mcp-for-i 0.1.13 → 0.2.0

package/dist/security/credentialStore.js

@@ -62,10 +62,19 @@ function getCredentialStoreMode() {
 function describeError(err) {
     return err instanceof Error ? err.message : String(err);
 }
-export async function setPassword(connectionName, password) {
-    if (getCredentialStoreMode() === "session") {
-        sessionStore.set(connectionName, password);
-        return;
+export class KeychainUnavailableError extends Error {
+    constructor(operation, detail) {
+        super(`MCP_FOR_I_CREDENTIAL_STORE=keychain is set, but the OS keychain could not ${operation}` +
+            `${detail ? `: ${detail}` : ""}. ` +
+            "Passwords are not kept in memory in keychain mode. Fix the keychain (or unset MCP_FOR_I_CREDENTIAL_STORE) and try again.");
+        this.name = "KeychainUnavailableError";
+    }
+}
+export async function setPassword(connectionName, password, options = {}) {
+    const mode = getCredentialStoreMode();
+    if (mode === "session") {
+        setSessionValue(connectionName, password, options);
+        return { persistent: false, store: "session" };
     }
     const kt = await getKeytar();
     if (kt) {
@@ -73,16 +82,24 @@ export async function setPassword(connectionName, password) {
             await kt.setPassword(SERVICE, connectionName, password);
             lastKeychainError = undefined;
             sessionStore.delete(connectionName);
-            return;
+            return { persistent: true, store: "keychain" };
         }
         catch (err) {
             lastKeychainError = describeError(err);
         }
     }
-    sessionStore.set(connectionName, password);
+    else if (!lastKeychainError) {
+        lastKeychainError = "keytar module is not available";
+    }
+    if (mode === "keychain") {
+        throw new KeychainUnavailableError("store the password", lastKeychainError);
+    }
+    setSessionValue(connectionName, password, options);
+    return { persistent: false, store: "session" };
 }
 export async function getPassword(connectionName) {
-    if (getCredentialStoreMode() === "session") {
+    const mode = getCredentialStoreMode();
+    if (mode === "session") {
         return sessionStore.get(connectionName);
     }
     const kt = await getKeytar();
@@ -92,15 +109,23 @@ export async function getPassword(connectionName) {
             lastKeychainError = undefined;
             if (password)
                 return password;
+            if (mode === "keychain")
+                return undefined;
         }
         catch (err) {
             lastKeychainError = describeError(err);
+            if (mode === "keychain")
+                throw new KeychainUnavailableError("read the password", lastKeychainError);
         }
     }
+    else if (mode === "keychain") {
+        throw new KeychainUnavailableError("read the password", "keytar module is not available");
+    }
     return sessionStore.get(connectionName);
 }
 export async function deletePassword(connectionName) {
-    if (getCredentialStoreMode() === "session") {
+    const mode = getCredentialStoreMode();
+    if (mode === "session") {
         sessionStore.delete(connectionName);
         return;
     }
@@ -112,10 +137,32 @@ export async function deletePassword(connectionName) {
         }
         catch (err) {
             lastKeychainError = describeError(err);
+            if (mode === "keychain") {
+                sessionStore.delete(connectionName);
+                throw new KeychainUnavailableError("delete the password", lastKeychainError);
+            }
         }
     }
+    else if (mode === "keychain") {
+        sessionStore.delete(connectionName);
+        throw new KeychainUnavailableError("delete the password", "keytar module is not available");
+    }
     sessionStore.delete(connectionName);
 }
+function setSessionValue(connectionName, password, options) {
+    if (options.keepExistingSessionValue && sessionStore.has(connectionName))
+        return;
+    sessionStore.set(connectionName, password);
+}
+/**
+ * Replaces the keytar module used by this store. Intended for tests only:
+ * pass an object with keytar's methods, `null` for "keytar not installed",
+ * or `undefined` to restore normal lazy loading.
