starmux 0.0.0-stage → 0.11.0

package/CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Contributing
+
+Thank you for helping build an independent, self-hosted MCP Gateway.
+
+- File reproducible issues with version, host OS and *sanitized* steps. Never share credentials, local IPs, Tunnel IDs, original MCP messages containing personal files or private logs.
+- Please open a discussion before large architectural changes. Keep local Core tests and authorization rules passing.
+- Fixes must preserve upstream Desktop Commander tool schemas and accurately separate local health from remote caller identity.
+- Feature ideas for programmable hooks, broader multi-upstream routing or multi-computer operation are welcome, but should be labeled **proposals** until independently implemented and tested.
+
+See [security](SECURITY.md) and [current preview status](docs/RELEASE_STATUS.md).
+
+## TypeScript development
+
+Use Node 22.12 or newer. See [platform coverage](docs/PLATFORMS.md) before testing on another host. Run `npm ci`, `npm run typecheck`, and `npm test`. Tests execute compiled JavaScript and use temporary configuration directories and isolated ports. `npm run build` emits Core, CLI and tests to `dist/`; do not edit generated files. `npm pack` rebuilds and includes only the explicit runtime allowlist. No business logic belongs in the compatibility `.mjs` adapters.
+
+Keep `strict`, `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`, `verbatimModuleSyntax` and `noEmitOnError` enabled. Treat JSON, CLI options, socket messages and environment input as unknown until checked. Use MCP SDK types for protocol objects; retain upstream metadata and extensions. Internal middleware changes must test refusal before execution and observer failure after execution, including tools/list versus tools/call consistency.
+
+The App builder installs locked build dependencies in a temporary staging directory, compiles there, then installs production dependencies in the bundle. Swift sources and the bundle launcher/helper paths are independent of this TypeScript build. Public signing and independent first-user acceptance remain separate release gates; remote authentication results are tracked per client and deployment in [client compatibility](docs/CLIENTS.md).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mac MCP Gateway contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,177 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# Starmux
+
+### Your computer. Your tools. Connected to your AI.
+
+Connect remote AI clients to files, terminals and development tools on your own computer. **Keep your development environment. Choose what AI can do. Start, stop and revoke access on your terms.**
+
+**Self-hosted MCP · Native macOS menu bar App · Cross-platform CLI preview · MIT**
+
+[Quick Start](#quick-start) · [Connect a client](docs/REMOTE_SETUP.md) · [Documentation](docs/README.md)
+
+</div>
+
+## Your AI client here. Your tools there.
+
+Your repositories, runtimes and development tools already live on your computer. Starmux lets your AI client work with that environment through a self-hosted MCP connection: inspect a project in read-only mode, or enable coding to edit files, run tests and use Git.
+
+- **Keep the tools you know.** Work with the files and software already installed on the host.
+- **Choose your AI client.** Use a compatible remote MCP client through HTTPS or a protected Tunnel.
+- **Stay in control.** Start safely with read-only access. Enable coding deliberately, give clients their own credentials and revoke access when needed.
+
+Install Starmux on the **computer whose files and tools you want to use**. Your AI client can run elsewhere.
+
+## Quick Start
+
+### 1. Install
+
+Requires Node.js **22.12 or newer**.
+
+```bash
+npm install -g starmux
+```
+
+### 2. Start in your project
+
+```bash
+cd /path/to/your/project
+
+# Safe read-only mode (default)
+starmux up
+
+# Full coding mode: file edits, Shell and Git
+starmux up --code
+```
+
+Starmux initializes itself and runs in the background. Coding mode asks for confirmation the first time; `--code` and `--write` are equivalent. Coding tools use your OS account's permissions, with the project as their default working directory.
+
+```text
+Starmux · default · running
+Workspace  /path/to/your/project
+Mode       Read-only
+Runtime    background
+MCP        http://127.0.0.1:18893/mcp
+Dashboard  http://127.0.0.1:18893/access
+Logs       starmux logs -f -i "default"
+```
+
+### 3. Create an API key (optional)
+
+For clients that support Bearer authentication:
+
+```bash
+starmux auth key "My AI Client"
+```
+
+This creates a key and enables API-key authentication immediately. Copy the key into your client's private configuration.
+
+## How it connects
+
+![AI clients connect through HTTPS or a protected Tunnel to Starmux and workspace tools.](docs/assets/mcp-gateway-simple.svg)
+
+
+```text
+AI client
+    → HTTPS / protected Tunnel
+    → authentication: ingress | API key | OAuth
+    → Starmux at 127.0.0.1:<port>/mcp
+    → your files and development tools
+```
+
+HTTPS or a protected Tunnel carries the connection; authentication determines who can connect; the permission mode controls what tools can do. Start with the route your client supports:
+
+
+| Client or deployment | Next step |
+| --- | --- |
+| WorkBuddy or a client accepting Bearer headers | [HTTPS + API key](docs/REMOTE_SETUP.md#2-https--bearer-api-key) |
+| ChatGPT with browser login | [OAuth provider and connection setup](docs/OAUTH.md) |
+| An existing protected ingress or MCP Tunnel | [Remote connection guide](docs/REMOTE_SETUP.md) |
+
+The guide connects the pieces: DNS, HTTPS/proxy or Tunnel, authentication, and a real client tool call. These network services are configured separately from Starmux.
+
+## Everyday commands
+
+```bash
+starmux status
+starmux verify          # Local MCP handshake and directory read
+starmux doctor          # Environment and configuration checks
+starmux dashboard      # Open the local Access console
+starmux logs -f
+starmux down            # Alias: stop
+```
+
+After initialization, `up` reuses your saved workspace. Use `starmux up .` to switch it to your current directory, or pass another path. `--foreground` keeps the process in your terminal.
+
+## A quiet place to keep an eye on things
+
+The native macOS menu bar App puts service health, workspace permissions, connection topology and recent tool activity in one compact panel. Start or stop the selected workspace, open its Access console, and keep the details close without leaving a management window open.
+
+<div align="center">
+  <img src="docs/assets/starmux-app-en.png" width="430" alt="Starmux menu bar showing service status, controls, connection topology and recent tool activity" />
+  <p><sub>Native macOS menu bar App · English and Chinese · Development build</sub></p>
+</div>
+
+The App and CLI control the same instances. Quitting the App stops only instances it started; CLI background instances keep running. [App build instructions](app/README.md)
+
+## More than one workspace
+
+```bash
+starmux up ~/work/repo-a -i work --code
+starmux up ~/personal/blog -i blog --read
+starmux ls
+starmux down -i work
+
+starmux config edit -i blog
+starmux config apply -i blog
+```
+
+Instance names are your labels. Each instance has its own port, configuration, credentials, policies and logs. [Instances and configuration →](docs/INSTANCES.md)
+
+## AI client compatibility
+
+These are recorded project workflows, including those validated before the Starmux rename. They are not a claim that every client, authentication mode and platform combination has passed the new release.
