@0xmaxma/claude-gateway 1.8.7 → 1.8.8

package/dist/connectors/custom-connectors-store.js

@@ -0,0 +1,204 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCustomConnectorsStore = createCustomConnectorsStore;
+const fsp = __importStar(require("fs/promises"));
+const config_write_lock_1 = require("../config/config-write-lock");
+/**
+ * Re-key a parsed connector map onto a null-prototype object. Every map this module
+ * hands out — to a caller of `read()`, to a `mutate` callback — goes through here.
+ *
+ * Connector ids are slugs derived from a user-supplied label, and `isValidConnectorId`
+ * accepts `constructor`, `toString`, `valueOf` — all inherited properties of a plain
+ * `JSON.parse` result. Every lookup in the routers is a bare `map[id]`, so an id like
+ * that resolved to a Function rather than to nothing: `GET /:id/status` answered
+ * `500 Connector has an unreadable configuration`, DELETE answered
+ * `500 Cannot read properties of undefined (reading 'map')` and `/connect`
+ * `... (reading 'length')` — both leaking an internal error message — where the honest
+ * answer to all three is 404. A null-prototype map has nothing to inherit, so `map[id]`
+ * is undefined exactly when the connector does not exist.
+ *
+ * `Object.assign` copies own enumerable keys only, which is also what `JSON.stringify`
+ * writes back out, so a map that has been through here round-trips unchanged.
+ */
+function ownKeysOnly(map) {
+    return Object.assign(Object.create(null), map);
+}
+function createCustomConnectorsStore(configPath) {
+    // Per store instance, not per module: one store exists per gateway process, so this
+    // is process-wide in production, while tests that build their own store each start
+    // from a clean throttle instead of inheriting a previous test's timestamp.
+    const READ_FAILURE_LOG_INTERVAL_MS = 60 * 1000;
+    let lastReadFailureLog = 0;
+    async function mutate(fn) {
+        if (!configPath)
+            return; // no persistence target (e.g. tests) — secret store is authoritative
+        return (0, config_write_lock_1.withConfigWriteLock)(configPath, async () => {
+            const raw = await fsp.readFile(configPath, 'utf-8');
+            const config = JSON.parse(raw);
+            config.gateway = config.gateway ?? {};
+            // The callback both reads (`slugify(label, Object.keys(c))`, /oauth/receive's
+            // `c[id]` capture of the entry it replaces) and writes, so it gets the same
+            // null-prototype treatment `read()` gives — see ownKeysOnly.
+            const connectors = ownKeysOnly(config.gateway.customConnectors);
+            config.gateway.customConnectors = connectors;
+            fn(connectors);
+            await (0, config_write_lock_1.writeConfigAtomic)(configPath, config);
+        });
+    }
+    async function read() {
+        if (!configPath)
+            return ownKeysOnly(undefined);
+        try {
+            const raw = await fsp.readFile(configPath, 'utf-8');
+            const config = JSON.parse(raw);
+            return ownKeysOnly(config.gateway?.customConnectors);
+        }
+        catch (err) {
+            noteReadFailure(err);
+            return ownKeysOnly(undefined);
+        }
+    }
+    /**
+     * Degrading to {} is right — see readTokenEnv()'s doc for the same argument: this
+     * feeds `GET /v1/connectors`, and a throw from an async Express 4 handler reaches
+     * index.ts's `unhandledRejection` hook and shuts the gateway down.
+     *
+     * But degrading SILENTLY is not. An EACCES config.json (one `sudo`, a restored
+     * volume) or a hand-edit that left invalid JSON both land here, and the caller
+     * cannot tell "no connectors are configured" from "the file that lists them is
+     * unreadable": the caller gets an empty list and the refresh sweep concludes
+     * there is nothing to refresh, with nothing written anywhere to say why. It
+     * also means connectors-router.ts's `500 Connector configuration could not be
+     * read` — the documented answer for exactly this — is unreachable, because
+     * this function never throws.
