@adcp/sdk 13.0.0-rc.4 → 13.0.0-rc.6

package/dist/lib/auth/oauth/web-flow.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/**\n * Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n *\n * Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n *\n * Wire contract:\n *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of\n *     truth for the RFC 8707 `resource` indicator. We fall back to\n *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n *     server does not implement PRM (404). Connection / parse / 5xx\n *     errors throw `ProtectedResourceMetadataError` — never silently\n *     downgrade to local guessing.\n *   - `prm.resource` must share an origin with the agent URL; the MCP\n *     SDK's `checkResourceAllowed` guards against a poisoned PRM\n *     pointing the audience at a third party.\n *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n *     the agent origin.\n *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n *     `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n *     > `clientMetadata.scope`.\n *   - Refresh is NOT this module's concern. Once `oauth_tokens` are\n *     persisted, `MCPOAuthProvider` handles refresh on the next agent\n *     call and the MCP SDK forwards `resource` into the refresh request.\n *     Callers who DIY refresh against `oauth_tokens` are responsible for\n *     forwarding `resource` themselves.\n */\n\nimport { randomBytes } from 'crypto';\nimport {\n  discoverAuthorizationServerMetadata,\n  discoverOAuthProtectedResourceMetadata,\n  exchangeAuthorization,\n  registerClient,\n  startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n  AuthorizationServerMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthProtectedResourceMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\n\n/**\n * Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n */\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1000;\n\n/**\n * State persisted between `/oauth/start` and `/oauth/callback`.\n *\n * `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n *\n * `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n */\nexport interface PendingWebFlow {\n  state: string;\n  agentId: string;\n  agentUrl: string;\n  codeVerifier: string;\n  redirectUri: string;\n  resource?: string;\n  scope?: string;\n  authorizationServerUrl: string;\n  /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */\n  clientInformation: OAuthClientInformation;\n  createdAt: Date;\n  expiresAt: Date;\n  /** JSON-serializable, no secrets, attacker-influenced. */\n  carry?: Record<string, unknown>;\n}\n\n/**\n * Persistence interface for in-flight web OAuth flows.\n *\n * Canonical implementations:\n *\n * Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n *   VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n *   WHERE state = $1 AND expires_at > now()\n *   RETURNING payload;\n * ```\n *\n * Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX     -- put\n * GETDEL pending:flow:<state>                      -- consume\n * ```\n *\n * `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n *\n * `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n *\n * **Tradeoff: consume runs before token exchange.** `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n */\nexport interface PendingWebFlowStore {\n  /** Insert a new flow. MUST reject duplicate `state`. */\n  put(flow: PendingWebFlow): Promise<void>;\n  /**\n   * Atomic delete-and-return. MUST NOT return the same row twice.\n   * Returns null if the row is absent or expired.\n   */\n  consume(state: string): Promise<PendingWebFlow | null>;\n  /** Optional housekeeping for expired rows that were never claimed. */\n  cleanupExpired?(): Promise<number>;\n}\n\n/** @deprecated Renamed to `PendingWebFlowStore`. */\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n  constructor(state: string) {\n    super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n    this.name = 'InvalidOrExpiredFlowError';\n  }\n}\n\nexport class StateMismatchError extends OAuthError {\n  constructor() {\n    super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n    this.name = 'StateMismatchError';\n  }\n}\n\nexport class TokenExchangeError extends OAuthError {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: string,\n    /**\n     * RFC 6749 §5.2 error code when the authorization server returned a\n     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n     * Undefined when the AS returned a non-OAuth-shaped failure.\n     */\n    public readonly oauthErrorCode?: string\n  ) {\n    super(message, 'token_exchange_failed');\n    this.name = 'TokenExchangeError';\n  }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n  constructor(message: string) {\n    super(message, 'protected_resource_metadata_error');\n    this.name = 'ProtectedResourceMetadataError';\n  }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n  constructor(agentId: string) {\n    super(\n      `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n      'agent_vanished_during_flow',\n      agentId\n    );\n    this.name = 'AgentVanishedDuringFlowError';\n  }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n  constructor(agentId: string | undefined) {\n    super(\n      'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n        'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n      'confidential_client_not_allowed',\n      agentId\n    );\n    this.name = 'ConfidentialClientNotAllowedError';\n  }\n}\n\nexport interface StartWebFlowOptions {\n  /** Agent the flow is for. Must include `agent_uri`. */\n  agent: AgentConfig;\n  /** Absolute URL of the consumer's `/callback` route (must match what the AS sees). */\n  redirectUri: string;\n  /** Where to persist the pending flow until callback. */\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, dynamic-registration results land in `agent.oauth_client`. */\n  agentStorage?: OAuthConfigStorage;\n  /**\n   * Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n   * Must be JSON-serializable. Do not store secrets here. Treated as\n   * attacker-influenced — validate before reflecting (e.g. via\n   * {@link safeReturnTo} for redirect targets).\n   */\n  carry?: Record<string, unknown>;\n  /**\n   * Scope hint (highest priority per SEP-835). Pass through the `scope`\n   * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n   */\n  scopeHint?: string;\n  /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */\n  ttlMs?: number;\n  /** Override the random-state generator (defaults to 32 bytes base64url). */\n  generateState?: () => string;\n  /** Override `fetch` (timeouts, signing, mocks). */\n  fetch?: typeof fetch;\n  /**\n   * Override base client metadata. `redirect_uris` is always replaced\n   * with `[redirectUri]` regardless of what's passed here.\n   */\n  clientMetadata?: Partial<OAuthClientMetadata>;\n  /**\n   * Permit the AS to register a confidential client (i.e. one that\n   * returns a `client_secret` from dynamic registration). Default false:\n   * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n   * rather than silently persisting a long-lived credential to your\n   * agent storage.