+
+| Client | Recorded validation |
+| --- | --- |
+| **ChatGPT web** | Tunnel + OAuth, including coding and session revocation |
+| **Codex** | Installed Gateway plugin through protected Tunnel |
+| **WorkBuddy** | HTTPS + IPv6 + API-key file reads and writes on macOS |
+| **Doubao (豆包)** | Owner-reported successful use; connection details not recorded |
+| **Claude App** | Compatibility target; end-to-end validation pending |
+
+[Exact test scope and client setup guides](docs/CLIENTS.md)
+
+## Platform support
+
+| Tool host | Core / CLI | Native App |
+| --- | --- | --- |
+| **macOS** | Starmux 0.10.0 local and published-package workflow tested | SwiftUI development build |
+| **Linux** | Preview; earlier Core tests passed on Ubuntu arm64; new CLI release acceptance pending | Not available |
+| **Windows** | Preview implementation; native validation pending | Not available |
+
+[Platform details](docs/PLATFORMS.md) · [Release status](docs/RELEASE_STATUS.md). The macOS App is currently an ad-hoc developer build; a signed, notarized public download is not yet available.
+
+## Where this is going
+
+Starmux began with the [community request for a self-hosted Desktop Commander workbench](https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/714). The first priority is a clear path from a local workspace to a real tool call in your preferred AI client.
+
+The longer-term direction is a gateway for more MCP servers and clients, with programmable middleware. A public Middleware SDK and user-script plugins are not shipped. Contributions to first-user setup, client compatibility and platform testing are welcome.
+
+## Documentation and support
+
+- [Installation](docs/INSTALL.md) and [documentation index](docs/README.md)
+- [Authentication](docs/ACCESS_CONTROL.md) and [permission boundaries](docs/SECURITY.md)
+- [Migrate from Mac MCP Gateway](docs/MIGRATION.md)
+- [Client compatibility](docs/CLIENTS.md), [platform support](docs/PLATFORMS.md), and [release status](docs/RELEASE_STATUS.md)
+- [Contributing](CONTRIBUTING.md) and [architecture](docs/ARCHITECTURE.md)
+
+Starmux 0.11.0 is a preview. The CLI supports macOS, Linux and Windows; the native macOS App is available as a development build. See the linked compatibility pages for tested combinations.
+
+## Built with Desktop Commander
+
+Starmux includes a pinned [Desktop Commander](https://github.com/wonderwhy-er/DesktopCommanderMCP) dependency, installed automatically with npm. You do not need to install it separately. Starmux supplies its own self-hosted MCP connection and lifecycle controls.
+
+## License
+
+Starmux original code is [MIT licensed](LICENSE). Desktop Commander retains its own license and notices. This independent project is not endorsed by Desktop Commander or AI client vendors.

package/SECURITY.md

@@ -0,0 +1,7 @@
+# Security policy
+
+**Status:** Community preview, version 0.9.0. Optional Gateway API key authentication and revocation are tested locally. Broad external-client compatibility and public Shell deployment acceptance remain unverified.
+
+Please **do not post security vulnerabilities, credentials or user data in public GitHub issues**. Before opening the new community repository, its owner should enable **GitHub Private Vulnerability Reporting** or provide another vetted confidential reporting contact. Until that private route is published, avoid sending exploit details publicly.
+
+Do not expose the raw Gateway HTTP port to the public internet. Read [security and trust boundaries](docs/SECURITY.md).

package/app/README.md

@@ -0,0 +1,29 @@
+# App source (Apple Silicon)
+
+The Starmux menu bar App is written in Swift and controls the same local Core
+as the CLI. Its main panel shows the selected workspace, service health, permissions,
+connection topology and recent tool activity. Advanced instance management opens
+from **Workspaces & settings**; launch does not open a management window. The individual Swift sources and build script are included here,
+without historical internal research reports.
+
+**Build a UI-only preview (not a self-contained public App)**:
+
+```bash
+python3 app/scripts/build_ui.py --output-dir /private/tmp/mac-mcp-ui-preview
+```
+
+**Build a self-contained, ad-hoc signed developer candidate**:
+
+1. Obtain the **official pinned** Node.js v26.10.0 darwin-arm64 tar.xz archive
+   from nodejs.org, verifying its SHA-256 (enforced by the build script).
+2. Run `npm ci`, then
+   `python3 build/build_arm64_app.py --node-archive /path/to/node-v26.10.0-darwin-arm64.tar.xz --output /private/tmp/mac-mcp-app-build`.
+The builder creates a separate temporary TypeScript build directory, runs a locked development install and compilation, and copies `dist/src` plus the stable `.mjs` launchers into the App. It then installs only locked production dependencies. The bundled launcher continues to use the pinned internal Node executable; Swift sources and helper paths are unchanged.
+
+3. Check codesign and test in a non-production macOS user profile.
+
+Ad-hoc signing is for developers. **No Developer ID / Apple notarization is
+provided**. Do not advertise this candidate as a notarized public binary;
+the App ZIP for GitHub Releases needs separate signing and end-user validation.
+
+For visual acceptance, launch the built executable with `--show-monitor` to open the same menu view in a window. Normal launch stays in the menu bar; reopening the App also shows the monitor.

package/bin/starmux.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+await import("../dist/src/cli/starmux.js");

package/dist/src/access-control.js

@@ -0,0 +1,222 @@
+import { oauthConfigSchema, oauthConnectionSchema, validateOAuthConfig, createOAuthVerifier, OAuthError } from './oauth-resource.js';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { lstat, readFile, writeFile, rename, rm, mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+import { createPrivateDirectory, ownedByUser } from './platform.js';
+const credential = z.object({ id: z.string().regex(/^[a-f0-9]{24}$/), name: z.string().trim().min(1).max(80).regex(/^[^\x00-\x1f\x7f]+$/),
+    digest: z.string().regex(/^[a-f0-9]{64}$/), createdAt: z.string().datetime(), expiresAt: z.string().datetime().nullable(),
+    revokedAt: z.string().datetime().nullable(), lastUsedAt: z.string().datetime().nullable(), permission: z.literal('owner-default') }).strict();
+const schema = z.object({ version: z.literal(1), mode: z.enum(['ingress', 'api-key', 'oauth']), credentials: z.array(credential).max(256),
+    oauth: oauthConfigSchema.optional(), oauthConnections: z.array(oauthConnectionSchema).max(512).default([]) }).strict();
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+const equal = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+export const defaultAccessFile = () => process.env.MAC_MCP_ACCESS_FILE || path.join(homedir(), '.config', 'starmux', 'access-v1.json');
+const active = (c) => !c.revokedAt && (!c.expiresAt || Date.parse(c.expiresAt) > Date.now());
+export async function createAccessControl(file = defaultAccessFile()) {
+    if (!path.isAbsolute(file))
+        throw Error('ACCESS_FILE_ABSOLUTE_REQUIRED');
+    const folder = path.dirname(file);
+    createPrivateDirectory(folder);
+    async function readPrivate(target) {
+        const st = await lstat(target);
+        if (!st.isFile() || st.nlink !== 1 || !ownedByUser(target, st, true) || st.size > 262144)
+            throw Error('ACCESS_FILE_UNSAFE');
+        return readFile(target, 'utf8');
+    }
+    async function save(data) {
+        schema.parse(data);
+        const temp = file + '.' + randomBytes(12).toString('hex');
+        try {
+            await writeFile(temp, JSON.stringify(data, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+            await rename(temp, file);
+        }
+        finally {
+            await rm(temp, { force: true });
+        }
+    }
+    // A filesystem lock serializes mutations across CLI and Core processes.
