skybridge 0.0.0-dev.bfd7070 → 0.0.0-dev.bfdcccb

package/dist/server/events.js

@@ -0,0 +1,449 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
+import dns from "node:dns";
+import http from "node:http";
+import https from "node:https";
+import net from "node:net";
+import { INVALID_PARAMS, ProtocolError, } from "@modelcontextprotocol/server";
+import { z } from "zod/v4";
+const EVENTS_ERROR = {
+    NotFound: -32011,
+    Forbidden: -32012,
+    Unsupported: -32014,
+    CallbackEndpointError: -32015,
+};
+const MAX_PAYLOAD_BYTES = 256 * 1024;
+const DELIVERY_TIMEOUT_MS = 10_000;
+const RETRY_DELAYS_MS = [1_000, 5_000];
+const VERIFICATION_CACHE_MS = 60 * 60_000;
+const SECRET_ROTATION_GRACE_MS = 5 * 60_000;
+const MIN_TTL_MS = 60_000;
+const DEFAULT_TTL_MS = 30 * 60_000;
+const MAX_TTL_MS = 24 * 60 * 60_000;
+function toStandardSchema(schema) {
+    return "~standard" in schema
+        ? schema
+        : z.object(schema);
+}
+async function validate(schema, value, what) {
+    const result = await schema["~standard"].validate(value);
+    if (result.issues) {
+        throw new ProtocolError(INVALID_PARAMS, `Invalid ${what}: ${result.issues.map((issue) => issue.message).join(", ")}`);
+    }
+    return result.value;
+}
+function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalJson).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.keys(value)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function principalOf(ctx) {
+    const authInfo = ctx.http?.authInfo;
+    const subject = authInfo?.extra?.subject;
+    const principal = typeof subject === "string" ? subject : authInfo?.clientId;
+    if (!principal) {
+        throw new ProtocolError(EVENTS_ERROR.Forbidden, "Webhook subscriptions require an authenticated caller");
+    }
+    return principal;
+}
+function isValidSecret(secret) {
+    const encoded = secret.startsWith("whsec_") ? secret.slice(6) : "";
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) {
+        return false;
+    }
+    const length = Buffer.from(encoded, "base64").length;
+    return length >= 24 && length <= 64;
+}
+function sign(secret, id, timestamp, body) {
+    const key = Buffer.from(secret.slice(6), "base64");
+    const digest = createHmac("sha256", key)
+        .update(`${id}.${timestamp}.${body}`)
+        .digest("base64");
+    return `v1,${digest}`;
+}
+const blockedAddresses = new net.BlockList();
+for (const [address, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.168.0.0", 16],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4],
+]) {
+    blockedAddresses.addSubnet(address, prefix, "ipv4");
+}
+for (const [address, prefix] of [
+    ["::", 128],
+    ["::1", 128],
+    ["64:ff9b::", 96],
+    ["64:ff9b:1::", 48],
+    ["100::", 64],
+    ["2001::", 23],
+    ["2001:db8::", 32],
+    ["2002::", 16],
+    ["3fff::", 20],
+    ["5f00::", 16],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["ff00::", 8],
+]) {
+    blockedAddresses.addSubnet(address, prefix, "ipv6");
+}
+/** @internal */
+export function isPublicAddress(address) {
+    const family = net.isIP(address);
+    if (family === 0) {
+        return false;
+    }
+    return !blockedAddresses.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+const insecureCallbacksAllowed = () => process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
+function checkCallbackUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new ProtocolError(INVALID_PARAMS, "delivery.url is not a valid URL");
+    }
+    const allowed = url.protocol === "https:" ||
+        (url.protocol === "http:" && insecureCallbacksAllowed());
+    if (!allowed) {
+        throw new ProtocolError(INVALID_PARAMS, "delivery.url must use https");
+    }
+    return url.href;
+}
+const safeLookup = (hostname, options, callback) => {
+    dns.lookup(hostname, { ...options, all: true }, (error, addresses) => {
+        if (error) {
+            callback(error, "", 4);
+            return;
+        }
+        const resolved = addresses;
+        const blocked = resolved.find(({ address }) => !isPublicAddress(address));
+        if (blocked) {
+            callback(new Error(`Callback resolves to a non-public address (${blocked.address})`), "", 4);
+            return;
+        }
+        if (options.all) {
+            callback(null, resolved);
+            return;
+        }
+        const [first] = resolved;
+        callback(null, first?.address ?? "", first?.family ?? 4);
+    });
+};
+function post(url, headers, body) {
+    const insecure = insecureCallbacksAllowed();
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    if (!insecure && net.isIP(hostname) && !isPublicAddress(hostname)) {
+        return Promise.resolve({ ok: false, reason: "connection_refused" });
+    }
+    const signal = AbortSignal.timeout(DELIVERY_TIMEOUT_MS);
+    const failure = (error) => ({
+        ok: false,
+        reason: signal.aborted
+            ? "timeout"
+            : error?.code?.startsWith("ERR_TLS") || error?.code?.includes("CERT")
+                ? "tls_error"
+                : "connection_refused",
+    });
+    const client = url.protocol === "https:" ? https : http;
+    return new Promise((resolve) => {
+        const request = client.request(url, {
+            method: "POST",
+            headers: { ...headers, "content-length": Buffer.byteLength(body) },
+            signal,
+            ...(insecure ? {} : { lookup: safeLookup }),
+        }, (response) => {
+            const status = response.statusCode ?? 0;
+            const chunks = [];
+            let size = 0;
+            response.on("data", (chunk) => {
+                size += chunk.length;
+                if (size <= 64 * 1024) {
+                    chunks.push(chunk);
+                }
+            });
+            response.on("end", () => {
+                if (status >= 200 && status < 300) {
+                    resolve({
+                        ok: true,
+                        status,
+                        body: Buffer.concat(chunks).toString(),
+                    });
+                }
+                else {
+                    resolve({
