@adcp/sdk 12.0.6 → 12.1.1

package/dist/lib/auth/oauth/authorization-required.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/authorization-required.ts"],"sourcesContent":["/**\n * Zero-config OAuth discovery + actionable authorization errors.\n *\n * When a library consumer calls an OAuth-gated MCP agent without saved\n * credentials, they get a `NeedsAuthorizationError` containing everything\n * needed to either run an interactive flow or present a clear prompt — no\n * re-probing required.\n *\n * Design note: this module only *discovers* — it never opens a browser or\n * writes state. Interactive flow handling stays in the caller (CLI or a\n * bespoke `OAuthFlowHandler`) so library behavior is predictable.\n */\nimport { ssrfSafeFetch, decodeBodyAsJsonOrText } from '../../net';\nimport { AuthenticationRequiredError, type OAuthMetadataInfo } from '../../errors';\nimport { parseWWWAuthenticate, type WWWAuthenticateChallenge } from './diagnostics';\n\n/**\n * Maximum length of an individual server-supplied string we copy into the\n * `AuthorizationRequirements` payload. Anything longer is truncated with a\n * `…` suffix so hostile agents can't smuggle megabyte error-descriptions\n * into operator-facing prompts and logs.\n */\nconst MAX_DISPLAY_STRING = 256;\n\n/**\n * Maximum number of scope strings we copy into `scopesSupported`. RFC 8414\n * allows an unbounded array; hostile servers have sent thousands.\n */\nconst MAX_SCOPES = 64;\n\n/**\n * Maximum number of auth-params we preserve under `challenge.params`. Bounds\n * memory pressure from hostile servers that pack the `WWW-Authenticate`\n * header with unknown auth-params.\n */\nconst MAX_CHALLENGE_PARAMS = 32;\n\n/**\n * Strip ASCII control characters (excluding TAB) from a server-supplied\n * string that may be shown to a human. Defeats terminal-hijack tricks like\n * `\\x1b]0;pwned\\x07` (rewrites terminal title), `\\r` (overwrites prompt),\n * and `\\x1b[2J` (clears screen). Also truncates over-long values.\n */\nfunction sanitizeDisplay(value: string): string {\n  const stripped = value.replace(/[\\x00-\\x08\\x0b-\\x1f\\x7f]/g, '');\n  if (stripped.length <= MAX_DISPLAY_STRING) return stripped;\n  return `${stripped.slice(0, MAX_DISPLAY_STRING - 1)}…`;\n}\n\n/**\n * Sanitize the parsed `WWW-Authenticate` challenge before embedding it in a\n * `NeedsAuthorizationError`. Consumers that render `requirements.challenge`\n * to a terminal should never see control characters. Caps `params` count to\n * bound hostile servers.\n *\n * The `scheme` is already lowercased + token-constrained by the parser.\n * Param keys are also token-constrained so they're safe; only values need\n * sanitizing.\n */\nfunction sanitizeChallenge(c: WWWAuthenticateChallenge): WWWAuthenticateChallenge {\n  const params: Record<string, string> = {};\n  for (const [k, v] of Object.entries(c.params)) {\n    if (Object.keys(params).length >= MAX_CHALLENGE_PARAMS) break;\n    params[k] = sanitizeDisplay(v);\n  }\n  return {\n    scheme: c.scheme,\n    ...(c.realm !== undefined ? { realm: sanitizeDisplay(c.realm) } : {}),\n    ...(c.error !== undefined ? { error: sanitizeDisplay(c.error) } : {}),\n    ...(c.error_description !== undefined ? { error_description: sanitizeDisplay(c.error_description) } : {}),\n    ...(c.scope !== undefined ? { scope: sanitizeDisplay(c.scope) } : {}),\n    ...(c.resource_metadata !== undefined ? { resource_metadata: sanitizeDisplay(c.resource_metadata) } : {}),\n    params,\n  };\n}\n\n/**\n * Structured description of what an agent's authorization server requires\n * before it will accept a `tools/call`. Produced by\n * {@link discoverAuthorizationRequirements}.\n */\nexport interface AuthorizationRequirements {\n  /** The agent URL we probed. */\n  agentUrl: string;\n  /** Resource URL the agent advertises in its `WWW-Authenticate` / PRM (RFC 9728). */\n  resource?: string;\n  /** URL of the protected-resource-metadata document (from `WWW-Authenticate: resource_metadata=…`). */\n  resourceMetadataUrl?: string;\n  /** First `authorization_servers[0]` from the protected-resource metadata. */\n  authorizationServer?: string;\n  /**\n   * All `authorization_servers` advertised by the PRM, in declaration order.\n   * The walker only probes `[0]` (PRM preference order — see RFC 9728 §3.3);\n   * the full list is exposed so callers can surface multi-issuer deployments\n   * in diagnostics. A length > 1 is uncommon and worth flagging to the\n   * operator — typically a federation partner or a staged migration.\n   */\n  authorizationServers?: string[];\n  /** `authorization_endpoint` from the authorization-server metadata (RFC 8414). */\n  authorizationEndpoint?: string;\n  /** `token_endpoint` from the authorization-server metadata. */\n  tokenEndpoint?: string;\n  /** `registration_endpoint` if the AS supports RFC 7591 dynamic client registration. */\n  registrationEndpoint?: string;\n  /** Scopes advertised by the AS (RFC 8414 `scopes_supported`). */\n  scopesSupported?: string[];\n  /**\n   * `grant_types_supported` advertised by the AS (RFC 8414). `undefined` when\n   * the AS didn't publish the field — per RFC 8414 that defaults to\n   * `[\"authorization_code\", \"implicit\"]`. Clients should treat absence as\n   * \"unknown, try your grant and see,\" not as proof the grant is unsupported.\n   */\n  grantTypesSupported?: string[];\n  /** True when the AS metadata came from the OIDC fallback URL rather than RFC 8414. */\n  metadataSource?: 'rfc-8414' | 'openid-configuration';\n  /** Scope hinted in the `WWW-Authenticate` challenge's `scope` auth-param. */\n  challengeScope?: string;\n  /** Raw parsed challenge the agent returned on the 401. */\n  challenge: WWWAuthenticateChallenge;\n}\n\n/**\n * Error raised when an agent returns a 401 and we do not have credentials\n * to satisfy it. Carries everything needed to run an interactive OAuth flow\n * or show the operator an actionable prompt.\n *\n * Extends {@link AuthenticationRequiredError} so existing callers that catch\n * `AuthenticationRequiredError` automatically receive the richer variant —\n * they can downcast with `instanceof NeedsAuthorizationError` when they\n * want walked discovery metadata.\n *\n * Note on `code` vs `subCode`:\n *   The parent class declares `readonly code = 'AUTHENTICATION_REQUIRED'` as\n *   a class field that re-initializes on every construction, so a child-side\n *   override attempt is silently overwritten under `useDefineForClassFields`.\n *   The narrow discriminator is exposed as `subCode` — prefer\n *   `instanceof NeedsAuthorizationError` for type-narrowing and use `subCode`\n *   only for structured-log keying.\n *\n * Note on `hasOAuth`:\n *   The inherited getter returns `true` only when both `authorization_endpoint`\n *   and `token_endpoint` were walked successfully. A partially-walked\n *   requirements record (PRM reachable but AS metadata missing) still yields\n *   `hasOAuth === false` even though `requirements.authorizationServer` is set.\n *   Treat it as \"we have enough to start a flow,\" not \"server wants OAuth.\"\n */\nexport class NeedsAuthorizationError extends AuthenticationRequiredError {\n  /** Narrow discriminator for consumers that already know about this class. */\n  readonly subCode = 'needs_authorization' as const;\n  readonly requirements: AuthorizationRequirements;\n\n  constructor(requirements: AuthorizationRequirements, message?: string) {\n    super(requirements.agentUrl, synthesizeOAuthMetadata(requirements), message ?? defaultMessage(requirements));\n    this.name = 'NeedsAuthorizationError';\n    this.requirements = requirements;\n    // Extend the parent's `details` payload so structured-logging consumers\n    // that read `err.details` (via `extractErrorInfo` or equivalent) see the\n    // full walked chain, not just the synthesized one-hop oauthMetadata.\n    this.details = { ...(this.details as object | undefined), requirements };\n  }\n}\n\n/**\n * Build an {@link OAuthMetadataInfo} for the base-class constructor so that\n * legacy callers still see a non-empty `oauthMetadata` + working\n * `hasOAuth`/`authorizationUrl` getters on the error. When discovery didn't\n * yield enough info, return undefined and let the base class degrade\n * gracefully.\n */\nfunction synthesizeOAuthMetadata(req: AuthorizationRequirements): OAuthMetadataInfo | undefined {\n  if (!req.authorizationEndpoint || !req.tokenEndpoint) return undefined;\n  return {\n    authorization_endpoint: req.authorizationEndpoint,\n    token_endpoint: req.tokenEndpoint,\n    ...(req.registrationEndpoint ? { registration_endpoint: req.registrationEndpoint } : {}),\n    ...(req.authorizationServer ? { issuer: req.authorizationServer } : {}),\n  };\n}\n\nfunction defaultMessage(req: AuthorizationRequirements): string {\n  const parts = [`Agent ${sanitizeDisplay(req.agentUrl)} requires OAuth authorization.`];\n  if (req.authorizationServer) {\n    parts.push(`Authorization server: ${req.authorizationServer}.`);\n  }\n  if (req.challenge.error_description) {\n    parts.push(`Server said: ${sanitizeDisplay(req.challenge.error_description)}.`);\n  }\n  parts.push('Provide an OAuthFlowHandler or run an interactive flow to complete authorization.');\n  return parts.join(' ');\n}\n\n/**\n * Options for {@link discoverAuthorizationRequirements}.\n */\nexport interface DiscoverAuthorizationOptions {\n  /** Allow http:// and private-IP probe targets. Default false. */\n  allowPrivateIp?: boolean;\n  /** Override per-probe HTTP timeout (ms). Default inherits from ssrfSafeFetch (10s). */\n  timeoutMs?: number;\n  /**\n   * If provided, use this `WWW-Authenticate` header verbatim instead of\n   * re-probing the agent. Use this when you already have a 401 response in\n   * hand and want to avoid a second round-trip.\n   */\n  wwwAuthenticate?: string;\n}\n\n/**\n * Walk the OAuth discovery chain starting from an agent URL. Returns\n * `AuthorizationRequirements` when the agent demands OAuth, or `null` when a\n * `tools/list` call succeeds without credentials.\n *\n * Strategy:\n *   1. POST `tools/list` to the agent with no `Authorization` header.\n *   2. If 401 + `WWW-Authenticate: Bearer`: parse the challenge.\n *   3. If the challenge carries `resource_metadata=…`: GET it and read\n *      `resource` + `authorization_servers`.\n *   4. For the first `authorization_servers[0]`: GET `/.well-known/oauth-authorization-server`\n *      and read `authorization_endpoint`, `token_endpoint`, `registration_endpoint`,\n *      `scopes_supported`.\n *   5. Return a structured record.\n *\n * Anything missing from the chain surfaces as `undefined` on the result —\n * callers can still present a partial picture without re-probing.\n */\nexport async function discoverAuthorizationRequirements(\n  agentUrl: string,\n  options: DiscoverAuthorizationOptions = {}\n): Promise<AuthorizationRequirements | null> {\n  // `allowPrivateIp` authorizes the agent probe. Chain hops (PRM, AS\n  // metadata) inherit that trust ONLY when they share the agent's origin —\n  // a compromised agent that advertises a private-IP authorization server\n  // on a different origin would otherwise pivot a discovery walk into the\n  // host's internal network.\n  const allowPrivateIpOnAgent = options.allowPrivateIp ?? false;\n  const agentOrigin = originOf(agentUrl);\n  const allowPrivateIpForHop = (url: string): boolean =>\n    allowPrivateIpOnAgent && agentOrigin !== undefined && originOf(url) === agentOrigin;\n\n  let challengeHeader = options.wwwAuthenticate;\n  if (!challengeHeader) {\n    const probe = await probeAgent401(agentUrl, allowPrivateIpOnAgent, options.timeoutMs);\n    if (probe.status !== 401) {\n      // 200, 403, 5xx, or network error — not an OAuth 401 we can act on.\n      return null;\n    }\n    challengeHeader = probe.wwwAuthenticate;\n  }\n\n  const challenge = parseWWWAuthenticate(challengeHeader ?? null);\n  if (!challenge || challenge.scheme !== 'bearer') {\n    // A 401 without a Bearer challenge isn't our kind of problem — let it propagate.\n    return null;\n  }\n\n  const requirements: AuthorizationRequirements = {\n    agentUrl,\n    resourceMetadataUrl: challenge.resource_metadata ? sanitizeDisplay(challenge.resource_metadata) : undefined,\n    challengeScope: challenge.scope ? sanitizeDisplay(challenge.scope) : undefined,\n    challenge: sanitizeChallenge(challenge),\n  };\n\n  // Walk protected-resource metadata (RFC 9728 §3). Private-IP targets are\n  // only allowed when the hop's origin matches the agent's.\n  if (challenge.resource_metadata && isSafeHttpUrl(challenge.resource_metadata)) {\n    const prm = await fetchJson(\n      challenge.resource_metadata,\n      allowPrivateIpForHop(challenge.resource_metadata),\n      options.timeoutMs\n    );\n    if (prm && typeof prm === 'object') {\n      const resource = (prm as { resource?: unknown }).resource;\n      const servers = (prm as { authorization_servers?: unknown }).authorization_servers;\n      if (typeof resource === 'string') requirements.resource = sanitizeDisplay(resource);\n      if (Array.isArray(servers)) {\n        const validServers = servers\n          .filter((s: unknown): s is string => typeof s === 'string' && isSafeHttpUrl(s))\n          .map(sanitizeDisplay);\n        if (validServers.length > 0) {\n          requirements.authorizationServers = validServers;\n          requirements.authorizationServer = validServers[0];\n        }\n      }\n    }\n  }\n\n  // Walk authorization-server metadata using the first issuer. RFC 8414 §3\n  // first, then OIDC Discovery 1.0 fallback for AS deployments (Keycloak in\n  // OIDC mode, Ping, ADFS) that only publish at\n  // `{issuer}/.well-known/openid-configuration`.\n  if (requirements.authorizationServer) {\n    const asUrl = buildAuthorizationServerMetadataUrl(requirements.authorizationServer);\n    let md: Record<string, unknown> | undefined;\n    let source: 'rfc-8414' | 'openid-configuration' | undefined;\n    if (asUrl) {\n      const res = await fetchJson(asUrl, allowPrivateIpForHop(asUrl), options.timeoutMs);\n      if (res && typeof res === 'object') {\n        md = res as Record<string, unknown>;\n        source = 'rfc-8414';\n      }\n    }\n    if (!md) {\n      const oidcUrl = buildOidcDiscoveryUrl(requirements.authorizationServer);\n      if (oidcUrl) {\n        const res = await fetchJson(oidcUrl, allowPrivateIpForHop(oidcUrl), options.timeoutMs);\n        if (res && typeof res === 'object') {\n          md = res as Record<string, unknown>;\n          source = 'openid-configuration';\n        }\n      }\n    }\n    if (md) {\n      requirements.metadataSource = source;\n      if (typeof md.authorization_endpoint === 'string') {\n        requirements.authorizationEndpoint = sanitizeDisplay(md.authorization_endpoint);\n      }\n      if (typeof md.token_endpoint === 'string') {\n        requirements.tokenEndpoint = sanitizeDisplay(md.token_endpoint);\n      }\n      if (typeof md.registration_endpoint === 'string') {\n        requirements.registrationEndpoint = sanitizeDisplay(md.registration_endpoint);\n      }\n      if (Array.isArray(md.scopes_supported)) {\n        const scopes = md.scopes_supported\n          .filter((s: unknown): s is string => typeof s === 'string')\n          .slice(0, MAX_SCOPES)\n          .map(sanitizeDisplay);\n        if (scopes.length > 0) requirements.scopesSupported = scopes;\n      }\n      if (Array.isArray(md.grant_types_supported)) {\n        const grants = md.grant_types_supported\n          .filter((g: unknown): g is string => typeof g === 'string')\n          .slice(0, 32)\n          .map(sanitizeDisplay);\n        if (grants.length > 0) requirements.grantTypesSupported = grants;\n      }\n    }\n  }\n\n  return requirements;\n}\n\n/**\n * Probe the agent for the parsed `WWW-Authenticate` challenge on a 401.\n *\n * Where `discoverAuthorizationRequirements` walks the full RFC 9728 → 8414\n * chain for Bearer/OAuth challenges, this helper is the catch-all: it works\n * for ANY scheme (Basic, Digest, Bearer-without-PRM, …) and returns the\n * structured challenge so callers can surface scheme-specific remediation\n * (e.g. \"use `--auth-scheme basic`\" when the gateway speaks RFC 7617).