+     *
+     * A missing file is not that: it is the ordinary pre-first-write state, and
+     * says the same thing as an empty map.
+     */
+    function noteReadFailure(err) {
+        if (err.code === 'ENOENT')
+            return;
+        const now = Date.now();
+        // Throttled for readTokenEnv's reason — status pollers hit this every couple
+        // of seconds, so one line per failure buries the log it belongs in.
+        if (now - lastReadFailureLog < READ_FAILURE_LOG_INTERVAL_MS)
+            return;
+        lastReadFailureLog = now;
+        console.error(`custom-connectors-store: cannot read connectors from ${configPath}` +
+            ` (${err.code ?? 'invalid JSON'}) — reporting no` +
+            ` connectors until it is readable: ${err.message}`);
+    }
+    /**
+     * The entry AND every agent's enablement flag for it. Returns whether anything went.
+     *
+     * Both halves, because per-agent enablement is stored separately from the
+     * connector entry itself (AgentConfig.connectors vs gateway.customConnectors),
+     * so removing only the entry leaves its enablement flags behind as orphans.
+     * They are inert while the id is unused — but ids are slugs derived from
+     * labels, so re-adding a connector with the same label revives whatever the
+     * old one's flags said. An agent that was explicitly disabled for the deleted
+     * connector would then start out disabled for the brand-new one, for no reason
+     * its owner can see.
+     *
+     * One write rather than two, because two would reintroduce the very orphan
+     * this exists to prevent: a crash — or the emergency shutdown index.ts runs on
+     * an unhandled rejection — landing between them leaves the entry gone and the
+     * flags behind, and with the entry gone nothing will ever come back for them.
+     *
+     * Only for a real delete of the entry. A soft disconnect keeps the entry and so
+     * must keep its enablement.
+     */
+    function dropConnector(config, connectorId) {
+        let changed = false;
+        // `hasOwnProperty`, not `in`: `'constructor' in {}` is true, so the `in` form
+        // deleted nothing (delete on an inherited property is a no-op), reported
+        // `changed`, and rewrote config.json for it — see ownKeysOnly for the same
+        // hazard on the read side.
+        if (config.gateway?.customConnectors &&
+            Object.prototype.hasOwnProperty.call(config.gateway.customConnectors, connectorId)) {
+            delete config.gateway.customConnectors[connectorId];
+            changed = true;
+        }
+        for (const agent of config.agents ?? []) {
+            if (agent.connectors && Object.prototype.hasOwnProperty.call(agent.connectors, connectorId)) {
+                delete agent.connectors[connectorId];
+                changed = true;
+            }
+        }
+        return changed;
+    }
+    async function withEntry(connectorId, fn) {
+        if (!configPath) {
+            // No persistence target (tests): the same "there is nothing there" `read()`
+            // reports, and a `remove()` that has nothing to remove.
+            return fn({ entry: undefined, remove: () => { } });
+        }
+        return (0, config_write_lock_1.withConfigWriteLock)(configPath, async () => {
+            let config = null;
+            try {
+                config = JSON.parse(await fsp.readFile(configPath, 'utf-8'));
+            }
+            catch (err) {
+                // Same degrade-and-log as read(): the callers reach this through a route
+                // that would already have answered 404 off `read()`'s empty map, so an
+                // unreadable config keeps meaning "no such connector" rather than
+                // rejecting into index.ts's unhandledRejection hook.
+                noteReadFailure(err);
+            }
+            const connectors = ownKeysOnly(config?.gateway?.customConnectors);
+            let removeRequested = false;
+            const result = await fn({
+                entry: connectors[connectorId],
+                remove: () => {
+                    removeRequested = true;
+                },
+            });
+            if (!removeRequested)
+                return result; // decided to keep it — nothing to write
+            if (!config) {
+                // Unreachable through the routes (no entry to act on means they 404 first),
+                // and a lie if it ever were: answering "removed" for a file we could not
+                // read. Surfaces as a 500 instead.