+ */
+export function setKeytarModuleForTesting(mod) {
+    keytar = mod;
+    lastKeychainError = undefined;
+}
 export async function isKeychainAvailable() {
     if (getCredentialStoreMode() === "session")
         return false;
@@ -153,11 +200,13 @@ export async function getCredentialStoreStatus() {
         error: lastKeychainError,
         message: keychainAvailable
             ? `Passwords are stored in ${environment.nativeStore}.`
-            : requestedMode === "session"
-                ? "Password storage is configured for session-only mode by MCP_FOR_I_CREDENTIAL_STORE=session."
-                : isWsl
-                    ? "WSL could not access a persistent Linux Secret Service keychain; passwords are kept in this process only. Use SSH keys, install/configure libsecret in WSL, or run MCP-for-i from Windows to use Windows Credential Manager."
-                    : "No persistent OS keychain is available; passwords are kept in this process only."
+            : requestedMode === "keychain"
+                ? `MCP_FOR_I_CREDENTIAL_STORE=keychain is set but ${environment.nativeStore} is not usable; saving or reading passwords will fail until it is fixed.`
+                : requestedMode === "session"
+                    ? "Password storage is configured for session-only mode by MCP_FOR_I_CREDENTIAL_STORE=session."
+                    : isWsl
+                        ? "WSL could not access a persistent Linux Secret Service keychain; passwords are kept in this process only. Use SSH keys, install/configure libsecret in WSL, or run MCP-for-i from Windows to use Windows Credential Manager."
+                        : "No persistent OS keychain is available; passwords are kept in this process only."
     };
 }
 function isWslRuntime(env = process.env, platform = process.platform, release = os.release()) {

package/dist/security/localPaths.js

@@ -0,0 +1,138 @@
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { getConfigDir } from "../config/store.js";
+const caseInsensitive = process.platform === "win32" || process.platform === "darwin";
+function sensitiveLocations() {
+    const home = os.homedir();
+    const list = [
+        ".ssh",
+        ".aws",
+        ".gnupg",
+        ".azure",
+        ".kube",
+        ".docker",
+        ".netrc",
+        ".git-credentials",
+        ".pgpass",
+        ".npmrc",
+        ".pypirc",
+        path.join(".config", "gcloud"),
+        path.join(".config", "gh")
+    ].map(rel => path.join(home, rel));
+    if (process.platform === "win32") {
+        list.push(process.env.APPDATA || path.join(home, "AppData", "Roaming"));
+    }
+    if (process.platform === "darwin") {
+        list.push(path.join(home, "Library", "Keychains"));
+    }
+    list.push(getConfigDir());
+    return list;
+}
+/**
+ * On Windows, %LOCALAPPDATA% holds browser profiles and cached tokens, but
+ * also the temp directory. Everything there except temp is refused.
+ */
+function isInsideLocalAppDataOutsideTemp(resolved) {
+    if (process.platform !== "win32")
+        return false;
+    const localAppData = process.env.LOCALAPPDATA || path.join(os.homedir(), "AppData", "Local");
+    if (!isInside(resolved, localAppData))
+        return false;
+    return !isInside(resolved, os.tmpdir()) && !isInside(resolved, path.join(localAppData, "Temp"));
+}
+function isCredentialsFileUnderConfig(resolved) {
+    const configRoot = path.join(os.homedir(), ".config");
+    if (!isInside(resolved, configRoot))
+        return false;
+    return path.relative(configRoot, resolved)
+        .split(path.sep)
+        .some(segment => /^credentials(\.[\w-]+)?$/i.test(segment));
+}
+function comparable(value) {
+    const normalized = path.resolve(value);
+    return caseInsensitive ? normalized.toLowerCase() : normalized;
+}
+function isInside(target, root) {
+    const relative = path.relative(comparable(root), comparable(target));
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+/** Resolve symlinks for the longest existing prefix of the path. */
+async function realpathAllowMissing(target) {
+    const absolute = path.resolve(target);
+    const missing = [];
+    let current = absolute;
+    for (;;) {
+        try {
+            const real = await fs.realpath(current);
+            return missing.length > 0 ? path.join(real, ...missing.reverse()) : real;
+        }
+        catch {
+            const parent = path.dirname(current);
+            if (parent === current)
+                return absolute;
+            missing.push(path.basename(current));
+            current = parent;
+        }
+    }
+}
+export function parseRootList(value) {
+    return String(value || "")
+        .split(path.delimiter)
+        .map(item => item.trim())
+        .filter(Boolean);
+}
+export function defaultLocalRoots() {
+    // A working directory that is a filesystem root (common when a client
+    // launches the server) would allow the whole disk, so it is skipped.