\n *\n * Returns `null` when the agent isn't responding with a 401, or when the\n * response carries no parseable `WWW-Authenticate`. Reuses `probeAgent401`\n * so the SSRF gate and timeout policy stay consistent with the OAuth path.\n */\nexport async function probeAuthChallenge(\n  agentUrl: string,\n  options: { allowPrivateIp?: boolean; timeoutMs?: number } = {}\n): Promise<WWWAuthenticateChallenge | null> {\n  const probe = await probeAgent401(agentUrl, options.allowPrivateIp ?? false, options.timeoutMs);\n  if (probe.status !== 401) return null;\n  return parseWWWAuthenticate(probe.wwwAuthenticate ?? null);\n}\n\n/**\n * Fire a single unauthenticated `tools/list` at the agent and return the\n * status + `WWW-Authenticate` header. Used when the caller hasn't provided\n * a cached 401 response.\n */\nasync function probeAgent401(\n  agentUrl: string,\n  allowPrivateIp: boolean,\n  timeoutMs?: number\n): Promise<{ status: number; wwwAuthenticate?: string }> {\n  const body = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' });\n  try {\n    const res = await ssrfSafeFetch(agentUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json',\n      },\n      body,\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n    });\n    return { status: res.status, wwwAuthenticate: res.headers['www-authenticate'] };\n  } catch {\n    return { status: 0 };\n  }\n}\n\n/**\n * Check a URL is an absolute `http:`/`https:` URL before we hand it to\n * `ssrfSafeFetch`. Defeats `javascript:`, `file:`, `data:`, etc. the agent\n * might echo back in PRM or AS metadata. `ssrfSafeFetch` refuses non-HTTP\n * schemes too, but failing fast here gives a cleaner discovery flow and\n * avoids surfacing scheme errors as mysterious discovery misses.\n */\nfunction originOf(value: string): string | undefined {\n  try {\n    return new URL(value).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isSafeHttpUrl(value: string): boolean {\n  try {\n    const u = new URL(value);\n    return u.protocol === 'https:' || u.protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Build the authorization-server metadata URL for an issuer per RFC 8414 §3.\n *\n * For issuer `https://as.example.com/tenant1`, metadata lives at\n * `https://as.example.com/.well-known/oauth-authorization-server/tenant1`\n * (well-known prefix inserted BEFORE the issuer path, not after). This\n * matches how the MCP SDK and most authorization servers advertise metadata.\n */\nfunction buildAuthorizationServerMetadataUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const pathname = u.pathname.endsWith('/') ? u.pathname.slice(0, -1) : u.pathname;\n  return `${u.origin}/.well-known/oauth-authorization-server${pathname}`;\n}\n\n/**\n * OpenID Connect Discovery 1.0 fallback URL. Some authorization servers\n * (Keycloak in OIDC mode, Ping, ADFS) only publish metadata at\n * `{issuer}/.well-known/openid-configuration` — path *suffixed*, not\n * prefixed. The OIDC discovery doc carries `token_endpoint`,\n * `authorization_endpoint`, and `grant_types_supported` with the same\n * semantics as RFC 8414, so it's a safe read-through when the RFC 8414\n * probe misses.\n */\nfunction buildOidcDiscoveryUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const base = u.pathname.endsWith('/') ? `${u.origin}${u.pathname.slice(0, -1)}` : `${u.origin}${u.pathname}`;\n  return `${base}/.well-known/openid-configuration`;\n}\n\nasync function fetchJson(url: string, allowPrivateIp: boolean, timeoutMs?: number): Promise<unknown> {\n  try {\n    const res = await ssrfSafeFetch(url, {\n      method: 'GET',\n      headers: { accept: 'application/json' },\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n    });\n    if (res.status !== 200) return undefined;\n    return decodeBodyAsJsonOrText(res.body, res.headers['content-type']);\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,iBAAsD;AACtD,oBAAoE;AACpE,yBAAoE;AAQpE,MAAM,qBAAqB;AAM3B,MAAM,aAAa;AAOnB,MAAM,uBAAuB;AAQ7B,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,WAAW,MAAM,QAAQ,6BAA6B,EAAE;AAC9D,MAAI,SAAS,UAAU,mBAAoB,QAAO;AAClD,SAAO,GAAG,SAAS,MAAM,GAAG,qBAAqB,CAAC,CAAC;AACrD;AAYA,SAAS,kBAAkB,GAAuD;AAChF,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,MAAM,GAAG;AAC7C,QAAI,OAAO,KAAK,MAAM,EAAE,UAAU,qBAAsB;AACxD,WAAO,CAAC,IAAI,gBAAgB,CAAC;AAAA,EAC/B;AACA,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG;AAAA,EACF;AACF;AAwEO,MAAM,gCAAgC,0CAA4B;AAAA;AAAA,EAE9D,UAAU;AAAA,EACV;AAAA,EAET,YAAY,cAAyC,SAAkB;AACrE,UAAM,aAAa,UAAU,wBAAwB,YAAY,GAAG,WAAW,eAAe,YAAY,CAAC;AAC3G,SAAK,OAAO;AACZ,SAAK,eAAe;AAIpB,SAAK,UAAU,EAAE,GAAI,KAAK,SAAgC,aAAa;AAAA,EACzE;AACF;AASA,SAAS,wBAAwB,KAA+D;AAC9F,MAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,cAAe,QAAO;AAC7D,SAAO;AAAA,IACL,wBAAwB,IAAI;AAAA,IAC5B,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,uBAAuB,EAAE,uBAAuB,IAAI,qBAAqB,IAAI,CAAC;AAAA,IACtF,GAAI,IAAI,sBAAsB,EAAE,QAAQ,IAAI,oBAAoB,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,SAAS,eAAe,KAAwC;AAC9D,QAAM,QAAQ,CAAC,SAAS,gBAAgB,IAAI,QAAQ,CAAC,gCAAgC;AACrF,MAAI,IAAI,qBAAqB;AAC3B,UAAM,KAAK,yBAAyB,IAAI,mBAAmB,GAAG;AAAA,EAChE;AACA,MAAI,IAAI,UAAU,mBAAmB;AACnC,UAAM,KAAK,gBAAgB,gBAAgB,IAAI,UAAU,iBAAiB,CAAC,GAAG;AAAA,EAChF;AACA,QAAM,KAAK,mFAAmF;AAC9F,SAAO,MAAM,KAAK,GAAG;AACvB;AAoCA,eAAsB,kCACpB,UACA,UAAwC,CAAC,GACE;AAM3C,QAAM,wBAAwB,QAAQ,kBAAkB;AACxD,QAAM,cAAc,SAAS,QAAQ;AACrC,QAAM,uBAAuB,CAAC,QAC5B,yBAAyB,gBAAgB,UAAa,SAAS,GAAG,MAAM;AAE1E,MAAI,kBAAkB,QAAQ;AAC9B,MAAI,CAAC,iBAAiB;AACpB,UAAM,QAAQ,MAAM,cAAc,UAAU,uBAAuB,QAAQ,SAAS;AACpF,QAAI,MAAM,WAAW,KAAK;AAExB,aAAO;AAAA,IACT;AACA,sBAAkB,MAAM;AAAA,EAC1B;AAEA,QAAM,gBAAY,yCAAqB,mBAAmB,IAAI;AAC9D,MAAI,CAAC,aAAa,UAAU,WAAW,UAAU;AAE/C,WAAO;AAAA,EACT;AAEA,QAAM,eAA0C;AAAA,IAC9C;AAAA,IACA,qBAAqB,UAAU,oBAAoB,gBAAgB,UAAU,iBAAiB,IAAI;AAAA,IAClG,gBAAgB,UAAU,QAAQ,gBAAgB,UAAU,KAAK,IAAI;AAAA,IACrE,WAAW,kBAAkB,SAAS;AAAA,EACxC;AAIA,MAAI,UAAU,qBAAqB,cAAc,UAAU,iBAAiB,GAAG;AAC7E,UAAM,MAAM,MAAM;AAAA,MAChB,UAAU;AAAA,MACV,qBAAqB,UAAU,iBAAiB;AAAA,MAChD,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,YAAM,WAAY,IAA+B;AACjD,YAAM,UAAW,IAA4C;AAC7D,UAAI,OAAO,aAAa,SAAU,cAAa,WAAW,gBAAgB,QAAQ;AAClF,UAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,cAAM,eAAe,QAClB,OAAO,CAAC,MAA4B,OAAO,MAAM,YAAY,cAAc,CAAC,CAAC,EAC7E,IAAI,eAAe;AACtB,YAAI,aAAa,SAAS,GAAG;AAC3B,uBAAa,uBAAuB;AACpC,uBAAa,sBAAsB,aAAa,CAAC;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,MAAI,aAAa,qBAAqB;AACpC,UAAM,QAAQ,oCAAoC,aAAa,mBAAmB;AAClF,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,UAAU,OAAO,qBAAqB,KAAK,GAAG,QAAQ,SAAS;AACjF,UAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,aAAK;AACL,iBAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,UAAU,sBAAsB,aAAa,mBAAmB;AACtE,UAAI,SAAS;AACX,cAAM,MAAM,MAAM,UAAU,SAAS,qBAAqB,OAAO,GAAG,QAAQ,SAAS;AACrF,YAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,eAAK;AACL,mBAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI;AACN,mBAAa,iBAAiB;AAC9B,UAAI,OAAO,GAAG,2BAA2B,UAAU;AACjD,qBAAa,wBAAwB,gBAAgB,GAAG,sBAAsB;AAAA,MAChF;AACA,UAAI,OAAO,GAAG,mBAAmB,UAAU;AACzC,qBAAa,gBAAgB,gBAAgB,GAAG,cAAc;AAAA,MAChE;AACA,UAAI,OAAO,GAAG,0BAA0B,UAAU;AAChD,qBAAa,uBAAuB,gBAAgB,GAAG,qBAAqB;AAAA,MAC9E;AACA,UAAI,MAAM,QAAQ,GAAG,gBAAgB,GAAG;AACtC,cAAM,SAAS,GAAG,iBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,UAAU,EACnB,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,kBAAkB;AAAA,MACxD;AACA,UAAI,MAAM,QAAQ,GAAG,qBAAqB,GAAG;AAC3C,cAAM,SAAS,GAAG,sBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,EAAE,EACX,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,sBAAsB;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAeA,eAAsB,mBACpB,UACA,UAA4D,CAAC,GACnB;AAC1C,QAAM,QAAQ,MAAM,cAAc,UAAU,QAAQ,kBAAkB,OAAO,QAAQ,SAAS;AAC9F,MAAI,MAAM,WAAW,IAAK,QAAO;AACjC,aAAO,yCAAqB,MAAM,mBAAmB,IAAI;AAC3D;AAOA,eAAe,cACb,UACA,gBACA,WACuD;AACvD,QAAM,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,aAAa,CAAC;AAC3E,MAAI;AACF,UAAM,MAAM,UAAM,0BAAc,UAAU;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,WAAO,EAAE,QAAQ,IAAI,QAAQ,iBAAiB,IAAI,QAAQ,kBAAkB,EAAE;AAAA,EAChF,QAAQ;AACN,WAAO,EAAE,QAAQ,EAAE;AAAA,EACrB;AACF;AASA,SAAS,SAAS,OAAmC;AACnD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,KAAK;AACvB,WAAO,EAAE,aAAa,YAAY,EAAE,aAAa;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,SAAS,oCAAoC,QAAoC;AAC/E,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,WAAW,EAAE,SAAS,SAAS,GAAG,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE,IAAI,EAAE;AACxE,SAAO,GAAG,EAAE,MAAM,0CAA0C,QAAQ;AACtE;AAWA,SAAS,sBAAsB,QAAoC;AACjE,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,OAAO,EAAE,SAAS,SAAS,GAAG,IAAI,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC1G,SAAO,GAAG,IAAI;AAChB;AAEA,eAAe,UAAU,KAAa,gBAAyB,WAAsC;AACnG,MAAI;AACF,UAAM,MAAM,UAAM,0BAAc,KAAK;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACtC;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,QAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,eAAO,mCAAuB,IAAI,MAAM,IAAI,QAAQ,cAAc,CAAC;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/authorization-required.ts"],"sourcesContent":["/**\n * Zero-config OAuth discovery + actionable authorization errors.\n *\n * When a library consumer calls an OAuth-gated MCP agent without saved\n * credentials, they get a `NeedsAuthorizationError` containing everything\n * needed to either run an interactive flow or present a clear prompt — no\n * re-probing required.\n *\n * Design note: this module only *discovers* — it never opens a browser or\n * writes state. Interactive flow handling stays in the caller (CLI or a\n * bespoke `OAuthFlowHandler`) so library behavior is predictable.\n */\nimport { ssrfSafeFetch, decodeBodyAsJsonOrText } from '../../net';\nimport { AuthenticationRequiredError, type OAuthMetadataInfo } from '../../errors';\nimport { parseWWWAuthenticate, type WWWAuthenticateChallenge } from './diagnostics';\n\n/**\n * Maximum length of an individual server-supplied string we copy into the\n * `AuthorizationRequirements` payload. Anything longer is truncated with a\n * `…` suffix so hostile agents can't smuggle megabyte error-descriptions\n * into operator-facing prompts and logs.\n */\nconst MAX_DISPLAY_STRING = 256;\n\n/**\n * Maximum number of scope strings we copy into `scopesSupported`. RFC 8414\n * allows an unbounded array; hostile servers have sent thousands.\n */\nconst MAX_SCOPES = 64;\n\n/**\n * Maximum number of auth-params we preserve under `challenge.params`. Bounds\n * memory pressure from hostile servers that pack the `WWW-Authenticate`\n * header with unknown auth-params.\n */\nconst MAX_CHALLENGE_PARAMS = 32;\n\n/**\n * Strip ASCII control characters (excluding TAB) from a server-supplied\n * string that may be shown to a human. Defeats terminal-hijack tricks like\n * `\\x1b]0;pwned\\x07` (rewrites terminal title), `\\r` (overwrites prompt),\n * and `\\x1b[2J` (clears screen). Also truncates over-long values.\n */\nfunction sanitizeDisplay(value: string): string {\n  const stripped = value.replace(/[\\x00-\\x08\\x0b-\\x1f\\x7f]/g, '');\n  if (stripped.length <= MAX_DISPLAY_STRING) return stripped;\n  return `${stripped.slice(0, MAX_DISPLAY_STRING - 1)}…`;\n}\n\n/**\n * Sanitize the parsed `WWW-Authenticate` challenge before embedding it in a\n * `NeedsAuthorizationError`. Consumers that render `requirements.challenge`\n * to a terminal should never see control characters. Caps `params` count to\n * bound hostile servers.\n *\n * The `scheme` is already lowercased + token-constrained by the parser.\n * Param keys are also token-constrained so they're safe; only values need\n * sanitizing.\n */\nfunction sanitizeChallenge(c: WWWAuthenticateChallenge): WWWAuthenticateChallenge {\n  const params: Record<string, string> = {};\n  for (const [k, v] of Object.entries(c.params)) {\n    if (Object.keys(params).length >= MAX_CHALLENGE_PARAMS) break;\n    params[k] = sanitizeDisplay(v);\n  }\n  return {\n    scheme: c.scheme,\n    ...(c.realm !== undefined ? { realm: sanitizeDisplay(c.realm) } : {}),\n    ...(c.error !== undefined ? { error: sanitizeDisplay(c.error) } : {}),\n    ...(c.error_description !== undefined ? { error_description: sanitizeDisplay(c.error_description) } : {}),\n    ...(c.scope !== undefined ? { scope: sanitizeDisplay(c.scope) } : {}),\n    ...(c.resource_metadata !== undefined ? { resource_metadata: sanitizeDisplay(c.resource_metadata) } : {}),\n    params,\n  };\n}\n\n/**\n * Structured description of what an agent's authorization server requires\n * before it will accept a `tools/call`. Produced by\n * {@link discoverAuthorizationRequirements}.\n */\nexport interface AuthorizationRequirements {\n  /** The agent URL we probed. */\n  agentUrl: string;\n  /** Resource URL the agent advertises in its `WWW-Authenticate` / PRM (RFC 9728). */\n  resource?: string;\n  /** URL of the protected-resource-metadata document (from `WWW-Authenticate: resource_metadata=…`). */\n  resourceMetadataUrl?: string;\n  /** First `authorization_servers[0]` from the protected-resource metadata. */\n  authorizationServer?: string;\n  /**\n   * All `authorization_servers` advertised by the PRM, in declaration order.\n   * The walker only probes `[0]` (PRM preference order — see RFC 9728 §3.3);\n   * the full list is exposed so callers can surface multi-issuer deployments\n   * in diagnostics. A length > 1 is uncommon and worth flagging to the\n   * operator — typically a federation partner or a staged migration.\n   */\n  authorizationServers?: string[];\n  /** `authorization_endpoint` from the authorization-server metadata (RFC 8414). */\n  authorizationEndpoint?: string;\n  /** `token_endpoint` from the authorization-server metadata. */\n  tokenEndpoint?: string;\n  /** `registration_endpoint` if the AS supports RFC 7591 dynamic client registration. */\n  registrationEndpoint?: string;\n  /** Scopes advertised by the AS (RFC 8414 `scopes_supported`). */\n  scopesSupported?: string[];\n  /**\n   * `grant_types_supported` advertised by the AS (RFC 8414). `undefined` when\n   * the AS didn't publish the field — per RFC 8414 that defaults to\n   * `[\"authorization_code\", \"implicit\"]`. Clients should treat absence as\n   * \"unknown, try your grant and see,\" not as proof the grant is unsupported.\n   */\n  grantTypesSupported?: string[];\n  /** True when the AS metadata came from the OIDC fallback URL rather than RFC 8414. */\n  metadataSource?: 'rfc-8414' | 'openid-configuration';\n  /** Scope hinted in the `WWW-Authenticate` challenge's `scope` auth-param. */\n  challengeScope?: string;\n  /** Raw parsed challenge the agent returned on the 401. */\n  challenge: WWWAuthenticateChallenge;\n}\n\n/**\n * Error raised when an agent returns a 401 and we do not have credentials\n * to satisfy it. Carries everything needed to run an interactive OAuth flow\n * or show the operator an actionable prompt.\n *\n * Extends {@link AuthenticationRequiredError} so existing callers that catch\n * `AuthenticationRequiredError` automatically receive the richer variant —\n * they can downcast with `instanceof NeedsAuthorizationError` when they\n * want walked discovery metadata.\n *\n * Note on `code` vs `subCode`:\n *   The parent class declares `readonly code = 'AUTHENTICATION_REQUIRED'` as\n *   a class field that re-initializes on every construction, so a child-side\n *   override attempt is silently overwritten under `useDefineForClassFields`.\n *   The narrow discriminator is exposed as `subCode` — prefer\n *   `instanceof NeedsAuthorizationError` for type-narrowing and use `subCode`\n *   only for structured-log keying.\n *\n * Note on `hasOAuth`:\n *   The inherited getter returns `true` only when both `authorization_endpoint`\n *   and `token_endpoint` were walked successfully. A partially-walked\n *   requirements record (PRM reachable but AS metadata missing) still yields\n *   `hasOAuth === false` even though `requirements.authorizationServer` is set.\n *   Treat it as \"we have enough to start a flow,\" not \"server wants OAuth.\"\n */\nexport class NeedsAuthorizationError extends AuthenticationRequiredError {\n  /** Narrow discriminator for consumers that already know about this class. */\n  readonly subCode = 'needs_authorization' as const;\n  readonly requirements: AuthorizationRequirements;\n\n  constructor(requirements: AuthorizationRequirements, message?: string) {\n    super(requirements.agentUrl, synthesizeOAuthMetadata(requirements), message ?? defaultMessage(requirements));\n    this.name = 'NeedsAuthorizationError';\n    this.requirements = requirements;\n    // Extend the parent's `details` payload so structured-logging consumers\n    // that read `err.details` (via `extractErrorInfo` or equivalent) see the\n    // full walked chain, not just the synthesized one-hop oauthMetadata.