+                        ok: false,
+                        status,
+                        reason: status >= 500 ? "http_5xx" : "http_4xx",
+                    });
+                }
+            });
+            response.on("error", (error) => resolve(failure(error)));
+            response.on("close", () => resolve(failure()));
+        });
+        request.on("error", (error) => resolve(failure(error)));
+        request.end(body);
+    });
+}
+function signedPost(subscription, messageId, body) {
+    const timestamp = Math.floor(Date.now() / 1000);
+    const secrets = [subscription.secret];
+    if (subscription.previousSecret &&
+        subscription.previousSecret.until > Date.now()) {
+        secrets.push(subscription.previousSecret.secret);
+    }
+    return post(new URL(subscription.url), {
+        "content-type": "application/json",
+        "webhook-id": messageId,
+        "webhook-timestamp": String(timestamp),
+        "webhook-signature": secrets
+            .map((secret) => sign(secret, messageId, timestamp, body))
+            .join(" "),
+        "x-mcp-subscription-id": subscription.id,
+    }, body);
+}
+function memoryEventStore() {
+    const subscriptions = new Map();
+    return {
+        get: async (id) => subscriptions.get(id),
+        set: async (subscription) => {
+            subscriptions.set(subscription.id, subscription);
+        },
+        delete: async (id) => {
+            subscriptions.delete(id);
+        },
+        listByEvent: async (name) => {
+            const now = Date.now();
+            for (const [id, subscription] of subscriptions) {
+                if (subscription.expiresAt <= now) {
+                    subscriptions.delete(id);
+                }
+            }
+            return [...subscriptions.values()].filter((sub) => sub.name === name);
+        },
+    };
+}
+const SubscriptionKeySchema = z.object({
+    name: z.string(),
+    arguments: z.record(z.string(), z.unknown()).optional(),
+    delivery: z.object({ url: z.string() }),
+});
+const SubscribeParamsSchema = SubscriptionKeySchema.extend({
+    delivery: z.object({
+        mode: z.string().optional(),
+        url: z.string(),
+        secret: z.string(),
+    }),
+    cursor: z.string().nullable().optional(),
+    ttlMs: z.number().nullable().optional(),
+});
+/**
+ * App-wide MCP Events state: the registered event types, the subscription
+ * store and the callback verification cache. One per {@link Skybridge} app,
+ * shared by every per-request server.
+ *
+ * @internal
+ */
+export class EventsRuntime {
+    store;
+    events = new Map();
+    verifiedCallbacks = new Map();
+    constructor(options = {}) {
+        this.store = options.store ?? memoryEventStore();
+    }
+    register(config, hooks = {}) {
+        this.events.set(config.name, {
+            name: config.name,
+            description: config.description,
+            inputSchema: toStandardSchema(config.inputSchema ?? {}),
+            payloadSchema: toStandardSchema(config.payloadSchema),
+            _meta: config._meta,
+            hooks,
+        });
+    }
+    /** Install the `events/*` handlers on a per-request server. */
+    install(server) {
+        server.setRequestHandler("events/list", { params: z.object({ cursor: z.string().optional() }).optional() }, () => ({
+            events: [...this.events.values()].map((event) => ({
+                name: event.name,
+                ...(event.description && { description: event.description }),
+                delivery: ["webhook"],
+                inputSchema: event.inputSchema["~standard"].jsonSchema.input({
+                    target: "draft-2020-12",
+                }),
+                payloadSchema: event.payloadSchema["~standard"].jsonSchema.output({
+                    target: "draft-2020-12",
+                }),
+                ...(event._meta && { _meta: event._meta }),
+            })),
+        }));
+        server.setRequestHandler("events/subscribe", { params: SubscribeParamsSchema }, async (params, ctx) => {
+            if (params.delivery.mode && params.delivery.mode !== "webhook") {
+                throw new ProtocolError(EVENTS_ERROR.Unsupported, `Unsupported delivery mode: ${params.delivery.mode}`, { feature: "deliveryMode", value: params.delivery.mode });
+            }
+            if (!isValidSecret(params.delivery.secret)) {
+                throw new ProtocolError(INVALID_PARAMS, "delivery.secret must be whsec_ followed by base64 of 24 to 64 bytes");
+            }
+            const { event, subscription } = await this.resolve(params, ctx);
+            const ttl = params.ttlMs === null ? MAX_TTL_MS : (params.ttlMs ?? DEFAULT_TTL_MS);
+            const candidate = {
+                ...subscription,
+                secret: params.delivery.secret,
+                expiresAt: Date.now() + Math.min(Math.max(ttl, MIN_TTL_MS), MAX_TTL_MS),
+            };
+            await this.verifyCallback(candidate);
+            await event.hooks.onSubscribe?.(subscription.arguments, ctx);
+            const existing = await this.liveSubscription(subscription.id);
+            const previousSecret = existing && existing.secret !== candidate.secret
+                ? {
+                    secret: existing.secret,
+                    until: Date.now() + SECRET_ROTATION_GRACE_MS,
+                }
+                : existing?.previousSecret;
+            await this.store.set({
+                ...candidate,
+                ...(previousSecret && { previousSecret }),
+            });
+            return {
+                id: candidate.id,
+                refreshBefore: new Date(candidate.expiresAt).toISOString(),
+                cursor: null,
+                truncated: false,
+            };
+        });
+        server.setRequestHandler("events/unsubscribe", { params: SubscriptionKeySchema }, async (params, ctx) => {
+            const { subscription } = await this.resolve(params, ctx);
+            await this.store.delete(subscription.id);
+            return {};
+        });
+    }
+    /** Deliver one event to every live, matching subscription. */
+    async emit(name, emitted) {