+                throw new Error(`Cannot remove connector '${connectorId}': ${configPath} is unreadable`);
+            }
+            if (dropConnector(config, connectorId))
+                await (0, config_write_lock_1.writeConfigAtomic)(configPath, config);
+            return result;
+        });
+    }
+    return { mutate, read, withEntry };
+}
+//# sourceMappingURL=custom-connectors-store.js.map

package/dist/connectors/custom-connectors-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-connectors-store.js","sourceRoot":"","sources":["../../src/connectors/custom-connectors-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,kEA4JC;AAnPD,iDAAmC;AAEnC,mEAAqF;AAuDrF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAClB,GAAqD;IAErD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAyC,EAAE,GAAG,CAAC,CAAC;AACzF,CAAC;AASD,SAAgB,2BAA2B,CAAC,UAAmB;IAC7D,oFAAoF;IACpF,mFAAmF;IACnF,2EAA2E;IAC3E,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,KAAK,UAAU,MAAM,CACnB,EAA8D;QAE9D,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,qEAAqE;QAC9F,OAAO,IAAA,uCAAmB,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAG5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACtC,8EAA8E;YAC9E,4EAA4E;YAC5E,6DAA6D;YAC7D,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAChE,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAC;YAC7C,EAAE,CAAC,UAAU,CAAC,CAAC;YACf,MAAM,IAAA,qCAAiB,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,IAAI,CAAC,UAAU;YAAE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;YACF,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,eAAe,CAAC,GAAY;QACnC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,GAAG,GAAG,kBAAkB,GAAG,4BAA4B;YAAE,OAAO;QACpE,kBAAkB,GAAG,GAAG,CAAC;QACzB,OAAO,CAAC,KAAK,CACX,wDAAwD,UAAU,EAAE;YAClE,KAAM,GAA6B,CAAC,IAAI,IAAI,cAAc,kBAAkB;YAC5E,qCAAsC,GAAa,CAAC,OAAO,EAAE,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,aAAa,CAAC,MAAoB,EAAE,WAAmB;QAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,8EAA8E;QAC9E,yEAAyE;QACzE,2EAA2E;QAC3E,2BAA2B;QAC3B,IACE,MAAM,CAAC,OAAO,EAAE,gBAAgB;YAChC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAClF,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACpD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5F,OAAO,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBACrC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,WAAmB,EACnB,EAA6C;QAE7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,4EAA4E;YAC5E,wDAAwD;YACxD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAA,uCAAmB,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE;YAChD,IAAI,MAAM,GAAwB,IAAI,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAiB,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qDAAqD;gBACrD,eAAe,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAClE,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;gBACtB,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC;gBAC9B,MAAM,EAAE,GAAG,EAAE;oBACX,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,eAAe;gBAAE,OAAO,MAAM,CAAC,CAAC,wCAAwC;YAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,4EAA4E;gBAC5E,yEAAyE;gBACzE,mCAAmC;gBACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,MAAM,UAAU,gBAAgB,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC;gBAAE,MAAM,IAAA,qCAAiB,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpF,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC"}

package/dist/connectors/custom.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Custom (user-pasted) connector helpers — id generation, placeholder
+ * extraction, and secret substitution. These entries are admin-trusted data,
+ * not code — see CustomConnectorEntry's doc comment in connectors/types.ts.
+ */
+/**
+ * MCP server names the gateway writes into every session's mcp-config.json itself
+ * (see session/process.ts's writeMcpConfig). That writer drops any injected entry whose
+ * key collides — a correct guard, but a silent one: a connector landing on one of these
+ * ids is created, stores its secret, and reports "Connected ✓" while never reaching a
+ * session, unfixable except by deleting it. Reserving the names where ids are minted
+ * turns that into a different, working id.
+ *
+ * Exported so process.ts's skip list is this same set, not a second copy of the
+ * literals — a name added there but not here silently reopens the hole.
