pqc-memory-mcp 1.0.0

package/dist/auth/tenant-verifier.js

@@ -0,0 +1,255 @@
+import { exchangeAuth0AccessToken, getMcpExchangeCache, looksLikeJwt, } from "../mcp-exchange.js";
+import { mcpDebug, tokenFingerprint } from "../debug.js";
+import { fetchTenantContextFromPqc, mockTenantIfEnabled, TenantResolveError, } from "../tenant-fetch.js";
+import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+function auth0ExchangeMode() {
+    const raw = (process.env.PQC_MCP_AUTH0_EXCHANGE || "").trim().toLowerCase();
+    if (!raw || raw === "0" || raw === "false" || raw === "off") {
+        return "off";
+    }
+    if (raw === "always") {
+        return "always";
+    }
+    if (raw === "1" || raw === "retry" || raw === "true") {
+        return "retry";
+    }
+    return "off";
+}
+function mapExchangeFailure(e) {
+    const msg = e.message || "token exchange failed";
+    if (e.statusCode === 404) {
+        return new InvalidTokenError("account not linked - sign in to the portal once so Auth0 sub is stored");
+    }
+    if (e.statusCode === 400) {
+        return new InvalidTokenError("access token is not a JWT (opaque tokens are not supported)");
+    }
+    if (e.statusCode === 503 || e.statusCode === 501) {
+        return new InvalidTokenError("token exchange is not configured on the API");
+    }
+    if (e.statusCode === 401) {
+        return new InvalidTokenError("invalid or expired token");
+    }
+    if (e.statusCode === 403) {
+        return new InvalidTokenError("not authorized for token exchange");
+    }
+    return new InvalidTokenError(msg.replace(/[^\x20-\x7E]/g, "-"));
+}
+async function resolveTenantContext(resolutionBaseUrl, inboundBearer) {
+    const mode = auth0ExchangeMode();
+    const inboundFp = tokenFingerprint(inboundBearer);
+    const cache = getMcpExchangeCache();
+    const fetchCtx = (bearer) => fetchTenantContextFromPqc(resolutionBaseUrl, bearer);
+    mcpDebug("auth.resolve.start", {
+        mode,
+        inboundTokenFp: inboundFp,
+        inboundLooksLikeJwt: looksLikeJwt(inboundBearer),
+    });
+    if (mode === "off") {
+        const tenantContext = await fetchCtx(inboundBearer);
+        mcpDebug("auth.resolve.done", { mode: "off", inboundTokenFp: inboundFp });
+        return { tenantContext, pqcApiBearer: inboundBearer };
+    }
+    if (mode === "always") {
+        if (!looksLikeJwt(inboundBearer)) {
+            mcpDebug("auth.resolve.fail", {
+                reason: "not_jwt_opaque_unsupported",
+                inboundTokenFp: inboundFp,
+            });
+            throw new InvalidTokenError("access token is not a JWT (opaque tokens are not supported)");
+        }
+        let cached = cache.getCachedPqcJwt(inboundBearer);
+        if (!cached) {
+            mcpDebug("auth.exchange.required", { inboundTokenFp: inboundFp, cacheHit: false });
+            try {
+                const tokens = await exchangeAuth0AccessToken(resolutionBaseUrl, inboundBearer);
+                cache.set(inboundBearer, tokens);
+            }
+            catch (err) {
+                if (err instanceof TenantResolveError) {
+                    mcpDebug("auth.exchange.failed", {
+                        inboundTokenFp: inboundFp,
+                        status: err.statusCode,
+                    });
+                    throw mapExchangeFailure(err);
+                }
+                throw err;
+            }
+            cached = cache.getCachedPqcJwt(inboundBearer);
+            if (!cached) {
+                throw new InvalidTokenError("token exchange cache miss after success");
+            }
+        }
+        else {