+        const event = this.events.get(name);
+        if (!event) {
+            throw new Error(`Event "${name}" is not registered.`);
+        }
+        const data = await validate(event.payloadSchema, emitted.data, "payload");
+        const id = emitted.id ?? `evt_${randomBytes(12).toString("hex")}`;
+        const body = JSON.stringify({
+            eventId: id,
+            name,
+            timestamp: (emitted.timestamp ?? new Date()).toISOString(),
+            data,
+            cursor: null,
+        });
+        if (Buffer.byteLength(body) > MAX_PAYLOAD_BYTES) {
+            throw new Error(`Event "${name}" payload exceeds ${MAX_PAYLOAD_BYTES} bytes; send a summary and expose a tool to fetch the rest.`);
+        }
+        const now = Date.now();
+        const subscriptions = (await this.store.listByEvent(name)).filter((sub) => sub.expiresAt > now);
+        const results = await Promise.allSettled(subscriptions.map(async (subscription) => {
+            const matches = (await event.hooks.match?.({ id, data }, {
+                arguments: subscription.arguments,
+                principal: subscription.principal,
+            })) ?? true;
+            if (matches) {
+                await this.deliver(subscription, id, body, 0);
+            }
+        }));
+        const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+        if (failures.length > 0) {
+            throw new AggregateError(failures, `Event ${id} was not delivered to ${failures.length} subscription(s) whose match hook threw.`);
+        }
+    }
+    async resolve(params, ctx) {
+        const event = this.events.get(params.name);
+        if (!event) {
+            throw new ProtocolError(EVENTS_ERROR.NotFound, `Unknown event: ${params.name}`, { kind: "event" });
+        }
+        const url = checkCallbackUrl(params.delivery.url);
+        const principal = principalOf(ctx);
+        const rawArguments = params.arguments ?? {};
+        const args = (await validate(event.inputSchema, rawArguments, "arguments"));
+        const hash = createHash("sha256")
+            .update(canonicalJson([principal, url, event.name, rawArguments]))
+            .digest("hex");
+        return {
+            event,
+            subscription: {
+                id: `sub_${hash.slice(0, 32)}`,
+                principal,
+                name: event.name,
+                arguments: args,
+                url,
+            },
+        };
+    }
+    async deliver(subscription, eventId, body, attempt) {
+        const outcome = await signedPost(subscription, eventId, body);
+        if (outcome.ok) {
+            return;
+        }
+        const status = outcome.status ?? 0;
+        const retryable = status !== 410 && status !== 413 && (status < 300 || status >= 400);
+        const delay = RETRY_DELAYS_MS[attempt];
+        if (!retryable || delay === undefined) {
+            console.warn(`skybridge: dropped event ${eventId} for subscription ${subscription.id} (${outcome.reason})`);
+            return;
+        }
+        setTimeout(() => {
+            this.liveSubscription(subscription.id)
+                .then((live) => live && this.deliver(live, eventId, body, attempt + 1))
+                .catch(() => { });
+        }, delay).unref();
+    }
+    async liveSubscription(id) {
+        const subscription = await this.store.get(id);
+        if (subscription && subscription.expiresAt <= Date.now()) {
+            await this.store.delete(id);
+            return undefined;
+        }
+        return subscription;
+    }
+    async verifyCallback(subscription) {
+        const key = `${subscription.principal}\n${subscription.url}`;
+        const now = Date.now();
+        if ((this.verifiedCallbacks.get(key) ?? 0) > now) {
+            return;
+        }
+        const challenge = randomBytes(24).toString("base64url");
+        const outcome = await signedPost(subscription, `msg_verification_${randomBytes(12).toString("hex")}`, JSON.stringify({ type: "verification", challenge }));
+        let echoed;
+        if (outcome.ok) {
+            try {
+                echoed = JSON.parse(outcome.body)?.challenge;
+            }
+            catch { }
+        }
+        const matched = typeof echoed === "string" &&
+            echoed.length === challenge.length &&
+            timingSafeEqual(Buffer.from(echoed), Buffer.from(challenge));
+        if (!matched) {
+            throw new ProtocolError(EVENTS_ERROR.CallbackEndpointError, "Callback endpoint verification failed", { reason: outcome.ok ? "challenge_failed" : outcome.reason });
+        }
+        for (const [cached, until] of this.verifiedCallbacks) {
+            if (until <= now) {
+                this.verifiedCallbacks.delete(cached);
+            }
+        }
+        this.verifiedCallbacks.set(key, now + VERIFICATION_CACHE_MS);
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/server/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/server/events.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,aAAa,GAKd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,CAAC,KAAK;IAChB,SAAS,EAAE,CAAC,KAAK;IACjB,WAAW,EAAE,CAAC,KAAK;IACnB,qBAAqB,EAAE,CAAC,KAAK;CACrB,CAAC;AAEX,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AACrC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACvC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC5C,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAgIpC,SAAS,gBAAgB,CAAC,MAAmB;IAC3C,OAAO,WAAW,IAAI,MAAM;QAC1B,CAAC,CAAE,MAAiC;QACpC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAkC,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAA8B,EAC9B,KAAc,EACd,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,WAAW,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,IAAI,EAAE;aACN,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,EAAE,CACrF;aACA,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,YAAY,CAAC,SAAS,EACtB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,EAAU,EAAE,SAAiB,EAAE,IAAY;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACrC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpB,OAAO,MAAM,MAAM,