@1mcp/agent 0.11.0 → 0.13.0

package/build/auth/sdkOAuthServerProvider.js

@@ -0,0 +1,428 @@
+import { randomUUID } from 'node:crypto';
+import logger from '../logger/logger.js';
+import { ServerSessionManager } from './serverSessionManager.js';
+import { AgentConfigManager } from '../core/server/agentConfig.js';
+import { AUTH_CONFIG } from '../constants.js';
+import { validateScopesAgainstAvailableTags, tagsToScopes, scopesToTags, auditScopeOperation, } from '../utils/scopeValidation.js';
+import { McpConfigManager } from '../config/mcpConfigManager.js';
+/**
+ * File-based OAuth clients store implementation using AUTH_CONFIG settings
+ */
+class FileBasedClientsStore {
+    sessionManager;
+    constructor(sessionManager) {
+        this.sessionManager = sessionManager;
+    }
+    getClient(clientId) {
+        const clientKey = this.getClientKey(clientId);
+        const clientSession = this.sessionManager.getSession(clientKey);
+        if (!clientSession?.data) {
+            return undefined;
+        }
+        try {
+            return JSON.parse(clientSession.data);
+        }
+        catch (error) {
+            logger.error(`Failed to parse client data for ${clientId}:`, error);
+            return undefined;
+        }
+    }
+    registerClient(client) {
+        const clientKey = this.getClientKey(client.client_id);
+        // Store client for 30 days (same as original implementation)
+        const ttlMs = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS;
+        try {
+            this.sessionManager.createSessionWithData(clientKey, JSON.stringify(client), ttlMs);
+            logger.info(`Registered OAuth client: ${client.client_id}`);
+            return client;
+        }
+        catch (error) {
+            logger.error(`Failed to register client ${client.client_id}:`, error);
+            throw error;
+        }
+    }
+    getClientKey(clientId) {
+        // Create a deterministic UUID-like key from the client ID for consistent retrieval
+        // We need to ensure this passes the session ID validation which expects sess- + UUID format
+        const hashInput = `${AUTH_CONFIG.CLIENT.PREFIXES.CLIENT}${clientId}`;
+        // Generate a deterministic UUID-like string using a simple hash
+        const hash = this.hashToUuid(hashInput);
+        return `sess-${hash}`;
+    }
+    hashToUuid(input) {
+        // Simple hash to UUID conversion (not cryptographically secure, but deterministic)
+        // Validate input is actually a string to prevent DoS attacks
+        if (typeof input !== 'string') {
+            throw new Error('Input must be a string');
+        }
+        // Limit input length to prevent DoS attacks
+        const maxLength = 1000;
+        // Use Math.min to ensure we never exceed maxLength, even if length property is malicious
+        const actualLength = Math.min(input.length, maxLength);
+        const safeInput = input.substring(0, actualLength);
+        let hash = 0;
+        // Use actualLength instead of safeInput.length to avoid potential issues
+        for (let i = 0; i < actualLength; i++) {
+            const char = safeInput.charCodeAt(i);
+            hash = (hash << 5) - hash + char;
+            hash = hash & hash; // Convert to 32-bit integer
+        }
+        // Convert hash to a UUID-like format
+        const hashStr = Math.abs(hash).toString(16).padStart(8, '0');
+        const uuid = `${hashStr.slice(0, 8)}-${hashStr.slice(0, 4)}-4${hashStr.slice(1, 4)}-8${hashStr.slice(4, 7)}-${hashStr.repeat(3).slice(0, 12)}`;
+        return uuid;
+    }
+}
+/**
+ * Implementation of SDK's OAuthServerProvider interface using existing SessionManager.
+ *
+ * This provider implements OAuth 2.1 server functionality using the MCP SDK's interfaces
+ * while maintaining compatibility with the existing session storage system.
