@1mcp/agent 0.37.0 → 0.38.0

package/build/sdk/legacy/auth/sdkOAuthServerProvider.js

@@ -0,0 +1,519 @@
+import { randomUUID } from 'node:crypto';
+import { OAuthStorageService } from '../../../auth/storage/oauthStorageService.js';
+import { McpConfigManager } from '../../../config/mcpConfigManager.js';
+import { AUTH_CONFIG } from '../../../constants.js';
+import { RuntimeIdentityService } from '../../../core/runtime/runtimeIdentityService.js';
+import { AgentConfigManager } from '../../../core/server/agentConfig.js';
+import logger from '../../../logger/logger.js';
+import { InvalidGrantError, InvalidScopeError, InvalidTargetError, ServerError, } from '../../../sdk/legacy/server/auth/errors.js';
+import { InsecureFilePermissionsError } from '../../../utils/filePermissions.js';
+import { escapeHtml } from '../../../utils/validation/sanitization.js';
+import { auditScopeOperation, scopesToTags, tagsToScopes, validateScopesAgainstAvailableTags, } from '../../../utils/validation/scopeValidation.js';
+const OAUTH_CONSENT_PAGE_CSP_SUFFIX = "style-src 'unsafe-inline'; img-src 'self' data:; base-uri 'none'; frame-ancestors 'none';";
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/**
+ * Reads from a credential repository, mapping a denied permission heal to an
+ * actionable OAuth server_error instead of a bare 500.
+ */
+function readCredential(read) {
+    try {
+        return read();
+    }
+    catch (error) {
+        if (error instanceof InsecureFilePermissionsError) {
+            logger.error(`OAuth store refused insecure credential file: ${error.message}`);
+            throw new ServerError('Credential storage is not owner-only and could not be repaired');
+        }
+        throw error;
+    }
+}
+/**
+ * Async twin of readCredential for promise-returning repository calls —
+ * a rejected promise must be remapped too, otherwise a denied heal still
+ * surfaces as an unhandled internal error.
+ */
+async function readCredentialAsync(read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (error instanceof InsecureFilePermissionsError) {
+            logger.error(`OAuth store refused insecure credential file: ${error.message}`);
+            throw new ServerError('Credential storage is not owner-only and could not be repaired');
+        }
+        throw error;
+    }
+}
+/**
+ * File-based OAuth clients store implementation using the new repository architecture
+ */
+class FileBasedClientsStore {
+    oauthStorage;
+    constructor(oauthStorage) {
+        this.oauthStorage = oauthStorage;
+    }
+    getClientKey(clientId) {
+        return `${AUTH_CONFIG.CLIENT.PREFIXES.CLIENT}${clientId}`;
+    }
+    getClient(clientId) {
+        const clientKey = this.getClientKey(clientId);
+        const clientData = readCredential(() => this.oauthStorage.clientDataRepository.get(clientKey));
+        if (!clientData) {
+            return undefined;
+        }
+        return clientData;
+    }
+    registerClient(client) {
+        const clientKey = this.getClientKey(client.client_id);
+        // Store client for 30 days (same as original implementation)
+        const ttlMs = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS;
+        try {
+            this.oauthStorage.clientDataRepository.save(clientKey, client, ttlMs);
+            logger.info(`Registered OAuth client: ${client.client_id}`);
+            return client;
+        }
+        catch (error) {
+            logger.error(`Failed to register client ${client.client_id}:`, error);
+            throw error;
+        }
+    }
+}
+/**
+ * Implementation of SDK's OAuthServerProvider interface using the new repository architecture.
+ *
+ * This provider implements OAuth 2.1 server functionality using the MCP SDK's interfaces
+ * with the new layered storage architecture for better separation of concerns.
+ */
+export class SDKOAuthServerProvider {
+    /**
+     * @deprecated Compatibility escape hatch for lower-level SDK/storage internals.
+     * HTTP routes should use `OAuthAuthorizationFlow` operations instead of reaching into storage.
+     */
+    oauthStorage;
+    configManager;
+    _clientsStore;
+    constructor(sessionStoragePath, runtimeScopeId) {
+        const scopeId = runtimeScopeId ?? new RuntimeIdentityService({ storageDir: sessionStoragePath }).getRuntimeScopeId();
+        this.oauthStorage = new OAuthStorageService(sessionStoragePath, scopeId);
+        this.configManager = AgentConfigManager.getInstance();
+        this._clientsStore = new FileBasedClientsStore(this.oauthStorage);
+    }
+    get clientsStore() {
+        return this._clientsStore;
+    }
+    /**
+     * Handles the authorization request with scope validation and user consent
+     */
+    async authorize(client, params, res) {
+        logger.debug('Authorizing client', { clientId: client.client_id, params });