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;AAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACR,EAAE,CAAC;IACX,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,OAAO,EAAE,EAAE,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACL,EAAE,CAAC;IACX,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,wBAAwB,GAAG,GAAG,EAAE,CACpC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAE5E,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GACX,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,wBAAwB,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IACrE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,SAAgC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CACN,IAAI,KAAK,CACP,8CAA8C,OAAO,CAAC,OAAO,GAAG,CACjE,EACD,EAAE,EACF,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACf,QAAiE,CAChE,IAAI,EACJ,QAAQ,CACT,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAMF,SAAS,IAAI,CACX,GAAQ,EACR,OAA+B,EAC/B,IAAY;IAEZ,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,KAA6B,EAAmB,EAAE,CAAC,CAAC;QACnE,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,OAAO;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,oBAAoB;KAC3B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAC5B,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAClE,MAAM;YACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;SAC5C,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;oBAClC,OAAO,CAAC;wBACN,EAAE,EAAE,IAAI;wBACR,MAAM;wBACN,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;qBACvC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC;wBACN,EAAE,EAAE,KAAK;wBACT,MAAM;wBACN,MAAM,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;qBAChD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC,CACF,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,YAA+B,EAC/B,SAAiB,EACjB,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,IACE,YAAY,CAAC,cAAc;QAC3B,YAAY,CAAC,cAAc,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CACT,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EACzB;QACE,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,SAAS;QACvB,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC;QACtC,mBAAmB,EAAE,OAAO;aACzB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;aACzD,IAAI,CAAC,GAAG,CAAC;QACZ,uBAAuB,EAAE,YAAY,CAAC,EAAE;KACzC,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC3D,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YAC1B,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACnB,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC/C,IAAI,YAAY,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;oBAClC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACP,KAAK,CAAa;IAClB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/D,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,gBAAgB,EAAE,CAAC;IACnD,CAAC;IAED,QAAQ,CACN,MAAqD,EACrD,QAAyC,EAAE;QAE3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YACvD,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,OAAO,CAAC,MAAyD;QAC/D,MAAM,CAAC,iBAAiB,CACtB,aAAa,EACb,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,EAClE,GAAG,EAAE,CAAC,CAAC;YACL,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC5D,QAAQ,EAAE,CAAC,SAAS,CAAC;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;oBAC3D,MAAM,EAAE,eAAe;iBACxB,CAAC;gBACF,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;oBAChE,MAAM,EAAE,eAAe;iBACxB,CAAC;gBACF,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;aAC3C,CAAC,CAAC;SACJ,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,kBAAkB,EAClB,EAAE,MAAM,EAAE,qBAAqB,EAAE,EACjC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/D,MAAM,IAAI,aAAa,CACrB,YAAY,CAAC,WAAW,EACxB,8BAA8B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EACpD,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CACzD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,GAAG,GACP,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC,CAAC;YACxE,MAAM,SAAS,GAAsB;gBACnC,GAAG,YAAY;gBACf,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC9B,SAAS,EACP,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC;aAC/D,CAAC;YACF,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAE7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,cAAc,GAClB,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;gBAC9C,CAAC,CAAC;oBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB;iBAC7C;gBACH,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,GAAG,SAAS;gBACZ,GAAG,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,aAAa,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC1D,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,iBAAiB,CACtB,oBAAoB,EACpB,EAAE,MAAM,EAAE,qBAAqB,EAAE,EACjC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAA8B;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,sBAAsB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,OAAO,EAAE,EAAE;YACX,IAAI;YACJ,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YAC1D,IAAI;YACJ,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,qBAAqB,iBAAiB,6DAA6D,CAClH,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAC/D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAC7B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE;YACvC,MAAM,OAAO,GACX,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CACxB,EAAE,EAAE,EAAE,IAAI,EAAE,EACZ;gBACE,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,SAAS,EAAE,YAAY,CAAC,SAAS;aAClC,CACF,CAAC,IAAI,IAAI,CAAC;YACb,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1C,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CACpD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,QAAQ,EACR,SAAS,EAAE,yBAAyB,QAAQ,CAAC,MAAM,0CAA0C,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAA6C,EAC7C,GAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CACrB,YAAY,CAAC,QAAQ,EACrB,kBAAkB,MAAM,CAAC,IAAI,EAAE,EAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAC1B,KAAK,CAAC,WAAW,EACjB,YAAY,EACZ,WAAW,CACZ,CAA4B,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;aACjE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO;YACL,KAAK;YACL,YAAY,EAAE;gBACZ,EAAE,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;gBAC9B,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,GAAG;aACJ;