+    async function locked(action) {
+        const lock = file + '.lock';
+        let acquired = false;
+        for (let i = 0; i < 100; i++) {
+            try {
+                await mkdir(lock, { mode: 0o700 });
+                acquired = true;
+                break;
+            }
+            catch (e) {
+                if (!(e instanceof Error && 'code' in e && e.code === 'EEXIST'))
+                    throw e;
+                await new Promise(r => setTimeout(r, 20));
+            }
+        }
+        if (!acquired)
+            throw Error('ACCESS_STORE_BUSY');
+        try {
+            return await action();
+        }
+        finally {
+            await rm(lock, { recursive: true, force: true });
+        }
+    }
+    async function load() {
+        if (!ownedByUser(folder, await lstat(folder), true))
+            throw Error('ACCESS_DIRECTORY_UNSAFE');
+        const data = schema.parse(JSON.parse(await readPrivate(file)));
+        if (data.oauth)
+            validateOAuthConfig(data.oauth);
+        if (data.mode === 'oauth' && !data.oauth)
+            throw Error('OAUTH_CONFIGURATION_REQUIRED');
+        return data;
+    }
+    await locked(async () => {
+        try {
+            await load();
+        }
+        catch (e) {
+            if (!(e instanceof Error && 'code' in e && e.code === 'ENOENT'))
+                throw e;
+            // A persistent marker prevents a deleted store from silently resetting
+            // enabled authentication to ingress mode after a CLI call or restart.
+            try {
+                await lstat(file + '.initialized');
+                throw Error('ACCESS_STORE_MISSING');
+            }
+            catch (markerError) {
+                if (!(markerError instanceof Error && 'code' in markerError && markerError.code === 'ENOENT'))
+                    throw markerError;
+            }
+            await writeFile(file + '.initialized', '1\n', { flag: 'wx', mode: 0o600 });
+            await save({ version: 1, mode: 'ingress', credentials: [], oauthConnections: [] });
+        }
+    });
+    const ownerFile = file + '.owner-token';
+    async function ownerToken() {
+        return locked(async () => {
+            try {
+                return (await readPrivate(ownerFile)).trim();
+            }
+            catch (e) {
+                if (!(e instanceof Error && 'code' in e && e.code === 'ENOENT'))
+                    throw e;
+                const token = randomBytes(32).toString('hex');
+                await writeFile(ownerFile, token + '\n', { flag: 'wx', mode: 0o600 });
+                return token;
+            }
+        });
+    }
+    async function authorized(token) {
+        if (typeof token !== 'string' || !/^[a-f0-9]{64}$/.test(token))
+            return false;
+        try {
+            return equal(token, (await readPrivate(ownerFile)).trim());
+        }
+        catch {
+            return false;
+        }
+    }
+    async function snapshot() {
+        const data = await load();
+        return { mode: data.mode, permission: 'owner-default', oauth: data.oauth ?? null, oauthConnections: data.oauthConnections,
+            credentials: data.credentials.map(({ digest: _, ...c }) => ({ ...c, status: c.revokedAt ? 'revoked' : active(c) ? 'active' : 'expired' })) };
+    }
+    async function create(name, expiresAt = null, activate = false) {
+        const secret = 'smx_' + randomBytes(32).toString('base64url');
+        const c = credential.parse({ id: randomBytes(12).toString('hex'), name, digest: digest(secret), createdAt: new Date().toISOString(),
+            expiresAt, revokedAt: null, lastUsedAt: null, permission: 'owner-default' });
+        if (!active(c))
+            throw Error('ACCESS_EXPIRY_MUST_BE_FUTURE');
+        await locked(async () => { const data = await load(); data.credentials.push(c); if (activate)
+            data.mode = 'api-key'; await save(data); });
+        return { id: c.id, name: c.name, key: secret, permission: c.permission };
+    }
+    async function setMode(mode) {
+        await locked(async () => {
+            const data = await load();
+            if (mode === 'api-key' && !data.credentials.some(active))
+                throw Error('ACCESS_ACTIVE_KEY_REQUIRED');
+            if (mode === 'oauth' && !data.oauth)
+                throw Error('OAUTH_CONFIGURATION_REQUIRED');
+            data.mode = mode;
+            await save(data);
+        });
+    }
+    async function revoke(id) {
+        await locked(async () => {
+            const data = await load();
+            const c = data.credentials.find(c => c.id === id);
+            if (!c)
+                throw Error('ACCESS_CREDENTIAL_NOT_FOUND');
+            c.revokedAt ??= new Date().toISOString();
+            await save(data);
+        });
+    }
+    async function configureOAuth(value) {
+        const config = validateOAuthConfig(value);
+        await locked(async () => { const data = await load(); data.oauth = config; await save(data); });
+    }
+    async function revokeOAuth(id) {
+        await locked(async () => {
+            const data = await load();
+            const c = data.oauthConnections.find(c => c.id === id);
+            if (!c)
+                throw Error('OAUTH_CONNECTION_NOT_FOUND');
+            c.revokedAt ??= new Date().toISOString();
+            await save(data);
+        });
+    }
+    async function oauthSettings() { const data = await load(); return data.mode === 'oauth' ? data.oauth : null; }
+    let verifier;
+    async function authenticateOAuth(config, header) {
+        const signature = JSON.stringify(config);
+        if (verifier?.signature !== signature)
+            verifier = { signature, verify: createOAuthVerifier(config) };
+        const verified = await verifier.verify(header);
+        await locked(async () => {
+            const data = await load();
+            if (data.mode !== 'oauth' || JSON.stringify(data.oauth) !== signature)
+                throw new OAuthError(401, 'OAUTH_CONFIGURATION_CHANGED');
+            const c = data.oauthConnections.find(c => c.id === verified.id);
+            if (c?.revokedAt)
+                throw new OAuthError(401, 'OAUTH_CONNECTION_REVOKED');
+            const now = new Date().toISOString();
+            if (c)
+                c.lastUsedAt = now;
+            else {
+                if (data.oauthConnections.length >= 512)
+                    throw new OAuthError(503, 'OAUTH_CONNECTION_LIMIT');
+                data.oauthConnections.push({ id: verified.id, subjectHash: verified.subjectHash, clientId: verified.clientId,
+                    createdAt: now, lastUsedAt: now, revokedAt: null, permission: 'owner-default' });
+            }
+            await save(data);
+        });
+        return { kind: 'verified-oauth', connectionId: verified.id, subjectHash: verified.subjectHash, scopes: verified.scopes, permission: 'owner-default' };
+    }
+    async function authenticate(header) {
+        const data = await load();
+        if (data.mode === 'ingress')
+            return { kind: 'unverified-local' };
+        if (data.mode === 'oauth')
+            return authenticateOAuth(data.oauth, header);
+        if (!header || !/^Bearer (?:mgw_|smx_)[A-Za-z0-9_-]{43}$/i.test(header))
+            throw Error('ACCESS_UNAUTHORIZED');
+        const hash = digest(header.slice(7));
+        const c = data.credentials.find(c => equal(c.digest, hash) && active(c));
+        if (!c)
+            throw Error('ACCESS_UNAUTHORIZED');
+        // Recheck under the mutation lock: revocation cannot be lost to a usage update.