+            mcpDebug("auth.exchange.cache_hit", { inboundTokenFp: inboundFp });
+        }
+        try {
+            const tenantContext = await fetchCtx(cached.accessToken);
+            mcpDebug("auth.resolve.done", { mode: "always", inboundTokenFp: inboundFp });
+            return {
+                tenantContext,
+                accessExpiresAtUnix: cached.expiresAtUnixSec,
+                pqcApiBearer: cached.accessToken,
+            };
+        }
+        catch (e) {
+            if (e instanceof TenantResolveError && e.statusCode === 401) {
+                mcpDebug("auth.tenant_context_401_cache_invalidate", { inboundTokenFp: inboundFp });
+                cache.invalidate(inboundBearer);
+            }
+            throw e;
+        }
+    }
+    // retry: try pqc-db JWT path first, then exchange on 401
+    const cached = cache.getCachedPqcJwt(inboundBearer);
+    if (cached) {
+        mcpDebug("auth.retry.cache_hit_try_pqc_jwt", { inboundTokenFp: inboundFp });
+        try {
+            const tenantContext = await fetchCtx(cached.accessToken);
+            mcpDebug("auth.resolve.done", { mode: "retry", via: "cached_pqc_jwt", inboundTokenFp: inboundFp });
+            return {
+                tenantContext,
+                accessExpiresAtUnix: cached.expiresAtUnixSec,
+                pqcApiBearer: cached.accessToken,
+            };
+        }
+        catch (e) {
+            if (e instanceof TenantResolveError && e.statusCode === 401) {
+                mcpDebug("auth.retry.cached_jwt_401_invalidate", { inboundTokenFp: inboundFp });
+                cache.invalidate(inboundBearer);
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    try {
+        mcpDebug("auth.retry.tenant_context_direct", { inboundTokenFp: inboundFp });
+        const tenantContext = await fetchCtx(inboundBearer);
+        mcpDebug("auth.resolve.done", { mode: "retry", via: "direct_bearer", inboundTokenFp: inboundFp });
+        return { tenantContext, pqcApiBearer: inboundBearer };
+    }
+    catch (e) {
+        if (!(e instanceof TenantResolveError) || e.statusCode !== 401) {
+            throw e;
+        }
+        mcpDebug("auth.retry.direct_401_try_exchange", { inboundTokenFp: inboundFp });
+        if (!looksLikeJwt(inboundBearer)) {
+            mcpDebug("auth.resolve.fail", { reason: "401_not_jwt", inboundTokenFp: inboundFp });
+            throw new InvalidTokenError("invalid or expired token");
+        }
+        try {
+            const tokens = await exchangeAuth0AccessToken(resolutionBaseUrl, inboundBearer);
+            cache.set(inboundBearer, tokens);
+        }
+        catch (err) {
+            if (err instanceof TenantResolveError) {
+                mcpDebug("auth.exchange.failed", {
+                    inboundTokenFp: inboundFp,
+                    status: err.statusCode,
+                });
+                throw mapExchangeFailure(err);
+            }
+            throw err;
+        }
+        const after = cache.getCachedPqcJwt(inboundBearer);
+        if (!after) {
+            throw new InvalidTokenError("token exchange cache miss after success");
+        }
+        const tenantContext = await fetchCtx(after.accessToken);
+        mcpDebug("auth.resolve.done", { mode: "retry", via: "after_exchange", inboundTokenFp: inboundFp });
+        return {
+            tenantContext,
+            accessExpiresAtUnix: after.expiresAtUnixSec,
+            pqcApiBearer: after.accessToken,
+        };
+    }
+}
+/**
+ * MCP SDK AccessTokenVerifier: resolves pqc-db tenant context for a bearer token.
+ * When PQC_MCP_AUTH0_EXCHANGE is set, calls POST /api/v1/auth/mcp-exchange for Auth0 JWTs (see docs).