+ */
+export class SDKOAuthServerProvider {
+    sessionManager;
+    configManager;
+    _clientsStore;
+    constructor(sessionStoragePath) {
+        this.sessionManager = new ServerSessionManager(sessionStoragePath);
+        this.configManager = AgentConfigManager.getInstance();
+        this._clientsStore = new FileBasedClientsStore(this.sessionManager);
+    }
+    get clientsStore() {
+        return this._clientsStore;
+    }
+    /**
+     * Handles the authorization request with scope validation and user consent
+     */
+    async authorize(client, params, res) {
+        logger.debug('Authorizing client', { clientId: client.client_id, params });
+        try {
+            // Get requested scopes (default to all available tags if none specified)
+            const requestedScopes = params.scopes || [];
+            const configManager = McpConfigManager.getInstance();
+            const availableTags = configManager.getAvailableTags();
+            // If no scopes requested, default to all available tags
+            const finalScopes = requestedScopes.length > 0 ? requestedScopes : tagsToScopes(availableTags);
+            // Validate requested scopes against available tags
+            const validation = validateScopesAgainstAvailableTags(finalScopes, availableTags);
+            if (!validation.isValid) {
+                auditScopeOperation('scope_validation_failed', {
+                    clientId: client.client_id,
+                    requestedScopes: finalScopes,
+                    success: false,
+                    error: validation.errors.join(', '),
+                });
+                logger.warn(`Invalid scopes requested by client ${client.client_id}`, {
+                    requestedScopes: finalScopes,
+                    errors: validation.errors,
+                });
+                res.status(400).json({
+                    error: 'invalid_scope',
+                    error_description: `Invalid scopes: ${validation.errors.join(', ')}`,
+                });
+                return;
+            }
+            // Check if this is a direct authorization (auto-approve) or requires user consent
+            const requiresUserConsent = this.requiresUserConsent(client, finalScopes);
+            if (requiresUserConsent) {
+                // Show consent page
+                await this.renderConsentPage(client, params, finalScopes, availableTags, res);
+            }
+            else {
+                // Auto-approve with validated scopes
+                await this.approveAuthorization(client, params, validation.validScopes, res);
+            }
+        }
+        catch (error) {
+            logger.error('Authorization error:', error);
+            res.status(500).json({ error: 'server_error', error_description: 'Internal server error' });
+        }
+    }
+    /**
+     * Determines if user consent is required for the authorization
+     */
+    requiresUserConsent(client, scopes) {
+        logger.debug('Requires user consent', { clientId: client.client_id, scopes });
+        // For now, always require user consent for security
+        // In the future, this could be configurable based on client trust level
+        return true;
+    }
+    /**
+     * Renders the consent page for scope selection
+     */
+    async renderConsentPage(client, params, requestedScopes, availableTags, res) {
+        const scopeTags = scopesToTags(requestedScopes);
+        const consentPageHtml = this.generateConsentPageHtml(client, params, scopeTags, availableTags);
+        // Remove any CSP that might interfere with form submission
+        res.removeHeader('Content-Security-Policy');
+        res.set('Content-Type', 'text/html');
+        res.send(consentPageHtml);
+    }
+    /**
+     * Approves the authorization and redirects back to client
+     */
+    async approveAuthorization(client, params, grantedScopes, res) {
+        logger.debug('Approving authorization', { clientId: client.client_id, params, grantedScopes });
+        // Create authorization code with granted scopes
+        const metadata = {
+            scopes: grantedScopes,
+            resource: params.resource?.toString() || '',
+            codeChallenge: params.codeChallenge,
+            redirectUri: params.redirectUri,
+        };
+        const ttlMs = this.configManager.getOAuthCodeTtlMs();
+        const code = this.sessionManager.createAuthCode(client.client_id, params.redirectUri, JSON.stringify(metadata), ttlMs);
+        // Build redirect URL
+        const redirectUrl = new URL(params.redirectUri);
+        redirectUrl.searchParams.set('code', code);
+        if (params.state) {
+            redirectUrl.searchParams.set('state', params.state);
+        }
+        auditScopeOperation('authorization_granted', {
+            clientId: client.client_id,
+            requestedScopes: params.scopes || [],
+            grantedScopes,
+            success: true,
+        });
+        logger.info(`OAuth authorization granted for client ${client.client_id}`, {
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            grantedScopes,
+        });
+        res.redirect(redirectUrl.toString());
+    }
+    /**
+     * Generates the HTML for the consent page
+     */
+    generateConsentPageHtml(client, params, requestedTags, availableTags) {
+        const clientName = client.client_name || client.client_id;
+        return `
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Authorize ${clientName}</title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; margin: 0; padding: 20px; background: #f5f5f5; }
+        .container { max-width: 500px; margin: 0 auto; background: white; padding: 30px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
+        h1 { color: #333; margin-bottom: 20px; }
+        .app-info { background: #f8f9fa; padding: 15px; border-radius: 6px; margin-bottom: 20px; }
+        .scopes-section { margin-bottom: 25px; }
+        .scope-item { display: flex; align-items: center; margin-bottom: 10px; }
+        .scope-item input { margin-right: 10px; }
+        .scope-item label { flex: 1; }
+        .tag-description { font-size: 0.9em; color: #666; margin-left: 25px; }
+        .buttons { display: flex; gap: 10px; justify-content: flex-end; }
+        .btn { padding: 10px 20px; border-radius: 4px; font-size: 14px; cursor: pointer; }
+        .btn-primary { background: #007bff; color: white; border: none; }
+        .btn-secondary { background: #6c757d; color: white; border: none; }
+        .btn:hover { opacity: 0.9; }
+        .security-notice { background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; border-radius: 4px; margin-bottom: 20px; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>Authorize Application</h1>
+
+        <div class="app-info">
+            <strong>${clientName}</strong> is requesting access to your MCP servers.