+        try {
+            // Get requested scopes (default to all available tags if none specified)
+            const requestedScopes = params.scopes || [];
+            const configManager = McpConfigManager.getInstance();
+            const availableTags = configManager.getAvailableTags();
+            // If no scopes requested, default to all available tags
+            const finalScopes = requestedScopes.length > 0 ? requestedScopes : tagsToScopes(availableTags);
+            // Validate requested scopes against available tags
+            const validation = validateScopesAgainstAvailableTags(finalScopes, availableTags);
+            if (!validation.isValid) {
+                auditScopeOperation('scope_validation_failed', {
+                    clientId: client.client_id,
+                    requestedScopes: finalScopes,
+                    success: false,
+                    error: validation.errors.join(', '),
+                });
+                logger.warn(`Invalid scopes requested by client ${client.client_id}`, {
+                    requestedScopes: finalScopes,
+                    errors: validation.errors,
+                });
+                res.status(400).json({
+                    error: 'invalid_scope',
+                    error_description: `Invalid scopes: ${validation.errors.join(', ')}`,
+                });
+                return;
+            }
+            // Check if this is a direct authorization (auto-approve) or requires user consent
+            const requiresUserConsent = this.requiresUserConsent(client, finalScopes);
+            if (requiresUserConsent) {
+                // Show consent page
+                await this.renderConsentPage(client, params, finalScopes, availableTags, res);
+            }
+            else {
+                // Auto-approve with validated scopes
+                await this.approveAuthorization(client, params, validation.validScopes, res);
+            }
+        }
+        catch (error) {
+            logger.error('Authorization error:', error);
+            res.status(500).json({ error: 'server_error', error_description: 'Internal server error' });
+        }
+    }
+    /**
+     * Determines if user consent is required for the authorization
+     */
+    requiresUserConsent(client, scopes) {
+        logger.debug('Requires user consent', { clientId: client.client_id, scopes });
+        // For now, always require user consent for security
+        // In the future, this could be configurable based on client trust level
+        return true;
+    }
+    /**
+     * Renders the consent page for scope selection
+     */
+    async renderConsentPage(client, params, requestedScopes, availableTags, res) {
+        // Create temporary authorization request to store the code challenge securely
+        const authRequestId = this.oauthStorage.createAuthorizationRequest(client.client_id, params.redirectUri, params.codeChallenge, params.state, params.resource?.toString(), requestedScopes);
+        const scopeTags = scopesToTags(requestedScopes);
+        const consentPageHtml = this.generateConsentPageHtml(client, authRequestId, scopeTags, availableTags);
+        res.set('Content-Security-Policy', createConsentPageCsp(client, params.redirectUri));
+        res.set('Content-Type', 'text/html');
+        res.send(consentPageHtml);
+    }
+    /**
+     * Approves the authorization and redirects back to client
+     */
+    async approveAuthorization(client, params, grantedScopes, res) {
+        logger.debug('Approving authorization', { clientId: client.client_id, params, grantedScopes });
+        // Create authorization code with granted scopes
+        const ttlMs = this.configManager.get('auth').oauthCodeTtlMs;
+        const code = this.oauthStorage.authCodeRepository.create(client.client_id, params.redirectUri, params.resource?.toString() || '', grantedScopes, ttlMs, params.codeChallenge);
+        // Build redirect URL
+        const redirectUrl = new URL(params.redirectUri);
+        redirectUrl.searchParams.set('code', code);
+        if (params.state) {
+            redirectUrl.searchParams.set('state', params.state);
+        }
+        auditScopeOperation('authorization_granted', {
+            clientId: client.client_id,
+            requestedScopes: params.scopes || [],
+            grantedScopes,
+            success: true,
+        });
+        logger.info(`OAuth authorization granted for client ${client.client_id}`, {
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            grantedScopes,
+        });
+        res.redirect(redirectUrl.toString());
+    }
+    /**
+     * Generates the HTML for the consent page
+     */
+    generateConsentPageHtml(client, authRequestId, requestedTags, availableTags) {