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,YAA+B,EAC/B,OAAe,EACf,IAAY,EACZ,OAAe;QAEf,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GACb,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,4BAA4B,OAAO,qBAAqB,YAAY,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,CAC9F,CAAC;YACF,OAAO;QACT,CAAC;QACD,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;iBACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;iBACtE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,YAAY,IAAI,YAAY,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,YAA+B;QAC1D,MAAM,GAAG,GAAG,GAAG,YAAY,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,YAAY,EACZ,oBAAoB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EACrD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CACpD,CAAC;QACF,IAAI,MAAe,CAAC;QACpB,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YAClC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,YAAY,CAAC,qBAAqB,EAClC,uCAAuC,EACvC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrD,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,qBAAqB,CAAC,CAAC;IAC/D,CAAC;CACF","sourcesContent":["import {\n  createHash,\n  createHmac,\n  randomBytes,\n  timingSafeEqual,\n} from \"node:crypto\";\nimport dns from \"node:dns\";\nimport http from \"node:http\";\nimport https from \"node:https\";\nimport net from \"node:net\";\nimport {\n  INVALID_PARAMS,\n  ProtocolError,\n  type McpServer as SdkMcpServer,\n  type ServerContext,\n  type StandardSchemaV1,\n  type StandardSchemaWithJSON,\n} from \"@modelcontextprotocol/server\";\nimport { z } from \"zod/v4\";\n\nconst EVENTS_ERROR = {\n  NotFound: -32011,\n  Forbidden: -32012,\n  Unsupported: -32014,\n  CallbackEndpointError: -32015,\n} as const;\n\nconst MAX_PAYLOAD_BYTES = 256 * 1024;\nconst DELIVERY_TIMEOUT_MS = 10_000;\nconst RETRY_DELAYS_MS = [1_000, 5_000];\nconst VERIFICATION_CACHE_MS = 60 * 60_000;\nconst SECRET_ROTATION_GRACE_MS = 5 * 60_000;\nconst MIN_TTL_MS = 60_000;\nconst DEFAULT_TTL_MS = 30 * 60_000;\nconst MAX_TTL_MS = 24 * 60 * 60_000;\n\n/**\n * A webhook subscription as held by an {@link EventStore}. Skybridge creates,\n * refreshes and deletes these; a store only persists them.\n */\nexport interface EventSubscription {\n  /** Deterministic over `(principal, url, name, arguments)`. */\n  id: string;\n  /** The authenticated subject that subscribed. */\n  principal: string;\n  /** Event type name. */\n  name: string;\n  /** Subscription arguments, validated against the event's `inputSchema`. */\n  arguments: Record<string, unknown>;\n  /** Callback URL deliveries are POSTed to. */\n  url: string;\n  /** Standard Webhooks signing secret (`whsec_…`). */\n  secret: string;\n  /** Secret being rotated out, still used to dual-sign until `until`. */\n  previousSecret?: { secret: string; until: number };\n  /** Expiry, in epoch milliseconds. */\n  expiresAt: number;\n}\n\n/**\n * Where webhook subscriptions live between the `events/subscribe` request\n * that creates them and the {@link Skybridge.emit} call that delivers to them.\n * Skybridge ignores subscriptions past `expiresAt`, so a store only needs to\n * persist them; dropping expired entries is optional housekeeping.\n *\n * The default in-memory store is enough for a single long-lived process. Pass\n * your own when the app runs on several instances or restarts often.\n */\nexport interface EventStore {\n  get(id: string): Promise<EventSubscription | undefined>;\n  set(subscription: EventSubscription): Promise<void>;\n  delete(id: string): Promise<void>;\n  /** Every stored subscription to the event named `name`. */\n  listByEvent(name: string): Promise<EventSubscription[]>;\n}\n\n/** Options for MCP Events, passed as `events` to {@link Skybridge}. */\nexport interface EventsOptions {\n  /** Where subscriptions are kept. Defaults to an in-memory store. */\n  store?: EventStore;\n}\n\n/** An event occurrence as passed to {@link Skybridge.emit}. */\nexport interface EmittedEvent<TData> {\n  /** Stable identifier used for deduplication, ideally the upstream's. Generated when omitted. */\n  id?: string;\n  /** When the event happened. Defaults to now. */\n  timestamp?: Date;\n  /** Payload, validated against the event's `payloadSchema`. */\n  data: TData;\n}\n\n/** Type marker for a registered event, produced by `registerEvent`. */\nexport type EventDef<TArguments = unknown, TPayload = unknown> = {\n  arguments: TArguments;\n  payload: TPayload;\n};\n\ntype EventSchema =\n  | Record<string, StandardSchemaWithJSON>\n  | StandardSchemaWithJSON;\n\nexport type InferEventSchema<T extends EventSchema> =\n  T extends StandardSchemaWithJSON\n    ? StandardSchemaV1.InferOutput<T>\n    : T extends Record<string, StandardSchemaWithJSON>\n      ? {\n          [K in keyof T as undefined extends StandardSchemaV1.InferOutput<T[K]>\n            ? never\n            : K]: StandardSchemaV1.InferOutput<T[K]>;\n        } & {\n          [K in keyof T as undefined extends StandardSchemaV1.InferOutput<T[K]>\n            ? K\n            : never]?: StandardSchemaV1.InferOutput<T[K]>;\n        }\n      : never;\n\n/** The `registerEvent` config: how the event type is described in `events/list`. */\nexport interface EventConfig<\n  TName extends string,\n  TInput extends EventSchema,\n  TPayload extends EventSchema,\n> {\n  /** Stable, specific name such as `comment.created`. */\n  name: TName;\n  /** What the event is and when it fires. */\n  description?: string;\n  /** Subscription arguments (filters): a Zod shape or a Standard Schema object. */\n  inputSchema?: TInput;\n  /** Shape of the delivered `data`: a Zod shape or a Standard Schema object. */\n  payloadSchema: TPayload;\n  _meta?: Record<string, unknown>;\n}\n\n/** Optional per-event behavior passed as the second argument of `registerEvent`. */\nexport interface EventHooks<TArguments, TPayload, TExtra> {\n  /**\n   * Decide whether an emitted event goes to a given subscription. Without it,\n   * every subscription to the event receives every emit.\n   */\n  match?