+        </div>
+
+        <div class="security-notice">
+            <strong>Security Notice:</strong> Only grant access to server groups that this application needs.
+        </div>
+
+        <form method="POST" action="/oauth/consent">
+            <input type="hidden" name="client_id" value="${client.client_id}">
+            <input type="hidden" name="redirect_uri" value="${params.redirectUri}">
+            <input type="hidden" name="code_challenge" value="${params.codeChallenge || ''}">
+            <input type="hidden" name="code_challenge_method" value="S256">
+            <input type="hidden" name="state" value="${params.state || ''}">
+            <input type="hidden" name="resource" value="${params.resource?.toString() || ''}">
+
+            <div class="scopes-section">
+                <h3>Server Access Permissions</h3>
+                <p>Select which server groups this application can access:</p>
+
+                ${availableTags
+            .map((tag) => `
+                    <div class="scope-item">
+                        <input type="checkbox"
+                               id="scope_${tag}"
+                               name="scopes"
+                               value="tag:${tag}"
+                               ${requestedTags.includes(tag) ? 'checked' : ''}>
+                        <label for="scope_${tag}">
+                            <strong>${tag}</strong> servers
+                        </label>
+                    </div>
+                    <div class="tag-description">
+                        Access servers tagged with "${tag}"
+                    </div>
+                `)
+            .join('')}
+            </div>
+
+            <div class="buttons">
+                <button type="submit" name="action" value="deny" class="btn btn-secondary">Deny</button>
+                <button type="submit" name="action" value="approve" class="btn btn-primary">Approve</button>
+            </div>
+        </form>
+    </div>
+</body>
+</html>
+    `;
+    }
+    /**
+     * Retrieves the PKCE challenge for an authorization code
+     */
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        logger.debug('Challenge for authorization code', { clientId: client.client_id, authorizationCode });
+        const codeData = this.sessionManager.getAuthCode(authorizationCode);
+        if (!codeData || codeData.clientId !== client.client_id) {
+            throw new Error('Invalid authorization code');
+        }
+        try {
+            const metadata = JSON.parse(codeData.resource);
+            return metadata.codeChallenge || '';
+        }
+        catch (_e) {
+            return '';
+        }
+    }
+    /**
+     * Exchanges authorization code for access token
+     */
+    async exchangeAuthorizationCode(client, authorizationCode, 
+    // Note: code verifier is checked in SDK's token.ts by default
+    // it's unused here for that reason.