+ */
+export function createPqcTenantVerifier(resolutionBaseUrl) {
+    if (!resolutionBaseUrl) {
+        throw new Error("PQC_TENANT_RESOLUTION_URL is required for HTTP MCP");
+    }
+    return {
+        async verifyAccessToken(token) {
+            const fp = tokenFingerprint(token);
+            mcpDebug("auth.verify.start", {
+                tokenFp: fp,
+                tokenLen: token.length,
+                looksLikeJwt: looksLikeJwt(token),
+            });
+            let mock = null;
+            try {
+                mock = mockTenantIfEnabled(token);
+            }
+            catch (e) {
+                console.error("[pqc-memory] mock tenant env misconfigured:", e);
+                mcpDebug("auth.verify.fail", { tokenFp: fp, reason: "mock_misconfigured" });
+                throw new InvalidTokenError("mock tenant misconfigured");
+            }
+            let tenantContext;
+            let accessExpiresAtUnix;
+            if (mock) {
+                tenantContext = mock;
+                mcpDebug("auth.verify.mock_tenant", { tokenFp: fp });
+            }
+            else {
+                try {
+                    const resolved = await resolveTenantContext(resolutionBaseUrl, token);
+                    tenantContext = {
+                        ...resolved.tenantContext,
+                        apiBearerToken: resolved.pqcApiBearer,
+                    };
+                    accessExpiresAtUnix = resolved.accessExpiresAtUnix;
+                }
+                catch (e) {
+                    if (e instanceof InvalidTokenError) {
+                        mcpDebug("auth.verify.invalid_token", {
+                            tokenFp: fp,
+                            message: e.message.slice(0, 120),
+                        });
+                        throw e;
+                    }
+                    const status = e instanceof TenantResolveError ? e.statusCode : undefined;
+                    console.error("[pqc-memory] tenant-context resolution failed:", status, e);
+                    mcpDebug("auth.verify.tenant_resolve_error", {
+                        tokenFp: fp,
+                        status: status ?? -1,
+                    });
+                    if (e instanceof TenantResolveError && status === 401) {
+                        throw new InvalidTokenError("invalid or expired token");
+                    }
+                    if (e instanceof TenantResolveError && status === 403) {
+                        throw new InvalidTokenError("not authorized for memory access");
+                    }
+                    throw new InvalidTokenError("tenant resolution failed");
+                }
+            }
+            const now = Math.floor(Date.now() / 1000);
+            const expiresAt = accessExpiresAtUnix ?? now + 3600;
+            let apiHost = "";
+            try {
+                apiHost = new URL(tenantContext.apiUrl).hostname;
+            }
+            catch {
+                apiHost = "(bad_api_url)";
+            }
+            mcpDebug("auth.verify.ok", {
+                tokenFp: fp,
+                apiHost,
+                bucketIdLen: tenantContext.bucketId.length,
+            });
+            return {
+                token,
+                clientId: "pqc-mcp-remote",
+                scopes: ["mcp:memory"],
+                expiresAt,
+                tenantContext,
+                rawToken: token,
+            };
+        },
+    };
+}
+//# sourceMappingURL=tenant-verifier.js.map