+ */
+export declare const RESERVED_CONNECTOR_IDS: ReadonlySet<string>;
+export declare function isReservedConnectorId(id: string): boolean;
+/**
+ * A slug not already used by a reserved id or an existing custom id. Appends
+ * -2, -3, ... on collision (custom ids are user-facing, not secret, so a readable
+ * suffix beats a random one).
+ *
+ * The result is always a valid connector id, length included. Every management route
+ * takes the id back from the URL and runs it through `isValidConnectorId`, so an id
+ * this function emits but that one rejects produces a connector that resolves into
+ * sessions and works — yet whose status, connect, delete and oauth/start routes all
+ * answer 400, fixable only by hand-editing config.json. The base is therefore truncated
+ * with the collision suffix's width already reserved.
+ *
+ * Managed ids like 'github'/'gmail' are NOT reserved here — an external control plane
+ * pushes those in, so a user-added connector could slug-collide with one. Accepted as a
+ * self-recoverable edge case (both paths are admin-trusted) rather than hardcoding
+ * another system's ids. RESERVED_CONNECTOR_IDS is reserved because that collision is
+ * NOT self-recoverable.
+ */
+export declare function slugify(label: string, existingCustomIds: Iterable<string>): string;
+/** Recursively collect every unique {name} placeholder found in string values. */
+export declare function extractPlaceholders(config: unknown): string[];
+/** Recursively replace every {name} in string values with secrets[name] (or '' if absent). */
+export declare function substitutePlaceholders(config: Record<string, unknown>, secrets: Record<string, string>): Record<string, unknown>;
+/** Namespaced mcp-token.env key so two custom connectors reusing {api_key} don't collide. */
+export declare function customSecretKey(id: string, name: string): string;
+/**
+ * Namespaced key for gateway-internal bookkeeping about a connector (the refresh
+ * token, its expiry, failure counters — see oauth-refresh-sweep.ts), stored in the
+ * same file but under a prefix `customSecretKey()` can never produce.
+ *
+ * The separate prefix is the whole point: `PLACEHOLDER_RE` accepts a leading
+ * underscore, so a pasted `{__refresh_token}` DOES yield `__refresh_token` as a
+ * secretName. Sharing one prefix would make `customSecretKey(id, '__refresh_token')`
+ * and the sweep's own slot the same string — a pasted config that resolves the
+ * gateway's refresh token into an outbound header. `isReservedPlaceholder` reports that
+ * at add-time; this split makes it unreachable even if a caller forgets to validate.
+ */
+export declare function internalSecretKey(id: string, name: string): string;
+/**
+ * Placeholder names the gateway reserves for itself. Rejected when adding or pushing
+ * a connector so the admin gets a clear 400 instead of a placeholder that silently
+ * resolves to the empty string.
+ */
+export declare function isReservedPlaceholder(name: string): boolean;
+/**
+ * Upper bound shared by the generator (`slugify`) and the validator below so the two
+ * can't drift — see slugify's doc comment for what happens when they do.
+ */
+export declare const MAX_CONNECTOR_ID_LENGTH = 64;
+export declare function isValidConnectorId(id: string): boolean;
+//# sourceMappingURL=custom.d.ts.map

package/dist/connectors/custom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../src/connectors/custom.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAoC,CAAC;AAE5F,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAalF;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAa7D;AAED,8FAA8F;AAC9F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczB;AAED,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAUD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/connectors/custom.js

@@ -0,0 +1,158 @@
+"use strict";
+/**
+ * Custom (user-pasted) connector helpers — id generation, placeholder
+ * extraction, and secret substitution. These entries are admin-trusted data,
+ * not code — see CustomConnectorEntry's doc comment in connectors/types.ts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CONNECTOR_ID_LENGTH = exports.RESERVED_CONNECTOR_IDS = void 0;
+exports.isReservedConnectorId = isReservedConnectorId;
+exports.slugify = slugify;
+exports.extractPlaceholders = extractPlaceholders;
+exports.substitutePlaceholders = substitutePlaceholders;
+exports.customSecretKey = customSecretKey;
+exports.internalSecretKey = internalSecretKey;
+exports.isReservedPlaceholder = isReservedPlaceholder;
+exports.isValidConnectorId = isValidConnectorId;
+const PLACEHOLDER_RE = /\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
+/**
+ * Lowercase, dash-separated id from a human label, e.g. "Google Calendar!" → "google-calendar".