+        const clientName = escapeHtml(client.client_name || client.client_id);
+        const escapedAuthRequestId = escapeHtml(authRequestId);
+        const renewableAccessNotice = client.grant_types?.includes('refresh_token')
+            ? '<p>This application can renew this access for up to 30 days.</p>'
+            : '';
+        return `
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Authorize ${clientName}</title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; margin: 0; padding: 20px; background: #f5f5f5; }
+        .container { max-width: 500px; margin: 0 auto; background: white; padding: 30px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
+        h1 { color: #333; margin-bottom: 20px; }
+        .app-info { background: #f8f9fa; padding: 15px; border-radius: 6px; margin-bottom: 20px; }
+        .scopes-section { margin-bottom: 25px; }
+        .scope-item { display: flex; align-items: center; margin-bottom: 10px; }
+        .scope-item input { margin-right: 10px; }
+        .scope-item label { flex: 1; }
+        .tag-description { font-size: 0.9em; color: #666; margin-left: 25px; }
+        .buttons { display: flex; gap: 10px; justify-content: flex-end; }
+        .btn { padding: 10px 20px; border-radius: 4px; font-size: 14px; cursor: pointer; }
+        .btn-primary { background: #007bff; color: white; border: none; }
+        .btn-secondary { background: #6c757d; color: white; border: none; }
+        .btn:hover { opacity: 0.9; }
+        .security-notice { background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; border-radius: 4px; margin-bottom: 20px; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>Authorize Application</h1>
+
+        <div class="app-info">
+            <strong>${clientName}</strong> is requesting access to your MCP servers.
+        </div>
+
+        <div class="security-notice">
+            <strong>Security Notice:</strong> Only grant access to server groups that this application needs.
+            ${renewableAccessNotice}
+        </div>
+
+        <form method="POST" action="/oauth/consent">
+            <input type="hidden" name="auth_request_id" value="${escapedAuthRequestId}">
+
+            <div class="scopes-section">
+                <h3>Server Access Permissions</h3>
+                <p>Select which server groups this application can access:</p>
+
+                ${availableTags
+            .map((tag) => {
+            const escapedTag = escapeHtml(tag);
+            return `
+                    <div class="scope-item">
+                        <input type="checkbox"
+                               id="scope_${escapedTag}"
+                               name="scopes"
+                               value="tag:${escapedTag}"
+                               ${requestedTags.includes(tag) ? 'checked' : ''}>
+                        <label for="scope_${escapedTag}">
+                            <strong>${escapedTag}</strong> servers
+                        </label>
+                    </div>
+                    <div class="tag-description">
+                        Access servers tagged with "${escapedTag}"
+                    </div>
+                `;
+        })
+            .join('')}
+            </div>
+
+            <div class="buttons">
+                <button type="submit" name="action" value="deny" class="btn btn-secondary">Deny</button>
+                <button type="submit" name="action" value="approve" class="btn btn-primary">Approve</button>
+            </div>
+        </form>
+    </div>
+</body>
+</html>
+    `;
+    }
+    /**
+     * Retrieves the PKCE challenge for an authorization code
+     */
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        logger.debug('Challenge for authorization code', { clientId: client.client_id });
+        const codeData = readCredential(() => this.oauthStorage.authCodeRepository.get(authorizationCode));
+        if (!codeData || codeData.clientId !== client.client_id) {
+            throw new InvalidGrantError('Invalid authorization code');
+        }
+        return codeData.codeChallenge || '';
+    }
+    /**
+     * Exchanges authorization code for access token
+     */
+    async exchangeAuthorizationCode(client, authorizationCode, 
+    // Note: code verifier is checked in SDK's token.ts by default
+    // it's unused here for that reason.
+    _codeVerifier, redirectUri, resource) {
+        logger.debug('Exchanging authorization code', {
+            clientId: client.client_id,
+            redirectUri,
+            resource,
+        });
+        return this.oauthStorage.fileStorage.withExclusiveLock('auth-code-exchange', async () => {
+            const codeData = readCredential(() => this.oauthStorage.authCodeRepository.get(authorizationCode));
+            if (!codeData) {
+                throw new InvalidGrantError('Invalid or expired authorization code');