+    return [process.cwd(), os.homedir()].filter(root => {
+        const resolved = path.resolve(root);
+        return path.parse(resolved).root !== resolved;
+    });
+}
+export function configuredLocalRoots(settingsRoots) {
+    const fromEnv = parseRootList(process.env.MCP_FOR_I_ALLOWED_LOCAL_ROOTS);
+    if (fromEnv.length > 0)
+        return fromEnv;
+    if (Array.isArray(settingsRoots)) {
+        const fromSettings = settingsRoots.map(v => String(v || "").trim()).filter(Boolean);
+        if (fromSettings.length > 0)
+            return fromSettings;
+    }
+    return defaultLocalRoots();
+}
+/**
+ * Resolve a local path and refuse it unless it is inside an allowed root and
+ * outside every sensitive location. Returns the resolved real path, which
+ * callers should use for the actual file operation.
+ */
+export async function resolveAllowedLocalPath(value, mode, roots = configuredLocalRoots()) {
+    const raw = String(value ?? "").trim();
+    if (!raw)
+        throw new Error("Local path is required");
+    if (raw.includes("\0"))
+        throw new Error("Local path contains a NUL character");
+    const expanded = raw === "~" || raw.startsWith("~/") || raw.startsWith("~\\")
+        ? path.join(os.homedir(), raw.substring(1))
+        : raw;
+    const resolved = await realpathAllowMissing(expanded);
+    for (const sensitive of sensitiveLocations()) {
+        const realSensitive = await realpathAllowMissing(sensitive);
+        if (isInside(resolved, sensitive) || isInside(resolved, realSensitive)) {
+            throw new Error(`Local path refused (${mode}): ${raw} is inside a protected location`);
+        }
+    }
+    if (isInsideLocalAppDataOutsideTemp(resolved)) {
+        throw new Error(`Local path refused (${mode}): ${raw} is inside a protected location`);
+    }
+    if (isCredentialsFileUnderConfig(resolved)) {
+        throw new Error(`Local path refused (${mode}): ${raw} is a credentials file`);
+    }
+    for (const root of roots) {
+        const realRoot = await realpathAllowMissing(root);
+        if (isInside(resolved, realRoot))
+            return resolved;
+    }
+    throw new Error(`Local path refused (${mode}): ${raw} is outside the allowed local roots. ` +
+        "Set MCP_FOR_I_ALLOWED_LOCAL_ROOTS or settings.allowedLocalRoots to allow it.");
+}

package/dist/security/redact.js

@@ -0,0 +1,79 @@
+/**
+ * Secret redaction for logs and audit records.
+ *
+ * Keys are matched case-insensitively by substring, so `newPassword`,
+ * `db_pwd` and `apiKey` are all caught. String values are also scanned for
+ * secrets embedded in CL commands, SQL text and command lines.
+ */
+export const REDACTED = "***REDACTED***";
+const SECRET_KEY_PARTS = [
+    "password",
+    "passwd",
+    "pwd",
+    "secret",
+    "token",
+    "apikey",
+    "api_key",
+    "api-key",
+    "privatekey",
+    "private_key",
+    "passphrase",
+    "authorization",
+    "signingkey",
+    "credential"
+];
+export function isSecretKey(key) {
+    const lower = String(key || "").toLowerCase();
+    return SECRET_KEY_PARTS.some(part => lower.includes(part));
+}
+const SECRET_WORDS = "[\\w-]*(?:password|passwd|pwd|secret|token|apikey|api_key|passphrase)[\\w-]*";
+const TEXT_RULES = [
+    // CL keyword parameters: PASSWORD(x), PWD('x'), NEWPWD(x), OLDPWD(x), RMTPWD(x) ...