+ *
+ * Truncated to `budget` characters (and re-trimmed, so a cut that lands on a dash
+ * doesn't leave a trailing one). See `slugify` for why the cap is not optional.
+ */
+function slugBase(label, budget) {
+    const slug = label
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, budget)
+        .replace(/-+$/g, '');
+    return slug || 'connector';
+}
+/**
+ * MCP server names the gateway writes into every session's mcp-config.json itself
+ * (see session/process.ts's writeMcpConfig). That writer drops any injected entry whose
+ * key collides — a correct guard, but a silent one: a connector landing on one of these
+ * ids is created, stores its secret, and reports "Connected ✓" while never reaching a
+ * session, unfixable except by deleting it. Reserving the names where ids are minted
+ * turns that into a different, working id.
+ *
+ * Exported so process.ts's skip list is this same set, not a second copy of the
+ * literals — a name added there but not here silently reopens the hole.
+ */
+exports.RESERVED_CONNECTOR_IDS = new Set(['gateway', 'telegram']);
+function isReservedConnectorId(id) {
+    return exports.RESERVED_CONNECTOR_IDS.has(id);
+}
+/**
+ * A slug not already used by a reserved id or an existing custom id. Appends
+ * -2, -3, ... on collision (custom ids are user-facing, not secret, so a readable
+ * suffix beats a random one).
+ *
+ * The result is always a valid connector id, length included. Every management route
+ * takes the id back from the URL and runs it through `isValidConnectorId`, so an id
+ * this function emits but that one rejects produces a connector that resolves into
+ * sessions and works — yet whose status, connect, delete and oauth/start routes all
+ * answer 400, fixable only by hand-editing config.json. The base is therefore truncated
+ * with the collision suffix's width already reserved.
+ *
+ * Managed ids like 'github'/'gmail' are NOT reserved here — an external control plane
+ * pushes those in, so a user-added connector could slug-collide with one. Accepted as a
+ * self-recoverable edge case (both paths are admin-trusted) rather than hardcoding
+ * another system's ids. RESERVED_CONNECTOR_IDS is reserved because that collision is
+ * NOT self-recoverable.
+ */
+function slugify(label, existingCustomIds) {
+    const taken = new Set(exports.RESERVED_CONNECTOR_IDS);
+    for (const id of existingCustomIds)
+        taken.add(id);
+    const base = slugBase(label, exports.MAX_CONNECTOR_ID_LENGTH);
+    if (!taken.has(base))
+        return base;
+    for (let n = 2;; n++) {
+        const suffix = `-${n}`;
+        // Re-slug against a smaller budget rather than trimming `base`, so the cut
+        // still lands on a clean boundary as the suffix grows past one digit.