(\n    event: { id: string; data: TPayload },\n    subscription: { arguments: TArguments; principal: string },\n  ): boolean | Promise<boolean>;\n  /**\n   * Runs on every `events/subscribe`, including refreshes, once the callback\n   * URL is verified and before the subscription is stored. Throw (e.g. a\n   * `ProtocolError`) to reject it, for instance when the caller may not access\n   * what the arguments point to.\n   */\n  onSubscribe?(args: TArguments, extra: TExtra): void | Promise<void>;\n}\n\ntype RegisteredEvent = {\n  name: string;\n  description?: string;\n  inputSchema: StandardSchemaWithJSON;\n  payloadSchema: StandardSchemaWithJSON;\n  _meta?: Record<string, unknown>;\n  hooks: EventHooks<Record<string, unknown>, unknown, ServerContext>;\n};\n\nfunction toStandardSchema(schema: EventSchema): StandardSchemaWithJSON {\n  return \"~standard\" in schema\n    ? (schema as StandardSchemaWithJSON)\n    : z.object(schema as unknown as z.ZodRawShape);\n}\n\nasync function validate(\n  schema: StandardSchemaWithJSON,\n  value: unknown,\n  what: string,\n): Promise<unknown> {\n  const result = await schema[\"~standard\"].validate(value);\n  if (result.issues) {\n    throw new ProtocolError(\n      INVALID_PARAMS,\n      `Invalid ${what}: ${result.issues.map((issue) => issue.message).join(\", \")}`,\n    );\n  }\n  return result.value;\n}\n\nfunction canonicalJson(value: unknown): string {\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalJson).join(\",\")}]`;\n  }\n  if (value && typeof value === \"object\") {\n    return `{${Object.keys(value)\n      .sort()\n      .map(\n        (key) =>\n          `${JSON.stringify(key)}:${canonicalJson((value as Record<string, unknown>)[key])}`,\n      )\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value);\n}\n\nfunction principalOf(ctx: ServerContext): string {\n  const authInfo = ctx.http?.authInfo;\n  const subject = authInfo?.extra?.subject;\n  const principal = typeof subject === \"string\" ? subject : authInfo?.clientId;\n  if (!principal) {\n    throw new ProtocolError(\n      EVENTS_ERROR.Forbidden,\n      \"Webhook subscriptions require an authenticated caller\",\n    );\n  }\n  return principal;\n}\n\nfunction isValidSecret(secret: string): boolean {\n  const encoded = secret.startsWith(\"whsec_\") ? secret.slice(6) : \"\";\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) {\n    return false;\n  }\n  const length = Buffer.from(encoded, \"base64\").length;\n  return length >= 24 && length <= 64;\n}\n\nfunction sign(secret: string, id: string, timestamp: number, body: string) {\n  const key = Buffer.from(secret.slice(6), \"base64\");\n  const digest = createHmac(\"sha256\", key)\n    .update(`${id}.${timestamp}.${body}`)\n    .digest(\"base64\");\n  return `v1,${digest}`;\n}\n\nconst blockedAddresses = new net.BlockList();\nfor (const [address, prefix] of [\n  [\"0.0.0.0\", 8],\n  [\"10.0.0.0\", 8],\n  [\"100.64.0.0\", 10],\n  [\"127.0.0.0\", 8],\n  [\"169.254.0.0\", 16],\n  [\"172.16.0.0\", 12],\n  [\"192.0.0.0\", 24],\n  [\"192.0.2.0\", 24],\n  [\"192.168.0.0\", 16],\n  [\"198.18.0.0\", 15],\n  [\"198.51.100.0\", 24],\n  [\"203.0.113.0\", 24],\n  [\"224.0.0.0\", 4],\n  [\"240.0.0.0\", 4],\n] as const) {\n  blockedAddresses.addSubnet(address, prefix, \"ipv4\");\n}\nfor (const [address, prefix] of [\n  [\"::\", 128],\n  [\"::1\", 128],\n  [\"64:ff9b::\", 96],\n  [\"64:ff9b:1::\", 48],\n  [\"100::\", 64],\n  [\"2001::\", 23],\n  [\"2001:db8::\", 32],\n  [\"2002::\", 16],\n  [\"3fff::\", 20],\n  [\"5f00::\", 16],\n  [\"fc00::\", 7],\n  [\"fe80::\", 10],\n  [\"ff00::\", 8],\n] as const) {\n  blockedAddresses.addSubnet(address, prefix, \"ipv6\");\n}\n\n/** @internal */\nexport function isPublicAddress(address: string): boolean {\n  const family = net.isIP(address);\n  if (family === 0) {\n    return false;\n  }\n  return !blockedAddresses.check(address, family === 4 ? \"ipv4\" : \"ipv6\");\n}\n\nconst insecureCallbacksAllowed = () =>\n  process.env.NODE_ENV === \"development\" || process.env.NODE_ENV === \"test\";\n\nfunction checkCallbackUrl(raw: string): string {\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    throw new ProtocolError(INVALID_PARAMS, \"delivery.url is not a valid URL\");\n  }\n  const allowed =\n    url.protocol === \"https:\" ||\n    (url.protocol === \"http:\" && insecureCallbacksAllowed());\n  if (!allowed) {\n    throw new ProtocolError(INVALID_PARAMS, \"delivery.url must use https\");\n  }\n  return url.href;\n}\n\nconst safeLookup: net.LookupFunction = (hostname, options, callback) => {\n  dns.lookup(hostname, { ...options, all: true }, (error, addresses) => {\n    if (error) {\n      callback(error, \"\", 4);\n      return;\n    }\n    const resolved = addresses as dns.LookupAddress[];\n    const blocked = resolved.find(({ address }) => !isPublicAddress(address));\n    if (blocked) {\n      callback(\n        new Error(\n          `Callback resolves to a non-public address (${blocked.address})`,\n        ),\n        \"\",\n        4,\n      );\n      return;\n    }\n    if (options.all) {\n      (callback as unknown as (e: null, a: dns.LookupAddress[]) => void)(\n        null,\n        resolved,\n      );\n      return;\n    }\n    const [first] = resolved;\n    callback(null, first?.address ?? \"\", first?.family ?? 4);\n  });\n};\n\ntype DeliveryOutcome =\n  | { ok: true; status: number; body: string }\n  | { ok: false; status?: number; reason: string };\n\nfunction post(\n  url: URL,\n  headers: Record<string, string>,\n  body: string,\n): Promise<DeliveryOutcome> {\n  const insecure = insecureCallbacksAllowed();\n  const hostname = url.hostname.replace(/^\\[|\\]$/g, \"\");\n  if (!insecure && net.isIP(hostname) && !isPublicAddress(hostname)) {\n    return Promise.resolve({ ok: false, reason: \"connection_refused\" });\n  }\n  const signal = AbortSignal.timeout(DELIVERY_TIMEOUT_MS);\n  const failure = (error?: NodeJS.ErrnoException): DeliveryOutcome => ({\n    ok: false,\n    reason: signal.aborted\n      ? \"timeout\"\n      : error?.code?.startsWith(\"ERR_TLS\") || error?.code?.includes(\"CERT\")\n        ? \"tls_error\"\n        : \"connection_refused\",\n  });\n  const client = url.protocol === \"https:\" ? https : http;\n  return new Promise((resolve) => {\n    const request = client.request(\n      url,\n      {\n        method: \"POST\",\n        headers: { ...headers, \"content-length\": Buffer.byteLength(body) },\n        signal,\n        ...