\n    this.details = { ...(this.details as object | undefined), requirements };\n  }\n}\n\n/**\n * Build an {@link OAuthMetadataInfo} for the base-class constructor so that\n * legacy callers still see a non-empty `oauthMetadata` + working\n * `hasOAuth`/`authorizationUrl` getters on the error. When discovery didn't\n * yield enough info, return undefined and let the base class degrade\n * gracefully.\n */\nfunction synthesizeOAuthMetadata(req: AuthorizationRequirements): OAuthMetadataInfo | undefined {\n  if (!req.authorizationEndpoint || !req.tokenEndpoint) return undefined;\n  return {\n    authorization_endpoint: req.authorizationEndpoint,\n    token_endpoint: req.tokenEndpoint,\n    ...(req.registrationEndpoint ? { registration_endpoint: req.registrationEndpoint } : {}),\n    ...(req.authorizationServer ? { issuer: req.authorizationServer } : {}),\n  };\n}\n\nfunction defaultMessage(req: AuthorizationRequirements): string {\n  const parts = [`Agent ${sanitizeDisplay(req.agentUrl)} requires OAuth authorization.`];\n  if (req.authorizationServer) {\n    parts.push(`Authorization server: ${req.authorizationServer}.`);\n  }\n  if (req.challenge.error_description) {\n    parts.push(`Server said: ${sanitizeDisplay(req.challenge.error_description)}.`);\n  }\n  parts.push('Provide an OAuthFlowHandler or run an interactive flow to complete authorization.');\n  return parts.join(' ');\n}\n\n/**\n * Options for {@link discoverAuthorizationRequirements}.\n */\nexport interface DiscoverAuthorizationOptions {\n  /** Allow http:// and private-IP probe targets. Default false. */\n  allowPrivateIp?: boolean;\n  /** Override per-probe HTTP timeout (ms). Default inherits from ssrfSafeFetch (10s). */\n  timeoutMs?: number;\n  /** Scoped fetch implementation for the agent, PRM, and AS metadata probes. */\n  fetchFn?: typeof fetch;\n  /**\n   * If provided, use this `WWW-Authenticate` header verbatim instead of\n   * re-probing the agent. Use this when you already have a 401 response in\n   * hand and want to avoid a second round-trip.\n   */\n  wwwAuthenticate?: string;\n}\n\n/**\n * Walk the OAuth discovery chain starting from an agent URL. Returns\n * `AuthorizationRequirements` when the agent demands OAuth, or `null` when a\n * `tools/list` call succeeds without credentials.\n *\n * Strategy:\n *   1. POST `tools/list` to the agent with no `Authorization` header.\n *   2. If 401 + `WWW-Authenticate: Bearer`: parse the challenge.\n *   3. If the challenge carries `resource_metadata=…`: GET it and read\n *      `resource` + `authorization_servers`.\n *   4. For the first `authorization_servers[0]`: GET `/.well-known/oauth-authorization-server`\n *      and read `authorization_endpoint`, `token_endpoint`, `registration_endpoint`,\n *      `scopes_supported`.\n *   5. Return a structured record.\n *\n * Anything missing from the chain surfaces as `undefined` on the result —\n * callers can still present a partial picture without re-probing.\n */\nexport async function discoverAuthorizationRequirements(\n  agentUrl: string,\n  options: DiscoverAuthorizationOptions = {}\n): Promise<AuthorizationRequirements | null> {\n  // `allowPrivateIp` authorizes the agent probe. Chain hops (PRM, AS\n  // metadata) inherit that trust ONLY when they share the agent's origin —\n  // a compromised agent that advertises a private-IP authorization server\n  // on a different origin would otherwise pivot a discovery walk into the\n  // host's internal network.\n  const allowPrivateIpOnAgent = options.allowPrivateIp ?? false;\n  const agentOrigin = originOf(agentUrl);\n  const allowPrivateIpForHop = (url: string): boolean =>\n    allowPrivateIpOnAgent && agentOrigin !== undefined && originOf(url) === agentOrigin;\n\n  let challengeHeader = options.wwwAuthenticate;\n  if (!challengeHeader) {\n    const probe = await probeAgent401(agentUrl, allowPrivateIpOnAgent, options.timeoutMs, options.fetchFn);\n    if (probe.status !== 401) {\n      // 200, 403, 5xx, or network error — not an OAuth 401 we can act on.\n      return null;\n    }\n    challengeHeader = probe.wwwAuthenticate;\n  }\n\n  const challenge = parseWWWAuthenticate(challengeHeader ?? null);\n  if (!challenge || challenge.scheme !== 'bearer') {\n    // A 401 without a Bearer challenge isn't our kind of problem — let it propagate.\n    return null;\n  }\n\n  const requirements: AuthorizationRequirements = {\n    agentUrl,\n    resourceMetadataUrl: challenge.resource_metadata ? sanitizeDisplay(challenge.resource_metadata) : undefined,\n    challengeScope: challenge.scope ? sanitizeDisplay(challenge.scope) : undefined,\n    challenge: sanitizeChallenge(challenge),\n  };\n\n  // Walk protected-resource metadata (RFC 9728 §3). Private-IP targets are\n  // only allowed when the hop's origin matches the agent's.\n  if (challenge.resource_metadata && isSafeHttpUrl(challenge.resource_metadata)) {\n    const prm = await fetchJson(\n      challenge.resource_metadata,\n      allowPrivateIpForHop(challenge.resource_metadata),\n      options.timeoutMs,\n      options.fetchFn\n    );\n    if (prm && typeof prm === 'object') {\n      const resource = (prm as { resource?: unknown }).resource;\n      const servers = (prm as { authorization_servers?: unknown }).authorization_servers;\n      if (typeof resource === 'string') requirements.resource = sanitizeDisplay(resource);\n      if (Array.isArray(servers)) {\n        const validServers = servers\n          .filter((s: unknown): s is string => typeof s === 'string' && isSafeHttpUrl(s))\n          .map(sanitizeDisplay);\n        if (validServers.length > 0) {\n          requirements.authorizationServers = validServers;\n          requirements.authorizationServer = validServers[0];\n        }\n      }\n    }\n  }\n\n  // Walk authorization-server metadata using the first issuer. RFC 8414 §3\n  // first, then OIDC Discovery 1.0 fallback for AS deployments (Keycloak in\n  // OIDC mode, Ping, ADFS) that only publish at\n  // `{issuer}/.well-known/openid-configuration`.\n  if (requirements.authorizationServer) {\n    const asUrl = buildAuthorizationServerMetadataUrl(requirements.authorizationServer);\n    let md: Record<string, unknown> | undefined;\n    let source: 'rfc-8414' | 'openid-configuration' | undefined;\n    if (asUrl) {\n      const res = await fetchJson(asUrl, allowPrivateIpForHop(asUrl), options.timeoutMs, options.fetchFn);\n      if (res && typeof res === 'object') {\n        md = res as Record<string, unknown>;\n        source = 'rfc-8414';\n      }\n    }\n    if (!md) {\n      const oidcUrl = buildOidcDiscoveryUrl(requirements.authorizationServer);\n      if (oidcUrl) {\n        const res = await fetchJson(oidcUrl, allowPrivateIpForHop(oidcUrl), options.timeoutMs, options.fetchFn);\n        if (res && typeof res === 'object') {\n          md = res as Record<string, unknown>;\n          source = 'openid-configuration';\n        }\n      }\n    }\n    if (md) {\n      requirements.metadataSource = source;\n      if (typeof md.authorization_endpoint === 'string') {\n        requirements.authorizationEndpoint = sanitizeDisplay(md.authorization_endpoint);\n      }\n      if (typeof md.token_endpoint === 'string') {\n        requirements.tokenEndpoint = sanitizeDisplay(md.token_endpoint);\n      }\n      if (typeof md.registration_endpoint === 'string') {\n        requirements.registrationEndpoint = sanitizeDisplay(md.registration_endpoint);\n      }\n      if (Array.isArray(md.scopes_supported)) {\n        const scopes = md.scopes_supported\n          .filter((s: unknown): s is string => typeof s === 'string')\n          .slice(0, MAX_SCOPES)\n          .map(sanitizeDisplay);\n        if (scopes.length > 0) requirements.scopesSupported = scopes;\n      }\n      if (Array.isArray(md.grant_types_supported)) {\n        const grants = md.grant_types_supported\n          .filter((g: unknown): g is string => typeof g === 'string')\n          .slice(0, 32)\n          .map(sanitizeDisplay);\n        if (grants.length > 0) requirements.grantTypesSupported = grants;\n      }\n    }\n  }\n\n  return requirements;\n}\n\n/**\n * Probe the agent for the parsed `WWW-Authenticate` challenge on a 401.\n *\n * Where `discoverAuthorizationRequirements` walks the full RFC 9728 → 8414\n * chain for Bearer/OAuth challenges, this helper is the catch-all: it works\n * for ANY scheme (Basic, Digest, Bearer-without-PRM, …) and returns the\n * structured challenge so callers can surface scheme-specific remediation\n * (e.g. \"use `--auth-scheme basic`\" when the gateway speaks RFC 7617).\n *\n * Returns `null` when the agent isn't responding with a 401, or when the\n * response carries no parseable `WWW-Authenticate`. Reuses `probeAgent401`\n * so the SSRF gate and timeout policy stay consistent with the OAuth path.\n */\nexport async function probeAuthChallenge(\n  agentUrl: string,\n  options: { allowPrivateIp?: boolean; timeoutMs?: number; fetchFn?: typeof fetch } = {}\n): Promise<WWWAuthenticateChallenge | null> {\n  const probe = await probeAgent401(agentUrl, options.allowPrivateIp ?? false, options.timeoutMs, options.fetchFn);\n  if (probe.status !== 401) return null;\n  return parseWWWAuthenticate(probe.wwwAuthenticate ?? null);\n}\n\n/**\n * Fire a single unauthenticated `tools/list` at the agent and return the\n * status + `WWW-Authenticate` header. Used when the caller hasn't provided\n * a cached 401 response.\n */\nasync function probeAgent401(\n  agentUrl: string,\n  allowPrivateIp: boolean,\n  timeoutMs?: number,\n  fetchFn?: typeof fetch\n): Promise<{ status: number; wwwAuthenticate?: string }> {\n  const body = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' });\n  try {\n    const res = await ssrfSafeFetch(agentUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json',\n      },\n      body,\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n      ...(fetchFn ? { trustedFetchFn: fetchFn } : {}),\n    });\n    return { status: res.status, wwwAuthenticate: res.headers['www-authenticate'] };\n  } catch {\n    return { status: 0 };\n  }\n}\n\n/**\n * Check a URL is an absolute `http:`/`https:` URL before we hand it to\n * `ssrfSafeFetch`. Defeats `javascript:`, `file:`, `data:`, etc. the agent\n * might echo back in PRM or AS metadata. `ssrfSafeFetch` refuses non-HTTP\n * schemes too, but failing fast here gives a cleaner discovery flow and\n * avoids surfacing scheme errors as mysterious discovery misses.\n */\nfunction originOf(value: string): string | undefined {\n  try {\n    return new URL(value).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isSafeHttpUrl(value: string): boolean {\n  try {\n    const u = new URL(value);\n    return u.protocol === 'https:' || u.protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Build the authorization-server metadata URL for an issuer per RFC 8414 §3.\n *\n * For issuer `https://as.example.com/tenant1`, metadata lives at\n * `https://as.example.com/.well-known/oauth-authorization-server/tenant1`\n * (well-known prefix inserted BEFORE the issuer path, not after). This\n * matches how the MCP SDK and most authorization servers advertise metadata.\n */\nfunction buildAuthorizationServerMetadataUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const pathname = u.pathname.endsWith('/') ? u.pathname.slice(0, -1) : u.pathname;\n  return `${u.origin}/.well-known/oauth-authorization-server${pathname}`;\n}\n\n/**\n * OpenID Connect Discovery 1.0 fallback URL. Some authorization servers\n * (Keycloak in OIDC mode, Ping, ADFS) only publish metadata at\n * `{issuer}/.well-known/openid-configuration` — path *suffixed*, not\n * prefixed. The OIDC discovery doc carries `token_endpoint`,\n * `authorization_endpoint`, and `grant_types_supported` with the same\n * semantics as RFC 8414, so it's a safe read-through when the RFC 8414\n * probe misses.\n */\nfunction buildOidcDiscoveryUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const base = u.pathname.endsWith('/') ? `${u.origin}${u.pathname.slice(0, -1)}` : `${u.origin}${u.pathname}`;\n  return `${base}/.well-known/openid-configuration`;\n}\n\nasync function fetchJson(\n  url: string,\n  allowPrivateIp: boolean,\n  timeoutMs?: number,\n  fetchFn?: typeof fetch\n): Promise<unknown> {\n  try {\n    const res = await ssrfSafeFetch(url, {\n      method: 'GET',\n      headers: { accept: 'application/json' },\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n      ...(fetchFn ? { trustedFetchFn: fetchFn } : {}),\n    });\n    if (res.status !== 200) return undefined;\n    return decodeBodyAsJsonOrText(res.body, res.headers['content-type']);\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,iBAAsD;AACtD,oBAAoE;AACpE,yBAAoE;AAQpE,MAAM,qBAAqB;AAM3B,MAAM,aAAa;AAOnB,MAAM,uBAAuB;AAQ7B,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,WAAW,MAAM,QAAQ,6BAA6B,EAAE;AAC9D,MAAI,SAAS,UAAU,mBAAoB,QAAO;AAClD,SAAO,GAAG,SAAS,MAAM,GAAG,qBAAqB,CAAC,CAAC;AACrD;AAYA,SAAS,kBAAkB,GAAuD;AAChF,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,MAAM,GAAG;AAC7C,QAAI,OAAO,KAAK,MAAM,EAAE,UAAU,qBAAsB;AACxD,WAAO,CAAC,IAAI,gBAAgB,CAAC;AAAA,EAC/B;AACA,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG;AAAA,EACF;AACF;AAwEO,MAAM,gCAAgC,0CAA4B;AAAA;AAAA,EAE9D,UAAU;AAAA,EACV;AAAA,EAET,YAAY,cAAyC,SAAkB;AACrE,UAAM,aAAa,UAAU,wBAAwB,YAAY,GAAG,WAAW,eAAe,YAAY,CAAC;AAC3G,SAAK,OAAO;AACZ,SAAK,eAAe;AAIpB,SAAK,UAAU,EAAE,GAAI,KAAK,SAAgC,aAAa;AAAA,EACzE;AACF;AASA,SAAS,wBAAwB,KAA+D;AAC9F,MAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,cAAe,QAAO;AAC7D,SAAO;AAAA,IACL,wBAAwB,IAAI;AAAA,IAC5B,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,uBAAuB,EAAE,uBAAuB,IAAI,qBAAqB,IAAI,CAAC;AAAA,IACtF,GAAI,IAAI,sBAAsB,EAAE,QAAQ,IAAI,oBAAoB,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,SAAS,eAAe,KAAwC;AAC9D,QAAM,QAAQ,CAAC,SAAS,gBAAgB,IAAI,QAAQ,CAAC,gCAAgC;AACrF,MAAI,IAAI,qBAAqB;AAC3B,UAAM,KAAK,yBAAyB,IAAI,mBAAmB,GAAG;AAAA,EAChE;AACA,MAAI,IAAI,UAAU,mBAAmB;AACnC,UAAM,KAAK,gBAAgB,gBAAgB,IAAI,UAAU,iBAAiB,CAAC,GAAG;AAAA,EAChF;AACA,QAAM,KAAK,mFAAmF;AAC9F,SAAO,MAAM,KAAK,GAAG;AACvB;AAsCA,eAAsB,kCACpB,UACA,UAAwC,CAAC,GACE;AAM3C,QAAM,wBAAwB,QAAQ,kBAAkB;AACxD,QAAM,cAAc,SAAS,QAAQ;AACrC,QAAM,uBAAuB,CAAC,QAC5B,yBAAyB,gBAAgB,UAAa,SAAS,GAAG,MAAM;AAE1E,MAAI,kBAAkB,QAAQ;AAC9B,MAAI,CAAC,iBAAiB;AACpB,UAAM,QAAQ,MAAM,cAAc,UAAU,uBAAuB,QAAQ,WAAW,QAAQ,OAAO;AACrG,QAAI,MAAM,WAAW,KAAK;AAExB,aAAO;AAAA,IACT;AACA,sBAAkB,MAAM;AAAA,EAC1B;AAEA,QAAM,gBAAY,yCAAqB,mBAAmB,IAAI;AAC9D,MAAI,CAAC,aAAa,UAAU,WAAW,UAAU;AAE/C,WAAO;AAAA,EACT;AAEA,QAAM,eAA0C;AAAA,IAC9C;AAAA,IACA,qBAAqB,UAAU,oBAAoB,gBAAgB,UAAU,iBAAiB,IAAI;AAAA,IAClG,gBAAgB,UAAU,QAAQ,gBAAgB,UAAU,KAAK,IAAI;AAAA,IACrE,WAAW,kBAAkB,SAAS;AAAA,EACxC;AAIA,MAAI,UAAU,qBAAqB,cAAc,UAAU,iBAAiB,GAAG;AAC7E,UAAM,MAAM,MAAM;AAAA,MAChB,UAAU;AAAA,MACV,qBAAqB,UAAU,iBAAiB;AAAA,MAChD,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,YAAM,WAAY,IAA+B;AACjD,YAAM,UAAW,IAA4C;AAC7D,UAAI,OAAO,aAAa,SAAU,cAAa,WAAW,gBAAgB,QAAQ;AAClF,UAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,cAAM,eAAe,QAClB,OAAO,CAAC,MAA4B,OAAO,MAAM,YAAY,cAAc,CAAC,CAAC,EAC7E,IAAI,eAAe;AACtB,YAAI,aAAa,SAAS,GAAG;AAC3B,uBAAa,uBAAuB;AACpC,uBAAa,sBAAsB,aAAa,CAAC;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,MAAI,aAAa,qBAAqB;AACpC,UAAM,QAAQ,oCAAoC,aAAa,mBAAmB;AAClF,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,UAAU,OAAO,qBAAqB,KAAK,GAAG,QAAQ,WAAW,QAAQ,OAAO;AAClG,UAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,aAAK;AACL,iBAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,UAAU,sBAAsB,aAAa,mBAAmB;AACtE,UAAI,SAAS;AACX,cAAM,MAAM,MAAM,UAAU,SAAS,qBAAqB,OAAO,GAAG,QAAQ,WAAW,QAAQ,OAAO;AACtG,YAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,eAAK;AACL,mBAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI;AACN,mBAAa,iBAAiB;AAC9B,UAAI,OAAO,GAAG,2BAA2B,UAAU;AACjD,qBAAa,wBAAwB,gBAAgB,GAAG,sBAAsB;AAAA,MAChF;AACA,UAAI,OAAO,GAAG,mBAAmB,UAAU;AACzC,qBAAa,gBAAgB,gBAAgB,GAAG,cAAc;AAAA,MAChE;AACA,UAAI,OAAO,GAAG,0BAA0B,UAAU;AAChD,qBAAa,uBAAuB,gBAAgB,GAAG,qBAAqB;AAAA,MAC9E;AACA,UAAI,MAAM,QAAQ,GAAG,gBAAgB,GAAG;AACtC,cAAM,SAAS,GAAG,iBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,UAAU,EACnB,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,kBAAkB;AAAA,MACxD;AACA,UAAI,MAAM,QAAQ,GAAG,qBAAqB,GAAG;AAC3C,cAAM,SAAS,GAAG,sBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,EAAE,EACX,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,sBAAsB;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAeA,eAAsB,mBACpB,UACA,UAAoF,CAAC,GAC3C;AAC1C,QAAM,QAAQ,MAAM,cAAc,UAAU,QAAQ,kBAAkB,OAAO,QAAQ,WAAW,QAAQ,OAAO;AAC/G,MAAI,MAAM,WAAW,IAAK,QAAO;AACjC,aAAO,yCAAqB,MAAM,mBAAmB,IAAI;AAC3D;AAOA,eAAe,cACb,UACA,gBACA,WACA,SACuD;AACvD,QAAM,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,aAAa,CAAC;AAC3E,MAAI;AACF,UAAM,MAAM,UAAM,0BAAc,UAAU;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MAC/C,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,WAAO,EAAE,QAAQ,IAAI,QAAQ,iBAAiB,IAAI,QAAQ,kBAAkB,EAAE;AAAA,EAChF,QAAQ;AACN,WAAO,EAAE,QAAQ,EAAE;AAAA,EACrB;AACF;AASA,SAAS,SAAS,OAAmC;AACnD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,KAAK;AACvB,WAAO,EAAE,aAAa,YAAY,EAAE,aAAa;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,SAAS,oCAAoC,QAAoC;AAC/E,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,WAAW,EAAE,SAAS,SAAS,GAAG,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE,IAAI,EAAE;AACxE,SAAO,GAAG,EAAE,MAAM,0CAA0C,QAAQ;AACtE;AAWA,SAAS,sBAAsB,QAAoC;AACjE,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,OAAO,EAAE,SAAS,SAAS,GAAG,IAAI,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC1G,SAAO,GAAG,IAAI;AAChB;AAEA,eAAe,UACb,KACA,gBACA,WACA,SACkB;AAClB,MAAI;AACF,UAAM,MAAM,UAAM,0BAAc,KAAK;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACtC;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MAC/C,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,QAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,eAAO,mCAAuB,IAAI,MAAM,IAAI,QAAQ,cAAc,CAAC;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/lib/auth/oauth/authorization-required.mjs