+        const candidate = `${slugBase(label, exports.MAX_CONNECTOR_ID_LENGTH - suffix.length)}${suffix}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+}
+/** Recursively collect every unique {name} placeholder found in string values. */
+function extractPlaceholders(config) {
+    const found = new Set();
+    const walk = (value) => {
+        if (typeof value === 'string') {
+            for (const m of value.matchAll(PLACEHOLDER_RE))
+                found.add(m[1]);
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(walk);
+        }
+        else if (value && typeof value === 'object') {
+            Object.values(value).forEach(walk);
+        }
+    };
+    walk(config);
+    return [...found];
+}
+/** Recursively replace every {name} in string values with secrets[name] (or '' if absent). */
+function substitutePlaceholders(config, secrets) {
+    const walk = (value) => {
+        if (typeof value === 'string') {
+            return value.replace(PLACEHOLDER_RE, (_match, name) => secrets[name] ?? '');
+        }
+        if (Array.isArray(value))
+            return value.map(walk);
+        if (value && typeof value === 'object') {
+            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, walk(v)]));
+        }
+        return value;
+    };
+    return walk(config);
+}
+/** Namespaced mcp-token.env key so two custom connectors reusing {api_key} don't collide. */
+function customSecretKey(id, name) {
+    return `CUSTOM__${id}__${name}`;
+}
+/**
+ * Namespaced key for gateway-internal bookkeeping about a connector (the refresh
+ * token, its expiry, failure counters — see oauth-refresh-sweep.ts), stored in the
+ * same file but under a prefix `customSecretKey()` can never produce.
+ *
+ * The separate prefix is the whole point: `PLACEHOLDER_RE` accepts a leading
+ * underscore, so a pasted `{__refresh_token}` DOES yield `__refresh_token` as a
+ * secretName. Sharing one prefix would make `customSecretKey(id, '__refresh_token')`
+ * and the sweep's own slot the same string — a pasted config that resolves the
+ * gateway's refresh token into an outbound header. `isReservedPlaceholder` reports that
+ * at add-time; this split makes it unreachable even if a caller forgets to validate.
+ */
+function internalSecretKey(id, name) {
+    return `CUSTOMINT__${id}__${name}`;
+}
+/**
+ * Placeholder names the gateway reserves for itself. Rejected when adding or pushing
+ * a connector so the admin gets a clear 400 instead of a placeholder that silently
+ * resolves to the empty string.
+ */
+function isReservedPlaceholder(name) {
+    return name.startsWith('__');
+}
+/**
+ * Connector ids are config.json object keys and are interpolated into mcp-token.env
+ * key names, so they are constrained to the shape `slugify()` produces. Routes taking
+ * an `:id` from the URL must check this first — `/oauth/receive` in particular names a
+ * connector it is creating, so there is no existing entry to validate against.
+ */
+const CONNECTOR_ID_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+ * Upper bound shared by the generator (`slugify`) and the validator below so the two
+ * can't drift — see slugify's doc comment for what happens when they do.
+ */
+exports.MAX_CONNECTOR_ID_LENGTH = 64;
+function isValidConnectorId(id) {
+    return id.length <= exports.MAX_CONNECTOR_ID_LENGTH && CONNECTOR_ID_RE.test(id);
+}
+//# sourceMappingURL=custom.js.map

package/dist/connectors/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../src/connectors/custom.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAkCH,sDAEC;AAoBD,0BAaC;AAGD,kDAaC;AAGD,wDAiBC;AAGD,0CAEC;AAcD,8CAEC;AAOD,sDAEC;AAgBD,gDAEC;AAvJD,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,MAAM,IAAI,GAAG,KAAK;SACf,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;SAChB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACU,QAAA,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAE5F,SAAgB,qBAAqB,CAAC,EAAU;IAC9C,OAAO,8BAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,OAAO,CAAC,KAAa,EAAE,iBAAmC;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,8BAAsB,CAAC,CAAC;IACtD,KAAK,MAAM,EAAE,IAAI,iBAAiB;QAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAElD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,+BAAuB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,+BAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;QACzF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,MAAe;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAQ,EAAE;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8FAA8F;AAC9F,SAAgB,sBAAsB,CACpC,MAA+B,EAC/B,OAA+B;IAE/B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,CAA4B,CAAC;AACjD,CAAC;AAED,6FAA6F;AAC7F,SAAgB,eAAe,CAAC,EAAU,EAAE,IAAY;IACtD,OAAO,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,iBAAiB,CAAC,EAAU,EAAE,IAAY;IACxD,OAAO,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAE/C;;;GAGG;AACU,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAE1C,SAAgB,kBAAkB,CAAC,EAAU;IAC3C,OAAO,EAAE,CAAC,MAAM,IAAI,+BAAuB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/connectors/mcp-oauth.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Generic OAuth 2.1 + PKCE (+ optional Dynamic Client Registration) support for
+ * "custom" MCP connectors whose only auth option is a real OAuth sign-in (no
+ * static API key) — e.g. Firecrawl's `https://mcp.firecrawl.dev/v2/mcp-oauth`.