+        await locked(async () => {
+            const current = await load();
+            const found = current.credentials.find(v => v.id === c.id);
+            if (current.mode !== 'api-key' || !found || !active(found))
+                throw Error('ACCESS_UNAUTHORIZED');
+            found.lastUsedAt = new Date().toISOString();
+            await save(current);
+        });
+        return { kind: 'verified-api-key', credentialId: c.id, permission: 'owner-default' };
+    }
+    return { file, snapshot, create, setMode, revoke, authenticate, ownerToken, authorized, configureOAuth, revokeOAuth, oauthSettings };
+}
+//# sourceMappingURL=access-control.js.map

package/dist/src/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../src/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,iBAAiB,EAAC,qBAAqB,EAAC,mBAAmB,EAAC,mBAAmB,EAAC,UAAU,EAAkB,MAAM,qBAAqB,CAAC;AAChJ,OAAO,EAAC,WAAW,EAAC,UAAU,EAAC,eAAe,EAAC,MAAM,aAAa,CAAC;AACnE,OAAO,EAAC,KAAK,EAAC,QAAQ,EAAC,SAAS,EAAC,MAAM,EAAC,EAAE,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,sBAAsB,EAAC,WAAW,EAAC,MAAM,eAAe,CAAC;AAGjE,MAAM,UAAU,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACjI,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpH,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1I,MAAM,MAAM,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAC,SAAS,EAAC,OAAO,CAAC,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7H,KAAK,EAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAC,gBAAgB,EAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAErH,MAAM,MAAM,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9E,MAAM,KAAK,GAAC,CAAC,CAAQ,EAAC,CAAQ,EAAC,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,CAAC,CAAC,MAAM,IAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACrG,MAAM,CAAC,MAAM,iBAAiB,GAAC,GAAE,EAAE,CAAA,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAC,SAAS,EAAC,SAAS,EAAC,gBAAgB,CAAC,CAAC;AAC9H,MAAM,MAAM,GAAC,CAAC,CAA0D,EAAC,EAAE,CAAA,CAAC,CAAC,CAAC,SAAS,IAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC5I,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAC,iBAAiB,EAAE;IAChE,IAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvE,MAAM,MAAM,GAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAAA,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/D,KAAK,UAAU,WAAW,CAAC,MAAa;QACtC,MAAM,EAAE,GAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAG,CAAC,EAAE,CAAC,MAAM,EAAE,IAAE,EAAE,CAAC,KAAK,KAAG,CAAC,IAAE,CAAC,WAAW,CAAC,MAAM,EAAC,EAAE,EAAC,IAAI,CAAC,IAAE,EAAE,CAAC,IAAI,GAAC,MAAM;YAAC,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC9G,OAAO,QAAQ,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,UAAU,IAAI,CAAC,IAAU;QAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,GAAC,IAAI,GAAC,GAAG,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,IAAG,CAAC;YAAA,MAAM,SAAS,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;YAAA,MAAM,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QAAA,CAAC;gBACpG,CAAC;YAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;QAAA,CAAC;IACvC,CAAC;IACD,wEAAwE;IACxE,KAAK,UAAU,MAAM,CAAI,MAAqB;QAC5C,MAAM,IAAI,GAAC,IAAI,GAAC,OAAO,CAAC;QAAA,IAAI,QAAQ,GAAC,KAAK,CAAC;QAC3C,KAAI,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,GAAG,EAAC,CAAC,EAAE,EAAC,CAAC;YACrB,IAAG,CAAC;gBAAA,MAAM,KAAK,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,QAAQ,GAAC,IAAI,CAAC;gBAAA,MAAM;YAAA,CAAC;YACxD,OAAM,CAAC,EAAC,CAAC;gBAAA,IAAG,CAAC,CAAC,CAAC,YAAY,KAAK,IAAE,MAAM,IAAI,CAAC,IAAE,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC;oBAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,IAAI,OAAO,CAAC,CAAC,CAAA,EAAE,CAAA,UAAU,CAAC,CAAC,EAAC,EAAE,CAAC,CAAC,CAAC;YAAA,CAAC;QACpH,CAAC;QACD,IAAG,CAAC,QAAQ;YAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9C,IAAG,CAAC;YAAA,OAAO,MAAM,MAAM,EAAE,CAAC;QAAA,CAAC;gBAAO,CAAC;YAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;QAAA,CAAC;IACjF,CAAC;IACD,KAAK,UAAU,IAAI;QACjB,IAAG,CAAC,WAAW,CAAC,MAAM,EAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxF,MAAM,IAAI,GAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAY,CAAC,CAAC;QACxE,IAAG,IAAI,CAAC,KAAK;YAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAG,IAAI,CAAC,IAAI,KAAG,OAAO,IAAE,CAAC,IAAI,CAAC,KAAK;YAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE;QACpB,IAAG,CAAC;YAAA,MAAM,IAAI,EAAE,CAAC;QAAA,CAAC;QAAA,OAAM,CAAC,EAAC,CAAC;YACzB,IAAG,CAAC,CAAC,CAAC,YAAY,KAAK,IAAE,MAAM,IAAI,CAAC,IAAE,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC;gBAAC,MAAM,CAAC,CAAC;YACjE,uEAAuE;YACvE,sEAAsE;YACtE,IAAG,CAAC;gBAAA,MAAM,KAAK,CAAC,IAAI,GAAC,cAAc,CAAC,CAAC;gBAAA,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAAA,CAAC;YAC1E,OAAM,WAAW,EAAC,CAAC;gBACjB,IAAG,CAAC,CAAC,WAAW,YAAY,KAAK,IAAE,MAAM,IAAI,WAAW,IAAE,WAAW,CAAC,IAAI,KAAG,QAAQ,CAAC;oBAAC,MAAM,WAAW,CAAC;YAC3G,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,GAAC,cAAc,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,SAAS,EAAC,WAAW,EAAC,EAAE,EAAC,gBAAgB,EAAC,EAAE,EAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAC,IAAI,GAAC,cAAc,CAAC;IACpC,KAAK,UAAU,UAAU;QACvB,OAAO,MAAM,CAAC,KAAK,IAAE,EAAE;YACrB,IAAG,CAAC;gBAAA,OAAO,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAA,CAAC;YAAA,OAAM,CAAC,EAAC,CAAC;gBACzD,IAAG,CAAC,CAAC,CAAC,YAAY,KAAK,IAAE,MAAM,IAAI,CAAC,IAAE,CAAC,CAAC,IAAI,KAAG,QAAQ,CAAC;oBAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,KAAK,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,SAAS,CAAC,SAAS,EAAC,KAAK,GAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,OAAO,KAAK,CAAC;YAC5E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,UAAU,UAAU,CAAC,KAAa;QACrC,IAAG,OAAO,KAAK,KAAG,QAAQ,IAAE,CAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAC,OAAO,KAAK,CAAC;QACxE,IAAG,CAAC;YAAA,OAAO,KAAK,CAAC,KAAK,EAAC,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,OAAO,KAAK,CAAC;QAAA,CAAC;IACrF,CAAC;IACD,KAAK,UAAU,QAAQ;QACrB,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC;QAAA,OAAO,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,EAAC,UAAU,EAAC,eAAwB,EAAC,KAAK,EAAC,IAAI,CAAC,KAAK,IAAE,IAAI,EAAC,gBAAgB,EAAC,IAAI,CAAC,gBAAgB;YAC9I,WAAW,EAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAC,MAAM,EAAC,CAAC,EAAC,GAAG,CAAC,EAAC,EAAC,EAAE,CAAA,CAAC,EAAC,GAAG,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,MAAM,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,SAAS,EAAC,CAAC,CAAC,EAAC,CAAC;IAC7H,CAAC;IACD,KAAK,UAAU,MAAM,CAAC,IAAW,EAAC,YAAsB,IAAI,EAAC,QAAQ,GAAC,KAAK;QACzE,MAAM,MAAM,GAAC,MAAM,GAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAC,UAAU,CAAC,KAAK,CAAC,EAAC,EAAE,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,SAAS,EAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxH,SAAS,EAAC,SAAS,EAAC,IAAI,EAAC,UAAU,EAAC,IAAI,EAAC,UAAU,EAAC,eAAe,EAAC,CAAC,CAAC;QACxE,IAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE,GAAC,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC,CAAA,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA,IAAG,QAAQ;YAAC,IAAI,CAAC,IAAI,GAAC,SAAS,CAAC,CAAA,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QAC5H,OAAO,EAAC,EAAE,EAAC,CAAC,CAAC,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,EAAC,GAAG,EAAC,MAAM,EAAC,UAAU,EAAC,CAAC,CAAC,UAAU,EAAC,CAAC;IAClE,CAAC;IACD,KAAK,UAAU,OAAO,CAAC,IAAgC;QACrD,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE;YAAC,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC;YAC7C,IAAG,IAAI,KAAG,SAAS,IAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC9F,IAAG,IAAI,KAAG,OAAO,IAAE,CAAC,IAAI,CAAC,KAAK;gBAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,GAAC,IAAI,CAAC;YAAA,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAA,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,UAAU,MAAM,CAAC,EAAS;QAC7B,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE;YAAC,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC;YAAA,MAAM,CAAC,GAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,EAAE,CAAC,CAAC;YACzF,IAAG,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAAA,CAAC,CAAC,SAAS,KAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAAA,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAA,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,KAAK,UAAU,cAAc,CAAC,KAAa;QACzC,MAAM,MAAM,GAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE,GAAC,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC,CAAA,IAAI,CAAC,KAAK,GAAC,MAAM,CAAC,CAAA,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,UAAU,WAAW,CAAC,EAAS;QAClC,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE;YAAC,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC;YAAA,MAAM,CAAC,GAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,EAAE,CAAC,CAAC;YAC9F,IAAG,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAAA,CAAC,CAAC,SAAS,KAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAAA,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAA,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,UAAU,aAAa,KAAG,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC,CAAA,OAAO,IAAI,CAAC,IAAI,KAAG,OAAO,CAAA,CAAC,CAAA,IAAI,CAAC,KAAM,CAAA,CAAC,CAAA,IAAI,CAAC,CAAA,CAAC;IACpG,IAAI,QAAmF,CAAC;IACxF,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAC,MAAuB;QACzE,MAAM,SAAS,GAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAG,QAAQ,EAAE,SAAS,KAAG,SAAS;YAAC,QAAQ,GAAC,EAAC,SAAS,EAAC,MAAM,EAAC,mBAAmB,CAAC,MAAM,CAAC,EAAC,CAAC;QAC3F,MAAM,QAAQ,GAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE;YACpB,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC;YACxB,IAAG,IAAI,CAAC,IAAI,KAAG,OAAO,IAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAG,SAAS;gBAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,6BAA6B,CAAC,CAAC;YACvH,MAAM,CAAC,GAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAG,CAAC,EAAE,SAAS;gBAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,0BAA0B,CAAC,CAAC;YACrE,MAAM,GAAG,GAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACnC,IAAG,CAAC;gBAAC,CAAC,CAAC,UAAU,GAAC,GAAG,CAAC;iBAClB,CAAC;gBACH,IAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAE,GAAG;oBAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,wBAAwB,CAAC,CAAC;gBACxF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAC,EAAE,EAAC,QAAQ,CAAC,EAAE,EAAC,WAAW,EAAC,QAAQ,CAAC,WAAW,EAAC,QAAQ,EAAC,QAAQ,CAAC,QAAQ;oBACpG,SAAS,EAAC,GAAG,EAAC,UAAU,EAAC,GAAG,EAAC,SAAS,EAAC,IAAI,EAAC,UAAU,EAAC,eAAe,EAAC,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,EAAC,IAAI,EAAC,gBAAgB,EAAC,YAAY,EAAC,QAAQ,CAAC,EAAE,EAAC,WAAW,EAAC,QAAQ,CAAC,WAAW,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,UAAU,EAAC,eAAe,EAAC,CAAC;IAC7I,CAAC;IACD,KAAK,UAAU,YAAY,CAAC,MAAuB;QACjD,MAAM,IAAI,GAAC,MAAM,IAAI,EAAE,CAAC;QACxB,IAAG,IAAI,CAAC,IAAI,KAAG,SAAS;YAAC,OAAO,EAAC,IAAI,EAAC,kBAAkB,EAAC,CAAC;QAC1D,IAAG,IAAI,CAAC,IAAI,KAAG,OAAO;YAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAM,EAAC,MAAM,CAAC,CAAC;QACpE,IAAG,CAAC,MAAM,IAAE,CAAC,0CAA0C,CAAC,IAAI,CAAC,MAAM,CAAC;YAAC,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxG,MAAM,IAAI,GAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAA,MAAM,CAAC,GAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,KAAK,CAAC,CAAC,CAAC,MAAM,EAAC,IAAI,CAAC,IAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,IAAG,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,gFAAgF;QAChF,MAAM,MAAM,CAAC,KAAK,IAAE,EAAE;YAAC,MAAM,OAAO,GAAC,MAAM,IAAI,EAAE,CAAC;YAAA,MAAM,KAAK,GAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACrG,IAAG,OAAO,CAAC,IAAI,KAAG,SAAS,IAAE,CAAC,KAAK,IAAE,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACvF,KAAK,CAAC,UAAU,GAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAAA,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAAA,CAAC,CAAC,CAAC;QACnE,OAAO,EAAC,IAAI,EAAC,kBAAkB,EAAC,YAAY,EAAC,CAAC,CAAC,EAAE,EAAC,UAAU,EAAC,eAAe,EAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAC,IAAI,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,YAAY,EAAC,UAAU,EAAC,UAAU,EAAC,cAAc,EAAC,WAAW,EAAC,aAAa,EAAC,CAAC;AAC3H,CAAC","sourcesContent":["import {oauthConfigSchema,oauthConnectionSchema,validateOAuthConfig,createOAuthVerifier,OAuthError,type OAuthConfig} from './oauth-resource.js';\nimport {randomBytes,createHash,timingSafeEqual} from 'node:crypto';\nimport {lstat,readFile,writeFile,rename,rm,mkdir} from 'node:fs/promises';\nimport {homedir} from 'node:os';\nimport path from 'node:path';\nimport {z} from 'zod';\nimport {createPrivateDirectory,ownedByUser} from './platform.js';\nimport type {RequestContext} from './contracts.js';\n\nconst credential=z.object({id:z.string().regex(/^[a-f0-9]{24}$/),name:z.string().trim().min(1).max(80).regex(/^[^\\x00-\\x1f\\x7f]+$/),\n  digest:z.string().regex(/^[a-f0-9]{64}$/),createdAt:z.string().datetime(),expiresAt:z.string().datetime().nullable(),\n  revokedAt:z.string().datetime().nullable(),lastUsedAt:z.string().datetime().nullable(),permission:z.literal('owner-default')}).strict();\nconst schema=z.object({version:z.literal(1),mode:z.enum(['ingress','api-key','oauth']),credentials:z.array(credential).max(256),\n  oauth:oauthConfigSchema.optional(),oauthConnections:z.array(oauthConnectionSchema).max(512).default([])}).strict();\ntype State=z.infer<typeof schema>;\nconst digest=(value:string)=>createHash('sha256').update(value).digest('hex');\nconst equal=(a:string,b:string)=>a.length===b.length&&timingSafeEqual(Buffer.from(a),Buffer.from(b));\nexport const defaultAccessFile=()=>process.env.MAC_MCP_ACCESS_FILE||path.join(homedir(),'.config','starmux','access-v1.json');\nconst active=(c:Pick<z.infer<typeof credential>,'revokedAt'|'expiresAt'>)=>!c.revokedAt&&(!c.expiresAt||Date.parse(c.expiresAt)>Date.now());\nexport async function createAccessControl(file=defaultAccessFile()){\n  if(!path.isAbsolute(file))throw Error('ACCESS_FILE_ABSOLUTE_REQUIRED');\n  const folder=path.dirname(file);createPrivateDirectory(folder);\n  async function readPrivate(target:string){\n    const st=await lstat(target);\n    if(!st.isFile()||st.nlink!==1||!ownedByUser(target,st,true)||st.size>262144)throw Error('ACCESS_FILE_UNSAFE');\n    return readFile(target,'utf8');\n  }\n  async function save(data:State){\n    schema.parse(data);\n    const temp=file+'.'+randomBytes(12).toString('hex');\n    try{await writeFile(temp,JSON.stringify(data,null,2)+'\\n',{flag:'wx',mode:0o600});await rename(temp,file);}\n    finally{await rm(temp,{force:true});}\n  }\n  // A filesystem lock serializes mutations across CLI and Core processes.\n  async function locked<T>(action:()=>Promise<T>):Promise<T>{\n    const lock=file+'.lock';let acquired=false;\n    for(let i=0;i<100;i++){\n      try{await mkdir(lock,{mode:0o700});acquired=true;break;}\n      catch(e){if(!(e instanceof Error&&'code' in e&&e.code==='EEXIST'))throw e;await new Promise(r=>setTimeout(r,20));}\n    }\n    if(!acquired)throw Error('ACCESS_STORE_BUSY');\n    try{return await action();}finally{await rm(lock,{recursive:true,force:true});}\n  }\n  async function load(){\n    if(!ownedByUser(folder,await lstat(folder),true))throw Error('ACCESS_DIRECTORY_UNSAFE');\n    const data=schema.parse(JSON.parse(await readPrivate(file)) as unknown);\n    if(data.oauth)validateOAuthConfig(data.oauth);\n    if(data.mode==='oauth'&&!data.oauth)throw Error('OAUTH_CONFIGURATION_REQUIRED');\n    return data;\n  }\n  await locked(async()=>{\n    try{await load();}catch(e){\n      if(!(e instanceof Error&&'code' in e&&e.code==='ENOENT'))throw e;\n      // A persistent marker prevents a deleted store from silently resetting\n      // enabled authentication to ingress mode after a CLI call or restart.\n      try{await lstat(file+'.initialized');throw Error('ACCESS_STORE_MISSING');}\n      catch(markerError){\n        if(!(markerError instanceof Error&&'code' in markerError&&markerError.code==='ENOENT'))throw markerError;\n      }\n      await writeFile(file+'.initialized','1\\n',{flag:'wx',mode:0o600});\n      await save({version:1,mode:'ingress',credentials:[],oauthConnections:[]});\n    }\n  });\n  const ownerFile=file+'.owner-token';\n  async function ownerToken(){\n    return locked(async()=>{\n      try{return (await readPrivate(ownerFile)).trim();}catch(e){\n        if(!(e instanceof Error&&'code' in e&&e.code==='ENOENT'))throw e;\n        const token=randomBytes(32).toString('hex');\n        await writeFile(ownerFile,token+'\\n',{flag:'wx',mode:0o600});return token;\n      }\n    });\n  }\n  async function authorized(token:unknown){\n    if(typeof token!=='string'||! /^[a-f0-9]{64}$/.test(token))return false;\n    try{return equal(token,(await readPrivate(ownerFile)).trim());}catch{return false;}\n  }\n  async function snapshot(){\n    const data=await load();return {mode:data.mode,permission:'owner-default' as const,oauth:data.oauth??null,oauthConnections:data.oauthConnections,\n      credentials:data.credentials.map(({digest:_,...c})=>({...c,status:c.revokedAt?'revoked':active(c)?'active':'expired'}))};\n  }\n  async function create(name:string,expiresAt:string|null=null,activate=false){\n    const secret='smx_'+randomBytes(32).toString('base64url');\n    const c=credential.parse({id:randomBytes(12).toString('hex'),name,digest:digest(secret),createdAt:new Date().toISOString(),\n      expiresAt,revokedAt:null,lastUsedAt:null,permission:'owner-default'});\n    if(!active(c))throw Error('ACCESS_EXPIRY_MUST_BE_FUTURE');\n    await locked(async()=>{const data=await load();data.credentials.push(c);if(activate)data.mode='api-key';await save(data);});\n    return {id:c.id,name:c.name,key:secret,permission:c.permission};\n  }\n  async function setMode(mode:'ingress'|'api-key'|'oauth'){\n    await locked(async()=>{const data=await load();\n      if(mode==='api-key'&&!data.credentials.some(active))throw Error('ACCESS_ACTIVE_KEY_REQUIRED');\n      if(mode==='oauth'&&!data.oauth)throw Error('OAUTH_CONFIGURATION_REQUIRED');\n      data.mode=mode;await save(data);});\n  }\n  async function revoke(id:string){\n    await locked(async()=>{const data=await load();const c=data.credentials.find(c=>c.id===id);\n      if(!c)throw Error('ACCESS_CREDENTIAL_NOT_FOUND');c.revokedAt??