@@ -62,7 +62,7 @@ async function discoverAuthorizationRequirements(agentUrl, options = {}) {
   const allowPrivateIpForHop = (url) => allowPrivateIpOnAgent && agentOrigin !== void 0 && originOf(url) === agentOrigin;
   let challengeHeader = options.wwwAuthenticate;
   if (!challengeHeader) {
-    const probe = await probeAgent401(agentUrl, allowPrivateIpOnAgent, options.timeoutMs);
+    const probe = await probeAgent401(agentUrl, allowPrivateIpOnAgent, options.timeoutMs, options.fetchFn);
     if (probe.status !== 401) {
       return null;
     }
@@ -82,7 +82,8 @@ async function discoverAuthorizationRequirements(agentUrl, options = {}) {
     const prm = await fetchJson(
       challenge.resource_metadata,
       allowPrivateIpForHop(challenge.resource_metadata),
-      options.timeoutMs
+      options.timeoutMs,
+      options.fetchFn
     );
     if (prm && typeof prm === "object") {
       const resource = prm.resource;
@@ -102,7 +103,7 @@ async function discoverAuthorizationRequirements(agentUrl, options = {}) {
     let md;
     let source;
     if (asUrl) {
-      const res = await fetchJson(asUrl, allowPrivateIpForHop(asUrl), options.timeoutMs);
+      const res = await fetchJson(asUrl, allowPrivateIpForHop(asUrl), options.timeoutMs, options.fetchFn);
       if (res && typeof res === "object") {
         md = res;
         source = "rfc-8414";
@@ -111,7 +112,7 @@ async function discoverAuthorizationRequirements(agentUrl, options = {}) {
     if (!md) {
       const oidcUrl = buildOidcDiscoveryUrl(requirements.authorizationServer);
       if (oidcUrl) {
-        const res = await fetchJson(oidcUrl, allowPrivateIpForHop(oidcUrl), options.timeoutMs);
+        const res = await fetchJson(oidcUrl, allowPrivateIpForHop(oidcUrl), options.timeoutMs, options.fetchFn);
         if (res && typeof res === "object") {
           md = res;
           source = "openid-configuration";
@@ -142,11 +143,11 @@ async function discoverAuthorizationRequirements(agentUrl, options = {}) {
   return requirements;
 }
 async function probeAuthChallenge(agentUrl, options = {}) {
-  const probe = await probeAgent401(agentUrl, options.allowPrivateIp ?? false, options.timeoutMs);
+  const probe = await probeAgent401(agentUrl, options.allowPrivateIp ?? false, options.timeoutMs, options.fetchFn);
   if (probe.status !== 401) return null;
   return parseWWWAuthenticate(probe.wwwAuthenticate ?? null);
 }
-async function probeAgent401(agentUrl, allowPrivateIp, timeoutMs) {
+async function probeAgent401(agentUrl, allowPrivateIp, timeoutMs, fetchFn) {
   const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" });
   try {
     const res = await ssrfSafeFetch(agentUrl, {
@@ -157,7 +158,8 @@ async function probeAgent401(agentUrl, allowPrivateIp, timeoutMs) {
       },
       body,
       allowPrivateIp,
-      ...timeoutMs !== void 0 ? { timeoutMs } : {}
+      ...timeoutMs !== void 0 ? { timeoutMs } : {},
+      ...fetchFn ? { trustedFetchFn: fetchFn } : {}
     });
     return { status: res.status, wwwAuthenticate: res.headers["www-authenticate"] };
   } catch {
@@ -191,13 +193,14 @@ function buildOidcDiscoveryUrl(issuer) {
   const base = u.pathname.endsWith("/") ? `${u.origin}${u.pathname.slice(0, -1)}` : `${u.origin}${u.pathname}`;
   return `${base}/.well-known/openid-configuration`;
 }
-async function fetchJson(url, allowPrivateIp, timeoutMs) {
+async function fetchJson(url, allowPrivateIp, timeoutMs, fetchFn) {
   try {
     const res = await ssrfSafeFetch(url, {
       method: "GET",
       headers: { accept: "application/json" },
       allowPrivateIp,
-      ...timeoutMs !== void 0 ? { timeoutMs } : {}
+      ...timeoutMs !== void 0 ? { timeoutMs } : {},
+      ...fetchFn ? { trustedFetchFn: fetchFn } : {}
     });
     if (res.status !== 200) return void 0;
     return decodeBodyAsJsonOrText(res.body, res.headers["content-type"]);

package/dist/lib/auth/oauth/authorization-required.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/authorization-required.ts"],"sourcesContent":["/**\n * Zero-config OAuth discovery + actionable authorization errors.\n *\n * When a library consumer calls an OAuth-gated MCP agent without saved\n * credentials, they get a `NeedsAuthorizationError` containing everything\n * needed to either run an interactive flow or present a clear prompt — no\n * re-probing required.\n *\n * Design note: this module only *discovers* — it never opens a browser or\n * writes state. Interactive flow handling stays in the caller (CLI or a\n * bespoke `OAuthFlowHandler`) so library behavior is predictable.\n */\nimport { ssrfSafeFetch, decodeBodyAsJsonOrText } from '../../net';\nimport { AuthenticationRequiredError, type OAuthMetadataInfo } from '../../errors';\nimport { parseWWWAuthenticate, type WWWAuthenticateChallenge } from './diagnostics';\n\n/**\n * Maximum length of an individual server-supplied string we copy into the\n * `AuthorizationRequirements` payload. Anything longer is truncated with a\n * `…` suffix so hostile agents can't smuggle megabyte error-descriptions\n * into operator-facing prompts and logs.\n */\nconst MAX_DISPLAY_STRING = 256;\n\n/**\n * Maximum number of scope strings we copy into `scopesSupported`. RFC 8414\n * allows an unbounded array; hostile servers have sent thousands.\n */\nconst MAX_SCOPES = 64;\n\n/**\n * Maximum number of auth-params we preserve under `challenge.params`. Bounds\n * memory pressure from hostile servers that pack the `WWW-Authenticate`\n * header with unknown auth-params.\n */\nconst MAX_CHALLENGE_PARAMS = 32;\n\n/**\n * Strip ASCII control characters (excluding TAB) from a server-supplied\n * string that may be shown to a human. Defeats terminal-hijack tricks like\n * `\\x1b]0;pwned\\x07` (rewrites terminal title), `\\r` (overwrites prompt),\n * and `\\x1b[2J` (clears screen). Also truncates over-long values.\n */\nfunction sanitizeDisplay(value: string): string {\n  const stripped = value.replace(/[\\x00-\\x08\\x0b-\\x1f\\x7f]/g, '');\n  if (stripped.length <= MAX_DISPLAY_STRING) return stripped;\n  return `${stripped.slice(0, MAX_DISPLAY_STRING - 1)}…`;\n}\n\n/**\n * Sanitize the parsed `WWW-Authenticate` challenge before embedding it in a\n * `NeedsAuthorizationError`. Consumers that render `requirements.challenge`\n * to a terminal should never see control characters. Caps `params` count to\n * bound hostile servers.\n *\n * The `scheme` is already lowercased + token-constrained by the parser.\n * Param keys are also token-constrained so they're safe; only values need\n * sanitizing.\n */\nfunction sanitizeChallenge(c: WWWAuthenticateChallenge): WWWAuthenticateChallenge {\n  const params: Record<string, string> = {};\n  for (const [k, v] of Object.entries(c.params)) {\n    if (Object.keys(params).length >= MAX_CHALLENGE_PARAMS) break;\n    params[k] = sanitizeDisplay(v);\n  }\n  return {\n    scheme: c.scheme,\n    ...(c.realm !== undefined ? { realm: sanitizeDisplay(c.realm) } : {}),\n    ...(c.error !== undefined ? { error: sanitizeDisplay(c.error) } : {}),\n    ...(c.error_description !== undefined ? { error_description: sanitizeDisplay(c.error_description) } : {}),\n    ...(c.scope !== undefined ? { scope: sanitizeDisplay(c.scope) } : {}),\n    ...(c.resource_metadata !== undefined ? { resource_metadata: sanitizeDisplay(c.resource_metadata) } : {}),\n    params,\n  };\n}\n\n/**\n * Structured description of what an agent's authorization server requires\n * before it will accept a `tools/call`. Produced by\n * {@link discoverAuthorizationRequirements}.\n */\nexport interface AuthorizationRequirements {\n  /** The agent URL we probed. */\n  agentUrl: string;\n  /** Resource URL the agent advertises in its `WWW-Authenticate` / PRM (RFC 9728). */\n  resource?: string;\n  /** URL of the protected-resource-metadata document (from `WWW-Authenticate: resource_metadata=…`). */\n  resourceMetadataUrl?: string;\n  /** First `authorization_servers[0]` from the protected-resource metadata. */\n  authorizationServer?: string;\n  /**\n   * All `authorization_servers` advertised by the PRM, in declaration order.\n   * The walker only probes `[0]` (PRM preference order — see RFC 9728 §3.3);\n   * the full list is exposed so callers can surface multi-issuer deployments\n   * in diagnostics. A length > 1 is uncommon and worth flagging to the\n   * operator — typically a federation partner or a staged migration.\n   */\n  authorizationServers?: string[];\n  /** `authorization_endpoint` from the authorization-server metadata (RFC 8414). */\n  authorizationEndpoint?: string;\n  /** `token_endpoint` from the authorization-server metadata. */\n  tokenEndpoint?: string;\n  /** `registration_endpoint` if the AS supports RFC 7591 dynamic client registration. */\n  registrationEndpoint?: string;\n  /** Scopes advertised by the AS (RFC 8414 `scopes_supported`). */\n  scopesSupported?: string[];\n  /**\n   * `grant_types_supported` advertised by the AS (RFC 8414). `undefined` when\n   * the AS didn't publish the field — per RFC 8414 that defaults to\n   * `[\"authorization_code\", \"implicit\"]`. Clients should treat absence as\n   * \"unknown, try your grant and see,\" not as proof the grant is unsupported.\n   */\n  grantTypesSupported?: string[];\n  /** True when the AS metadata came from the OIDC fallback URL rather than RFC 8414. */\n  metadataSource?: 'rfc-8414' | 'openid-configuration';\n  /** Scope hinted in the `WWW-Authenticate` challenge's `scope` auth-param. */\n  challengeScope?: string;\n  /** Raw parsed challenge the agent returned on the 401. */\n  challenge: WWWAuthenticateChallenge;\n}\n\n/**\n * Error raised when an agent returns a 401 and we do not have credentials\n * to satisfy it. Carries everything needed to run an interactive OAuth flow\n * or show the operator an actionable prompt.\n *\n * Extends {@link AuthenticationRequiredError} so existing callers that catch\n * `AuthenticationRequiredError` automatically receive the richer variant —\n * they can downcast with `instanceof NeedsAuthorizationError` when they\n * want walked discovery metadata.\n *\n * Note on `code` vs `subCode`:\n *   The parent class declares `readonly code = 'AUTHENTICATION_REQUIRED'` as\n *   a class field that re-initializes on every construction, so a child-side\n *   override attempt is silently overwritten under `useDefineForClassFields`.\n *   The narrow discriminator is exposed as `subCode` — prefer\n *   `instanceof NeedsAuthorizationError` for type-narrowing and use `subCode`\n *   only for structured-log keying.\n *\n * Note on `hasOAuth`:\n *   The inherited getter returns `true` only when both `authorization_endpoint`\n *   and `token_endpoint` were walked successfully. A partially-walked\n *   requirements record (PRM reachable but AS metadata missing) still yields\n *   `hasOAuth === false` even though `requirements.authorizationServer` is set.\n *   Treat it as \"we have enough to start a flow,\" not \"server wants OAuth.\"\n */\nexport class NeedsAuthorizationError extends AuthenticationRequiredError {\n  /** Narrow discriminator for consumers that already know about this class. */\n  readonly subCode = 'needs_authorization' as const;\n  readonly requirements: AuthorizationRequirements;\n\n  constructor(requirements: AuthorizationRequirements, message?: string) {\n    super(requirements.agentUrl, synthesizeOAuthMetadata(requirements), message ?? defaultMessage(requirements));\n    this.name = 'NeedsAuthorizationError';\n    this.requirements = requirements;\n    // Extend the parent's `details` payload so structured-logging consumers\n    // that read `err.details` (via `extractErrorInfo` or equivalent) see the\n    // full walked chain, not just the synthesized one-hop oauthMetadata.\n    this.details = { ...(this.details as object | undefined), requirements };\n  }\n}\n\n/**\n * Build an {@link OAuthMetadataInfo} for the base-class constructor so that\n * legacy callers still see a non-empty `oauthMetadata` + working\n * `hasOAuth`/`authorizationUrl` getters on the error. When discovery didn't\n * yield enough info, return undefined and let the base class degrade\n * gracefully.\n */\nfunction synthesizeOAuthMetadata(req: AuthorizationRequirements): OAuthMetadataInfo | undefined {\n  if (!req.authorizationEndpoint || !req.tokenEndpoint) return undefined;\n  return {\n    authorization_endpoint: req.authorizationEndpoint,\n    token_endpoint: req.tokenEndpoint,\n    ...(req.registrationEndpoint ? { registration_endpoint: req.registrationEndpoint } : {}),\n    ...(req.authorizationServer ? { issuer: req.authorizationServer } : {}),\n  };\n}\n\nfunction defaultMessage(req: AuthorizationRequirements): string {\n  const parts = [`Agent ${sanitizeDisplay(req.agentUrl)} requires OAuth authorization.`];\n  if (req.authorizationServer) {\n    parts.push(`Authorization server: ${req.authorizationServer}.`);\n  }\n  if (req.challenge.error_description) {\n    parts.push(`Server said: ${sanitizeDisplay(req.challenge.error_description)}.`);\n  }\n  parts.push('Provide an OAuthFlowHandler or run an interactive flow to complete authorization.');\n  return parts.join(' ');\n}\n\n/**\n * Options for {@link discoverAuthorizationRequirements}.\n */\nexport interface DiscoverAuthorizationOptions {\n  /** Allow http:// and private-IP probe targets. Default false. */\n  allowPrivateIp?: boolean;\n  /** Override per-probe HTTP timeout (ms). Default inherits from ssrfSafeFetch (10s). */\n  timeoutMs?: number;\n  /**\n   * If provided, use this `WWW-Authenticate` header verbatim instead of\n   * re-probing the agent. Use this when you already have a 401 response in\n   * hand and want to avoid a second round-trip.\n   */\n  wwwAuthenticate?: string;\n}\n\n/**\n * Walk the OAuth discovery chain starting from an agent URL. Returns\n * `AuthorizationRequirements` when the agent demands OAuth, or `null` when a\n * `tools/list` call succeeds without credentials.\n *\n * Strategy:\n *   1. POST `tools/list` to the agent with no `Authorization` header.\n *   2. If 401 + `WWW-Authenticate: Bearer`: parse the challenge.\n *   3. If the challenge carries `resource_metadata=…`: GET it and read\n *      `resource` + `authorization_servers`.\n *   4. For the first `authorization_servers[0]`: GET `/.well-known/oauth-authorization-server`\n *      and read `authorization_endpoint`, `token_endpoint`, `registration_endpoint`,\n *      `scopes_supported`.\n *   5. Return a structured record.\n *\n * Anything missing from the chain surfaces as `undefined` on the result —\n * callers can still present a partial picture without re-probing.