(insecure ? {} : { lookup: safeLookup }),\n      },\n      (response) => {\n        const status = response.statusCode ?? 0;\n        const chunks: Buffer[] = [];\n        let size = 0;\n        response.on(\"data\", (chunk: Buffer) => {\n          size += chunk.length;\n          if (size <= 64 * 1024) {\n            chunks.push(chunk);\n          }\n        });\n        response.on(\"end\", () => {\n          if (status >= 200 && status < 300) {\n            resolve({\n              ok: true,\n              status,\n              body: Buffer.concat(chunks).toString(),\n            });\n          } else {\n            resolve({\n              ok: false,\n              status,\n              reason: status >= 500 ? \"http_5xx\" : \"http_4xx\",\n            });\n          }\n        });\n        response.on(\"error\", (error) => resolve(failure(error)));\n        response.on(\"close\", () => resolve(failure()));\n      },\n    );\n    request.on(\"error\", (error) => resolve(failure(error)));\n    request.end(body);\n  });\n}\n\nfunction signedPost(\n  subscription: EventSubscription,\n  messageId: string,\n  body: string,\n): Promise<DeliveryOutcome> {\n  const timestamp = Math.floor(Date.now() / 1000);\n  const secrets = [subscription.secret];\n  if (\n    subscription.previousSecret &&\n    subscription.previousSecret.until > Date.now()\n  ) {\n    secrets.push(subscription.previousSecret.secret);\n  }\n  return post(\n    new URL(subscription.url),\n    {\n      \"content-type\": \"application/json\",\n      \"webhook-id\": messageId,\n      \"webhook-timestamp\": String(timestamp),\n      \"webhook-signature\": secrets\n        .map((secret) => sign(secret, messageId, timestamp, body))\n        .join(\" \"),\n      \"x-mcp-subscription-id\": subscription.id,\n    },\n    body,\n  );\n}\n\nfunction memoryEventStore(): EventStore {\n  const subscriptions = new Map<string, EventSubscription>();\n  return {\n    get: async (id) => subscriptions.get(id),\n    set: async (subscription) => {\n      subscriptions.set(subscription.id, subscription);\n    },\n    delete: async (id) => {\n      subscriptions.delete(id);\n    },\n    listByEvent: async (name) => {\n      const now = Date.now();\n      for (const [id, subscription] of subscriptions) {\n        if (subscription.expiresAt <= now) {\n          subscriptions.delete(id);\n        }\n      }\n      return [...subscriptions.values()].filter((sub) => sub.name === name);\n    },\n  };\n}\n\nconst SubscriptionKeySchema = z.object({\n  name: z.string(),\n  arguments: z.record(z.string(), z.unknown()).optional(),\n  delivery: z.object({ url: z.string() }),\n});\n\nconst SubscribeParamsSchema = SubscriptionKeySchema.extend({\n  delivery: z.object({\n    mode: z.string().optional(),\n    url: z.string(),\n    secret: z.string(),\n  }),\n  cursor: z.string().nullable().optional(),\n  ttlMs: z.number().nullable().optional(),\n});\n\n/**\n * App-wide MCP Events state: the registered event types, the subscription\n * store and the callback verification cache. One per {@link Skybridge} app,\n * shared by every per-request server.\n *\n * @internal\n */\nexport class EventsRuntime {\n  private readonly store: EventStore;\n  private readonly events = new Map<string, RegisteredEvent>();\n  private readonly verifiedCallbacks = new Map<string, number>();\n\n  constructor(options: EventsOptions = {}) {\n    this.store = options.store ?? memoryEventStore();\n  }\n\n  register(\n    config: EventConfig<string, EventSchema, EventSchema>,\n    hooks: EventHooks<never, never, never> = {},\n  ): void {\n    this.events.set(config.name, {\n      name: config.name,\n      description: config.description,\n      inputSchema: toStandardSchema(config.inputSchema ?? {}),\n      payloadSchema: toStandardSchema(config.payloadSchema),\n      _meta: config._meta,\n      hooks,\n    });\n  }\n\n  /** Install the `events/*` handlers on a per-request server. */\n  install(server: Pick<SdkMcpServer[\"server\"], \"setRequestHandler\">): void {\n    server.setRequestHandler(\n      \"events/list\",\n      { params: z.object({ cursor: z.string().optional() }).optional() },\n      () => ({\n        events: [...this.events.values()].map((event) => ({\n          name: event.name,\n          ...(event.description && { description: event.description }),\n          delivery: [\"webhook\"],\n          inputSchema: event.inputSchema[\"~standard\"].jsonSchema.input({\n            target: \"draft-2020-12\",\n          }),\n          payloadSchema: event.payloadSchema[\"~standard\"].jsonSchema.output({\n            target: \"draft-2020-12\",\n          }),\n          ...(event._meta && { _meta: event._meta }),\n        })),\n      }),\n    );\n\n    server.setRequestHandler(\n      \"events/subscribe\",\n      { params: SubscribeParamsSchema },\n      async (params, ctx) => {\n        if (params.delivery.mode && params.delivery.mode !== \"webhook\") {\n          throw new ProtocolError(\n            EVENTS_ERROR.Unsupported,\n            `Unsupported delivery mode: ${params.delivery.mode}`,\n            { feature: \"deliveryMode\", value: params.delivery.mode },\n          );\n        }\n        if (!isValidSecret(params.delivery.secret)) {\n          throw new ProtocolError(\n            INVALID_PARAMS,\n            \"delivery.secret must be whsec_ followed by base64 of 24 to 64 bytes\",\n          );\n        }\n        const { event, subscription } = await this.resolve(params, ctx);\n        const ttl =\n          params.ttlMs === null ? MAX_TTL_MS : (params.ttlMs ?? DEFAULT_TTL_MS);\n        const candidate: EventSubscription = {\n          ...subscription,\n          secret: params.delivery.secret,\n          expiresAt:\n            Date.now() + Math.min(Math.max(ttl, MIN_TTL_MS), MAX_TTL_MS),\n        };\n        await this.verifyCallback(candidate);\n        await event.hooks.onSubscribe?.