\n   */\n  allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n  authorizationUrl: string;\n  state: string;\n  expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n  state: string;\n  code: string;\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, the issued tokens are persisted to `agent.oauth_tokens`. */\n  agentStorage?: OAuthConfigStorage;\n  fetch?: typeof fetch;\n  /**\n   * The caller-bound expected state (e.g. from a session cookie set at\n   * `/oauth/start`). When provided, must equal `state`; mismatch throws\n   * {@link StateMismatchError}. Without this, `state` is replay-protected\n   * but not browser-bound — see WEB-OAUTH.md.\n   */\n  expectedState?: string;\n}\n\nexport interface CompleteWebFlowResult {\n  agentId: string;\n  agentUrl: string;\n  tokens: OAuthTokens;\n  carry?: Record<string, unknown>;\n  /** True if `agentStorage` was provided AND `saveAgent` succeeded. */\n  persisted: boolean;\n}\n\n/**\n * Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n */\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n  const {\n    agent,\n    redirectUri,\n    pendingFlowStore,\n    agentStorage,\n    carry,\n    scopeHint,\n    ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n    generateState,\n    fetch: fetchFn,\n    clientMetadata: clientMetadataOverrides,\n    allowConfidentialClient = false,\n  } = opts;\n\n  if (!agent.agent_uri) {\n    throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n  }\n\n  const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n  if (prm?.resource) {\n    assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n  }\n\n  const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n  const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n  if (!asMetadata) {\n    throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n  }\n\n  const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n  const baseClientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    ...clientMetadataOverrides,\n    redirect_uris: [redirectUri],\n  };\n\n  const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n  const clientInformation = await resolveClientInformation({\n    agent,\n    agentStorage,\n    asUrl,\n    asMetadata,\n    clientMetadata: baseClientMetadata,\n    fetchFn,\n    allowConfidentialClient,\n  });\n\n  const state = (generateState ?? defaultGenerateState)();\n  const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n    metadata: asMetadata,\n    clientInformation,\n    redirectUrl: redirectUri,\n    scope,\n    state,\n    resource,\n  });\n\n  const now = new Date();\n  const expiresAt = new Date(now.getTime() + ttlMs);\n  const flow: PendingWebFlow = {\n    state,\n    agentId: agent.id,\n    agentUrl: agent.agent_uri,\n    codeVerifier,\n    redirectUri,\n    resource: resource.href,\n    scope,\n    authorizationServerUrl: asUrl.toString(),\n    clientInformation,\n    createdAt: now,\n    expiresAt,\n    carry,\n  };\n  await pendingFlowStore.put(flow);\n\n  return {\n    authorizationUrl: authorizationUrl.toString(),\n    state,\n    expiresAt,\n  };\n}\n\n/**\n * Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n *\n * The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n */\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n  const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState } = opts;\n\n  if (expectedState !== undefined && expectedState !== state) {\n    throw new StateMismatchError();\n  }\n\n  const flow = await pendingFlowStore.consume(state);\n  if (!flow || flow.expiresAt.getTime() < Date.now()) {\n    throw new InvalidOrExpiredFlowError(state);\n  }\n\n  const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n    fetchFn,\n  });\n\n  let tokens: OAuthTokens;\n  try {\n    tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n      metadata: asMetadata ?? undefined,\n      clientInformation: flow.clientInformation,\n      authorizationCode: code,\n      codeVerifier: flow.codeVerifier,\n      redirectUri: flow.redirectUri,\n      resource: flow.resource ? new URL(flow.resource) : undefined,\n      fetchFn,\n    });\n  } catch (err) {\n    throw wrapTokenExchangeError(err);\n  }\n\n  let persisted = false;\n  if (agentStorage) {\n    const agent = await agentStorage.loadAgent(flow.agentId);\n    if (!agent) {\n      throw new AgentVanishedDuringFlowError(flow.agentId);\n    }\n    agent.oauth_tokens = fromMCPTokens(tokens);\n    delete agent.oauth_code_verifier;\n    await agentStorage.saveAgent(agent);\n    persisted = true;\n  }\n\n  return {\n    agentId: flow.agentId,\n    agentUrl: flow.agentUrl,\n    tokens,\n    carry: flow.carry,\n    persisted,\n  };\n}\n\n/**\n * Validate a redirect target supplied via `carry`.\n *\n * Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n *\n * Defaults to **path-only** redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n *\n * @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n */\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string | undefined {\n  if (typeof value !== 'string' || value.length === 0) return undefined;\n\n  // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n  if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n    return value;\n  }\n\n  const allowed = options.allowedReturnHosts;\n  if (!allowed || allowed.length === 0) return undefined;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return undefined;\n  }\n  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n  if (!allowed.includes(parsed.host)) return undefined;\n  return parsed.toString();\n}\n\n/**\n * In-memory pending-flow store for tests and single-instance dev.\n *\n * Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n */\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n  private readonly flows = new Map<string, PendingWebFlow>();\n\n  async put(flow: PendingWebFlow): Promise<void> {\n    if (this.flows.has(flow.state)) {\n      throw new Error(`Pending flow already exists for state ${flow.state}`);\n    }\n    this.flows.set(flow.state, flow);\n  }\n\n  async consume(state: string): Promise<PendingWebFlow | null> {\n    const flow = this.flows.get(state);\n    if (!flow) return null;\n    this.flows.delete(state);\n    if (flow.expiresAt.getTime() < Date.now()) return null;\n    return flow;\n  }\n\n  async cleanupExpired(): Promise<number> {\n    const now = Date.now();\n    let removed = 0;\n    for (const [state, flow] of this.flows) {\n      if (flow.expiresAt.getTime() < now) {\n        this.flows.delete(state);\n        removed++;\n      }\n    }\n    return removed;\n  }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/**\n * The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n *\n * Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n *   `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n *   throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n *   when `response.status === 404` (or no response was returned).\n *\n * If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n */\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n  agentUrl: string,\n  fetchFn: typeof fetch | undefined\n): Promise<OAuthProtectedResourceMetadata | undefined> {\n  try {\n    return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n  } catch (err) {\n    if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n      // PRM is optional under RFC 9728 — fall back to local resource\n      // derivation. Connection/parse/5xx errors fall through.