+            }
+            // Validate client ID
+            if (codeData.clientId !== client.client_id) {
+                throw new InvalidGrantError('Invalid or expired authorization code');
+            }
+            // Validate redirect URI if provided
+            if (redirectUri && codeData.redirectUri !== redirectUri) {
+                throw new InvalidGrantError('Redirect URI mismatch');
+            }
+            // Validate resource if provided
+            if (resource && codeData.resource && codeData.resource !== resource.toString()) {
+                throw new InvalidTargetError('Resource mismatch');
+            }
+            // Delete the authorization code (one-time use)
+            this.oauthStorage.authCodeRepository.delete(authorizationCode);
+            // Create access token
+            const tokenId = randomUUID();
+            const accessToken = AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX + tokenId;
+            const ttlMs = this.configManager.get('auth').oauthTokenTtlMs;
+            const refreshFamily = client.grant_types?.includes('refresh_token')
+                ? await this.oauthStorage.refreshTokenFamilyRepository.create(client.client_id, codeData.scopes, codeData.resource || '', tokenId, (familyId) => this.oauthStorage.sessionRepository.createRefreshFamilyAccessSession({
+                    tokenId,
+                    clientId: client.client_id,
+                    resource: codeData.resource || '',
+                    scopes: codeData.scopes,
+                    ttlMs,
+                    familyId,
+                }))
+                : undefined;
+            if (!refreshFamily) {
+                this.oauthStorage.sessionRepository.createWithId(tokenId, client.client_id, codeData.resource || '', codeData.scopes, ttlMs);
+            }
+            const tokens = {
+                access_token: accessToken,
+                token_type: 'Bearer',
+                expires_in: Math.floor(ttlMs / 1000),
+                scope: codeData.scopes ? codeData.scopes.join(' ') : '',
+                ...(refreshFamily ? { refresh_token: refreshFamily.refreshToken } : {}),
+            };
+            logger.info(`Exchanged authorization code for access token`, {
+                clientId: client.client_id,
+                tokenId: tokenId.substring(0, 8) + '...',
+                expiresIn: tokens.expires_in,
+            });
+            return tokens;
+        });
+    }
+    /**
+     * Atomically rotates a single-use refresh token and issues a new access token.
+     */
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const repository = this.oauthStorage.refreshTokenFamilyRepository;
+        const family = readCredential(() => repository.findByToken(refreshToken));
+        if (!family || family.clientId !== client.client_id) {
+            throw new InvalidGrantError('Invalid refresh token');
+        }
+        const requestedScopes = scopes ?? family.scopeCeiling;
+        if (requestedScopes.some((scope) => !family.scopeCeiling.includes(scope))) {
+            throw new InvalidScopeError('Requested scope exceeds the originally consented scope');
+        }
+        if (resource && resource.toString() !== family.resource) {
+            throw new InvalidTargetError('Requested resource does not match the original resource');
+        }
+        const tokenId = randomUUID();
+        const ttlMs = this.configManager.get('auth').oauthTokenTtlMs;
+        const rotation = await readCredentialAsync(() => repository.consume(refreshToken, client.client_id, tokenId, (familyId) => this.oauthStorage.sessionRepository.createRefreshFamilyAccessSession({
+            tokenId,
+            clientId: client.client_id,
+            resource: family.resource,
+            scopes: requestedScopes,
+            ttlMs,
+            familyId,
+        })));
+        if (rotation.status === 'replay') {
+            this.revokeFamilyAccessTokens(rotation.family.accessTokenIds);
+            throw new InvalidGrantError('Refresh token replay detected');
+        }
+        if (rotation.status !== 'rotated') {
+            throw new InvalidGrantError('Invalid refresh token');
+        }
+        return {
+            access_token: AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX + tokenId,
+            token_type: 'Bearer',
+            expires_in: Math.floor(ttlMs / 1000),
+            scope: requestedScopes.join(' '),
+            refresh_token: rotation.refreshToken,
+        };
+    }
+    /**
+     * Verifies access token and returns auth info with granted scopes
+     */
+    async verifyAccessToken(token) {
+        logger.debug('Verifying access token');
+        if (!this.configManager.get('features').auth) {
+            // Auth disabled, return minimal auth info with all available tags as scopes
