, issueMcpToken, issueRunMcpToken, mcpAuthScopeForSettings, resolveRunClaim, revokeMcpToken, revokeRunClaim, validMcpToken, } from "./auth.js";
 export { executeTool, mountedSkillSources, toolSpecs } from "./tools.js";
 export { acquireAgentMcpEndpoint, acquireAgentMcpEndpointForRun, trackerMcpServerName, } from "./agentEndpoint.js";
 export { mountMcp, startMcpServer, mcpResponse } from "./server.js";

package/node_modules/@lorenz/mcp/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/node_modules/@lorenz/mcp/dist/server.d.ts

@@ -1,12 +1,28 @@
 import { Hono } from "hono";
 import { type Settings } from "@lorenz/domain";
 import { type ToolRegistry } from "@lorenz/tool-sdk";
+/**
+ * Read-only liveness oracle injected from the composition root (daemon.ts).
+ * Given a per-run claim's `(runKey, workerHost, generation)`, returns false once
+ * the run is settled/recycled/superseded, pairing liveness with the generation
+ * fence. The per-run claim-enforcing mount always injects the real
+ * coordinator-backed oracle; {@link defaultIsRunLive} is the FAIL-CLOSED default
+ * for any mount that resolves a Token B claim without one, so a wiring omission
+ * denies rather than authorizes.
+ */
+export type IsRunLive = (runKey: string, workerHost: string, generation: number) => boolean;
 export interface ObservabilityServerOptions {
     host: string;
     port: number;
     authScope?: string | undefined;
     /** Tool packs available to this endpoint; defaults to the process-wide registry. */
     tools?: ToolRegistry | undefined;
+    /**
+     * Read-only liveness oracle for per-run (Token B) claims. Injected at the
+     * composition root; absent on non-claim mounts, where the FAIL-CLOSED default
+     * denies any Token B presented to them.
+     */
+    isRunLive?: IsRunLive | undefined;
 }
 export interface ObservabilityServerHandle {
     host: string;
@@ -19,6 +35,12 @@ export interface McpMountOptions {
     authScope?: string | undefined;
     /** Tool packs available to this endpoint; defaults to the process-wide registry. */
     tools?: ToolRegistry | undefined;
+    /**
+     * Read-only liveness oracle for per-run (Token B) claims. Injected at the
+     * composition root; absent on non-claim mounts, where the FAIL-CLOSED default
+     * denies any Token B presented to them.
+     */
+    isRunLive?: IsRunLive | undefined;
 }
 export declare function startMcpServer(settings: Settings, options: ObservabilityServerOptions): Promise<ObservabilityServerHandle>;
 /**

package/node_modules/@lorenz/mcp/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAG1C,OAAO,EAAgD,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAK1E,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oFAAoF;IACpF,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oFAAoF;IACpF,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC;AAID,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAepC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,EACrC,OAAO,GAAE,eAAoB,GAC5B,IAAI,CAuBN;AA6DD,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,GAAE,YAAkC,GACxC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA8CzC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAG1C,OAAO,EAAgD,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAW1E;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;AAI5F,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oFAAoF;IACpF,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oFAAoF;IACpF,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACnC;AAUD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAepC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,EACrC,OAAO,GAAE,eAAoB,GAC5B,IAAI,CA8CN;AAuGD,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,GAAE,YAAkC,GACxC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA8CzC"}