\n      return undefined;\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n  }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n  const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n  if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n    throw new ProtectedResourceMetadataError(\n      `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n    );\n  }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata | undefined): URL {\n  const first = prm?.authorization_servers?.[0];\n  if (first) {\n    return new URL(first);\n  }\n  return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n  agent: AgentConfig;\n  agentStorage?: OAuthConfigStorage;\n  asUrl: URL;\n  asMetadata: AuthorizationServerMetadata;\n  clientMetadata: OAuthClientMetadata;\n  fetchFn?: typeof fetch;\n  allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n  if (agent.oauth_client) {\n    return toMCPClientInfo(agent.oauth_client);\n  }\n\n  if (!asMetadata.registration_endpoint) {\n    throw new OAuthError(\n      'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n      'no_client_credentials',\n      agent.id\n    );\n  }\n\n  const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n    metadata: asMetadata,\n    clientMetadata,\n    fetchFn,\n  });\n\n  if (registered.client_secret && !allowConfidentialClient) {\n    throw new ConfidentialClientNotAllowedError(agent.id);\n  }\n\n  if (agentStorage) {\n    // Load fresh and save fresh so two concurrent /start calls for the\n    // same agentId do not trample each other's `oauth_client` via a\n    // shared in-memory reference.\n    const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n    fresh.oauth_client = fromMCPClientInfo(registered);\n    await agentStorage.saveAgent(fresh);\n  }\n\n  return registered;\n}\n\nfunction defaultGenerateState(): string {\n  return randomBytes(32).toString('base64url');\n}\n\n/**\n * Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n */\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n  // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n  // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n  // `InvalidGrantError`). Malformed responses come through as\n  // `ServerError` with the raw body in `message`, so the redaction pass\n  // covers both cases.\n  const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n  const message = err instanceof Error ? err.message : String(err);\n  const status = (err as { status?: number })?.status ?? 0;\n  const rawBody = (err as { body?: string })?.body ?? message;\n  const body = redactTokens(rawBody);\n  const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n  return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/**\n * Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n */\nfunction redactTokens(input: string): string {\n  let out = input;\n  for (const key of SENSITIVE_TOKEN_KEYS) {\n    // JSON form: \"key\":\"…\"\n    out = out.replace(new RegExp(`(\"${key}\"\\\\s*:\\\\s*\")[^\"]*(\")`, 'gi'), '$1<redacted>$2');\n    // form-encoded: key=…\n    out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BA,oBAA4B;AAC5B,kBAMO;AACP,wBAA+D;AAW/D,mBAAuG;AAOhG,MAAM,0BAA0B,KAAK,KAAK;AAoF1C,MAAM,kCAAkC,wBAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,wBAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,wBAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,wBAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAgFA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,wBAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,KAAK,UAAU;AACjB,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,UAAM,iDAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,wBAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,KAAK,WAAW,IAAI,IAAI,IAAI,QAAQ,QAAI,4CAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAE1G,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,UAAM,gCAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,cAAc,IAAI;AAEvF,MAAI,kBAAkB,UAAa,kBAAkB,OAAO;AAC1D,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,QAAM,aAAa,UAAM,iDAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,UAAM,mCAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAChB,UAAM,QAAQ,MAAM,aAAa,UAAU,KAAK,OAAO;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,IACrD;AACA,UAAM,mBAAe,4BAAc,MAAM;AACzC,WAAO,MAAM;AACb,UAAM,aAAa,UAAU,KAAK;AAClC,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,UAAM,oDAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,gBAAY,4CAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,KAAC,wCAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,eAAO,8BAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,UAAM,4BAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,mBAAe,gCAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,aAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/**\n * Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n *\n * Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n *\n * Wire contract:\n *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of\n *     truth for the RFC 8707 `resource` indicator. We fall back to\n *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n *     server does not implement PRM (404). Connection / parse / 5xx\n *     errors throw `ProtectedResourceMetadataError` — never silently\n *     downgrade to local guessing.\n *   - `prm.resource` must share an origin with the agent URL; the MCP\n *     SDK's `checkResourceAllowed` guards against a poisoned PRM\n *     pointing the audience at a third party.\n *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n *     the agent origin.\n *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n *     `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n *     > `clientMetadata.scope`.\n *   - Refresh is NOT this module's concern. Once `oauth_tokens` are\n *     persisted, `MCPOAuthProvider` handles refresh on the next agent\n *     call and the MCP SDK forwards `resource` into the refresh request.\n *     Callers who DIY refresh against `oauth_tokens` are responsible for\n *     forwarding `resource` themselves.\n */\n\nimport { randomBytes } from 'crypto';\nimport {\n  discoverAuthorizationServerMetadata,\n  discoverOAuthProtectedResourceMetadata,\n  exchangeAuthorization,\n  registerClient,\n  startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n  AuthorizationServerMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthProtectedResourceMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\n\n/**\n * Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n */\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1000;\n\n/**\n * State persisted between `/oauth/start` and `/oauth/callback`.\n *\n * `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n *\n * `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n */\nexport interface PendingWebFlow {\n  state: string;\n  agentId: string;\n  agentUrl: string;\n  codeVerifier: string;\n  redirectUri: string;\n  resource?: string;\n  scope?: string;\n  authorizationServerUrl: string;\n  /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */\n  clientInformation: OAuthClientInformation;\n  createdAt: Date;\n  expiresAt: Date;\n  /** JSON-serializable, no secrets, attacker-influenced. */\n  carry?: Record<string, unknown>;\n}\n\n/**\n * Persistence interface for in-flight web OAuth flows.