+    _codeVerifier, redirectUri, resource) {
+        logger.debug('Exchanging authorization code', {
+            clientId: client.client_id,
+            authorizationCode,
+            redirectUri,
+            resource,
+        });
+        const codeData = this.sessionManager.getAuthCode(authorizationCode);
+        if (!codeData) {
+            throw new Error('Invalid or expired authorization code');
+        }
+        // Validate client ID
+        if (codeData.clientId !== client.client_id) {
+            throw new Error('Client ID mismatch');
+        }
+        // Validate redirect URI if provided
+        if (redirectUri && codeData.redirectUri !== redirectUri) {
+            throw new Error('Redirect URI mismatch');
+        }
+        // Parse metadata to check PKCE and other parameters
+        let metadata = {};
+        try {
+            metadata = JSON.parse(codeData.resource);
+        }
+        catch (_e) {
+            // Legacy format, treat as plain resource string
+            metadata = { resource: codeData.resource };
+        }
+        // Validate resource if provided
+        if (resource && metadata.resource && metadata.resource !== resource.toString()) {
+            throw new Error('Resource mismatch');
+        }
+        // Delete the authorization code (one-time use)
+        this.sessionManager.deleteAuthCode(authorizationCode);
+        // Create access token
+        const tokenId = randomUUID();
+        const accessToken = AUTH_CONFIG.SERVER.PREFIXES.ACCESS_TOKEN + tokenId;
+        const ttlMs = this.configManager.getOAuthTokenTtlMs();
+        // Store session for token validation
+        this.sessionManager.createSessionWithId(tokenId, client.client_id, metadata.resource || '', ttlMs);
+        const tokens = {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: Math.floor(ttlMs / 1000),
+            scope: metadata.scopes ? metadata.scopes.join(' ') : '',
+        };
+        logger.info(`Exchanged authorization code for access token`, {
+            clientId: client.client_id,
+            tokenId: tokenId.substring(0, 8) + '...',
+            expiresIn: tokens.expires_in,
+        });
+        return tokens;
+    }
+    /**
+     * Exchanges refresh token for new access token (not implemented)
+     */
+    async exchangeRefreshToken(_client, _refreshToken, _scopes, _resource) {
+        throw new Error('Refresh tokens not supported');
+    }
+    /**
+     * Verifies access token and returns auth info with granted scopes
+     */
+    async verifyAccessToken(token) {
+        logger.debug('Verifying access token', { token });
+        if (!this.configManager.isAuthEnabled()) {
+            // Auth disabled, return minimal auth info with all available tags as scopes
+            const configManager = McpConfigManager.getInstance();
+            const availableTags = configManager.getAvailableTags();
+            return {
+                token,
+                clientId: 'anonymous',
+                scopes: tagsToScopes(availableTags),
+            };
+        }
+        // Strip prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.SERVER.PREFIXES.ACCESS_TOKEN)
+            ? token.slice(AUTH_CONFIG.SERVER.PREFIXES.ACCESS_TOKEN.length)
+            : token;
+        // Get session data
+        const sessionId = AUTH_CONFIG.SERVER.PREFIXES.SESSION_ID + tokenId;
+        const sessionData = this.sessionManager.getSession(sessionId);
+        if (!sessionData) {
+            throw new Error('Invalid or expired access token');
+        }
+        // Extract scopes from session resource (stored during authorization)
+        let scopes = [];
+        if (sessionData.resource) {
+            try {
+                const metadata = JSON.parse(sessionData.resource);
+                scopes = metadata.scopes || [];
+            }
+            catch (error) {
+                logger.warn(`Failed to parse session metadata for token ${tokenId}:`, error);
+            }
+        }
+        return {
+            token,
+            clientId: sessionData.clientId,
+            scopes,
+            expiresAt: sessionData.expires,
+            resource: sessionData.resource ? new URL(sessionData.resource) : undefined,
+        };
+    }
+    /**
+     * Revokes a token
+     */
+    async revokeToken(client, request) {
+        logger.debug('Revoking token', { clientId: client.client_id, request });
+        const token = request.token;
+        // Strip prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.SERVER.PREFIXES.ACCESS_TOKEN)
+            ? token.slice(AUTH_CONFIG.SERVER.PREFIXES.ACCESS_TOKEN.length)
+            : token;
+        const sessionId = AUTH_CONFIG.SERVER.PREFIXES.SESSION_ID + tokenId;
+        const success = this.sessionManager.deleteSession(sessionId);
+        if (success) {
+            logger.info(`Revoked access token for client ${client.client_id}`, {
+                tokenId: tokenId.substring(0, 8) + '...',
+            });
+        }
+    }
+    /**
+     * Graceful shutdown
+     */
+    shutdown() {
+        this.sessionManager.shutdown();
+    }
+}
+//# sourceMappingURL=sdkOAuthServerProvider.js.map