+            const configManager = McpConfigManager.getInstance();
+            const availableTags = configManager.getAvailableTags();
+            return {
+                token,
+                clientId: 'anonymous',
+                scopes: tagsToScopes(availableTags),
+            };
+        }
+        // Strip prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX)
+            ? token.slice(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX.length)
+            : token;
+        // Get session data
+        const sessionId = AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + tokenId;
+        const sessionData = readCredential(() => this.oauthStorage.sessionRepository.get(sessionId));
+        if (!sessionData) {
+            throw new Error('Invalid or expired access token');
+        }
+        const refreshFamilyId = sessionData.refreshFamilyId;
+        if (refreshFamilyId) {
+            const family = readCredential(() => this.oauthStorage.refreshTokenFamilyRepository.findById(refreshFamilyId));
+            if (!family || family.status !== 'active' || !family.accessTokenIds.includes(tokenId)) {
+                throw new Error('Invalid or expired access token');
+            }
+        }
+        return {
+            token,
+            clientId: sessionData.clientId,
+            scopes: sessionData.scopes,
+            expiresAt: sessionData.expires,
+            resource: sessionData.resource ? new URL(sessionData.resource) : undefined,
+        };
+    }
+    /**
+     * Revokes a token
+     */
+    async revokeToken(client, request) {
+        logger.debug('Revoking OAuth token', { clientId: client.client_id });
+        const token = request.token;
+        const refreshFamily = readCredential(() => this.oauthStorage.refreshTokenFamilyRepository.findByToken(token));
+        if (refreshFamily) {
+            const revokedFamily = await this.oauthStorage.refreshTokenFamilyRepository.revokeForClient(refreshFamily, client.client_id);
+            if (revokedFamily) {
+                this.revokeFamilyAccessTokens(revokedFamily.accessTokenIds);
+            }
+            return;
+        }
+        // Strip prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX)
+            ? token.slice(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX.length)
+            : token;
+        const sessionId = AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + tokenId;
+        const session = readCredential(() => this.oauthStorage.sessionRepository.get(sessionId));
+        const success = session?.clientId === client.client_id && this.oauthStorage.sessionRepository.delete(sessionId);
+        if (success) {
+            logger.info(`Revoked access token for client ${client.client_id}`, {
+                tokenId: tokenId.substring(0, 8) + '...',
+            });
+        }
+    }
+    revokeFamilyAccessTokens(accessTokenIds) {
+        const failures = [];
+        for (const accessTokenId of accessTokenIds) {
+            try {
+                this.oauthStorage.sessionRepository.delete(AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + accessTokenId);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (failures.length > 0) {
+            throw new AggregateError(failures, 'Failed to revoke access sessions for refresh token family');
+        }
+    }
+    /**
+     * Graceful shutdown
+     */
+    shutdown() {
+        this.oauthStorage.shutdown();
+    }
+}
+function createConsentPageCsp(client, requestedRedirectUri) {
+    const callbackOrigin = getValidatedLoopbackCallbackOrigin(client.redirect_uris, requestedRedirectUri);
+    const formAction = callbackOrigin ? `form-action 'self' ${callbackOrigin};` : "form-action 'self';";
+    return `default-src 'none'; ${formAction} ${OAUTH_CONSENT_PAGE_CSP_SUFFIX}`;
+}
+function getValidatedLoopbackCallbackOrigin(registeredRedirectUris, requestedRedirectUri) {
+    let requested;
+    try {
+        requested = new URL(requestedRedirectUri);
+    }
+    catch {
+        return null;
+    }
+    if (!LOOPBACK_HOSTS.has(requested.hostname)) {
+        return null;
+    }
+    const matchesRegistered = registeredRedirectUris.some((registeredRedirectUri) => {
+        try {
+            const registered = new URL(registeredRedirectUri);
+            return (LOOPBACK_HOSTS.has(registered.hostname) &&
+                requested.protocol === registered.protocol &&
+                requested.hostname === registered.hostname &&
+                requested.pathname === registered.pathname &&
+                requested.search === registered.search);
+        }
+        catch {
+            return false;
+        }
+    });
+    return matchesRegistered ? requested.origin : null;
+}
+//# sourceMappingURL=sdkOAuthServerProvider.js.map