\n *\n * Canonical implementations:\n *\n * Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n *   VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n *   WHERE state = $1 AND expires_at > now()\n *   RETURNING payload;\n * ```\n *\n * Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX     -- put\n * GETDEL pending:flow:<state>                      -- consume\n * ```\n *\n * `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n *\n * `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n *\n * **Tradeoff: consume runs before token exchange.** `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n */\nexport interface PendingWebFlowStore {\n  /** Insert a new flow. MUST reject duplicate `state`. */\n  put(flow: PendingWebFlow): Promise<void>;\n  /**\n   * Atomic delete-and-return. MUST NOT return the same row twice.\n   * Returns null if the row is absent or expired.\n   */\n  consume(state: string): Promise<PendingWebFlow | null>;\n  /** Optional housekeeping for expired rows that were never claimed. */\n  cleanupExpired?(): Promise<number>;\n}\n\n/** @deprecated Renamed to `PendingWebFlowStore`. */\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n  constructor(state: string) {\n    super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n    this.name = 'InvalidOrExpiredFlowError';\n  }\n}\n\nexport class StateMismatchError extends OAuthError {\n  constructor() {\n    super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n    this.name = 'StateMismatchError';\n  }\n}\n\nexport class TokenExchangeError extends OAuthError {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: string,\n    /**\n     * RFC 6749 §5.2 error code when the authorization server returned a\n     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n     * Undefined when the AS returned a non-OAuth-shaped failure.\n     */\n    public readonly oauthErrorCode?: string\n  ) {\n    super(message, 'token_exchange_failed');\n    this.name = 'TokenExchangeError';\n  }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n  constructor(message: string) {\n    super(message, 'protected_resource_metadata_error');\n    this.name = 'ProtectedResourceMetadataError';\n  }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n  constructor(agentId: string) {\n    super(\n      `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n      'agent_vanished_during_flow',\n      agentId\n    );\n    this.name = 'AgentVanishedDuringFlowError';\n  }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n  constructor(agentId: string | undefined) {\n    super(\n      'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n        'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n      'confidential_client_not_allowed',\n      agentId\n    );\n    this.name = 'ConfidentialClientNotAllowedError';\n  }\n}\n\nexport class BrowserBindingRequiredError extends OAuthError {\n  constructor() {\n    super(\n      'completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied — ' +\n        'pass the state value from the session cookie set at /oauth/start',\n      'browser_binding_required'\n    );\n    this.name = 'BrowserBindingRequiredError';\n  }\n}\n\nexport interface StartWebFlowOptions {\n  /** Agent the flow is for. Must include `agent_uri`. */\n  agent: AgentConfig;\n  /** Absolute URL of the consumer's `/callback` route (must match what the AS sees). */\n  redirectUri: string;\n  /** Where to persist the pending flow until callback. */\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, dynamic-registration results land in `agent.oauth_client`. */\n  agentStorage?: OAuthConfigStorage;\n  /**\n   * Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n   * Must be JSON-serializable. Do not store secrets here. Treated as\n   * attacker-influenced — validate before reflecting (e.g. via\n   * {@link safeReturnTo} for redirect targets).\n   */\n  carry?: Record<string, unknown>;\n  /**\n   * Scope hint (highest priority per SEP-835). Pass through the `scope`\n   * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n   */\n  scopeHint?: string;\n  /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */\n  ttlMs?: number;\n  /** Override the random-state generator (defaults to 32 bytes base64url). */\n  generateState?: () => string;\n  /** Override `fetch` (timeouts, signing, mocks). */\n  fetch?: typeof fetch;\n  /**\n   * Override base client metadata. `redirect_uris` is always replaced\n   * with `[redirectUri]` regardless of what's passed here.\n   */\n  clientMetadata?: Partial<OAuthClientMetadata>;\n  /**\n   * Permit the AS to register a confidential client (i.e. one that\n   * returns a `client_secret` from dynamic registration). Default false:\n   * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n   * rather than silently persisting a long-lived credential to your\n   * agent storage.\n   */\n  allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n  authorizationUrl: string;\n  state: string;\n  expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n  state: string;\n  code: string;\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, the issued tokens are persisted to `agent.oauth_tokens`. */\n  agentStorage?: OAuthConfigStorage;\n  fetch?: typeof fetch;\n  /**\n   * The caller-bound expected state (e.g. from a session cookie set at\n   * `/oauth/start`). When provided, must equal `state`; mismatch throws\n   * {@link StateMismatchError}. Without this, `state` is replay-protected\n   * but not browser-bound — see WEB-OAUTH.md.\n   */\n  expectedState?: string;\n  /**\n   * When `true`, throws {@link BrowserBindingRequiredError} if `expectedState`\n   * is omitted instead of emitting a `console.warn`. Use this in frameworks\n   * where session cookies are always available so that a missing bind is caught\n   * at development time rather than silently permitted in production.\n   *\n   * Default: `false`.\n   */\n  requireBrowserBinding?: boolean;\n}\n\nexport interface CompleteWebFlowResult {\n  agentId: string;\n  agentUrl: string;\n  tokens: OAuthTokens;\n  carry?: Record<string, unknown>;\n  /** True if `agentStorage` was provided AND `saveAgent` succeeded. */\n  persisted: boolean;\n}\n\n/**\n * Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n */\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n  const {\n    agent,\n    redirectUri,\n    pendingFlowStore,\n    agentStorage,\n    carry,\n    scopeHint,\n    ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n    generateState,\n    fetch: fetchFn,\n    clientMetadata: clientMetadataOverrides,\n    allowConfidentialClient = false,\n  } = opts;\n\n  if (!agent.agent_uri) {\n    throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n  }\n\n  const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n  if (prm?.resource) {\n    assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n  }\n\n  const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n  const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n  if (!asMetadata) {\n    throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n  }\n\n  const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n  const baseClientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    ...clientMetadataOverrides,\n    redirect_uris: [redirectUri],\n  };\n\n  