package/dist/auth/tenant-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-verifier.js","sourceRoot":"","sources":["../../src/auth/tenant-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAYpF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAqB;IAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,uBAAuB,CAAC;IACjD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,IAAI,iBAAiB,CAC1B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,IAAI,iBAAiB,CAAC,6DAA6D,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,iBAAyB,EACzB,aAAqB;IAOrB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,yBAAyB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAE1F,QAAQ,CAAC,oBAAoB,EAAE;QAC7B,IAAI;QACJ,cAAc,EAAE,SAAS;QACzB,mBAAmB,EAAE,YAAY,CAAC,aAAa,CAAC;KACjD,CAAC,CAAC;IAEH,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;QACpD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,mBAAmB,EAAE;gBAC5B,MAAM,EAAE,4BAA4B;gBACpC,cAAc,EAAE,SAAS;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,iBAAiB,CACzB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,wBAAwB,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;gBAChF,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,QAAQ,CAAC,sBAAsB,EAAE;wBAC/B,cAAc,EAAE,SAAS;wBACzB,MAAM,EAAE,GAAG,CAAC,UAAU;qBACvB,CAAC,CAAC;oBACH,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAChC,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,yBAAyB,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7E,OAAO;gBACL,aAAa;gBACb,mBAAmB,EAAE,MAAM,CAAC,gBAAgB;gBAC5C,YAAY,EAAE,MAAM,CAAC,WAAW;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC5D,QAAQ,CAAC,0CAA0C,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpF,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,kCAAkC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;YACnG,OAAO;gBACL,aAAa;gBACb,mBAAmB,EAAE,MAAM,CAAC,gBAAgB;gBAC5C,YAAY,EAAE,MAAM,CAAC,WAAW;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC5D,QAAQ,CAAC,sCAAsC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChF,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,kCAAkC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;QACpD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAClG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC/D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,QAAQ,CAAC,oCAAoC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAChF,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,QAAQ,CAAC,sBAAsB,EAAE;oBAC/B,cAAc,EAAE,SAAS;oBACzB,MAAM,EAAE,GAAG,CAAC,UAAU;iBACvB,CAAC,CAAC;gBACH,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,OAAO;YACL,aAAa;YACb,mBAAmB,EAAE,KAAK,CAAC,gBAAgB;YAC3C,YAAY,EAAE,KAAK,CAAC,WAAW;SAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,iBAAqC;IAC3E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACnC,QAAQ,CAAC,mBAAmB,EAAE;gBAC5B,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,IAAI,GAAyB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;gBAChE,QAAQ,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,aAA4B,CAAC;YACjC,IAAI,mBAAuC,CAAC;YAE5C,IAAI,IAAI,EAAE,CAAC;gBACT,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;oBACtE,aAAa,GAAG;wBACd,GAAG,QAAQ,CAAC,aAAa;wBACzB,cAAc,EAAE,QAAQ,CAAC,YAAY;qBACtC,CAAC;oBACF,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;gBACrD,CAAC;gBAAC,OAAO,CAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,YAAY,iBAAiB,EAAE,CAAC;wBACnC,QAAQ,CAAC,2BAA2B,EAAE;4BACpC,OAAO,EAAE,EAAE;4BACX,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBACjC,CAAC,CAAC;wBACH,MAAM,CAAC,CAAC;oBACV,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,YAAY,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC1E,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC3E,QAAQ,CAAC,kCAAkC,EAAE;wBAC3C,OAAO,EAAE,EAAE;wBACX,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;qBACrB,CAAC,CAAC;oBACH,IAAI,CAAC,YAAY,kBAAkB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;wBACtD,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;oBAC1D,CAAC;oBACD,IAAI,CAAC,YAAY,kBAAkB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;wBACtD,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;oBAClE,CAAC;oBACD,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,mBAAmB,IAAI,GAAG,GAAG,IAAI,CAAC;YAEpD,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,eAAe,CAAC;YAC5B,CAAC;YACD,QAAQ,CAAC,gBAAgB,EAAE;gBACzB,OAAO,EAAE,EAAE;gBACX,OAAO;gBACP,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM;aAC3C,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,CAAC,YAAY,CAAC;gBACtB,SAAS;gBACT,aAAa;gBACb,QAAQ,EAAE,KAAK;aACS,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+/**
+ * Entry for npm bin `pqc-memory-mcp`.
+ * - No subcommand → stdio MCP (index).
+ * - `init` / `setup` → Cursor mcp.json wizard.