=new Date().toISOString();await save(data);});\n  }\n  async function configureOAuth(value:unknown){\n    const config=validateOAuthConfig(value);\n    await locked(async()=>{const data=await load();data.oauth=config;await save(data);});\n  }\n  async function revokeOAuth(id:string){\n    await locked(async()=>{const data=await load();const c=data.oauthConnections.find(c=>c.id===id);\n      if(!c)throw Error('OAUTH_CONNECTION_NOT_FOUND');c.revokedAt??=new Date().toISOString();await save(data);});\n  }\n  async function oauthSettings(){const data=await load();return data.mode==='oauth'?data.oauth!:null;}\n  let verifier:{signature:string;verify:ReturnType<typeof createOAuthVerifier>}|undefined;\n  async function authenticateOAuth(config:OAuthConfig,header:string|undefined):Promise<RequestContext['identity']>{\n    const signature=JSON.stringify(config);\n    if(verifier?.signature!==signature)verifier={signature,verify:createOAuthVerifier(config)};\n    const verified=await verifier.verify(header);\n    await locked(async()=>{\n      const data=await load();\n      if(data.mode!=='oauth'||JSON.stringify(data.oauth)!==signature)throw new OAuthError(401,'OAUTH_CONFIGURATION_CHANGED');\n      const c=data.oauthConnections.find(c=>c.id===verified.id);\n      if(c?.revokedAt)throw new OAuthError(401,'OAUTH_CONNECTION_REVOKED');\n      const now=new Date().toISOString();\n      if(c)c.lastUsedAt=now;\n      else{\n        if(data.oauthConnections.length>=512)throw new OAuthError(503,'OAUTH_CONNECTION_LIMIT');\n        data.oauthConnections.push({id:verified.id,subjectHash:verified.subjectHash,clientId:verified.clientId,\n          createdAt:now,lastUsedAt:now,revokedAt:null,permission:'owner-default'});\n      }\n      await save(data);\n    });\n    return {kind:'verified-oauth',connectionId:verified.id,subjectHash:verified.subjectHash,scopes:verified.scopes,permission:'owner-default'};\n  }\n  async function authenticate(header:string|undefined):Promise<RequestContext['identity']>{\n    const data=await load();\n    if(data.mode==='ingress')return {kind:'unverified-local'};\n    if(data.mode==='oauth')return authenticateOAuth(data.oauth!,header);\n    if(!header||!/^Bearer (?:mgw_|smx_)[A-Za-z0-9_-]{43}$/i.test(header))throw Error('ACCESS_UNAUTHORIZED');\n    const hash=digest(header.slice(7));const c=data.credentials.find(c=>equal(c.digest,hash)&&active(c));\n    if(!c)throw Error('ACCESS_UNAUTHORIZED');\n    // Recheck under the mutation lock: revocation cannot be lost to a usage update.\n    await locked(async()=>{const current=await load();const found=current.credentials.find(v=>v.id===c.id);\n      if(current.mode!=='api-key'||!found||!active(found))throw Error('ACCESS_UNAUTHORIZED');\n      found.lastUsedAt=new Date().toISOString();await save(current);});\n    return {kind:'verified-api-key',credentialId:c.id,permission:'owner-default'};\n  }\n  return {file,snapshot,create,setMode,revoke,authenticate,ownerToken,authorized,configureOAuth,revokeOAuth,oauthSettings};\n}\nexport type AccessControl=Awaited<ReturnType<typeof createAccessControl>>;\n"]}

package/dist/src/access-dashboard.js

@@ -0,0 +1,71 @@
+import { discoverOAuth, metadataUrl } from './oauth-resource.js';
+import { permissionHeaders } from './permissions-dashboard.js';
+import { createHash } from 'node:crypto';
+const loginScript = `(()=>{const k='starmux-owner-token';const q=new URLSearchParams(location.hash.slice(1));const t=q.get('token');if(t){history.replaceState(null,'',location.pathname);sessionStorage.setItem(k,t);}const token=sessionStorage.getItem(k);if(token)for(const input of document.querySelectorAll('input[name="token"]'))input.value=token;})();`;
+const scriptHash = createHash('sha256').update(loginScript).digest('base64');
+export const accessHeaders = Object.freeze({ ...permissionHeaders, 'content-security-policy': permissionHeaders['content-security-policy'] + `; script-src 'sha256-${scriptHash}'` });
+const e = (s) => String(s ?? '').replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+export function accessPage(state, created) {
+    const form = (op, fields, label) => `<form method="post" action="/access"><input type="hidden" name="op" value="${op}">${fields}<label>Owner management token <input type="password" name="token" required autocomplete="off"></label><button>${label}</button></form>`;
+    return `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Gateway · Access control</title><style>body{font:16px system-ui;max-width:960px;margin:40px auto;padding:0 24px;background:#f5f7fa;color:#243249}section{background:white;border:1px solid #dae0e8;border-radius:12px;padding:24px;margin:20px 0}input,select,button{font:inherit;padding:8px;margin:8px}label{display:block}code{overflow-wrap:anywhere}td,th{text-align:left;padding:10px;border-bottom:1px solid #ddd}table{width:100%}</style><h1>Access control</h1>
+  <p><a href="/dashboard">Dashboard</a> · <a href="/permissions">Workspace permissions</a></p>
+  <section><h2>${state.mode === 'ingress' ? 'Managed by ingress' : state.mode === 'oauth' ? 'OAuth' : 'Gateway API key'}</h2><p>Permission: Owner default. Credentials do not change workspace, tool or operating-system permissions.</p><p>${state.mode === 'ingress' ? 'Gateway does not verify caller identity. Restrict remote access through your ingress. HTTPS encryption alone does not authenticate callers.' : 'Every MCP request requires an active credential. Missing, invalid, expired or revoked credentials are rejected.'}</p></section>