+    {
+        pattern: /\b([A-Z0-9]*PWD|PASSWORD|PASSWD|PASSPHRASE)(\s*\(\s*)('(?:[^']|'')*'|[^)]*)(\))/gi,
+        replace: (_m, kw, open, _value, close) => `${kw}${open}${REDACTED}${close}`
+    },
+    // SQL: SET ENCRYPTION PASSWORD = 'x', PASSWORD 'x', ... USING 'x'
+    {
+        pattern: /\b(PASSWORD|USING)(\s*=?\s*)'(?:[^']|'')*'/gi,
+        replace: (_m, kw, sep) => `${kw}${sep}'${REDACTED}'`
+    },
+    // Command-line flags: --password=x, --password x, -pwd x
+    {
+        pattern: new RegExp(`(?<![\\w-])(--?${SECRET_WORDS})(=|\\s+)("[^"]*"|'[^']*'|[^\\s,;&]+)`, "gi"),
+        replace: (_m, flag, sep) => `${flag}${sep}${REDACTED}`
+    },
+    // key=value / key: value / "key":"value" pairs
+    {
+        pattern: new RegExp(`(\\b${SECRET_WORDS}"?)(\\s*[=:]\\s*)("[^"]*"|'[^']*'|[^\\s,;&"']+)`, "gi"),
+        replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+    },
+    // HTTP authorization values
+    {
+        pattern: /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/g,
+        replace: (_m, scheme) => `${scheme} ${REDACTED}`
+    }
+];
+/** Redact secrets embedded in a free-text value. */
+export function redactSecretsInText(text) {
+    let out = String(text);
+    for (const rule of TEXT_RULES) {
+        out = out.replace(rule.pattern, (...args) => rule.replace(...args.slice(0, -2)));
+    }
+    return out;
+}
+/** Deep-copy a value, redacting secret keys and secrets inside strings. */
+export function redactSecrets(input) {
+    if (Array.isArray(input))
+        return input.map(redactSecrets);
+    if (input && typeof input === "object") {
+        const out = {};
+        for (const [key, value] of Object.entries(input)) {
+            out[key] = isSecretKey(key) ? REDACTED : redactSecrets(value);
+        }
+        return out;
+    }
+    if (typeof input === "string")
+        return redactSecretsInText(input);
+    return input;
+}

package/dist/util/atomicWrite.js

@@ -0,0 +1,101 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+/**
+ * Error codes that Windows (antivirus, search indexer, backup agents, another
+ * reader holding the file open) raises transiently on rename/open/unlink.
+ */
+const TRANSIENT_CODES = new Set(["EPERM", "EBUSY", "EACCES", "EAGAIN", "EMFILE", "ENFILE"]);
+export function isTransientFsError(err) {
+    const code = err?.code;
+    return typeof code === "string" && TRANSIENT_CODES.has(code);
+}
+/**
+ * Writes `data` to `filePath` atomically: the content goes to a uniquely named
+ * temp file in the same directory, is fsynced, and then renamed over the target.
+ * Rename is retried on transient Windows errors. There is deliberately no
+ * non-atomic fallback: if the rename keeps failing the temp file is removed and
+ * the error is thrown, leaving the original file untouched.