package/build/sdk/legacy/auth/sdkOAuthServerProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthServerProvider.js","sourceRoot":"","sources":["../../../../src/sdk/legacy/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAE3C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,uCAAuC,CAAC;AAQ/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,kCAAkC,GACnC,MAAM,0CAA0C,CAAC;AAIlD,MAAM,6BAA6B,GACjC,2FAA2F,CAAC;AAC9F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;GAGG;AACH,SAAS,cAAc,CAAI,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,MAAM,CAAC,KAAK,CAAC,iDAAiD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,WAAW,CAAC,gEAAgE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAI,IAAsB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;YAClD,MAAM,CAAC,KAAK,CAAC,iDAAiD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,WAAW,CAAC,gEAAgE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,qBAAqB;IACjB,YAAY,CAAsB;IAE1C,YAAY,YAAiC;QAC3C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAE/F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,MAAkC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAE9C,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IACjC;;;OAGG;IACI,YAAY,CAAsB;IACjC,aAAa,CAAqB;IAClC,aAAa,CAA8B;IAEnD,YAAY,kBAA2B,EAAE,cAAuB;QAC9D,MAAM,OAAO,GACX,cAAc,IAAI,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACvG,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,yEAAyE;YACzE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YAEvD,wDAAwD;YACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAE/F,mDAAmD;YACnD,MAAM,UAAU,GAAG,kCAAkC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAElF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,mBAAmB,CAAC,yBAAyB,EAAE;oBAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,eAAe,EAAE,WAAW;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,SAAS,EAAE,EAAE;oBACpE,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,mBAAmB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE1E,IAAI,mBAAmB,EAAE,CAAC;gBACxB,oBAAoB;gBACpB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,MAAkC,EAAE,MAAgB;QAC9E,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,oDAAoD;QACpD,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAkC,EAClC,MAA2B,EAC3B,eAAyB,EACzB,aAAuB,EACvB,GAAa;QAEb,8EAA8E;QAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAChE,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAC3B,eAAe,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAEtG,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAC/B,MAAkC,EAClC,MAA2B,EAC3B,aAAuB,EACvB,GAAa;QAEb,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/F,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CACtD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EACjC,aAAa,EACb,KAAK,EACL,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YACpC,aAAa;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,EAAE;YACxE,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa;SACd,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAkC,EAClC,aAAqB,EACrB,aAAuB,EACvB,aAAuB;QAEvB,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,CAAC;YACzE,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;;;;uBAIY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0BX,UAAU;;;;;cAKlB,qBAAqB;;;;iEAI8B,oBAAoB;;;;;;kBAMnE,aAAa;aACZ,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAEnC,OAAO;;;2CAGgB,UAAU;;4CAET,UAAU;iCACrB,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;4CACjC,UAAU;sCAChB,UAAU;;;;sDAIM,UAAU;;iBAE/C,CAAC;QACA,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;KAWtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAkC,EAAE,iBAAyB;QAC/F,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAEjF,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB;IACzB,8DAA8D;IAC9D,oCAAoC;IACpC,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,qBAAqB;YACrB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,oCAAoC;YACpC,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBACxD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,CAAC;YAED,gCAAgC;YAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/E,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAED,+CAA+C;YAC/C,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAE/D,sBAAsB;YACtB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC;YAE7D,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,CAAC;gBACjE,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,MAAM,CACzD,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,QAAQ,IAAI,EAAE,EACvB,OAAO,EACP,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,gCAAgC,CAAC;oBACnE,OAAO;oBACP,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;oBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,KAAK;oBACL,QAAQ;iBACT,CAAC,CACL;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAC9C,OAAO,EACP,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,QAAQ,IAAI,EAAE,EACvB,QAAQ,CAAC,MAAM,EACf,KAAK,CACN,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;gBACpC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBACxC,SAAS,EAAE,MAAM,CAAC,UAAU;aAC7B,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;QACtD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,iBAAiB,CAAC,wDAAwD,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAAC,yDAAyD,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,CAC9C,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,gCAAgC,CAAC;YACnE,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,eAAe;YACvB,KAAK;YACL,QAAQ;SACT,CAAC,CACH,CACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO;YACL,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO;YAC1D,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACpC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,aAAa,EAAE,QAAQ,CAAC,YAAY;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,4EAA4E;YAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,mBAAmB;QACnB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAE7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,eAAe,CAAC;QACpD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC9G,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9G,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,eAAe,CACxF,aAAa,EACb,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEhH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,SAAS,EAAE,EAAE;gBACjE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,wBAAwB,CAAC,cAAwB;QACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC;YACnG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,2DAA2D,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,MAAkC,EAAE,oBAA4B;IAC5F,MAAM,cAAc,GAAG,kCAAkC,CAAC,MAAM,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IACtG,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,sBAAsB,cAAc,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpG,OAAO,uBAAuB,UAAU,IAAI,6BAA6B,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,kCAAkC,CACzC,sBAAgC,EAChC,oBAA4B;IAE5B,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAClD,OAAO,CACL,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACvC,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAC1C,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAC1C,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAC1C,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CACvC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}