+ *
+ * This module never touches Express or the pending-flow store — pure discovery
+ * + token functions, unit-testable with plain HTTP mocks. See
+ * `pending-oauth-store.ts` for the in-flight-flow state and
+ * `api/oauth-connectors-router.ts` for the HTTP endpoints that glue this
+ * together with `connectors/custom.ts`'s existing secret storage.
+ *
+ * Empirically verified against production Firecrawl (2026-09, this repo's own
+ * throwaway PoC — see git history / PR description, not reproduced here):
+ * DCR genuinely works with an arbitrary redirect_uri (no pre-registration
+ * needed), and the RFC 8707 `resource` parameter is REQUIRED on both the
+ * authorize request and the token exchange — omitting it yields a token that
+ * exchanges fine but is rejected by the MCP endpoint itself
+ * ("OAUTH_CONNECTION_INVALID"). Always pass `resource` through this module's
+ * functions; never make it optional.
+ */
+export interface OAuthMetadata {
+    /** The MCP server URL this metadata was discovered for — also the RFC 8707 `resource`. */
+    resource: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    /** Absent when the AS doesn't advertise RFC 7591 Dynamic Client Registration. */
+    registrationEndpoint?: string;
+    /**
+     * Scopes to request for this resource: the protected-resource metadata's list
+     * when it publishes one, else the authorization server's. Empty when neither
+     * does — see `resolveScope` for what gets sent then.
+     */
+    scopesSupported: string[];
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+}
+/**
+ * A token endpoint that answered, and answered with a refusal.
+ *
+ * The distinction this class exists to draw is between "the grant is dead" and
+ * "we couldn't reach the provider just now". The refresh sweep gives up on a
+ * connector after a few consecutive failures and deletes its stored credentials,
+ * which is right for the first case and destructive for the second — a fifteen
+ * minute provider outage is an ordinary event and must not cost the user their
+ * sign-in. Only an explicit OAuth error response can be classified, so only this
+ * error type carries `isPermanent`; anything else the sweep sees (a DNS failure,
+ * a socket timeout, a 502, a discovery step that returned the wrong shape) is
+ * treated as retryable by default.
+ */
+export declare class OAuthTokenError extends Error {
+    readonly status: number;
+    /** RFC 6749 §5.2 `error` code from the response body, when it had one. */
+    readonly errorCode?: string | undefined;
+    constructor(message: string, status: number, 
+    /** RFC 6749 §5.2 `error` code from the response body, when it had one. */
+    errorCode?: string | undefined);
+    /**
+     * True when the authorization server has told us this grant will never work
+     * again. Deliberately a small allowlist rather than "any 4xx": a 400 with no
+     * recognisable `error` code, or a 429, says more about this request than about
+     * the grant, and retrying costs nothing but a backoff.
+     */
+    get isPermanent(): boolean;
+}
+/**
+ * Discover OAuth metadata for an MCP server by probing it unauthenticated
+ * (expects a 401 advertising `resource_metadata`, per RFC 9728), then walking
+ * protected-resource metadata → authorization-server metadata (RFC 8414).
+ * Throws a descriptive error at whichever step fails — callers surface it
+ * to the admin as "can't set up OAuth for this URL", not a generic 500.
+ */
+export declare function discoverOAuthMetadata(mcpUrl: string): Promise<OAuthMetadata>;
+/**
+ * `discoverOAuthMetadata` with a process-local cache, for the background refresh
+ * sweep.