+ */
+const sub = process.argv[2];
+async function run() {
+    if (sub === "init" || sub === "setup") {
+        const { runInitWizard } = await import("./init-wizard.js");
+        await runInitWizard();
+        return;
+    }
+    if (sub === "help" || sub === "--help" || sub === "-h") {
+        console.log(`pqc-memory-mcp — MCP server for pqc-db memory
+
+Usage:
+  pqc-memory-mcp              Start stdio MCP (Cursor, Claude Code, Junie, Zed, …)
+  pqc-memory-mcp init         Guided setup: merges mcpServers for Cursor, Claude Code, or Junie
+  pqc-memory-mcp setup        Same as init
+
+Example:
+  npx -y pqc-memory-mcp init
+`);
+        process.exit(0);
+    }
+    await import("./index.js");
+}
+run().catch((err) => {
+    console.error("[pqc-memory] Fatal error:", err);
+    process.exit(1);
+});
+export {};
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;GAIG;AACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE5B,KAAK,UAAU,GAAG;IAChB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,aAAa,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;CASf,CAAC,CAAC;QACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAC7B,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAClB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,244 @@
+import type { StartSessionRequest, StartSessionResponse, SessionStatusResponse, WriteMemoryRequest, WriteMemoryResponse, PromoteMemoryRequest, PromoteMemoryResponse, QueryMemoriesResponse, ReflectRequest, ReflectResponse, ListEntitiesResponse, RelatedEntitiesResponse, TagOutcomeRequest, CreateMentalModelRequest, MentalModel, ListMentalModelsResponse, ListStrategiesResponse, DistillStrategiesRequest, DistillStrategiesResponse, MemoryStatsResponse, ListTraitsResponse, InheritableTraitsResponse, ListPatternsResponse, PromotePatternResponse, ObsidianExportRequest, ObsidianExportResponse, ObsidianExportStatus, ApiError } from "./types.js";
+export interface PqcClientConfig {
+    apiUrl: string;
+    apiKey: string;
+    /** Optional pqc-db JWT; sent as Authorization Bearer with X-API-Key (HTTP MCP). */
+    bearerToken?: string;
+}
+export declare class PqcApiError extends Error {
+    statusCode: number;
+    apiError: ApiError;
+    constructor(statusCode: number, apiError: ApiError);
+}
+/** JSON body from POST /api/v1/keys/managed/{key_id}/objects (typically 201). */
+export interface ManagedKeyObjectUploadResponse {
+    object_id: string;
+    [key: string]: unknown;
+}
+export declare class PqcClient {
+    private baseUrl;
+    private apiKey;
+    private bearerToken?;
+    constructor(config: PqcClientConfig);
+    private buildAuthHeaders;
+    private parseErrorBody;
+    private request;
+    /**
+     * Encrypted object upload via org managed Kyber key (multipart).
+     * POST /api/v1/keys/managed/{key_id}/objects
+     */
+    uploadManagedKeyObject(keyId: string, options: {
+        bucketId: string;
+        file: Buffer;
+        /** Filename for the multipart file part (Content-Disposition). */
+        multipartFilename?: string;
+        /** Optional display name override (form field `filename`). */
+        displayFilename?: string;
+    }): Promise<ManagedKeyObjectUploadResponse>;
+    /**
+     * Download and decrypt object bytes.
+     * GET /api/v1/keys/managed/{key_id}/objects/{object_id}
+     */
+    downloadManagedKeyObject(keyId: string, objectId: string): Promise<{
+        body: Buffer;
+        contentType: string | null;
+    }>;
+    /**
+     * List org objects; optional bucket filter.
+     * GET /api/v1/objects
+     */
+    listOrgObjects(options?: {
+        bucket?: string;
+    }): Promise<unknown>;
+    /**
+     * Object metadata (may include download_hint for encrypted objects).