\n */\nexport async function discoverAuthorizationRequirements(\n  agentUrl: string,\n  options: DiscoverAuthorizationOptions = {}\n): Promise<AuthorizationRequirements | null> {\n  // `allowPrivateIp` authorizes the agent probe. Chain hops (PRM, AS\n  // metadata) inherit that trust ONLY when they share the agent's origin —\n  // a compromised agent that advertises a private-IP authorization server\n  // on a different origin would otherwise pivot a discovery walk into the\n  // host's internal network.\n  const allowPrivateIpOnAgent = options.allowPrivateIp ?? false;\n  const agentOrigin = originOf(agentUrl);\n  const allowPrivateIpForHop = (url: string): boolean =>\n    allowPrivateIpOnAgent && agentOrigin !== undefined && originOf(url) === agentOrigin;\n\n  let challengeHeader = options.wwwAuthenticate;\n  if (!challengeHeader) {\n    const probe = await probeAgent401(agentUrl, allowPrivateIpOnAgent, options.timeoutMs);\n    if (probe.status !== 401) {\n      // 200, 403, 5xx, or network error — not an OAuth 401 we can act on.\n      return null;\n    }\n    challengeHeader = probe.wwwAuthenticate;\n  }\n\n  const challenge = parseWWWAuthenticate(challengeHeader ?? null);\n  if (!challenge || challenge.scheme !== 'bearer') {\n    // A 401 without a Bearer challenge isn't our kind of problem — let it propagate.\n    return null;\n  }\n\n  const requirements: AuthorizationRequirements = {\n    agentUrl,\n    resourceMetadataUrl: challenge.resource_metadata ? sanitizeDisplay(challenge.resource_metadata) : undefined,\n    challengeScope: challenge.scope ? sanitizeDisplay(challenge.scope) : undefined,\n    challenge: sanitizeChallenge(challenge),\n  };\n\n  // Walk protected-resource metadata (RFC 9728 §3). Private-IP targets are\n  // only allowed when the hop's origin matches the agent's.\n  if (challenge.resource_metadata && isSafeHttpUrl(challenge.resource_metadata)) {\n    const prm = await fetchJson(\n      challenge.resource_metadata,\n      allowPrivateIpForHop(challenge.resource_metadata),\n      options.timeoutMs\n    );\n    if (prm && typeof prm === 'object') {\n      const resource = (prm as { resource?: unknown }).resource;\n      const servers = (prm as { authorization_servers?: unknown }).authorization_servers;\n      if (typeof resource === 'string') requirements.resource = sanitizeDisplay(resource);\n      if (Array.isArray(servers)) {\n        const validServers = servers\n          .filter((s: unknown): s is string => typeof s === 'string' && isSafeHttpUrl(s))\n          .map(sanitizeDisplay);\n        if (validServers.length > 0) {\n          requirements.authorizationServers = validServers;\n          requirements.authorizationServer = validServers[0];\n        }\n      }\n    }\n  }\n\n  // Walk authorization-server metadata using the first issuer. RFC 8414 §3\n  // first, then OIDC Discovery 1.0 fallback for AS deployments (Keycloak in\n  // OIDC mode, Ping, ADFS) that only publish at\n  // `{issuer}/.well-known/openid-configuration`.\n  if (requirements.authorizationServer) {\n    const asUrl = buildAuthorizationServerMetadataUrl(requirements.authorizationServer);\n    let md: Record<string, unknown> | undefined;\n    let source: 'rfc-8414' | 'openid-configuration' | undefined;\n    if (asUrl) {\n      const res = await fetchJson(asUrl, allowPrivateIpForHop(asUrl), options.timeoutMs);\n      if (res && typeof res === 'object') {\n        md = res as Record<string, unknown>;\n        source = 'rfc-8414';\n      }\n    }\n    if (!md) {\n      const oidcUrl = buildOidcDiscoveryUrl(requirements.authorizationServer);\n      if (oidcUrl) {\n        const res = await fetchJson(oidcUrl, allowPrivateIpForHop(oidcUrl), options.timeoutMs);\n        if (res && typeof res === 'object') {\n          md = res as Record<string, unknown>;\n          source = 'openid-configuration';\n        }\n      }\n    }\n    if (md) {\n      requirements.metadataSource = source;\n      if (typeof md.authorization_endpoint === 'string') {\n        requirements.authorizationEndpoint = sanitizeDisplay(md.authorization_endpoint);\n      }\n      if (typeof md.token_endpoint === 'string') {\n        requirements.tokenEndpoint = sanitizeDisplay(md.token_endpoint);\n      }\n      if (typeof md.registration_endpoint === 'string') {\n        requirements.registrationEndpoint = sanitizeDisplay(md.registration_endpoint);\n      }\n      if (Array.isArray(md.scopes_supported)) {\n        const scopes = md.scopes_supported\n          .filter((s: unknown): s is string => typeof s === 'string')\n          .slice(0, MAX_SCOPES)\n          .map(sanitizeDisplay);\n        if (scopes.length > 0) requirements.scopesSupported = scopes;\n      }\n      if (Array.isArray(md.grant_types_supported)) {\n        const grants = md.grant_types_supported\n          .filter((g: unknown): g is string => typeof g === 'string')\n          .slice(0, 32)\n          .map(sanitizeDisplay);\n        if (grants.length > 0) requirements.grantTypesSupported = grants;\n      }\n    }\n  }\n\n  return requirements;\n}\n\n/**\n * Probe the agent for the parsed `WWW-Authenticate` challenge on a 401.\n *\n * Where `discoverAuthorizationRequirements` walks the full RFC 9728 → 8414\n * chain for Bearer/OAuth challenges, this helper is the catch-all: it works\n * for ANY scheme (Basic, Digest, Bearer-without-PRM, …) and returns the\n * structured challenge so callers can surface scheme-specific remediation\n * (e.g. \"use `--auth-scheme basic`\" when the gateway speaks RFC 7617).\n *\n * Returns `null` when the agent isn't responding with a 401, or when the\n * response carries no parseable `WWW-Authenticate`. Reuses `probeAgent401`\n * so the SSRF gate and timeout policy stay consistent with the OAuth path.\n */\nexport async function probeAuthChallenge(\n  agentUrl: string,\n  options: { allowPrivateIp?: boolean; timeoutMs?: number } = {}\n): Promise<WWWAuthenticateChallenge | null> {\n  const probe = await probeAgent401(agentUrl, options.allowPrivateIp ?? false, options.timeoutMs);\n  if (probe.status !== 401) return null;\n  return parseWWWAuthenticate(probe.wwwAuthenticate ?? null);\n}\n\n/**\n * Fire a single unauthenticated `tools/list` at the agent and return the\n * status + `WWW-Authenticate` header. Used when the caller hasn't provided\n * a cached 401 response.\n */\nasync function probeAgent401(\n  agentUrl: string,\n  allowPrivateIp: boolean,\n  timeoutMs?: number\n): Promise<{ status: number; wwwAuthenticate?: string }> {\n  const body = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' });\n  try {\n    const res = await ssrfSafeFetch(agentUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json',\n      },\n      body,\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n    });\n    return { status: res.status, wwwAuthenticate: res.headers['www-authenticate'] };\n  } catch {\n    return { status: 0 };\n  }\n}\n\n/**\n * Check a URL is an absolute `http:`/`https:` URL before we hand it to\n * `ssrfSafeFetch`. Defeats `javascript:`, `file:`, `data:`, etc. the agent\n * might echo back in PRM or AS metadata. `ssrfSafeFetch` refuses non-HTTP\n * schemes too, but failing fast here gives a cleaner discovery flow and\n * avoids surfacing scheme errors as mysterious discovery misses.\n */\nfunction originOf(value: string): string | undefined {\n  try {\n    return new URL(value).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isSafeHttpUrl(value: string): boolean {\n  try {\n    const u = new URL(value);\n    return u.protocol === 'https:' || u.protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Build the authorization-server metadata URL for an issuer per RFC 8414 §3.\n *\n * For issuer `https://as.example.com/tenant1`, metadata lives at\n * `https://as.example.com/.well-known/oauth-authorization-server/tenant1`\n * (well-known prefix inserted BEFORE the issuer path, not after). This\n * matches how the MCP SDK and most authorization servers advertise metadata.\n */\nfunction buildAuthorizationServerMetadataUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const pathname = u.pathname.endsWith('/') ? u.pathname.slice(0, -1) : u.pathname;\n  return `${u.origin}/.well-known/oauth-authorization-server${pathname}`;\n}\n\n/**\n * OpenID Connect Discovery 1.0 fallback URL. Some authorization servers\n * (Keycloak in OIDC mode, Ping, ADFS) only publish metadata at\n * `{issuer}/.well-known/openid-configuration` — path *suffixed*, not\n * prefixed. The OIDC discovery doc carries `token_endpoint`,\n * `authorization_endpoint`, and `grant_types_supported` with the same\n * semantics as RFC 8414, so it's a safe read-through when the RFC 8414\n * probe misses.\n */\nfunction buildOidcDiscoveryUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const base = u.pathname.endsWith('/') ? `${u.origin}${u.pathname.slice(0, -1)}` : `${u.origin}${u.pathname}`;\n  return `${base}/.well-known/openid-configuration`;\n}\n\nasync function fetchJson(url: string, allowPrivateIp: boolean, timeoutMs?: number): Promise<unknown> {\n  try {\n    const res = await ssrfSafeFetch(url, {\n      method: 'GET',\n      headers: { accept: 'application/json' },\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n    });\n    if (res.status !== 200) return undefined;\n    return decodeBodyAsJsonOrText(res.body, res.headers['content-type']);\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":"AAYA,SAAS,eAAe,8BAA8B;AACtD,SAAS,mCAA2D;AACpE,SAAS,4BAA2D;AAQpE,MAAM,qBAAqB;AAM3B,MAAM,aAAa;AAOnB,MAAM,uBAAuB;AAQ7B,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,WAAW,MAAM,QAAQ,6BAA6B,EAAE;AAC9D,MAAI,SAAS,UAAU,mBAAoB,QAAO;AAClD,SAAO,GAAG,SAAS,MAAM,GAAG,qBAAqB,CAAC,CAAC;AACrD;AAYA,SAAS,kBAAkB,GAAuD;AAChF,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,MAAM,GAAG;AAC7C,QAAI,OAAO,KAAK,MAAM,EAAE,UAAU,qBAAsB;AACxD,WAAO,CAAC,IAAI,gBAAgB,CAAC;AAAA,EAC/B;AACA,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG;AAAA,EACF;AACF;AAwEO,MAAM,gCAAgC,4BAA4B;AAAA;AAAA,EAE9D,UAAU;AAAA,EACV;AAAA,EAET,YAAY,cAAyC,SAAkB;AACrE,UAAM,aAAa,UAAU,wBAAwB,YAAY,GAAG,WAAW,eAAe,YAAY,CAAC;AAC3G,SAAK,OAAO;AACZ,SAAK,eAAe;AAIpB,SAAK,UAAU,EAAE,GAAI,KAAK,SAAgC,aAAa;AAAA,EACzE;AACF;AASA,SAAS,wBAAwB,KAA+D;AAC9F,MAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,cAAe,QAAO;AAC7D,SAAO;AAAA,IACL,wBAAwB,IAAI;AAAA,IAC5B,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,uBAAuB,EAAE,uBAAuB,IAAI,qBAAqB,IAAI,CAAC;AAAA,IACtF,GAAI,IAAI,sBAAsB,EAAE,QAAQ,IAAI,oBAAoB,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,SAAS,eAAe,KAAwC;AAC9D,QAAM,QAAQ,CAAC,SAAS,gBAAgB,IAAI,QAAQ,CAAC,gCAAgC;AACrF,MAAI,IAAI,qBAAqB;AAC3B,UAAM,KAAK,yBAAyB,IAAI,mBAAmB,GAAG;AAAA,EAChE;AACA,MAAI,IAAI,UAAU,mBAAmB;AACnC,UAAM,KAAK,gBAAgB,gBAAgB,IAAI,UAAU,iBAAiB,CAAC,GAAG;AAAA,EAChF;AACA,QAAM,KAAK,mFAAmF;AAC9F,SAAO,MAAM,KAAK,GAAG;AACvB;AAoCA,eAAsB,kCACpB,UACA,UAAwC,CAAC,GACE;AAM3C,QAAM,wBAAwB,QAAQ,kBAAkB;AACxD,QAAM,cAAc,SAAS,QAAQ;AACrC,QAAM,uBAAuB,CAAC,QAC5B,yBAAyB,gBAAgB,UAAa,SAAS,GAAG,MAAM;AAE1E,MAAI,kBAAkB,QAAQ;AAC9B,MAAI,CAAC,iBAAiB;AACpB,UAAM,QAAQ,MAAM,cAAc,UAAU,uBAAuB,QAAQ,SAAS;AACpF,QAAI,MAAM,WAAW,KAAK;AAExB,aAAO;AAAA,IACT;AACA,sBAAkB,MAAM;AAAA,EAC1B;AAEA,QAAM,YAAY,qBAAqB,mBAAmB,IAAI;AAC9D,MAAI,CAAC,aAAa,UAAU,WAAW,UAAU;AAE/C,WAAO;AAAA,EACT;AAEA,QAAM,eAA0C;AAAA,IAC9C;AAAA,IACA,qBAAqB,UAAU,oBAAoB,gBAAgB,UAAU,iBAAiB,IAAI;AAAA,IAClG,gBAAgB,UAAU,QAAQ,gBAAgB,UAAU,KAAK,IAAI;AAAA,IACrE,WAAW,kBAAkB,SAAS;AAAA,EACxC;AAIA,MAAI,UAAU,qBAAqB,cAAc,UAAU,iBAAiB,GAAG;AAC7E,UAAM,MAAM,MAAM;AAAA,MAChB,UAAU;AAAA,MACV,qBAAqB,UAAU,iBAAiB;AAAA,MAChD,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,YAAM,WAAY,IAA+B;AACjD,YAAM,UAAW,IAA4C;AAC7D,UAAI,OAAO,aAAa,SAAU,cAAa,WAAW,gBAAgB,QAAQ;AAClF,UAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,cAAM,eAAe,QAClB,OAAO,CAAC,MAA4B,OAAO,MAAM,YAAY,cAAc,CAAC,CAAC,EAC7E,IAAI,eAAe;AACtB,YAAI,aAAa,SAAS,GAAG;AAC3B,uBAAa,uBAAuB;AACpC,uBAAa,sBAAsB,aAAa,CAAC;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,MAAI,aAAa,qBAAqB;AACpC,UAAM,QAAQ,oCAAoC,aAAa,mBAAmB;AAClF,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,UAAU,OAAO,qBAAqB,KAAK,GAAG,QAAQ,SAAS;AACjF,UAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,aAAK;AACL,iBAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,UAAU,sBAAsB,aAAa,mBAAmB;AACtE,UAAI,SAAS;AACX,cAAM,MAAM,MAAM,UAAU,SAAS,qBAAqB,OAAO,GAAG,QAAQ,SAAS;AACrF,YAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,eAAK;AACL,mBAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI;AACN,mBAAa,iBAAiB;AAC9B,UAAI,OAAO,GAAG,2BAA2B,UAAU;AACjD,qBAAa,wBAAwB,gBAAgB,GAAG,sBAAsB;AAAA,MAChF;AACA,UAAI,OAAO,GAAG,mBAAmB,UAAU;AACzC,qBAAa,gBAAgB,gBAAgB,GAAG,cAAc;AAAA,MAChE;AACA,UAAI,OAAO,GAAG,0BAA0B,UAAU;AAChD,qBAAa,uBAAuB,gBAAgB,GAAG,qBAAqB;AAAA,MAC9E;AACA,UAAI,MAAM,QAAQ,GAAG,gBAAgB,GAAG;AACtC,cAAM,SAAS,GAAG,iBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,UAAU,EACnB,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,kBAAkB;AAAA,MACxD;AACA,UAAI,MAAM,QAAQ,GAAG,qBAAqB,GAAG;AAC3C,cAAM,SAAS,GAAG,sBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,EAAE,EACX,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,sBAAsB;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAeA,eAAsB,mBACpB,UACA,UAA4D,CAAC,GACnB;AAC1C,QAAM,QAAQ,MAAM,cAAc,UAAU,QAAQ,kBAAkB,OAAO,QAAQ,SAAS;AAC9F,MAAI,MAAM,WAAW,IAAK,QAAO;AACjC,SAAO,qBAAqB,MAAM,mBAAmB,IAAI;AAC3D;AAOA,eAAe,cACb,UACA,gBACA,WACuD;AACvD,QAAM,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,aAAa,CAAC;AAC3E,MAAI;AACF,UAAM,MAAM,MAAM,cAAc,UAAU;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,WAAO,EAAE,QAAQ,IAAI,QAAQ,iBAAiB,IAAI,QAAQ,kBAAkB,EAAE;AAAA,EAChF,QAAQ;AACN,WAAO,EAAE,QAAQ,EAAE;AAAA,EACrB;AACF;AASA,SAAS,SAAS,OAAmC;AACnD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,KAAK;AACvB,WAAO,EAAE,aAAa,YAAY,EAAE,aAAa;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,SAAS,oCAAoC,QAAoC;AAC/E,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,WAAW,EAAE,SAAS,SAAS,GAAG,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE,IAAI,EAAE;AACxE,SAAO,GAAG,EAAE,MAAM,0CAA0C,QAAQ;AACtE;AAWA,SAAS,sBAAsB,QAAoC;AACjE,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,OAAO,EAAE,SAAS,SAAS,GAAG,IAAI,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC1G,SAAO,GAAG,IAAI;AAChB;AAEA,eAAe,UAAU,KAAa,gBAAyB,WAAsC;AACnG,MAAI;AACF,UAAM,MAAM,MAAM,cAAc,KAAK;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACtC;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,QAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,WAAO,uBAAuB,IAAI,MAAM,IAAI,QAAQ,cAAc,CAAC;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/authorization-required.ts"],"sourcesContent":["/**\n * Zero-config OAuth discovery + actionable authorization errors.\n *\n * When a library consumer calls an OAuth-gated MCP agent without saved\n * credentials, they get a `NeedsAuthorizationError` containing everything\n * needed to either run an interactive flow or present a clear prompt — no\n * re-probing required.\n *\n * Design note: this module only *discovers* — it never opens a browser or\n * writes state. Interactive flow handling stays in the caller (CLI or a\n * bespoke `OAuthFlowHandler`) so library behavior is predictable.\n */\nimport { ssrfSafeFetch, decodeBodyAsJsonOrText } from '../../net';\nimport { AuthenticationRequiredError, type OAuthMetadataInfo } from '../../errors';\nimport { parseWWWAuthenticate, type WWWAuthenticateChallenge } from './diagnostics';\n\n/**\n * Maximum length of an individual server-supplied string we copy into the\n * `AuthorizationRequirements` payload. Anything longer is truncated with a\n * `…` suffix so hostile agents can't smuggle megabyte error-descriptions\n * into operator-facing prompts and logs.\n */\nconst MAX_DISPLAY_STRING = 256;\n\n/**\n * Maximum number of scope strings we copy into `scopesSupported`. RFC 8414\n * allows an unbounded array; hostile servers have sent thousands.\n */\nconst MAX_SCOPES = 64;\n\n/**\n * Maximum number of auth-params we preserve under `challenge.params`. Bounds\n * memory pressure from hostile servers that pack the `WWW-Authenticate`\n * header with unknown auth-params.\n */\nconst MAX_CHALLENGE_PARAMS = 32;\n\n/**\n * Strip ASCII control characters (excluding TAB) from a server-supplied\n * string that may be shown to a human. Defeats terminal-hijack tricks like\n * `\\x1b]0;pwned\\x07` (rewrites terminal title), `\\r` (overwrites prompt),\n * and `\\x1b[2J` (clears screen). Also truncates over-long values.