package/build/auth/sdkOAuthServerProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthServerProvider.js","sourceRoot":"","sources":["../../src/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,kCAAkC,EAClC,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE;;GAEG;AACH,MAAM,qBAAqB;IACjB,cAAc,CAAuB;IAE7C,YAAY,cAAoC;QAC9C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEhE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAA+B,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,cAAc,CAAC,MAAkC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAE9C,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,mFAAmF;QACnF,4FAA4F;QAC5F,MAAM,SAAS,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACrE,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,KAAa;QAC9B,mFAAmF;QACnF,6DAA6D;QAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC;QACvB,yFAAyF;QACzF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAEnD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,yEAAyE;QACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;YACjC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,4BAA4B;QAClD,CAAC;QAED,qCAAqC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/I,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IACzB,cAAc,CAAuB;IACrC,aAAa,CAAqB;IAClC,aAAa,CAA8B;IAEnD,YAAY,kBAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,yEAAyE;YACzE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YAEvD,wDAAwD;YACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAE/F,mDAAmD;YACnD,MAAM,UAAU,GAAG,kCAAkC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAElF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,mBAAmB,CAAC,yBAAyB,EAAE;oBAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,eAAe,EAAE,WAAW;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,SAAS,EAAE,EAAE;oBACpE,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,mBAAmB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE1E,IAAI,mBAAmB,EAAE,CAAC;gBACxB,oBAAoB;gBACpB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,MAAkC,EAAE,MAAgB;QAC9E,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,oDAAoD;QACpD,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAkC,EAClC,MAA2B,EAC3B,eAAyB,EACzB,aAAuB,EACvB,GAAa;QAEb,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAE/F,2DAA2D;QAC3D,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAC/B,MAAkC,EAClC,MAA2B,EAC3B,aAAuB,EACvB,GAAa;QAEb,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/F,gDAAgD;QAChD,MAAM,QAAQ,GAAG;YACf,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7C,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EACxB,KAAK,CACN,CAAC;QAEF,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YACpC,aAAa;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,EAAE;YACxE,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa;SACd,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAkC,EAClC,MAA2B,EAC3B,aAAuB,EACvB,aAAuB;QAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC;QAE1D,OAAO;;;;uBAIY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0BX,UAAU;;;;;;;;2DAQ2B,MAAM,CAAC,SAAS;8DACb,MAAM,CAAC,WAAW;gEAChB,MAAM,CAAC,aAAa,IAAI,EAAE;;uDAEnC,MAAM,CAAC,KAAK,IAAI,EAAE;0DACf,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;;;;;;kBAMzE,aAAa;aACZ,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CAAC;;;2CAGc,GAAG;;4CAEF,GAAG;iCACd,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;4CACjC,GAAG;sCACT,GAAG;;;;sDAIa,GAAG;;iBAExC,CACE;aACA,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;KAWtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAkC,EAAE,iBAAyB;QAC/F,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC/C,OAAO,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB;IACzB,8DAA8D;IAC9D,oCAAoC;IACpC,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,iBAAiB;YACjB,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,qBAAqB;QACrB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,oDAAoD;QACpD,IAAI,QAAQ,GAAQ,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,gDAAgD;YAChD,QAAQ,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAEtD,sBAAsB;QACtB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,GAAG,OAAO,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QAEtD,qCAAqC;QACrC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAEnG,MAAM,MAAM,GAAgB;YAC1B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACpC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;SACxD,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;YACxC,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmC,EACnC,aAAqB,EACrB,OAAkB,EAClB,SAAe;QAEf,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAElD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACxC,4EAA4E;YAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;YAC9D,CAAC,CAAC,KAAK,CAAC;QAEV,mBAAmB;QACnB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,qEAAqE;QACrE,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClD,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,8CAA8C,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM;YACN,SAAS,EAAE,WAAW,CAAC,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;YAC9D,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE7D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,SAAS,EAAE,EAAE;gBACjE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;CACF"}

package/build/{server/auth/sessionManager.d.ts → auth/serverSessionManager.d.ts}

@@ -1,37 +1,4 @@
-/**
- * Represents session data stored for access tokens.
- *
- * Contains all necessary information to validate and manage user sessions
- * including client identification, resource access, and expiration details.