+     * GET /api/v1/objects/{id}
+     */
+    getOrgObjectMetadata(objectId: string): Promise<unknown>;
+    startSession(req: StartSessionRequest): Promise<StartSessionResponse>;
+    endSession(sessionToken: string): Promise<void>;
+    getSessionStatus(sessionToken: string): Promise<SessionStatusResponse>;
+    writeMemory(sessionToken: string, req: WriteMemoryRequest): Promise<WriteMemoryResponse>;
+    promoteMemory(sessionToken: string, req: PromoteMemoryRequest): Promise<PromoteMemoryResponse>;
+    deleteMemory(sessionToken: string, memoryId: string): Promise<void>;
+    queryMemories(sessionToken: string, options?: {
+        tags?: string[];
+        memoryType?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<QueryMemoriesResponse>;
+    semanticSearch(sessionToken: string, query: string, limit?: number, scope?: "org", branchId?: string, includeBranches?: boolean): Promise<QueryMemoriesResponse>;
+    reflect(sessionToken: string, req: ReflectRequest): Promise<ReflectResponse>;
+    hybridSearch(sessionToken: string, query: string, options?: {
+        limit?: number;
+        tags?: string[];
+        tagsMatch?: string;
+    }): Promise<QueryMemoriesResponse>;
+    listEntities(sessionToken: string): Promise<ListEntitiesResponse>;
+    findRelatedEntities(sessionToken: string, entityName: string, hops?: number): Promise<RelatedEntitiesResponse>;
+    findMemoriesByEntity(sessionToken: string, entityName: string, limit?: number): Promise<QueryMemoriesResponse>;
+    tagOutcome(sessionToken: string, memoryId: string, req: TagOutcomeRequest): Promise<void>;
+    listMentalModels(sessionToken: string, limit?: number, offset?: number): Promise<ListMentalModelsResponse>;
+    getMentalModel(sessionToken: string, modelId: string): Promise<MentalModel>;
+    createMentalModel(sessionToken: string, req: CreateMentalModelRequest): Promise<MentalModel>;
+    refreshMentalModel(sessionToken: string, modelId: string): Promise<MentalModel>;
+    deleteMentalModel(sessionToken: string, modelId: string): Promise<void>;
+    listStrategies(sessionToken: string, options?: {
+        outcomeType?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<ListStrategiesResponse>;
+    distillStrategies(sessionToken: string, req: DistillStrategiesRequest): Promise<DistillStrategiesResponse>;
+    getStats(sessionToken: string): Promise<MemoryStatsResponse>;
+    listTraits(sessionToken: string, options?: {
+        agentId?: string;
+        traitType?: string;
+        sourceType?: string;
+        minConfidence?: number;
+        tags?: string[];
+        includeDeprecated?: boolean;
+        limit?: number;
+        offset?: number;
+    }): Promise<ListTraitsResponse>;
+    getInheritableTraits(sessionToken: string, agentId: string, options?: {
+        traitType?: string;
+        minConfidence?: number;
+        minSuccessRate?: number;
+        limit?: number;
+    }): Promise<InheritableTraitsResponse>;
+    listPatterns(sessionToken: string, options?: {
+        patternType?: string;
+        status?: string;
+        minAgentCount?: number;
+        minConfidence?: number;
+        limit?: number;
+        offset?: number;
+    }): Promise<ListPatternsResponse>;
+    promotePattern(sessionToken: string, patternId: string, traitName?: string): Promise<PromotePatternResponse>;
+    obsidianExport(sessionToken: string, req: ObsidianExportRequest): Promise<ObsidianExportResponse>;
+    obsidianStatus(sessionToken: string): Promise<ObsidianExportStatus>;
+    obsidianDownloadUrl(sessionToken: string): Promise<string>;
+    obsidianDelete(sessionToken: string): Promise<void>;
+    routedSearch(sessionToken: string, query: string, limit?: number, routing?: string, condensed?: boolean, branchId?: string, includeBranches?: boolean): Promise<any>;
+    activateContext(sessionToken: string, memoryId: string, priority?: number, reason?: string, expiresInHours?: number): Promise<any>;
+    getActiveContext(sessionToken: string): Promise<any>;
+    checkTriggers(sessionToken: string, filePath?: string, tags?: string[], entities?: string[], keywords?: string[]): Promise<any>;
+    lookupFact(sessionToken: string, key: string): Promise<any>;
+    searchFacts(sessionToken: string, query: string): Promise<any>;
+    createTrigger(sessionToken: string, trigger: {
+        trigger_type: string;
+        pattern: string;
+        recall_query: string;
+        auto_activate?: boolean;
+        priority?: number;
+        max_memories?: number;
+    }): Promise<any>;
+    listTriggers(sessionToken: string): Promise<any>;
+    getIdentity(sessionToken: string): Promise<any>;
+    createNarrative(sessionToken: string, name: string, description?: string, tags?: string[]): Promise<any>;