\n */\nfunction sanitizeDisplay(value: string): string {\n  const stripped = value.replace(/[\\x00-\\x08\\x0b-\\x1f\\x7f]/g, '');\n  if (stripped.length <= MAX_DISPLAY_STRING) return stripped;\n  return `${stripped.slice(0, MAX_DISPLAY_STRING - 1)}…`;\n}\n\n/**\n * Sanitize the parsed `WWW-Authenticate` challenge before embedding it in a\n * `NeedsAuthorizationError`. Consumers that render `requirements.challenge`\n * to a terminal should never see control characters. Caps `params` count to\n * bound hostile servers.\n *\n * The `scheme` is already lowercased + token-constrained by the parser.\n * Param keys are also token-constrained so they're safe; only values need\n * sanitizing.\n */\nfunction sanitizeChallenge(c: WWWAuthenticateChallenge): WWWAuthenticateChallenge {\n  const params: Record<string, string> = {};\n  for (const [k, v] of Object.entries(c.params)) {\n    if (Object.keys(params).length >= MAX_CHALLENGE_PARAMS) break;\n    params[k] = sanitizeDisplay(v);\n  }\n  return {\n    scheme: c.scheme,\n    ...(c.realm !== undefined ? { realm: sanitizeDisplay(c.realm) } : {}),\n    ...(c.error !== undefined ? { error: sanitizeDisplay(c.error) } : {}),\n    ...(c.error_description !== undefined ? { error_description: sanitizeDisplay(c.error_description) } : {}),\n    ...(c.scope !== undefined ? { scope: sanitizeDisplay(c.scope) } : {}),\n    ...(c.resource_metadata !== undefined ? { resource_metadata: sanitizeDisplay(c.resource_metadata) } : {}),\n    params,\n  };\n}\n\n/**\n * Structured description of what an agent's authorization server requires\n * before it will accept a `tools/call`. Produced by\n * {@link discoverAuthorizationRequirements}.\n */\nexport interface AuthorizationRequirements {\n  /** The agent URL we probed. */\n  agentUrl: string;\n  /** Resource URL the agent advertises in its `WWW-Authenticate` / PRM (RFC 9728). */\n  resource?: string;\n  /** URL of the protected-resource-metadata document (from `WWW-Authenticate: resource_metadata=…`). */\n  resourceMetadataUrl?: string;\n  /** First `authorization_servers[0]` from the protected-resource metadata. */\n  authorizationServer?: string;\n  /**\n   * All `authorization_servers` advertised by the PRM, in declaration order.\n   * The walker only probes `[0]` (PRM preference order — see RFC 9728 §3.3);\n   * the full list is exposed so callers can surface multi-issuer deployments\n   * in diagnostics. A length > 1 is uncommon and worth flagging to the\n   * operator — typically a federation partner or a staged migration.\n   */\n  authorizationServers?: string[];\n  /** `authorization_endpoint` from the authorization-server metadata (RFC 8414). */\n  authorizationEndpoint?: string;\n  /** `token_endpoint` from the authorization-server metadata. */\n  tokenEndpoint?: string;\n  /** `registration_endpoint` if the AS supports RFC 7591 dynamic client registration. */\n  registrationEndpoint?: string;\n  /** Scopes advertised by the AS (RFC 8414 `scopes_supported`). */\n  scopesSupported?: string[];\n  /**\n   * `grant_types_supported` advertised by the AS (RFC 8414). `undefined` when\n   * the AS didn't publish the field — per RFC 8414 that defaults to\n   * `[\"authorization_code\", \"implicit\"]`. Clients should treat absence as\n   * \"unknown, try your grant and see,\" not as proof the grant is unsupported.\n   */\n  grantTypesSupported?: string[];\n  /** True when the AS metadata came from the OIDC fallback URL rather than RFC 8414. */\n  metadataSource?: 'rfc-8414' | 'openid-configuration';\n  /** Scope hinted in the `WWW-Authenticate` challenge's `scope` auth-param. */\n  challengeScope?: string;\n  /** Raw parsed challenge the agent returned on the 401. */\n  challenge: WWWAuthenticateChallenge;\n}\n\n/**\n * Error raised when an agent returns a 401 and we do not have credentials\n * to satisfy it. Carries everything needed to run an interactive OAuth flow\n * or show the operator an actionable prompt.\n *\n * Extends {@link AuthenticationRequiredError} so existing callers that catch\n * `AuthenticationRequiredError` automatically receive the richer variant —\n * they can downcast with `instanceof NeedsAuthorizationError` when they\n * want walked discovery metadata.\n *\n * Note on `code` vs `subCode`:\n *   The parent class declares `readonly code = 'AUTHENTICATION_REQUIRED'` as\n *   a class field that re-initializes on every construction, so a child-side\n *   override attempt is silently overwritten under `useDefineForClassFields`.\n *   The narrow discriminator is exposed as `subCode` — prefer\n *   `instanceof NeedsAuthorizationError` for type-narrowing and use `subCode`\n *   only for structured-log keying.\n *\n * Note on `hasOAuth`:\n *   The inherited getter returns `true` only when both `authorization_endpoint`\n *   and `token_endpoint` were walked successfully. A partially-walked\n *   requirements record (PRM reachable but AS metadata missing) still yields\n *   `hasOAuth === false` even though `requirements.authorizationServer` is set.\n *   Treat it as \"we have enough to start a flow,\" not \"server wants OAuth.\"\n */\nexport class NeedsAuthorizationError extends AuthenticationRequiredError {\n  /** Narrow discriminator for consumers that already know about this class. */\n  readonly subCode = 'needs_authorization' as const;\n  readonly requirements: AuthorizationRequirements;\n\n  constructor(requirements: AuthorizationRequirements, message?: string) {\n    super(requirements.agentUrl, synthesizeOAuthMetadata(requirements), message ?? defaultMessage(requirements));\n    this.name = 'NeedsAuthorizationError';\n    this.requirements = requirements;\n    // Extend the parent's `details` payload so structured-logging consumers\n    // that read `err.details` (via `extractErrorInfo` or equivalent) see the\n    // full walked chain, not just the synthesized one-hop oauthMetadata.\n    this.details = { ...(this.details as object | undefined), requirements };\n  }\n}\n\n/**\n * Build an {@link OAuthMetadataInfo} for the base-class constructor so that\n * legacy callers still see a non-empty `oauthMetadata` + working\n * `hasOAuth`/`authorizationUrl` getters on the error. When discovery didn't\n * yield enough info, return undefined and let the base class degrade\n * gracefully.\n */\nfunction synthesizeOAuthMetadata(req: AuthorizationRequirements): OAuthMetadataInfo | undefined {\n  if (!req.authorizationEndpoint || !req.tokenEndpoint) return undefined;\n  return {\n    authorization_endpoint: req.authorizationEndpoint,\n    token_endpoint: req.tokenEndpoint,\n    ...(req.registrationEndpoint ? { registration_endpoint: req.registrationEndpoint } : {}),\n    ...(req.authorizationServer ? { issuer: req.authorizationServer } : {}),\n  };\n}\n\nfunction defaultMessage(req: AuthorizationRequirements): string {\n  const parts = [`Agent ${sanitizeDisplay(req.agentUrl)} requires OAuth authorization.`];\n  if (req.authorizationServer) {\n    parts.push(`Authorization server: ${req.authorizationServer}.`);\n  }\n  if (req.challenge.error_description) {\n    parts.push(`Server said: ${sanitizeDisplay(req.challenge.error_description)}.`);\n  }\n  parts.push('Provide an OAuthFlowHandler or run an interactive flow to complete authorization.');\n  return parts.join(' ');\n}\n\n/**\n * Options for {@link discoverAuthorizationRequirements}.\n */\nexport interface DiscoverAuthorizationOptions {\n  /** Allow http:// and private-IP probe targets. Default false. */\n  allowPrivateIp?: boolean;\n  /** Override per-probe HTTP timeout (ms). Default inherits from ssrfSafeFetch (10s). */\n  timeoutMs?: number;\n  /** Scoped fetch implementation for the agent, PRM, and AS metadata probes. */\n  fetchFn?: typeof fetch;\n  /**\n   * If provided, use this `WWW-Authenticate` header verbatim instead of\n   * re-probing the agent. Use this when you already have a 401 response in\n   * hand and want to avoid a second round-trip.\n   */\n  wwwAuthenticate?: string;\n}\n\n/**\n * Walk the OAuth discovery chain starting from an agent URL. Returns\n * `AuthorizationRequirements` when the agent demands OAuth, or `null` when a\n * `tools/list` call succeeds without credentials.\n *\n * Strategy:\n *   1. POST `tools/list` to the agent with no `Authorization` header.\n *   2. If 401 + `WWW-Authenticate: Bearer`: parse the challenge.\n *   3. If the challenge carries `resource_metadata=…`: GET it and read\n *      `resource` + `authorization_servers`.\n *   4. For the first `authorization_servers[0]`: GET `/.well-known/oauth-authorization-server`\n *      and read `authorization_endpoint`, `token_endpoint`, `registration_endpoint`,\n *      `scopes_supported`.\n *   5. Return a structured record.\n *\n * Anything missing from the chain surfaces as `undefined` on the result —\n * callers can still present a partial picture without re-probing.\n */\nexport async function discoverAuthorizationRequirements(\n  agentUrl: string,\n  options: DiscoverAuthorizationOptions = {}\n): Promise<AuthorizationRequirements | null> {\n  // `allowPrivateIp` authorizes the agent probe. Chain hops (PRM, AS\n  // metadata) inherit that trust ONLY when they share the agent's origin —\n  // a compromised agent that advertises a private-IP authorization server\n  // on a different origin would otherwise pivot a discovery walk into the\n  // host's internal network.\n  const allowPrivateIpOnAgent = options.allowPrivateIp ?? false;\n  const agentOrigin = originOf(agentUrl);\n  const allowPrivateIpForHop = (url: string): boolean =>\n    allowPrivateIpOnAgent && agentOrigin !== undefined && originOf(url) === agentOrigin;\n\n  let challengeHeader = options.wwwAuthenticate;\n  if (!challengeHeader) {\n    const probe = await probeAgent401(agentUrl, allowPrivateIpOnAgent, options.timeoutMs, options.fetchFn);\n    if (probe.status !== 401) {\n      // 200, 403, 5xx, or network error — not an OAuth 401 we can act on.\n      return null;\n    }\n    challengeHeader = probe.wwwAuthenticate;\n  }\n\n  const challenge = parseWWWAuthenticate(challengeHeader ?? null);\n  if (!challenge || challenge.scheme !== 'bearer') {\n    // A 401 without a Bearer challenge isn't our kind of problem — let it propagate.\n    return null;\n  }\n\n  const requirements: AuthorizationRequirements = {\n    agentUrl,\n    resourceMetadataUrl: challenge.resource_metadata ? sanitizeDisplay(challenge.resource_metadata) : undefined,\n    challengeScope: challenge.scope ? sanitizeDisplay(challenge.scope) : undefined,\n    challenge: sanitizeChallenge(challenge),\n  };\n\n  // Walk protected-resource metadata (RFC 9728 §3). Private-IP targets are\n  // only allowed when the hop's origin matches the agent's.\n  if (challenge.resource_metadata && isSafeHttpUrl(challenge.resource_metadata)) {\n    const prm = await fetchJson(\n      challenge.resource_metadata,\n      allowPrivateIpForHop(challenge.resource_metadata),\n      options.timeoutMs,\n      options.fetchFn\n    );\n    if (prm && typeof prm === 'object') {\n      const resource = (prm as { resource?: unknown }).resource;\n      const servers = (prm as { authorization_servers?: unknown }).authorization_servers;\n      if (typeof resource === 'string') requirements.resource = sanitizeDisplay(resource);\n      if (Array.isArray(servers)) {\n        const validServers = servers\n          .filter((s: unknown): s is string => typeof s === 'string' && isSafeHttpUrl(s))\n          .map(sanitizeDisplay);\n        if (validServers.length > 0) {\n          requirements.authorizationServers = validServers;\n          requirements.authorizationServer = validServers[0];\n        }\n      }\n    }\n  }\n\n  // Walk authorization-server metadata using the first issuer. RFC 8414 §3\n  // first, then OIDC Discovery 1.0 fallback for AS deployments (Keycloak in\n  // OIDC mode, Ping, ADFS) that only publish at\n  // `{issuer}/.well-known/openid-configuration`.\n  if (requirements.authorizationServer) {\n    const asUrl = buildAuthorizationServerMetadataUrl(requirements.authorizationServer);\n    let md: Record<string, unknown> | undefined;\n    let source: 'rfc-8414' | 'openid-configuration' | undefined;\n    if (asUrl) {\n      const res = await fetchJson(asUrl, allowPrivateIpForHop(asUrl), options.timeoutMs, options.fetchFn);\n      if (res && typeof res === 'object') {\n        md = res as Record<string, unknown>;\n        source = 'rfc-8414';\n      }\n    }\n    if (!md) {\n      const oidcUrl = buildOidcDiscoveryUrl(requirements.authorizationServer);\n      if (oidcUrl) {\n        const res = await fetchJson(oidcUrl, allowPrivateIpForHop(oidcUrl), options.timeoutMs, options.fetchFn);\n        if (res && typeof res === 'object') {\n          md = res as Record<string, unknown>;\n          source = 'openid-configuration';\n        }\n      }\n    }\n    if (md) {\n      requirements.metadataSource = source;\n      if (typeof md.authorization_endpoint === 'string') {\n        requirements.authorizationEndpoint = sanitizeDisplay(md.authorization_endpoint);\n      }\n      if (typeof md.token_endpoint === 'string') {\n        requirements.tokenEndpoint = sanitizeDisplay(md.token_endpoint);\n      }\n      if (typeof md.registration_endpoint === 'string') {\n        requirements.registrationEndpoint = sanitizeDisplay(md.registration_endpoint);\n      }\n      if (Array.isArray(md.scopes_supported)) {\n        const scopes = md.scopes_supported\n          .filter((s: unknown): s is string => typeof s === 'string')\n          .slice(0, MAX_SCOPES)\n          .map(sanitizeDisplay);\n        if (scopes.length > 0) requirements.scopesSupported = scopes;\n      }\n      if (Array.isArray(md.grant_types_supported)) {\n        const grants = md.grant_types_supported\n          .filter((g: unknown): g is string => typeof g === 'string')\n          .slice(0, 32)\n          .map(sanitizeDisplay);\n        if (grants.length > 0) requirements.grantTypesSupported = grants;\n      }\n    }\n  }\n\n  return requirements;\n}\n\n/**\n * Probe the agent for the parsed `WWW-Authenticate` challenge on a 401.\n *\n * Where `discoverAuthorizationRequirements` walks the full RFC 9728 → 8414\n * chain for Bearer/OAuth challenges, this helper is the catch-all: it works\n * for ANY scheme (Basic, Digest, Bearer-without-PRM, …) and returns the\n * structured challenge so callers can surface scheme-specific remediation\n * (e.g. \"use `--auth-scheme basic`\" when the gateway speaks RFC 7617).\n *\n * Returns `null` when the agent isn't responding with a 401, or when the\n * response carries no parseable `WWW-Authenticate`. Reuses `probeAgent401`\n * so the SSRF gate and timeout policy stay consistent with the OAuth path.\n */\nexport async function probeAuthChallenge(\n  agentUrl: string,\n  options: { allowPrivateIp?: boolean; timeoutMs?: number; fetchFn?: typeof fetch } = {}\n): Promise<WWWAuthenticateChallenge | null> {\n  const probe = await probeAgent401(agentUrl, options.allowPrivateIp ?? false, options.timeoutMs, options.fetchFn);\n  if (probe.status !== 401) return null;\n  return parseWWWAuthenticate(probe.wwwAuthenticate ?? null);\n}\n\n/**\n * Fire a single unauthenticated `tools/list` at the agent and return the\n * status + `WWW-Authenticate` header. Used when the caller hasn't provided\n * a cached 401 response.\n */\nasync function probeAgent401(\n  agentUrl: string,\n  allowPrivateIp: boolean,\n  timeoutMs?: number,\n  fetchFn?: typeof fetch\n): Promise<{ status: number; wwwAuthenticate?: string }> {\n  const body = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' });\n  try {\n    const res = await ssrfSafeFetch(agentUrl, {\n      method: 'POST',\n      headers: {\n        'content-type': 'application/json',\n        accept: 'application/json',\n      },\n      body,\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n      ...(fetchFn ? { trustedFetchFn: fetchFn } : {}),\n    });\n    return { status: res.status, wwwAuthenticate: res.headers['www-authenticate'] };\n  } catch {\n    return { status: 0 };\n  }\n}\n\n/**\n * Check a URL is an absolute `http:`/`https:` URL before we hand it to\n * `ssrfSafeFetch`. Defeats `javascript:`, `file:`, `data:`, etc. the agent\n * might echo back in PRM or AS metadata. `ssrfSafeFetch` refuses non-HTTP\n * schemes too, but failing fast here gives a cleaner discovery flow and\n * avoids surfacing scheme errors as mysterious discovery misses.