+ */
+export async function writeFileAtomic(filePath, data, options = {}) {
+    const dir = path.dirname(filePath);
+    const tempPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+    const mode = options.mode ?? 0o666;
+    const handle = await fs.open(tempPath, "wx", mode);
+    try {
+        if (typeof data === "string") {
+            await handle.writeFile(data, options.encoding || "utf8");
+        }
+        else {
+            await handle.writeFile(data);
+        }
+        if (options.fsync !== false) {
+            await handle.sync();
+        }
+    }
+    catch (err) {
+        await handle.close().catch(() => { });
+        await fs.rm(tempPath, { force: true }).catch(() => { });
+        throw err;
+    }
+    await handle.close();
+    try {
+        await renameWithRetry(tempPath, filePath, options.retries ?? 10, options.retryDelayMs ?? 25);
+    }
+    catch (err) {
+        await fs.rm(tempPath, { force: true }).catch(() => { });
+        throw err;
+    }
+    if (options.mode !== undefined && process.platform !== "win32") {
+        await fs.chmod(filePath, options.mode).catch(() => { });
+    }
+    if (options.fsync !== false) {
+        await fsyncDirectory(dir);
+    }
+}
+export async function renameWithRetry(from, to, retries = 10, delayMs = 25) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            await fs.rename(from, to);
+            return;
+        }
+        catch (err) {
+            if (!isTransientFsError(err) || attempt >= retries)
+                throw err;
+            await sleep(delayMs * (attempt + 1));
+        }
+    }
+}
+/** Reads a file, retrying on transient Windows sharing errors. ENOENT and other errors are thrown unchanged. */
+export async function readFileWithRetry(filePath, retries = 5, delayMs = 25) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await fs.readFile(filePath, "utf8");
+        }
+        catch (err) {
+            if (!isTransientFsError(err) || attempt >= retries)
+                throw err;
+            await sleep(delayMs * (attempt + 1));
+        }
+    }
+}
+async function fsyncDirectory(dir) {
+    // Directory fsync makes the rename durable on POSIX; Windows cannot open directories this way.
+    if (process.platform === "win32")
+        return;
+    try {
+        const handle = await fs.open(dir, "r");
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        // Best effort only.
+    }
+}
+export function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}

package/dist/util/fileLock.js

@@ -0,0 +1,206 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { isTransientFsError, sleep } from "./atomicWrite.js";
+const DEFAULT_STALE_MS = 30_000;
+const DEFAULT_TIMEOUT_MS = 15_000;
+const DEFAULT_RETRY_MS = 20;
+// Serializes lock users inside this process so they queue instead of spinning on the lock file.
+const inProcessQueues = new Map();
+/**
+ * Runs `fn` while holding an exclusive lock that works across processes.
+ *
+ * - Within one process, callers using the same lock path are queued in order.
+ * - Across processes the lock is a file created with O_EXCL ("wx"). The owner
+ *   refreshes its mtime while it holds the lock; a lock file that is older than
+ *   `staleMs`, or whose owner process on this host no longer exists, is broken.
+ *
+ * The lock is not re-entrant: calling withFileLock for the same path from inside
+ * `fn` deadlocks until the timeout.
+ */
+export async function withFileLock(lockPath, fn, options = {}) {
+    const key = lockKey(lockPath);
+    const previous = inProcessQueues.get(key) || Promise.resolve();
+    let releaseQueue;
+    const gate = new Promise(resolve => {
+        releaseQueue = resolve;
+    });
+    const tail = previous.then(() => gate);
+    inProcessQueues.set(key, tail);
+    await previous;
+    try {
+        const handle = await acquireFileLock(lockPath, options);
+        try {
+            return await fn();
+        }
+        finally {
+            await handle.release();
+        }
+    }
+    finally {
+        releaseQueue();
+        if (inProcessQueues.get(key) === tail)
+            inProcessQueues.delete(key);
+    }
+}
+/**
+ * Acquires the cross-process lock file only (no in-process queueing). Prefer
+ * withFileLock unless the lock must be held across separate calls.