const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n  const clientInformation = await resolveClientInformation({\n    agent,\n    agentStorage,\n    asUrl,\n    asMetadata,\n    clientMetadata: baseClientMetadata,\n    fetchFn,\n    allowConfidentialClient,\n  });\n\n  const state = (generateState ?? defaultGenerateState)();\n  const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n    metadata: asMetadata,\n    clientInformation,\n    redirectUrl: redirectUri,\n    scope,\n    state,\n    resource,\n  });\n\n  const now = new Date();\n  const expiresAt = new Date(now.getTime() + ttlMs);\n  const flow: PendingWebFlow = {\n    state,\n    agentId: agent.id,\n    agentUrl: agent.agent_uri,\n    codeVerifier,\n    redirectUri,\n    resource: resource.href,\n    scope,\n    authorizationServerUrl: asUrl.toString(),\n    clientInformation,\n    createdAt: now,\n    expiresAt,\n    carry,\n  };\n  await pendingFlowStore.put(flow);\n\n  return {\n    authorizationUrl: authorizationUrl.toString(),\n    state,\n    expiresAt,\n  };\n}\n\n/**\n * Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n *\n * The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n */\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n  const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;\n\n  if (expectedState === undefined) {\n    if (requireBrowserBinding) {\n      throw new BrowserBindingRequiredError();\n    }\n    // Warn callers who omit expectedState: the flow is replay-protected via\n    // atomic consume but is not browser-bound (any request carrying the correct\n    // state + code would be accepted). Pass expectedState from a session cookie\n    // set at /oauth/start to fully bind the callback to the initiating browser.\n    // Set requireBrowserBinding:true to make this a hard error instead.\n    console.warn(\n      '[adcp/sdk] completeWebOAuthFlow: expectedState not supplied — the callback is replay-protected ' +\n        'but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, ' +\n        'or set requireBrowserBinding:true to enforce it.'\n    );\n  } else if (expectedState !== state) {\n    throw new StateMismatchError();\n  }\n\n  const flow = await pendingFlowStore.consume(state);\n  if (!flow || flow.expiresAt.getTime() < Date.now()) {\n    throw new InvalidOrExpiredFlowError(state);\n  }\n\n  const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n    fetchFn,\n  });\n\n  let tokens: OAuthTokens;\n  try {\n    tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n      metadata: asMetadata ?? undefined,\n      clientInformation: flow.clientInformation,\n      authorizationCode: code,\n      codeVerifier: flow.codeVerifier,\n      redirectUri: flow.redirectUri,\n      resource: flow.resource ? new URL(flow.resource) : undefined,\n      fetchFn,\n    });\n  } catch (err) {\n    throw wrapTokenExchangeError(err);\n  }\n\n  let persisted = false;\n  if (agentStorage) {\n    const agent = await agentStorage.loadAgent(flow.agentId);\n    if (!agent) {\n      throw new AgentVanishedDuringFlowError(flow.agentId);\n    }\n    agent.oauth_tokens = fromMCPTokens(tokens);\n    delete agent.oauth_code_verifier;\n    await agentStorage.saveAgent(agent);\n    persisted = true;\n  }\n\n  return {\n    agentId: flow.agentId,\n    agentUrl: flow.agentUrl,\n    tokens,\n    carry: flow.carry,\n    persisted,\n  };\n}\n\n/**\n * Validate a redirect target supplied via `carry`.\n *\n * Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n *\n * Defaults to **path-only** redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n *\n * @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n */\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string | undefined {\n  if (typeof value !== 'string' || value.length === 0) return undefined;\n\n  // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n  if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n    return value;\n  }\n\n  const allowed = options.allowedReturnHosts;\n  if (!allowed || allowed.length === 0) return undefined;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return undefined;\n  }\n  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n  if (!allowed.includes(parsed.host)) return undefined;\n  return parsed.toString();\n}\n\n/**\n * In-memory pending-flow store for tests and single-instance dev.\n *\n * Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n */\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n  private readonly flows = new Map<string, PendingWebFlow>();\n\n  async put(flow: PendingWebFlow): Promise<void> {\n    if (this.flows.has(flow.state)) {\n      throw new Error(`Pending flow already exists for state ${flow.state}`);\n    }\n    this.flows.set(flow.state, flow);\n  }\n\n  async consume(state: string): Promise<PendingWebFlow | null> {\n    const flow = this.flows.get(state);\n    if (!flow) return null;\n    this.flows.delete(state);\n    if (flow.expiresAt.getTime() < Date.now()) return null;\n    return flow;\n  }\n\n  async cleanupExpired(): Promise<number> {\n    const now = Date.now();\n    let removed = 0;\n    for (const [state, flow] of this.flows) {\n      if (flow.expiresAt.getTime() < now) {\n        this.flows.delete(state);\n        removed++;\n      }\n    }\n    return removed;\n  }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/**\n * The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n *\n * Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n *   `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n *   throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n *   when `response.status === 404` (or no response was returned).\n *\n * If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n */\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n  agentUrl: string,\n  fetchFn: typeof fetch | undefined\n): Promise<OAuthProtectedResourceMetadata | undefined> {\n  try {\n    return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n  } catch (err) {\n    if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n      // PRM is optional under RFC 9728 — fall back to local resource\n      // derivation. Connection/parse/5xx errors fall through.\n      return undefined;\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n  }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n  const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n  if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n    throw new ProtectedResourceMetadataError(\n      `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n    );\n  }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata | undefined): URL {\n  const first = prm?.authorization_servers?.[0];\n  if (first) {\n    return new URL(first);\n  }\n  return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n  agent: AgentConfig;\n  agentStorage?: OAuthConfigStorage;\n  asUrl: URL;\n  asMetadata: AuthorizationServerMetadata;\n  clientMetadata: OAuthClientMetadata;\n  fetchFn?: typeof fetch;\n  allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n  if (agent.oauth_client) {\n    return toMCPClientInfo(agent.oauth_client);\n  }\n\n  if (!asMetadata.registration_endpoint) {\n    throw new OAuthError(\n      'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n      'no_client_credentials',\n      agent.id\n    );\n  }\n\n  const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n    metadata: asMetadata,\n    clientMetadata,\n    fetchFn,\n  });\n\n  if (registered.client_secret && !allowConfidentialClient) {\n    throw new ConfidentialClientNotAllowedError(agent.id);\n  }\n\n  if (agentStorage) {\n    // Load fresh and save fresh so two concurrent /start calls for the\n    // same agentId do not trample each other's `oauth_client` via a\n    // shared in-memory reference.