+  ${created ? `<section><h2>Copy this key now</h2><code>${e(created.key)}</code><p>This key is shown only in this response. Keep it private; it grants the owner-approved MCP capabilities.</p></section>` : ''}
+  <section><h2>Client credentials</h2><table><tr><th>Name / ID</th><th>Status / Revoked</th><th>Created / Last used / Expiry</th></tr>${state.credentials.map(c => `<tr><td>${e(c.name)}<br><code>${e(c.id)}</code></td><td>${e(c.status)}<br>${e(c.revokedAt || '—')}</td><td>${e(c.createdAt)}<br>${e(c.lastUsedAt || 'Never')}<br>${e(c.expiresAt || 'No expiry')}</td></tr>`).join('') || '<tr><td colspan="3">No credentials</td></tr>'}</table></section>
+  <section><h2>Create credential</h2>${form('create', '<label>Name <input name="name" maxlength="80" required></label><label>Expiry (optional, UTC ISO 8601) <input name="expiresAt" placeholder="2027-01-01T00:00:00.000Z"></label>', 'Create')}</section>
+  <section><h2>Authentication mode</h2>${form('mode', '<select name="mode"><option value="api-key">Require Gateway API key</option><option value="oauth">Require OAuth (configure first)</option><option value="ingress">Managed by ingress (no Gateway key required)</option></select>', 'Apply mode')}<p>Switching to ingress mode permits requests without a Gateway key. Existing owner permissions still apply.</p></section>
+  <section><h2>OAuth configuration</h2><p>Use an existing authorization server. Configuration does not enable OAuth until you change the mode above.</p>
+  ${state.oauth ? `<p>Issuer: <code>${e(state.oauth.issuer)}</code><br>Resource: <code>${e(state.oauth.resource)}</code><br>Discovery: <code>${e(metadataUrl(state.oauth))}</code><br>Client: ${e(state.oauth.clientId)} · ${e(state.oauth.clientRegistration)}<br>Scope: ${e(state.oauth.scope)}</p>` : '<p>Not configured</p>'}
+  ${form('oauth-configure', '<label>Issuer URL <input name="issuer" type="url" required></label><label>Public MCP resource URL <input name="resource" type="url" required></label><label>Registered client ID <input name="clientId" required></label><label>Allowed owner subject IDs (comma separated) <input name="subjects" required></label><label>Token endpoint authentication <select name="tokenAuth"><option value="none">none (public client + PKCE)</option><option value="client_secret_basic">client_secret_basic</option><option value="client_secret_post">client_secret_post</option></select></label>', 'Discover and save')}
+  <p>This form uses a predefined client and HTTPS. Client secrets stay with the authorization server and ChatGPT; do not enter them here. Advanced registration and local development are available through the CLI.</p></section>
+  <section><h2>OAuth connections</h2><p>Revocation blocks the session, including tokens refreshed from it. A new owner-approved login may establish a new session.</p>
+  <table><tr><th>Connection ID / Client</th><th>Status</th><th>Last used</th></tr>${state.oauthConnections.map(c => `<tr><td><code>${e(c.id)}</code><br>${e(c.clientId)}</td><td>${c.revokedAt ? 'Revoked' : 'Active'}</td><td>${e(c.lastUsedAt)}</td></tr>`).join('') || '<tr><td colspan="3">No OAuth connections</td></tr>'}</table>
+  ${form('oauth-revoke', '<label>Connection ID <input name="id" required></label>', 'Revoke OAuth connection')}</section>
+  <section><h2>Revoke credential</h2>${form('revoke', '<label>Credential ID <input name="id" required></label>', 'Revoke')}<p>Revocation blocks subsequent requests; it does not cancel an already executing tool.</p></section>
+  <p>Get the separate owner management token locally: <code>starmux dashboard --token</code>. Do not give this token to AI clients.</p><script>${loginScript}</script></html>`;
+}
+export async function accessPost(req, access) {
+    if (req.headers.origin !== 'http://' + req.headers.host || (req.headers['content-type'] || '').split(';')[0] !== 'application/x-www-form-urlencoded')
+        return { status: 403 };
+    const size = Number(req.headers['content-length']);
+    if (!Number.isSafeInteger(size) || size < 1 || size > 4096)
+        return { status: 413 };
+    let body = '';
+    for await (const chunk of req) {
+        body += String(chunk);
+        if (Buffer.byteLength(body) > 4096)
+            return { status: 413 };
+    }
+    const q = new URLSearchParams(body);
+    for (const key of q.keys())
+        if (!['op', 'token', 'name', 'expiresAt', 'mode', 'id', 'issuer', 'resource', 'clientId', 'subjects', 'tokenAuth'].includes(key) || q.getAll(key).length !== 1)
+            return { status: 400 };
+    if (!await access.authorized(q.get('token')))
+        return { status: 403 };
+    try {
+        let created;
+        if (q.get('op') === 'create')
+            created = await access.create(q.get('name') || '', q.get('expiresAt') || null);
+        else if (q.get('op') === 'revoke')
+            await access.revoke(q.get('id') || '');
+        else if (q.get('op') === 'mode' && (q.get('mode') === 'ingress' || q.get('mode') === 'api-key' || q.get('mode') === 'oauth'))
+            await access.setMode(q.get('mode'));
+        else if (q.get('op') === 'oauth-revoke')
+            await access.revokeOAuth(q.get('id') || '');
+        else if (q.get('op') === 'oauth-configure') {
+            const method = q.get('tokenAuth') || 'none';
+            if (!['none', 'client_secret_basic', 'client_secret_post'].includes(method))
+                return { status: 400 };
+            await access.configureOAuth(await discoverOAuth({ issuer: q.get('issuer') || '', resource: q.get('resource') || '',
+                clientId: q.get('clientId') || '', allowedSubjects: (q.get('subjects') || '').split(',').map(s => s.trim()).filter(Boolean),
+                tokenEndpointAuthMethod: method }));
+        }
+        else
+            return { status: 400 };
+        return { status: 200, html: accessPage(await access.snapshot(), created) };
+    }
+    catch {
+        return { status: 400 };
+    }
+}
+//# sourceMappingURL=access-dashboard.js.map