+ */
+export async function acquireFileLock(lockPath, options = {}) {
+    const staleMs = Math.max(1000, options.staleMs ?? DEFAULT_STALE_MS);
+    const timeoutMs = Math.max(0, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const retryDelayMs = Math.max(1, options.retryDelayMs ?? DEFAULT_RETRY_MS);
+    const deadline = Date.now() + timeoutMs;
+    const token = crypto.randomBytes(16).toString("hex");
+    await fs.mkdir(path.dirname(lockPath), { recursive: true });
+    let lastOwner;
+    for (let attempt = 0;; attempt++) {
+        try {
+            await createLockFile(lockPath, token);
+            return startHeldLock(lockPath, token, staleMs);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code !== "EEXIST" && !isTransientFsError(err))
+                throw err;
+        }
+        const state = await inspectLock(lockPath);
+        if (state) {
+            lastOwner = state.owner;
+            if (isStale(state, staleMs)) {
+                await breakStaleLock(lockPath, state.raw);
+                continue;
+            }
+        }
+        if (Date.now() >= deadline) {
+            const holder = lastOwner?.pid ? ` (held by pid ${lastOwner.pid} on ${lastOwner.hostname || "unknown host"})` : "";
+            throw new Error(`Timed out after ${timeoutMs} ms waiting for lock ${lockPath}${holder}`);
+        }
+        const backoff = Math.min(retryDelayMs * (1 + Math.floor(attempt / 5)), 250);
+        await sleep(backoff + Math.floor(Math.random() * retryDelayMs));
+    }
+}
+async function createLockFile(lockPath, token) {
+    const owner = {
+        pid: process.pid,
+        hostname: os.hostname(),
+        token,
+        acquiredAt: new Date().toISOString()
+    };
+    const handle = await fs.open(lockPath, "wx", 0o600);
+    try {
+        await handle.writeFile(JSON.stringify(owner), "utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+function startHeldLock(lockPath, token, staleMs) {
+    const heartbeat = setInterval(() => {
+        const now = new Date();
+        fs.utimes(lockPath, now, now).catch(() => { });
+    }, Math.max(250, Math.floor(staleMs / 3)));
+    heartbeat.unref?.();
+    let released = false;
+    return {
+        lockPath,
+        token,
+        async release() {
+            if (released)
+                return;
+            released = true;
+            clearInterval(heartbeat);
+            try {
+                const raw = await fs.readFile(lockPath, "utf8");
+                if (parseOwner(raw)?.token !== token)
+                    return; // our lock was broken and someone else owns it now
+            }
+            catch {
+                return;
+            }
+            for (let attempt = 0; attempt < 10; attempt++) {
+                try {
+                    await fs.unlink(lockPath);
+                    return;
+                }
+                catch (err) {
+                    if (err?.code === "ENOENT")
+                        return;
+                    if (!isTransientFsError(err))
+                        throw err;
+                    await sleep(15 * (attempt + 1));
+                }
+            }
+        }
+    };
+}
+async function inspectLock(lockPath) {
+    try {
+        const stat = await fs.stat(lockPath);
+        let raw = "";
+        try {
+            raw = await fs.readFile(lockPath, "utf8");
+        }
+        catch {
+            // Holder may be mid-create or mid-release; age alone decides.
+        }
+        return { raw, owner: parseOwner(raw), mtimeMs: stat.mtimeMs };
+    }
+    catch {
+        return undefined;
+    }
+}
+function isStale(state, staleMs) {
+    if (Date.now() - state.mtimeMs > staleMs)
+        return true;
+    const owner = state.owner;
+    if (owner?.pid && owner.hostname === os.hostname() && owner.pid !== process.pid) {
+        return !isProcessAlive(owner.pid);
+    }
+    return false;
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err?.code === "EPERM";
+    }
+}
+async function breakStaleLock(lockPath, observedRaw) {
+    const aside = `${lockPath}.stale-${process.pid}-${crypto.randomBytes(4).toString("hex")}`;
+    try {
+        await fs.rename(lockPath, aside);
+    }
+    catch {
+        return; // someone else broke or released it first
+    }
+    let movedRaw = "";
+    try {
+        movedRaw = await fs.readFile(aside, "utf8");
+    }
+    catch {
+        // ignore
+    }
+    if (observedRaw && movedRaw !== observedRaw) {
+        // We moved a lock that was re-acquired after we inspected it. Put it back if nobody took the slot.
+        await fs.link(aside, lockPath).catch(() => { });
+    }
+    await fs.rm(aside, { force: true }).catch(() => { });
+}
+function parseOwner(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function lockKey(lockPath) {
+    const resolved = path.resolve(lockPath);
+    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}