\n    const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n    fresh.oauth_client = fromMCPClientInfo(registered);\n    await agentStorage.saveAgent(fresh);\n  }\n\n  return registered;\n}\n\nfunction defaultGenerateState(): string {\n  return randomBytes(32).toString('base64url');\n}\n\n/**\n * Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n */\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n  // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n  // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n  // `InvalidGrantError`). Malformed responses come through as\n  // `ServerError` with the raw body in `message`, so the redaction pass\n  // covers both cases.\n  const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n  const message = err instanceof Error ? err.message : String(err);\n  const status = (err as { status?: number })?.status ?? 0;\n  const rawBody = (err as { body?: string })?.body ?? message;\n  const body = redactTokens(rawBody);\n  const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n  return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/**\n * Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n */\nfunction redactTokens(input: string): string {\n  let out = input;\n  for (const key of SENSITIVE_TOKEN_KEYS) {\n    // JSON form: \"key\":\"…\"\n    out = out.replace(new RegExp(`(\"${key}\"\\\\s*:\\\\s*\")[^\"]*(\")`, 'gi'), '$1<redacted>$2');\n    // form-encoded: key=…\n    out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BA,oBAA4B;AAC5B,kBAMO;AACP,wBAA+D;AAW/D,mBAAuG;AAOhG,MAAM,0BAA0B,KAAK,KAAK;AAoF1C,MAAM,kCAAkC,wBAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,wBAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,wBAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,wBAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,wBAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,wBAAW;AAAA,EAC1D,cAAc;AACZ;AAAA,MACE;AAAA,MAEA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAyFA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,wBAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,KAAK,UAAU;AACjB,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,UAAM,iDAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,wBAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,KAAK,WAAW,IAAI,IAAI,IAAI,QAAQ,QAAI,4CAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAE1G,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,UAAM,gCAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,eAAe,sBAAsB,IAAI;AAE9G,MAAI,kBAAkB,QAAW;AAC/B,QAAI,uBAAuB;AACzB,YAAM,IAAI,4BAA4B;AAAA,IACxC;AAMA,YAAQ;AAAA,MACN;AAAA,IAGF;AAAA,EACF,WAAW,kBAAkB,OAAO;AAClC,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,QAAM,aAAa,UAAM,iDAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,UAAM,mCAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAChB,UAAM,QAAQ,MAAM,aAAa,UAAU,KAAK,OAAO;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,IACrD;AACA,UAAM,mBAAe,4BAAc,MAAM;AACzC,WAAO,MAAM;AACb,UAAM,aAAa,UAAU,KAAK;AAClC,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,UAAM,oDAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,gBAAY,4CAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,KAAC,wCAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,eAAO,8BAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,UAAM,4BAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,mBAAe,gCAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,aAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}

package/dist/lib/auth/oauth/web-flow.mjs

@@ -59,6 +59,15 @@ class ConfidentialClientNotAllowedError extends OAuthError {
     this.name = "ConfidentialClientNotAllowedError";
   }
 }
+class BrowserBindingRequiredError extends OAuthError {
+  constructor() {
+    super(
+      "completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied \u2014 pass the state value from the session cookie set at /oauth/start",
+      "browser_binding_required"
+    );
+    this.name = "BrowserBindingRequiredError";
+  }
+}
 async function startWebOAuthFlow(opts) {
   const {
     agent,
@@ -134,8 +143,15 @@ async function startWebOAuthFlow(opts) {
   };
 }
 async function completeWebOAuthFlow(opts) {
-  const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState } = opts;
-  if (expectedState !== void 0 && expectedState !== state) {
+  const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;
+  if (expectedState === void 0) {
+    if (requireBrowserBinding) {
+      throw new BrowserBindingRequiredError();
+    }
+    console.warn(
+      "[adcp/sdk] completeWebOAuthFlow: expectedState not supplied \u2014 the callback is replay-protected but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, or set requireBrowserBinding:true to enforce it."
+    );
+  } else if (expectedState !== state) {
     throw new StateMismatchError();
   }
   const flow = await pendingFlowStore.consume(state);
@@ -299,6 +315,7 @@ function redactTokens(input) {
 }
 export {
   AgentVanishedDuringFlowError,
+  BrowserBindingRequiredError,
   ConfidentialClientNotAllowedError,
   DEFAULT_WEB_FLOW_TTL_MS,
   InMemoryPendingFlowStore,

package/dist/lib/auth/oauth/web-flow.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/**\n * Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n *\n * Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n *\n * Wire contract:\n *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of\n *     truth for the RFC 8707 `resource` indicator. We fall back to\n *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n *     server does not implement PRM (404). Connection / parse / 5xx\n *     errors throw `ProtectedResourceMetadataError` — never silently\n *     downgrade to local guessing.\n *   - `prm.resource` must share an origin with the agent URL; the MCP\n *     SDK's `checkResourceAllowed` guards against a poisoned PRM\n *     pointing the audience at a third party.\n *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n *     the agent origin.\n *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n *     `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n *     > `clientMetadata.scope`.\n *   - Refresh is NOT this module's concern. Once `oauth_tokens` are\n *     persisted, `MCPOAuthProvider` handles refresh on the next agent\n *     call and the MCP SDK forwards `resource` into the refresh request.\n *     Callers who DIY refresh against `oauth_tokens` are responsible for\n *     forwarding `resource` themselves.\n */\n\nimport { randomBytes } from 'crypto';\nimport {\n  discoverAuthorizationServerMetadata,\n  discoverOAuthProtectedResourceMetadata,\n  exchangeAuthorization,\n  registerClient,\n  startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n  AuthorizationServerMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthProtectedResourceMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\n\n/**\n * Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n */\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1000;\n\n/**\n * State persisted between `/oauth/start` and `/oauth/callback`.