- */
-export interface SessionData {
-    /** The client ID that owns this session */
-    clientId: string;
-    /** The resource this session has access to */
-    resource: string;
-    /** Unix timestamp when this session expires */
-    expires: number;
-    /** Unix timestamp when this session was created */
-    createdAt: number;
-}
-/**
- * Represents authorization code data for OAuth 2.1 flow.
- *
- * Contains information about authorization codes used in the OAuth
- * authorization code grant flow, including client and redirect details.
- */
-export interface AuthCodeData {
-    /** The client ID that requested this authorization code */
-    clientId: string;
-    /** The redirect URI where the code should be used */
-    redirectUri: string;
-    /** The resource this code grants access to */
-    resource: string;
-    /** Unix timestamp when this code expires */
-    expires: number;
-    /** Unix timestamp when this code was created */
-    createdAt: number;
-}
+import { SessionData, AuthCodeData } from './sessionTypes.js';
 /**
  * SessionManager handles file-based session storage with automatic cleanup.
  *
@@ -52,7 +19,7 @@ export interface AuthCodeData {
  * const session = sessionManager.getSession(sessionId);
  * ```
  */
-export declare class SessionManager {
+export declare class ServerSessionManager {
     private sessionStoragePath;
     private cleanupInterval;
     /**
@@ -64,6 +31,12 @@ export declare class SessionManager {
      * @param sessionStoragePath - Optional custom path for session storage
      */
     constructor(sessionStoragePath?: string);
+    /**
+     * Gets the session storage path.
+     *
+     * @returns The absolute path to the session storage directory
+     */
+    getSessionStoragePath(): string;
     /**
      * Ensures the session storage directory exists.
      *
@@ -88,7 +61,8 @@ export declare class SessionManager {
      */
     private getAuthCodeFilePath;
     /**
-     * Utility to validate session IDs and auth codes for safe characters (alphanumeric and dashes only).
+     * Utility to validate session IDs and auth codes for proper format and security.
+     * Ensures proper format with prefix and UUID structure for security.
      * @param id - The session ID or auth code to validate
      * @returns true if valid, false otherwise
      */
@@ -173,6 +147,10 @@ export declare class SessionManager {
      * by removing them to prevent future errors.
      */
     private cleanupExpiredSessions;
+    /**
+     * Cleans up expired server sessions and authorization codes.
+     */
+    private cleanupExpiredServerSessions;
     /**
      * Performs graceful shutdown of the SessionManager.
      *
@@ -192,5 +170,16 @@ export declare class SessionManager {
      * @throws Error if session creation fails
      */
     createSessionWithId(tokenId: string, clientId: string, resource: string, ttlMs: number): string;
+    /**
+     * Creates a new session with custom data.
+     * Used for OAuth client data storage where arbitrary data needs to be stored.
+     *
+     * @param sessionId - The session ID to use
+     * @param data - The custom data to store
+     * @param ttlMs - Time-to-live in milliseconds
+     * @returns The session ID
+     * @throws Error if session creation fails
+     */
+    createSessionWithData(sessionId: string, data: string, ttlMs: number): string;
 }
-//# sourceMappingURL=sessionManager.d.ts.map
+//# sourceMappingURL=serverSessionManager.d.ts.map

package/build/auth/serverSessionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverSessionManager.d.ts","sourceRoot":"","sources":["../../src/auth/serverSessionManager.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,eAAe,CAA+C;IAEtE;;;;;;;OAOG;gBACS,kBAAkB,CAAC,EAAE,MAAM;IAOvC;;;;OAIG;IACI,qBAAqB,IAAI,MAAM;IAItC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAoB1B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAoCjB;;;;;;;;;;;OAWG;IACI,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAoB/E;;;;;;;;OAQG;IACI,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IA0BxD;;;;;;;OAOG;IACI,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAmBhD;;;;;;;;;;;;OAYG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAqBrG;;;;;;;;OAQG;IACI,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IA0BrD;;;;;;;OAOG;IACI,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAmB5C;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAI9B;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAqCpC;;;;;OAKG;IACI,QAAQ,IAAI,IAAI;IAOvB;;;;;;;;;;OAUG;IACI,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAoBtG;;;;;;;;;OASG;IACI,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;CAmBrF"}