package/build/sdk/legacy/client/auth.d.ts

@@ -0,0 +1,2 @@
+export * from '@modelcontextprotocol/sdk/client/auth.js';
+//# sourceMappingURL=auth.d.ts.map

package/build/sdk/legacy/client/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/sdk/legacy/client/auth.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC"}

package/build/sdk/legacy/client/auth.js

@@ -0,0 +1,2 @@
+export * from '@modelcontextprotocol/sdk/client/auth.js';
+//# sourceMappingURL=auth.js.map

package/build/sdk/legacy/client/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/sdk/legacy/client/auth.ts"],"names":[],"mappings":"AAAA,cAAc,0CAA0C,CAAC"}

package/build/sdk/legacy/client/index.d.ts

@@ -0,0 +1,2 @@
+export * from '@modelcontextprotocol/sdk/client/index.js';
+//# sourceMappingURL=index.d.ts.map

package/build/sdk/legacy/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/sdk/legacy/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,2CAA2C,CAAC"}

package/build/sdk/legacy/client/index.js

@@ -0,0 +1,2 @@
+export * from '@modelcontextprotocol/sdk/client/index.js';
+//# sourceMappingURL=index.js.map

package/build/sdk/legacy/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/sdk/legacy/client/index.ts"],"names":[],"mappings":"AAAA,cAAc,2CAA2C,CAAC"}

package/build/sdk/legacy/client/runtime/clientFactory.d.ts

@@ -0,0 +1,10 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import type { AuthProviderTransport } from './legacyTransport.js';
+import type { OutboundSdkClient } from './sdkClient.js';
+export declare class ClientFactory {
+    createClient(transport?: AuthProviderTransport): OutboundSdkClient;
+    private createModernClient;
+    createClientInstance(): Client;
+    createPooledClientInstance(): Client;
+}
+//# sourceMappingURL=clientFactory.d.ts.map

package/build/sdk/legacy/client/runtime/clientFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientFactory.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/legacy/client/runtime/clientFactory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,qBAAqB,EAA2B,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAQxD,qBAAa,aAAa;IACjB,YAAY,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,iBAAiB;IAqBzE,OAAO,CAAC,kBAAkB;IAuBnB,oBAAoB,IAAI,MAAM;IAU9B,0BAA0B,IAAI,MAAM;CAW5C"}