+    listNarratives(sessionToken: string, status?: string, limit?: number): Promise<any>;
+    getNarrative(sessionToken: string, narrativeId: string): Promise<any>;
+    updateNarrative(sessionToken: string, narrativeId: string, updates: {
+        name?: string;
+        description?: string;
+        status?: string;
+        tags?: string[];
+    }): Promise<any>;
+    deleteNarrative(sessionToken: string, narrativeId: string): Promise<any>;
+    linkMemoryToNarrative(sessionToken: string, narrativeId: string, memoryId: string, options?: {
+        sequence_order?: number;
+        chapter?: string;
+        link_type?: string;
+        notes?: string;
+    }): Promise<any>;
+    unlinkMemoryFromNarrative(sessionToken: string, narrativeId: string, memoryId: string): Promise<any>;
+    getNarrativeTimeline(sessionToken: string, narrativeId: string): Promise<any>;
+    getSelfEvaluationStats(sessionToken: string): Promise<any>;
+    getUnifiedContext(sessionToken: string, options?: {
+        maxTokens?: number;
+        includeIdentity?: boolean;
+        includeActiveContext?: boolean;
+        includeTriggers?: boolean;
+        includeMentalModels?: boolean;
+        filePath?: string;
+        entities?: string[];
+        tags?: string[];
+    }): Promise<any>;
+    registerSwarm(sessionToken: string, req: {
+        bucket_id?: string;
+        name: string;
+        description?: string;
+        auto_archivist?: boolean;
+        max_subagents?: number;
+    }): Promise<{
+        swarm_id: string;
+        master_key_id: string;
+    }>;
+    spawnSubagent(sessionToken: string, req: {
+        role: string;
+        description?: string;
+        derivation_path?: string;
+    }): Promise<{
+        subagent_id: string;
+        role: string;
+        api_key: string;
+        archivist_id?: string;
+        archivist_key?: string;
+    }>;
+    listSubagents(sessionToken: string, includeInactive?: boolean): Promise<{
+        subagents: any[];
+        total: number;
+        swarm_info?: any;
+    }>;
+    dissolveSubagent(sessionToken: string, subagentId: string): Promise<void>;
+    getSwarmPermissions(sessionToken: string): Promise<{
+        can_read_collective: boolean;
+        can_write_collective: boolean;
+        can_read_branches: string[];
+        can_promote: boolean;
+        can_spawn: boolean;
+    }>;
+    codegraphFindSymbol(name: string, limit?: number): Promise<{
+        functions?: CodeGraphFunction[];
+        types?: CodeGraphType[];
+    }>;
+    codegraphFindCallers(functionId: string, limit?: number): Promise<{
+        callers: CodeGraphFunction[];
+    }>;
+    codegraphFindCallees(functionId: string, limit?: number): Promise<{
+        callees: CodeGraphFunction[];
+    }>;
+    codegraphFindImpact(functionId: string, maxDepth?: number, limit?: number): Promise<{
+        impacted: CodeGraphFunction[];
+        depth: number;
+    }>;
+    codegraphFileSummary(filePath: string): Promise<{
+        file_path: string;
+        functions: CodeGraphFunction[];
+        types: CodeGraphType[];
+    }>;
+}
+export interface CodeGraphFunction {
+    id: string;
+    org_id: string;
+    name: string;
+    qualified_name: string;
+    signature: string;
+    file_path: string;
+    start_line: number;
+    end_line: number;
+    is_method: boolean;
+    receiver_type?: string;
+    is_exported: boolean;
+}
+export interface CodeGraphType {
+    id: string;
+    org_id: string;
+    name: string;
+    kind: string;
+    file_path: string;
+    start_line: number;
+    end_line: number;
+    is_exported: boolean;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,wBAAwB,EACxB,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,WAAY,SAAQ,KAAK;IAE3B,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,QAAQ;gBADlB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ;CAK5B;AAED,iFAAiF;AACjF,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAC,CAAS;gBAEjB,MAAM,EAAE,eAAe;IAMnC,OAAO,CAAC,gBAAgB;YAmBV,cAAc;YAad,OAAO;IAwCrB;;;OAGG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,kEAAkE;QAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,8DAA8D;QAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC,8BAA8B,CAAC;IA2C1C;;;OAGG;IACG,wBAAwB,CAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAmBxD;;;OAGG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE;QAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC;IAMpB;;;OAGG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxD,YAAY,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMrE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAMtE,WAAW,CACf,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAOzB,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAO3B,YAAY,CAChB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAQV,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACP,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACZ,GACL,OAAO,CAAC,qBAAqB,CAAC;IAY3B,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAW,EAClB,KAAK,CAAC,EAAE,KAAK,EACb,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAa3B,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,eAAe,CAAC;IAOrB,YAAY,CAChB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACf,GACL,OAAO,CAAC,qBAAqB,CAAC;IAY3B,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAMjE,mBAAmB,CACvB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAU,GACf,OAAO,CAAC,uBAAuB,CAAC;IAO7B,oBAAoB,CACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC,qBAAqB,CAAC;IAO3B,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC;IAWV,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,KAAK,GAAE,MAAW,EAClB,MAAM,GAAE,MAAU,GACjB,OAAO,CAAC,wBAAwB,CAAC;IAW9B,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,CAAC;IAQjB,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,WAAW,CAAC;IAOjB,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,CAAC;IAQjB,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAQV,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACZ,GACL,OAAO,CAAC,sBAAsB,CAAC;IAW5B,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,yBAAyB,CAAC;IAW/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAU5D,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACZ,GACL,OAAO,CAAC,kBAAkB,CAAC;IAgBxB,oBAAoB,CACxB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;KACX,GACL,OAAO,CAAC,yBAAyB,CAAC;IAgB/B,YAAY,CAChB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACZ,GACL,OAAO,CAAC,oBAAoB,CAAC;IAkB1B,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC;IAe5B,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,sBAAsB,CAAC;IAW5B,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQnE,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK1D,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnD,YAAY,CAChB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAW,EAClB,OAAO,GAAE,MAAe,EACxB,SAAS,GAAE,OAAe,EAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,GAAG,CAAC;IAcT,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAU,EACpB,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,GAAE,MAAU,GACzB,OAAO,CAAC,GAAG,CAAC;IAYT,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAMpD,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,EAAE,EACf,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,GAAG,CAAC;IAYT,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAO3D,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAO9D,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC,GAAG,CAAC;IAOT,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAM/C,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,GAAG,CAAC;IAOT,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC,GAAG,CAAC;IAOT,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAMrE,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACjF,OAAO,CAAC,GAAG,CAAC;IAOT,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAMxE,qBAAqB,CACzB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GACA,OAAO,CAAC,GAAG,CAAC;IAOT,yBAAyB,CAC7B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAMT,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAM7E,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAM1D,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACZ,GACL,OAAO,CAAC,GAAG,CAAC;IAoBT,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAOjD,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAOI,aAAa,CACjB,YAAY,EAAE,MAAM,EACpB,eAAe,GAAE,OAAe,GAC/B,OAAO,CAAC;QACT,SAAS,EAAE,GAAG,EAAE,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,GAAG,CAAC;KAClB,CAAC;IAOI,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzE,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QACvD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oBAAoB,EAAE,OAAO,CAAC;QAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IAUI,mBAAmB,CACvB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC;QACT,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;KACzB,CAAC;IAMI,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC;IAMtC,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC;IAMtC,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAU,EACpB,KAAK,GAAE,MAAY,GAClB,OAAO,CAAC;QAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAMtD,oBAAoB,CACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,iBAAiB,EAAE,CAAC;QAC/B,KAAK,EAAE,aAAa,EAAE,CAAC;KACxB,CAAC;CAKH;AAGD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB"}