\n */\nfunction originOf(value: string): string | undefined {\n  try {\n    return new URL(value).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isSafeHttpUrl(value: string): boolean {\n  try {\n    const u = new URL(value);\n    return u.protocol === 'https:' || u.protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Build the authorization-server metadata URL for an issuer per RFC 8414 §3.\n *\n * For issuer `https://as.example.com/tenant1`, metadata lives at\n * `https://as.example.com/.well-known/oauth-authorization-server/tenant1`\n * (well-known prefix inserted BEFORE the issuer path, not after). This\n * matches how the MCP SDK and most authorization servers advertise metadata.\n */\nfunction buildAuthorizationServerMetadataUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const pathname = u.pathname.endsWith('/') ? u.pathname.slice(0, -1) : u.pathname;\n  return `${u.origin}/.well-known/oauth-authorization-server${pathname}`;\n}\n\n/**\n * OpenID Connect Discovery 1.0 fallback URL. Some authorization servers\n * (Keycloak in OIDC mode, Ping, ADFS) only publish metadata at\n * `{issuer}/.well-known/openid-configuration` — path *suffixed*, not\n * prefixed. The OIDC discovery doc carries `token_endpoint`,\n * `authorization_endpoint`, and `grant_types_supported` with the same\n * semantics as RFC 8414, so it's a safe read-through when the RFC 8414\n * probe misses.\n */\nfunction buildOidcDiscoveryUrl(issuer: string): string | undefined {\n  if (!isSafeHttpUrl(issuer)) return undefined;\n  const u = new URL(issuer);\n  const base = u.pathname.endsWith('/') ? `${u.origin}${u.pathname.slice(0, -1)}` : `${u.origin}${u.pathname}`;\n  return `${base}/.well-known/openid-configuration`;\n}\n\nasync function fetchJson(\n  url: string,\n  allowPrivateIp: boolean,\n  timeoutMs?: number,\n  fetchFn?: typeof fetch\n): Promise<unknown> {\n  try {\n    const res = await ssrfSafeFetch(url, {\n      method: 'GET',\n      headers: { accept: 'application/json' },\n      allowPrivateIp,\n      ...(timeoutMs !== undefined ? { timeoutMs } : {}),\n      ...(fetchFn ? { trustedFetchFn: fetchFn } : {}),\n    });\n    if (res.status !== 200) return undefined;\n    return decodeBodyAsJsonOrText(res.body, res.headers['content-type']);\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":"AAYA,SAAS,eAAe,8BAA8B;AACtD,SAAS,mCAA2D;AACpE,SAAS,4BAA2D;AAQpE,MAAM,qBAAqB;AAM3B,MAAM,aAAa;AAOnB,MAAM,uBAAuB;AAQ7B,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,WAAW,MAAM,QAAQ,6BAA6B,EAAE;AAC9D,MAAI,SAAS,UAAU,mBAAoB,QAAO;AAClD,SAAO,GAAG,SAAS,MAAM,GAAG,qBAAqB,CAAC,CAAC;AACrD;AAYA,SAAS,kBAAkB,GAAuD;AAChF,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,MAAM,GAAG;AAC7C,QAAI,OAAO,KAAK,MAAM,EAAE,UAAU,qBAAsB;AACxD,WAAO,CAAC,IAAI,gBAAgB,CAAC;AAAA,EAC/B;AACA,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG,GAAI,EAAE,UAAU,SAAY,EAAE,OAAO,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,IACnE,GAAI,EAAE,sBAAsB,SAAY,EAAE,mBAAmB,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,CAAC;AAAA,IACvG;AAAA,EACF;AACF;AAwEO,MAAM,gCAAgC,4BAA4B;AAAA;AAAA,EAE9D,UAAU;AAAA,EACV;AAAA,EAET,YAAY,cAAyC,SAAkB;AACrE,UAAM,aAAa,UAAU,wBAAwB,YAAY,GAAG,WAAW,eAAe,YAAY,CAAC;AAC3G,SAAK,OAAO;AACZ,SAAK,eAAe;AAIpB,SAAK,UAAU,EAAE,GAAI,KAAK,SAAgC,aAAa;AAAA,EACzE;AACF;AASA,SAAS,wBAAwB,KAA+D;AAC9F,MAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,cAAe,QAAO;AAC7D,SAAO;AAAA,IACL,wBAAwB,IAAI;AAAA,IAC5B,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,uBAAuB,EAAE,uBAAuB,IAAI,qBAAqB,IAAI,CAAC;AAAA,IACtF,GAAI,IAAI,sBAAsB,EAAE,QAAQ,IAAI,oBAAoB,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,SAAS,eAAe,KAAwC;AAC9D,QAAM,QAAQ,CAAC,SAAS,gBAAgB,IAAI,QAAQ,CAAC,gCAAgC;AACrF,MAAI,IAAI,qBAAqB;AAC3B,UAAM,KAAK,yBAAyB,IAAI,mBAAmB,GAAG;AAAA,EAChE;AACA,MAAI,IAAI,UAAU,mBAAmB;AACnC,UAAM,KAAK,gBAAgB,gBAAgB,IAAI,UAAU,iBAAiB,CAAC,GAAG;AAAA,EAChF;AACA,QAAM,KAAK,mFAAmF;AAC9F,SAAO,MAAM,KAAK,GAAG;AACvB;AAsCA,eAAsB,kCACpB,UACA,UAAwC,CAAC,GACE;AAM3C,QAAM,wBAAwB,QAAQ,kBAAkB;AACxD,QAAM,cAAc,SAAS,QAAQ;AACrC,QAAM,uBAAuB,CAAC,QAC5B,yBAAyB,gBAAgB,UAAa,SAAS,GAAG,MAAM;AAE1E,MAAI,kBAAkB,QAAQ;AAC9B,MAAI,CAAC,iBAAiB;AACpB,UAAM,QAAQ,MAAM,cAAc,UAAU,uBAAuB,QAAQ,WAAW,QAAQ,OAAO;AACrG,QAAI,MAAM,WAAW,KAAK;AAExB,aAAO;AAAA,IACT;AACA,sBAAkB,MAAM;AAAA,EAC1B;AAEA,QAAM,YAAY,qBAAqB,mBAAmB,IAAI;AAC9D,MAAI,CAAC,aAAa,UAAU,WAAW,UAAU;AAE/C,WAAO;AAAA,EACT;AAEA,QAAM,eAA0C;AAAA,IAC9C;AAAA,IACA,qBAAqB,UAAU,oBAAoB,gBAAgB,UAAU,iBAAiB,IAAI;AAAA,IAClG,gBAAgB,UAAU,QAAQ,gBAAgB,UAAU,KAAK,IAAI;AAAA,IACrE,WAAW,kBAAkB,SAAS;AAAA,EACxC;AAIA,MAAI,UAAU,qBAAqB,cAAc,UAAU,iBAAiB,GAAG;AAC7E,UAAM,MAAM,MAAM;AAAA,MAChB,UAAU;AAAA,MACV,qBAAqB,UAAU,iBAAiB;AAAA,MAChD,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,YAAM,WAAY,IAA+B;AACjD,YAAM,UAAW,IAA4C;AAC7D,UAAI,OAAO,aAAa,SAAU,cAAa,WAAW,gBAAgB,QAAQ;AAClF,UAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,cAAM,eAAe,QAClB,OAAO,CAAC,MAA4B,OAAO,MAAM,YAAY,cAAc,CAAC,CAAC,EAC7E,IAAI,eAAe;AACtB,YAAI,aAAa,SAAS,GAAG;AAC3B,uBAAa,uBAAuB;AACpC,uBAAa,sBAAsB,aAAa,CAAC;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,MAAI,aAAa,qBAAqB;AACpC,UAAM,QAAQ,oCAAoC,aAAa,mBAAmB;AAClF,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,UAAU,OAAO,qBAAqB,KAAK,GAAG,QAAQ,WAAW,QAAQ,OAAO;AAClG,UAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,aAAK;AACL,iBAAS;AAAA,MACX;AAAA,IACF;AACA,QAAI,CAAC,IAAI;AACP,YAAM,UAAU,sBAAsB,aAAa,mBAAmB;AACtE,UAAI,SAAS;AACX,cAAM,MAAM,MAAM,UAAU,SAAS,qBAAqB,OAAO,GAAG,QAAQ,WAAW,QAAQ,OAAO;AACtG,YAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,eAAK;AACL,mBAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI;AACN,mBAAa,iBAAiB;AAC9B,UAAI,OAAO,GAAG,2BAA2B,UAAU;AACjD,qBAAa,wBAAwB,gBAAgB,GAAG,sBAAsB;AAAA,MAChF;AACA,UAAI,OAAO,GAAG,mBAAmB,UAAU;AACzC,qBAAa,gBAAgB,gBAAgB,GAAG,cAAc;AAAA,MAChE;AACA,UAAI,OAAO,GAAG,0BAA0B,UAAU;AAChD,qBAAa,uBAAuB,gBAAgB,GAAG,qBAAqB;AAAA,MAC9E;AACA,UAAI,MAAM,QAAQ,GAAG,gBAAgB,GAAG;AACtC,cAAM,SAAS,GAAG,iBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,UAAU,EACnB,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,kBAAkB;AAAA,MACxD;AACA,UAAI,MAAM,QAAQ,GAAG,qBAAqB,GAAG;AAC3C,cAAM,SAAS,GAAG,sBACf,OAAO,CAAC,MAA4B,OAAO,MAAM,QAAQ,EACzD,MAAM,GAAG,EAAE,EACX,IAAI,eAAe;AACtB,YAAI,OAAO,SAAS,EAAG,cAAa,sBAAsB;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAeA,eAAsB,mBACpB,UACA,UAAoF,CAAC,GAC3C;AAC1C,QAAM,QAAQ,MAAM,cAAc,UAAU,QAAQ,kBAAkB,OAAO,QAAQ,WAAW,QAAQ,OAAO;AAC/G,MAAI,MAAM,WAAW,IAAK,QAAO;AACjC,SAAO,qBAAqB,MAAM,mBAAmB,IAAI;AAC3D;AAOA,eAAe,cACb,UACA,gBACA,WACA,SACuD;AACvD,QAAM,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,aAAa,CAAC;AAC3E,MAAI;AACF,UAAM,MAAM,MAAM,cAAc,UAAU;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MAC/C,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,WAAO,EAAE,QAAQ,IAAI,QAAQ,iBAAiB,IAAI,QAAQ,kBAAkB,EAAE;AAAA,EAChF,QAAQ;AACN,WAAO,EAAE,QAAQ,EAAE;AAAA,EACrB;AACF;AASA,SAAS,SAAS,OAAmC;AACnD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,KAAK;AACvB,WAAO,EAAE,aAAa,YAAY,EAAE,aAAa;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,SAAS,oCAAoC,QAAoC;AAC/E,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,WAAW,EAAE,SAAS,SAAS,GAAG,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE,IAAI,EAAE;AACxE,SAAO,GAAG,EAAE,MAAM,0CAA0C,QAAQ;AACtE;AAWA,SAAS,sBAAsB,QAAoC;AACjE,MAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAM,OAAO,EAAE,SAAS,SAAS,GAAG,IAAI,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC1G,SAAO,GAAG,IAAI;AAChB;AAEA,eAAe,UACb,KACA,gBACA,WACA,SACkB;AAClB,MAAI;AACF,UAAM,MAAM,MAAM,cAAc,KAAK;AAAA,MACnC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACtC;AAAA,MACA,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MAC/C,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,QAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,WAAO,uBAAuB,IAAI,MAAM,IAAI,QAAQ,cAAc,CAAC;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/lib/core/AgentClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/AgentClient.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,GAAG;IACnF,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1C,UAAU,EAAE,6BAA6B,CAAC;CAC3C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,mBAAmB,CAAC;IAClC,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,cAAc,EAAE,qBAAqB,CAAC;IACtC,cAAc,EAAE,qBAAqB,CAAC;IACtC,cAAc,EAAE,oBAAoB,CAAC;IACrC,sBAAsB,EAAE,2BAA2B,CAAC;IACpD,4BAA4B,EAAE,kCAAkC,CAAC;IACjE,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,cAAc,EAAE,qBAAqB,CAAC;IACtC,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,sBAAsB,EAAE,4BAA4B,CAAC;IACrD,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,yBAAyB,EAAE,+BAA+B,CAAC;IAC3D,eAAe,EAAE,qBAAqB,CAAC;IACvC,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,qBAAqB,CAAC;IACvC,oBAAoB,EAAE,0BAA0B,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,uBAAuB,EACrB,aAAa,GACb,iBAAiB,GACjB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,uBAAuB,GACvB,SAAS,GACT,gBAAgB,GAChB,0BAA0B,GAC1B,sBAAsB,CACzB,GAAG;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AA4CF,qBAAa,WAAW;IAOpB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAPhB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAG7B,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IA2B9C;;;OAGG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,GAAE,0BAA+B,GAAG,WAAW;IA8BhG;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,WAAW;IAenB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAInB;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI/F;;;;;;;;;;;OAWG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAMV;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,WAAW,CACf,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,GACzC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAChD,WAAW,CACf,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,GACzC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IA2C3C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyEG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAU9C;;;;;;;;;OASG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAU9C;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAQ1C;;OAEG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;OAKG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIrG;;;;;OAKG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAInE;;;;OAIG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;OAGG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAQpD;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAQnD;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAQhD;;OAEG;IACG,uBAAuB,CAC3B,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAUvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;;;;;;;;;;;;;;;OAgBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAYzB;;OAEG;IACH,UAAU,IAAI,OAAO,EAAE,GAAG,SAAS;IAOnC;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAIpB;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAQjC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;IACH,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMrC;;OAEG;IACH,QAAQ,IAAI,WAAW;IAIvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;OAKG;IACH,eAAe,IAAI,MAAM;IAIzB;;;;;;;;OAQG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAU5C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO;IAQtD;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7E;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAI9C;;OAEG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC;;;;;;;uBAkJskjF,CAAC;uBAA2B,CAAC;sBAA2C,CAAC;;;IA9IrtjF;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;OAEG;IACH,cAAc;IAMd;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,CAAC,SAAS,YAAY,EACtC,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C;;OAEG;IACG,WAAW,CAAC,CAAC,GAAG,OAAO,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAmBzB;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAI3D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAI5D;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAId;;;;;OAKG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAU5D;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CASzC"}
+{"version":3,"file":"AgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/AgentClient.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,GAAG;IACnF,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1C,UAAU,EAAE,6BAA6B,CAAC;CAC3C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,mBAAmB,CAAC;IAClC,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,cAAc,EAAE,qBAAqB,CAAC;IACtC,cAAc,EAAE,qBAAqB,CAAC;IACtC,cAAc,EAAE,oBAAoB,CAAC;IACrC,sBAAsB,EAAE,2BAA2B,CAAC;IACpD,4BAA4B,EAAE,kCAAkC,CAAC;IACjE,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,cAAc,EAAE,qBAAqB,CAAC;IACtC,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,sBAAsB,EAAE,4BAA4B,CAAC;IACrD,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,iBAAiB,EAAE,wBAAwB,CAAC;IAC5C,yBAAyB,EAAE,+BAA+B,CAAC;IAC3D,eAAe,EAAE,qBAAqB,CAAC;IACvC,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,qBAAqB,CAAC;IACvC,oBAAoB,EAAE,0BAA0B,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,uBAAuB,EACrB,aAAa,GACb,iBAAiB,GACjB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,uBAAuB,GACvB,SAAS,GACT,gBAAgB,GAChB,0BAA0B,GAC1B,sBAAsB,CACzB,GAAG;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AA4CF,qBAAa,WAAW;IAOpB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAPhB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAG7B,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IA2B9C;;;OAGG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,GAAE,0BAA+B,GAAG,WAAW;IA8BhG;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,WAAW;IAenB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAInB;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI/F;;;;;;;;;;;OAWG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAMV;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,WAAW,CACf,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,GACzC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAChD,WAAW,CACf,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,GACzC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IA2C3C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyEG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAU9C;;;;;;;;;OASG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAU9C;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAQ1C;;OAEG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;OAKG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIrG;;;;;OAKG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAInE;;;;OAIG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;OAGG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAQpD;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAQnD;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAQhD;;OAEG;IACG,uBAAuB,CAC3B,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAUvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;;;;;;;;;;;;;;;OAgBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAYzB;;OAEG;IACH,UAAU,IAAI,OAAO,EAAE,GAAG,SAAS;IAOnC;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAIpB;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAQjC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;IACH,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMrC;;OAEG;IACH,QAAQ,IAAI,WAAW;IAIvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;OAKG;IACH,eAAe,IAAI,MAAM;IAIzB;;;;;;;;OAQG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAU5C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO;IAQtD;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7E;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAI9C;;OAEG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC;;;;;;;uBAkJo+pF,CAAC;uBAA2B,CAAC;sBAA2C,CAAC;;;IA9InnqF;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;OAEG;IACH,cAAc;IAMd;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,CAAC,SAAS,YAAY,EACtC,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C;;OAEG;IACG,WAAW,CAAC,CAAC,GAAG,OAAO,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAmBzB;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAI3D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAI5D;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAId;;;;;OAKG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAU5D;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CASzC"}

package/dist/lib/core/SingleAgentClient.d.mts