(subscription.arguments, ctx);\n\n        const existing = await this.liveSubscription(subscription.id);\n        const previousSecret =\n          existing && existing.secret !== candidate.secret\n            ? {\n                secret: existing.secret,\n                until: Date.now() + SECRET_ROTATION_GRACE_MS,\n              }\n            : existing?.previousSecret;\n        await this.store.set({\n          ...candidate,\n          ...(previousSecret && { previousSecret }),\n        });\n        return {\n          id: candidate.id,\n          refreshBefore: new Date(candidate.expiresAt).toISOString(),\n          cursor: null,\n          truncated: false,\n        };\n      },\n    );\n\n    server.setRequestHandler(\n      \"events/unsubscribe\",\n      { params: SubscriptionKeySchema },\n      async (params, ctx) => {\n        const { subscription } = await this.resolve(params, ctx);\n        await this.store.delete(subscription.id);\n        return {};\n      },\n    );\n  }\n\n  /** Deliver one event to every live, matching subscription. */\n  async emit(name: string, emitted: EmittedEvent<unknown>): Promise<void> {\n    const event = this.events.get(name);\n    if (!event) {\n      throw new Error(`Event \"${name}\" is not registered.`);\n    }\n    const data = await validate(event.payloadSchema, emitted.data, \"payload\");\n    const id = emitted.id ?? `evt_${randomBytes(12).toString(\"hex\")}`;\n    const body = JSON.stringify({\n      eventId: id,\n      name,\n      timestamp: (emitted.timestamp ?? new Date()).toISOString(),\n      data,\n      cursor: null,\n    });\n    if (Buffer.byteLength(body) > MAX_PAYLOAD_BYTES) {\n      throw new Error(\n        `Event \"${name}\" payload exceeds ${MAX_PAYLOAD_BYTES} bytes; send a summary and expose a tool to fetch the rest.`,\n      );\n    }\n    const now = Date.now();\n    const subscriptions = (await this.store.listByEvent(name)).filter(\n      (sub) => sub.expiresAt > now,\n    );\n    const results = await Promise.allSettled(\n      subscriptions.map(async (subscription) => {\n        const matches =\n          (await event.hooks.match?.(\n            { id, data },\n            {\n              arguments: subscription.arguments,\n              principal: subscription.principal,\n            },\n          )) ?? true;\n        if (matches) {\n          await this.deliver(subscription, id, body, 0);\n        }\n      }),\n    );\n    const failures = results.flatMap((result) =>\n      result.status === \"rejected\" ? [result.reason] : [],\n    );\n    if (failures.length > 0) {\n      throw new AggregateError(\n        failures,\n        `Event ${id} was not delivered to ${failures.length} subscription(s) whose match hook threw.`,\n      );\n    }\n  }\n\n  private async resolve(\n    params: z.infer<typeof SubscriptionKeySchema>,\n    ctx: ServerContext,\n  ) {\n    const event = this.events.get(params.name);\n    if (!event) {\n      throw new ProtocolError(\n        EVENTS_ERROR.NotFound,\n        `Unknown event: ${params.name}`,\n        { kind: \"event\" },\n      );\n    }\n    const url = checkCallbackUrl(params.delivery.url);\n    const principal = principalOf(ctx);\n    const rawArguments = params.arguments ?? {};\n    const args = (await validate(\n      event.inputSchema,\n      rawArguments,\n      \"arguments\",\n    )) as Record<string, unknown>;\n    const hash = createHash(\"sha256\")\n      .update(canonicalJson([principal, url, event.name, rawArguments]))\n      .digest(\"hex\");\n    return {\n      event,\n      subscription: {\n        id: `sub_${hash.slice(0, 32)}`,\n        principal,\n        name: event.name,\n        arguments: args,\n        url,\n      },\n    };\n  }\n\n  private async deliver(\n    subscription: EventSubscription,\n    eventId: string,\n    body: string,\n    attempt: number,\n  ): Promise<void> {\n    const outcome = await signedPost(subscription, eventId, body);\n    if (outcome.ok) {\n      return;\n    }\n    const status = outcome.status ?? 0;\n    const retryable =\n      status !== 410 && status !== 413 && (status < 300 || status >= 400);\n    const delay = RETRY_DELAYS_MS[attempt];\n    if (!retryable || delay === undefined) {\n      console.warn(\n        `skybridge: dropped event ${eventId} for subscription ${subscription.id} (${outcome.reason})`,\n      );\n      return;\n    }\n    setTimeout(() => {\n      this.liveSubscription(subscription.id)\n        .then((live) => live && this.deliver(live, eventId, body, attempt + 1))\n        .catch(() => {});\n    }, delay).unref();\n  }\n\n  private async liveSubscription(id: string) {\n    const subscription = await this.store.get(id);\n    if (subscription && subscription.expiresAt <= Date.now()) {\n      await this.store.delete(id);\n      return undefined;\n    }\n    return subscription;\n  }\n\n  private async verifyCallback(subscription: EventSubscription): Promise<void> {\n    const key = `${subscription.principal}\\n${subscription.url}`;\n    const now = Date.now();\n    if ((this.verifiedCallbacks.get(key) ?? 0) > now) {\n      return;\n    }\n    const challenge = randomBytes(24).toString(\"base64url\");\n    const outcome = await signedPost(\n      subscription,\n      `msg_verification_${randomBytes(12).toString(\"hex\")}`,\n      JSON.stringify({ type: \"verification\", challenge }),\n    );\n    let echoed: unknown;\n    if (outcome.ok) {\n      try {\n        echoed = JSON.parse(outcome.body)?.challenge;\n      } catch {}\n    }\n    const matched =\n      typeof echoed === \"string\" &&\n      echoed.length === challenge.length &&\n      timingSafeEqual(Buffer.from(echoed), Buffer.from(challenge));\n    if (!matched) {\n      throw new ProtocolError(\n        EVENTS_ERROR.CallbackEndpointError,\n        \"Callback endpoint verification failed\",\n        { reason: outcome.ok ? \"challenge_failed\" : outcome.reason },\n      );\n    }\n    for (const [cached, until] of this.verifiedCallbacks) {\n      if (until <= now) {\n        this.verifiedCallbacks.delete(cached);\n      }\n    }\n    this.verifiedCallbacks.set(key, now + VERIFICATION_CACHE_MS);\n  }\n}\n"]}

package/dist/server/events.test.d.ts

@@ -0,0 +1 @@
+export {};