+ *
+ * Discovery costs three round trips — an MCP probe that is *expected* to 401, then
+ * protected-resource metadata, then authorization-server metadata — to obtain a
+ * document that changes about never. Paying that on every refresh is not just waste:
+ * each of those three requests is another way for a refresh to fail, and a failed
+ * refresh is what eventually makes the sweep give up and delete the connector's
+ * credentials. Fewer moving parts on the periodic path means fewer spurious failures.
+ *
+ * Only the sweep uses this. An admin-initiated `oauth/start` still calls
+ * `discoverOAuthMetadata` directly: that is the moment a human is waiting to find out
+ * whether this URL works at all, so it should see today's truth, not a cached answer
+ * from before they fixed their provider's configuration.
+ */
+export declare function discoverOAuthMetadataCached(mcpUrl: string): Promise<OAuthMetadata>;
+/** Drop every cached metadata document. For tests, and for a forced re-discovery. */
+export declare function clearOAuthMetadataCache(): void;
+/**
+ * Register a public (no client_secret) client via RFC 7591 DCR. Throws if the
+ * server rejects it — callers fall back to a per-connector static client_id
+ * (an env var an admin configured by hand) when this isn't available at all,
+ * see `resolveClientId` below.
+ */
+export declare function registerClient(registrationEndpoint: string, redirectUri: string, clientName: string): Promise<string>;
+/**
+ * Resolve a client_id for `metadata`: try DCR first, fall back to a static
+ * `MCP_OAUTH_CLIENT_ID__<connectorId>` env var (an admin-configured client_id
+ * for a provider that advertises no registration_endpoint at all).
+ */
+export declare function resolveClientId(metadata: OAuthMetadata, connectorId: string, redirectUri: string): Promise<string>;
+/**
+ * The `scope` to send with an authorization request for `metadata`.
+ *
+ * An admin-set `MCP_OAUTH_SCOPES__<connectorId>` (space-separated) wins, for the
+ * same reason `MCP_OAUTH_CLIENT_ID__<connectorId>` exists above: discovery is the
+ * provider's story about itself, and when that story is wrong the sign-in fails at
+ * the provider with an `invalid_scope` the operator cannot otherwise do anything
+ * about. Some servers publish a scope the client is not entitled to; some grant a
+ * refresh_token only when `offline_access` is asked for and never advertise it.
+ * Both are one env var away from working, instead of a code change away.
+ *
+ * `offline_access` is the fallback when nothing is discovered or configured: the
+ * refresh sweep needs a refresh_token, and an authorization request carrying no
+ * scope at all gets whatever the provider's default happens to be.
+ */
+export declare function resolveScope(metadata: OAuthMetadata, connectorId: string): string;
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare function generatePkce(): PkcePair;
+export declare function generateState(): string;
+export declare function buildAuthorizeUrl(opts: {
+    metadata: OAuthMetadata;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    codeChallenge: string;
+    state: string;
+}): string;
+export declare function exchangeCode(opts: {
+    metadata: OAuthMetadata;
+    clientId: string;
+    redirectUri: string;
+    code: string;
+    codeVerifier: string;
+}): Promise<TokenResponse>;
+export declare function refreshAccessToken(opts: {
+    metadata: OAuthMetadata;
+    clientId: string;
+    refreshToken: string;
+}): Promise<TokenResponse>;
+//# sourceMappingURL=mcp-oauth.d.ts.map

package/dist/connectors/mcp-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/connectors/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiIH,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM;gBAH3B,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,0EAA0E;IACjE,SAAS,CAAC,EAAE,MAAM,YAAA;IAM7B;;;;;OAKG;IACH,IAAI,WAAW,IAAI,OAAO,CASzB;CACF;AA6BD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyElF;AA6CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxF;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAKjF;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAgB,YAAY,IAAI,QAAQ,CAIvC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAYT;AAsED,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAUzB"}