@@ -600,8 +600,8 @@ export declare class SingleAgentClient {
      * 3.1-only fields for a 3.0 seller). Returns the adapted params and any
      * drift log entries describing what was changed.
      *
-     * Runs after `detectServerVersion` so `cachedCapabilities` is populated
-     * and the protocol-version adapters see the seller's declared caps.
+     * Runs after `detectServerVersion` so capabilities are available and the
+     * current call's tool schemas can be supplied without cross-tenant caching.
      */
     private adaptRequest;
     /**

package/dist/lib/core/SingleAgentClient.d.ts

@@ -600,8 +600,8 @@ export declare class SingleAgentClient {
      * 3.1-only fields for a 3.0 seller). Returns the adapted params and any
      * drift log entries describing what was changed.
      *
-     * Runs after `detectServerVersion` so `cachedCapabilities` is populated
-     * and the protocol-version adapters see the seller's declared caps.
+     * Runs after `detectServerVersion` so capabilities are available and the
+     * current call's tool schemas can be supplied without cross-tenant caching.
      */
     private adaptRequest;
     /**

package/dist/lib/core/SingleAgentClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SingleAgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/SingleAgentClient.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAIrE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EAEnB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,EACN,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,oBAAoB,EAA0C,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EACV,iBAAiB,EAEjB,UAAU,EACV,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0B1E,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBrG,OAAO,KAAK,EAAE,gBAAgB,EAA8B,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAgBvG,OAAO,EAGL,KAAK,mBAAmB,EAGxB,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAE3F,KAAK,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,OAAO,EAAE,MAAM;aACf,aAAa,EAAE,IAAI,GAAG,IAAI;gBAD1B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,IAAI,GAAG,IAAI,EAC1C,OAAO,CAAC,EAAE,MAAM;CAKnB;AAqBD,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;IACjC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,kBAAkB,CAAC;IAChD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,0BAA0B,GAC1B,wBAAwB,CAAC;AAE7B,MAAM,WAAW,4BAA4B;IAC3C,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;IACvC,+GAA+G;IAC/G,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC9C,+BAA+B;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,QAAQ,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,CAAC;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM1E;AAuBD;;GAEG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1C;;;OAGG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,cAAc,EAAE,mBAAmB,CAAC;IAC7D,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;kEAC8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,cAAc,EAAE,wBAAwB,CAAC;IACtE;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3D;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAC/D;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAChE;;;;;;WAMG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;;;WAWG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC;;;;;;;;;;;;;;;;;WAiBG;QACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;QAC9C;;;;;;;;;;WAUG;QACH,qBAAqB,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;KAC7D,CAAC;IACF,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;IAC1D;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,CAAC;CACrD;AAqID,qBAAa,iBAAiB;IAkB1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAlBhB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,eAAe,CAAC,CAAc;IACtC,OAAO,CAAC,gBAAgB,CAAC,CAAsB;IAC/C,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAmB;IAC9C,OAAO,CAAC,iBAAiB,CAAC,CAAuC;IACjE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAA8C;IAC/F,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAGnC,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IAgD9C;;;;;;;;;OASG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;YACW,wBAAwB;IAiCtC;;;;;OAKG;YACW,0BAA0B;IA0BxC;;;;;;OAMG;YACW,oBAAoB;IA4FlC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;OAcG;YACW,mBAAmB;IA8IjC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAmC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;OAQG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAwEjF,qBAAqB;IAkDnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAwH/B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAY5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,oBAAoB,KAEhB,KAAK;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC5C,IAAI,EAAE,OAAO,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,EACD,KAAK;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;SAAE,CAAC;QAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;QACnE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KAC7B;IA4DL;;;;;;;;;;;;;;;;;;;OAmBG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAqBV;;;;OAIG;YACW,gBAAgB;IAmJ9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;YAsDtB,0BAA0B;IAwLxC,OAAO,CAAC,kCAAkC;IAqB1C,OAAO,CAAC,gCAAgC;IAIxC,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,sCAAsC;YA2ChC,oCAAoC;IAwClD,OAAO,CAAC,oCAAoC;YAW9B,yCAAyC;IA+CvD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IA8JpB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;OAQG;YACW,oCAAoC;IAuElD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,WAAW,CACf,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAU3C;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAoD9C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAU9C;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;;;;;OAMG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;;OAMG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;;;;;OAMG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAU1C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;;;;;OAMG;IACG,SAAS,CACb,MAAM,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,EAC9C,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAUzC;;;;;;OAMG;IACG,gBAAgB,CACpB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAYhD;;;;;;OAMG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAQrE,OAAO,CAAC,kBAAkB;IAY1B;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAcnD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAUpD;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAUhD;;OAEG;IACG,uBAAuB,CAC3B,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAYvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAYlD;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,CAAC,GAAG,GAAG,EACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAyHzB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IASpG;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAKzB;;OAEG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM;IAIrC;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAM9C;;;;;;;;OAQG;IACH,QAAQ,IAAI,WAAW;IAevB;;;;;;;;OAQG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAK9C;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;;;;;;;;;OAaG;IACH,eAAe,IAAI,MAAM;IAUzB;;;;;;;;;;OAUG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAc5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO;IAa5D;;;;;;;;OAQG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAcnF;;OAEG;IACH,cAAc;IAMd;;;;;;;;;;;;OAYG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItC;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAI3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAI5D;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAId;;;;;;;;;;OAUG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,KAAK,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC,CAAC;KACJ,CAAC;IAsNF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuJ9E;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK7E;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAKvC;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAKvD;;;;;;;;;;;OAWG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYnE;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAKtD;;;;;OAKG;YACW,oBAAoB;IAalC;;;;;;OAMG;IACH,OAAO,CAAC,yCAAyC;IA8BjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,4BAA4B;IAuBpC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CtG;;;;;;;OAOG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,OAAO,CAAC,WAAW;IAOnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;WACU,uBAAuB,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,GAAE,KAAK,GAAG,KAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoBlH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;CAiDxB;AA6ED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAE/G"}
+{"version":3,"file":"SingleAgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/SingleAgentClient.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAIrE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EAEnB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,EACN,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,oBAAoB,EAA0C,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EACV,iBAAiB,EAEjB,UAAU,EACV,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0B1E,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBrG,OAAO,KAAK,EAAE,gBAAgB,EAA8B,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAgBvG,OAAO,EAGL,KAAK,mBAAmB,EAGxB,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAE3F,KAAK,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;AAQpE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,OAAO,EAAE,MAAM;aACf,aAAa,EAAE,IAAI,GAAG,IAAI;gBAD1B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,IAAI,GAAG,IAAI,EAC1C,OAAO,CAAC,EAAE,MAAM;CAKnB;AAqBD,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;IACjC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,kBAAkB,CAAC;IAChD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,0BAA0B,GAC1B,wBAAwB,CAAC;AAE7B,MAAM,WAAW,4BAA4B;IAC3C,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;IACvC,+GAA+G;IAC/G,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC9C,+BAA+B;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,QAAQ,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,CAAC;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM1E;AAuBD;;GAEG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1C;;;OAGG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,cAAc,EAAE,mBAAmB,CAAC;IAC7D,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;kEAC8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,cAAc,EAAE,wBAAwB,CAAC;IACtE;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3D;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAC/D;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAChE;;;;;;WAMG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;;;WAWG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC;;;;;;;;;;;;;;;;;WAiBG;QACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;QAC9C;;;;;;;;;;WAUG;QACH,qBAAqB,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;KAC7D,CAAC;IACF,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;IAC1D;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,CAAC;CACrD;AAqID,qBAAa,iBAAiB;IAkB1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAlBhB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,eAAe,CAAC,CAAc;IACtC,OAAO,CAAC,gBAAgB,CAAC,CAAsB;IAC/C,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAmB;IAC9C,OAAO,CAAC,iBAAiB,CAAC,CAAuC;IACjE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAA8C;IAC/F,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAGnC,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IAgD9C;;;;;;;;;OASG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;YACW,wBAAwB;IAkDtC;;;;;OAKG;YACW,0BAA0B;IAqCxC;;;;;;OAMG;YACW,oBAAoB;IAoGlC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;OAcG;YACW,mBAAmB;IAqKjC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAmC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;OAQG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAwEjF,qBAAqB;IAkDnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAwH/B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAY5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,oBAAoB,KAEhB,KAAK;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC5C,IAAI,EAAE,OAAO,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,EACD,KAAK;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;SAAE,CAAC;QAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;QACnE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KAC7B;IA4DL;;;;;;;;;;;;;;;;;;;OAmBG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAqBV;;;;OAIG;YACW,gBAAgB;IAyJ9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;YAsDtB,0BAA0B;IAwLxC,OAAO,CAAC,kCAAkC;IAqB1C,OAAO,CAAC,gCAAgC;IAIxC,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,sCAAsC;YA2ChC,oCAAoC;IAwClD,OAAO,CAAC,oCAAoC;YAW9B,yCAAyC;IA+CvD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IA+JpB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;OAQG;YACW,oCAAoC;IAuElD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,WAAW,CACf,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAU3C;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAoD9C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAU9C;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;;;;;OAMG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;;OAMG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;;;;;OAMG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAU1C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;;;;;OAMG;IACG,SAAS,CACb,MAAM,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,EAC9C,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAUzC;;;;;;OAMG;IACG,gBAAgB,CACpB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAYhD;;;;;;OAMG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAQrE,OAAO,CAAC,kBAAkB;IAY1B;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAcnD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAUpD;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAUhD;;OAEG;IACG,uBAAuB,CAC3B,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAYvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAYlD;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,CAAC,GAAG,GAAG,EACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IA+HzB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IASpG;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAKzB;;OAEG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM;IAIrC;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAM9C;;;;;;;;OAQG;IACH,QAAQ,IAAI,WAAW;IAevB;;;;;;;;OAQG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAK9C;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;;;;;;;;;OAaG;IACH,eAAe,IAAI,MAAM;IAUzB;;;;;;;;;;OAUG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAc5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO;IAa5D;;;;;;;;OAQG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAcnF;;OAEG;IACH,cAAc;IAMd;;;;;;;;;;;;OAYG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItC;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAI3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAI5D;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAId;;;;;;;;;;OAUG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,KAAK,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC,CAAC;KACJ,CAAC;IA0OF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgK9E;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK7E;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAKvC;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAKvD;;;;;;;;;;;OAWG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYnE;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAKtD;;;;;OAKG;YACW,oBAAoB;IAalC;;;;;;OAMG;IACH,OAAO,CAAC,yCAAyC;IA8BjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,4BAA4B;IAuBpC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CtG;;;;;;;OAOG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,OAAO,CAAC,WAAW;IAOnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;WACU,uBAAuB,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,GAAE,KAAK,GAAG,KAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoBlH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;CAiDxB;AA6ED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAE/G"}