package/build/sdk/legacy/client/runtime/clientFactory.js

@@ -0,0 +1,56 @@
+import { Client as ModernClient } from '@modelcontextprotocol/client';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { MCP_CLIENT_CAPABILITIES, MCP_SERVER_NAME, MCP_SERVER_VERSION } from '../../../../constants.js';
+import { CustomJsonSchemaValidator } from '../../../../core/validation/CustomJsonSchemaValidator.js';
+const DEBOUNCED_NOTIFICATION_METHODS = [
+    'notifications/tools/list_changed',
+    'notifications/resources/list_changed',
+    'notifications/prompts/list_changed',
+];
+export class ClientFactory {
+    createClient(transport) {
+        const protocolVersion = transport?.outboundProtocolVersion;
+        if (protocolVersion && protocolVersion !== 'legacy') {
+            return this.createModernClient(protocolVersion, transport);
+        }
+        const customValidator = new CustomJsonSchemaValidator();
+        return new Client({
+            name: MCP_SERVER_NAME,
+            version: MCP_SERVER_VERSION,
+        }, {
+            capabilities: MCP_CLIENT_CAPABILITIES,
+            jsonSchemaValidator: customValidator,
+            debouncedNotificationMethods: [...DEBOUNCED_NOTIFICATION_METHODS],
+        });
+    }
+    createModernClient(protocolVersion, transport) {
+        const mode = protocolVersion === 'auto' ? 'auto' : { pin: protocolVersion };
+        const configuredTimeout = transport.connectionTimeout ?? transport.timeout;
+        const probeTimeout = configuredTimeout && configuredTimeout > 0 ? configuredTimeout : 5_000;
+        return new ModernClient({
+            name: MCP_SERVER_NAME,
+            version: MCP_SERVER_VERSION,
+        }, {
+            capabilities: MCP_CLIENT_CAPABILITIES,
+            versionNegotiation: {
+                mode,
+                probe: { timeoutMs: probeTimeout, maxRetries: 0 },
+            },
+        });
+    }
+    createClientInstance() {
+        return new Client({
+            name: MCP_SERVER_NAME,
+            version: MCP_SERVER_VERSION,
+        }, undefined);
+    }
+    createPooledClientInstance() {
+        return new Client({
+            name: '1mcp-client',
+            version: '1.0.0',
+        }, {
+            capabilities: {},
+        });
+    }
+}
+//# sourceMappingURL=clientFactory.js.map

package/build/sdk/legacy/client/runtime/clientFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientFactory.js","sourceRoot":"","sources":["../../../../../src/sdk/legacy/client/runtime/clientFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,YAAY,EAA+B,MAAM,8BAA8B,CAAC;AAEnG,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAK9F,MAAM,8BAA8B,GAAG;IACrC,kCAAkC;IAClC,sCAAsC;IACtC,oCAAoC;CAC5B,CAAC;AAEX,MAAM,OAAO,aAAa;IACjB,YAAY,CAAC,SAAiC;QACnD,MAAM,eAAe,GAAG,SAAS,EAAE,uBAAuB,CAAC;QAC3D,IAAI,eAAe,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAExD,OAAO,IAAI,MAAM,CACf;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,kBAAkB;SAC5B,EACD;YACE,YAAY,EAAE,uBAAuB;YACrC,mBAAmB,EAAE,eAAe;YACpC,4BAA4B,EAAE,CAAC,GAAG,8BAA8B,CAAC;SAClE,CACF,CAAC;IACJ,CAAC;IAEO,kBAAkB,CACxB,eAA2D,EAC3D,SAAgC;QAEhC,MAAM,IAAI,GAA2B,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACpG,MAAM,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,OAAO,CAAC;QAC3E,MAAM,YAAY,GAAG,iBAAiB,IAAI,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5F,OAAO,IAAI,YAAY,CACrB;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,kBAAkB;SAC5B,EACD;YACE,YAAY,EAAE,uBAAgC;YAC9C,kBAAkB,EAAE;gBAClB,IAAI;gBACJ,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE;aAClD;SACF,CACF,CAAC;IACJ,CAAC;IAEM,oBAAoB;QACzB,OAAO,IAAI,MAAM,CACf;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,kBAAkB;SAC5B,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAEM,0BAA0B;QAC/B,OAAO,IAAI,MAAM,CACf;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;SACjB,EACD;YACE,YAAY,EAAE,EAAE;SACjB,CACF,CAAC;IACJ,CAAC;CACF"}