\n *\n * `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n *\n * `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n */\nexport interface PendingWebFlow {\n  state: string;\n  agentId: string;\n  agentUrl: string;\n  codeVerifier: string;\n  redirectUri: string;\n  resource?: string;\n  scope?: string;\n  authorizationServerUrl: string;\n  /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */\n  clientInformation: OAuthClientInformation;\n  createdAt: Date;\n  expiresAt: Date;\n  /** JSON-serializable, no secrets, attacker-influenced. */\n  carry?: Record<string, unknown>;\n}\n\n/**\n * Persistence interface for in-flight web OAuth flows.\n *\n * Canonical implementations:\n *\n * Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n *   VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n *   WHERE state = $1 AND expires_at > now()\n *   RETURNING payload;\n * ```\n *\n * Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX     -- put\n * GETDEL pending:flow:<state>                      -- consume\n * ```\n *\n * `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n *\n * `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n *\n * **Tradeoff: consume runs before token exchange.** `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n */\nexport interface PendingWebFlowStore {\n  /** Insert a new flow. MUST reject duplicate `state`. */\n  put(flow: PendingWebFlow): Promise<void>;\n  /**\n   * Atomic delete-and-return. MUST NOT return the same row twice.\n   * Returns null if the row is absent or expired.\n   */\n  consume(state: string): Promise<PendingWebFlow | null>;\n  /** Optional housekeeping for expired rows that were never claimed. */\n  cleanupExpired?(): Promise<number>;\n}\n\n/** @deprecated Renamed to `PendingWebFlowStore`. */\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n  constructor(state: string) {\n    super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n    this.name = 'InvalidOrExpiredFlowError';\n  }\n}\n\nexport class StateMismatchError extends OAuthError {\n  constructor() {\n    super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n    this.name = 'StateMismatchError';\n  }\n}\n\nexport class TokenExchangeError extends OAuthError {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: string,\n    /**\n     * RFC 6749 §5.2 error code when the authorization server returned a\n     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n     * Undefined when the AS returned a non-OAuth-shaped failure.\n     */\n    public readonly oauthErrorCode?: string\n  ) {\n    super(message, 'token_exchange_failed');\n    this.name = 'TokenExchangeError';\n  }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n  constructor(message: string) {\n    super(message, 'protected_resource_metadata_error');\n    this.name = 'ProtectedResourceMetadataError';\n  }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n  constructor(agentId: string) {\n    super(\n      `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n      'agent_vanished_during_flow',\n      agentId\n    );\n    this.name = 'AgentVanishedDuringFlowError';\n  }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n  constructor(agentId: string | undefined) {\n    super(\n      'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n        'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n      'confidential_client_not_allowed',\n      agentId\n    );\n    this.name = 'ConfidentialClientNotAllowedError';\n  }\n}\n\nexport interface StartWebFlowOptions {\n  /** Agent the flow is for. Must include `agent_uri`. */\n  agent: AgentConfig;\n  /** Absolute URL of the consumer's `/callback` route (must match what the AS sees). */\n  redirectUri: string;\n  /** Where to persist the pending flow until callback. */\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, dynamic-registration results land in `agent.oauth_client`. */\n  agentStorage?: OAuthConfigStorage;\n  /**\n   * Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n   * Must be JSON-serializable. Do not store secrets here. Treated as\n   * attacker-influenced — validate before reflecting (e.g. via\n   * {@link safeReturnTo} for redirect targets).\n   */\n  carry?: Record<string, unknown>;\n  /**\n   * Scope hint (highest priority per SEP-835). Pass through the `scope`\n   * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n   */\n  scopeHint?: string;\n  /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */\n  ttlMs?: number;\n  /** Override the random-state generator (defaults to 32 bytes base64url). */\n  generateState?: () => string;\n  /** Override `fetch` (timeouts, signing, mocks). */\n  fetch?: typeof fetch;\n  /**\n   * Override base client metadata. `redirect_uris` is always replaced\n   * with `[redirectUri]` regardless of what's passed here.\n   */\n  clientMetadata?: Partial<OAuthClientMetadata>;\n  /**\n   * Permit the AS to register a confidential client (i.e. one that\n   * returns a `client_secret` from dynamic registration). Default false:\n   * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n   * rather than silently persisting a long-lived credential to your\n   * agent storage.\n   */\n  allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n  authorizationUrl: string;\n  state: string;\n  expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n  state: string;\n  code: string;\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, the issued tokens are persisted to `agent.oauth_tokens`. */\n  agentStorage?: OAuthConfigStorage;\n  fetch?: typeof fetch;\n  /**\n   * The caller-bound expected state (e.g. from a session cookie set at\n   * `/oauth/start`). When provided, must equal `state`; mismatch throws\n   * {@link StateMismatchError}. Without this, `state` is replay-protected\n   * but not browser-bound — see WEB-OAUTH.md.\n   */\n  expectedState?: string;\n}\n\nexport interface CompleteWebFlowResult {\n  agentId: string;\n  agentUrl: string;\n  tokens: OAuthTokens;\n  carry?: Record<string, unknown>;\n  /** True if `agentStorage` was provided AND `saveAgent` succeeded. */\n  persisted: boolean;\n}\n\n/**\n * Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n */\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n  const {\n    agent,\n    redirectUri,\n    pendingFlowStore,\n    agentStorage,\n    carry,\n    scopeHint,\n    ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n    generateState,\n    fetch: fetchFn,\n    clientMetadata: clientMetadataOverrides,\n    allowConfidentialClient = false,\n  } = opts;\n\n  if (!agent.agent_uri) {\n    throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n  }\n\n  const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n  if (prm?.resource) {\n    assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n  }\n\n  const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n  const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n  if (!asMetadata) {\n    throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n  }\n\n  const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n  const baseClientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    ...clientMetadataOverrides,\n    redirect_uris: [redirectUri],\n  };\n\n  const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n  const clientInformation = await resolveClientInformation({\n    agent,\n    agentStorage,\n    asUrl,\n    asMetadata,\n    clientMetadata: baseClientMetadata,\n    fetchFn,\n    allowConfidentialClient,\n  });\n\n  const state = (generateState ?? defaultGenerateState)();\n  const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n    metadata: asMetadata,\n    clientInformation,\n    redirectUrl: redirectUri,\n    scope,\n    state,\n    resource,\n  });\n\n  const now = new Date();\n  const expiresAt = new Date(now.getTime() + ttlMs);\n  const flow: PendingWebFlow = {\n    state,\n    agentId: agent.id,\n    agentUrl: agent.agent_uri,\n    codeVerifier,\n    redirectUri,\n    resource: resource.href,\n    scope,\n    authorizationServerUrl: asUrl.toString(),\n    clientInformation,\n    createdAt: now,\n    expiresAt,\n    carry,\n  };\n  await pendingFlowStore.put(flow);\n\n  return {\n    authorizationUrl: authorizationUrl.toString(),\n    state,\n    expiresAt,\n  };\n}\n\n/**\n * Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n *\n * The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n */\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n  const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState } = opts;\n\n  if (expectedState !== undefined && expectedState !== state) {\n    throw new StateMismatchError();\n  }\n\n  const flow = await pendingFlowStore.consume(state);\n  if (!flow || flow.expiresAt.getTime() < Date.now()) {\n    throw new InvalidOrExpiredFlowError(state);\n  }\n\n  const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n    fetchFn,\n  });\n\n  let tokens: OAuthTokens;\n  try {\n    tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n      metadata: asMetadata ?? undefined,\n      clientInformation: flow.clientInformation,\n      authorizationCode: code,\n      codeVerifier: flow.codeVerifier,\n      redirectUri: flow.redirectUri,\n      resource: flow.resource ? new URL(flow.resource) : undefined,\n      fetchFn,\n    });\n  } catch (err) {\n    throw wrapTokenExchangeError(err);\n  }\n\n  let persisted = false;\n  if (agentStorage) {\n    const agent = await agentStorage.loadAgent(flow.agentId);\n    if (!agent) {\n      throw new AgentVanishedDuringFlowError(flow.agentId);\n    }\n    agent.oauth_tokens = fromMCPTokens(tokens);\n    delete agent.oauth_code_verifier;\n    await agentStorage.saveAgent(agent);\n    persisted = true;\n  }\n\n  return {\n    agentId: flow.agentId,\n    agentUrl: flow.agentUrl,\n    tokens,\n    carry: flow.carry,\n    persisted,\n  };\n}\n\n/**\n * Validate a redirect target supplied via `carry`.\n *\n * Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n *\n * Defaults to **path-only** redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n *\n * @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n */\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string | undefined {\n  if (typeof value !== 'string' || value.length === 0) return undefined;\n\n  // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n  if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n    return value;\n  }\n\n  const allowed = options.allowedReturnHosts;\n  if (!allowed || allowed.length === 0) return undefined;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return undefined;\n  }\n  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n  if (!allowed.includes(parsed.host)) return undefined;\n  return parsed.toString();\n}\n\n/**\n * In-memory pending-flow store for tests and single-instance dev.\n *\n * Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n */\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n  private readonly flows = new Map<string, PendingWebFlow>();\n\n  async put(flow: PendingWebFlow): Promise<void> {\n    if (this.flows.has(flow.state)) {\n      throw new Error(`Pending flow already exists for state ${flow.state}`);\n    }\n    this.flows.set(flow.state, flow);\n  }\n\n  async consume(state: string): Promise<PendingWebFlow | null> {\n    const flow = this.flows.get(state);\n    if (!flow) return null;\n    this.flows.delete(state);\n    if (flow.expiresAt.getTime() < Date.now()) return null;\n    return flow;\n  }\n\n  async cleanupExpired(): Promise<number> {\n    const now = Date.now();\n    let removed = 0;\n    for (const [state, flow] of this.flows) {\n      if (flow.expiresAt.getTime() < now) {\n        this.flows.delete(state);\n        removed++;\n      }\n    }\n    return removed;\n  }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/**\n * The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n *\n * Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n *   `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n *   throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n *   when `response.status === 404` (or no response was returned).\n *\n * If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n */\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n  agentUrl: string,\n  fetchFn: typeof fetch | undefined\n): Promise<OAuthProtectedResourceMetadata | undefined> {\n  try {\n    return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n  } catch (err) {\n    if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n      // PRM is optional under RFC 9728 — fall back to local resource\n      // derivation. Connection/parse/5xx errors fall through.\n      return undefined;\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n  }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n  const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n  if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n    throw new ProtectedResourceMetadataError(\n      `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n    );\n  }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata | undefined): URL {\n  const first = prm?.authorization_servers?.[0];\n  if (first) {\n    return new URL(first);\n  }\n  return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n  agent: AgentConfig;\n  agentStorage?: OAuthConfigStorage;\n  asUrl: URL;\n  asMetadata: AuthorizationServerMetadata;\n  clientMetadata: OAuthClientMetadata;\n  fetchFn?: typeof fetch;\n  allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n  if (agent.oauth_client) {\n    return toMCPClientInfo(agent.oauth_client);\n  }\n\n  if (!asMetadata.registration_endpoint) {\n    throw new OAuthError(\n      'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n      'no_client_credentials',\n      agent.id\n    );\n  }\n\n  const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n    metadata: asMetadata,\n    clientMetadata,\n    fetchFn,\n  });\n\n  if (registered.client_secret && !allowConfidentialClient) {\n    throw new ConfidentialClientNotAllowedError(agent.id);\n  }\n\n  if (agentStorage) {\n    // Load fresh and save fresh so two concurrent /start calls for the\n    // same agentId do not trample each other's `oauth_client` via a\n    // shared in-memory reference.\n    const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n    fresh.oauth_client = fromMCPClientInfo(registered);\n    await agentStorage.saveAgent(fresh);\n  }\n\n  return registered;\n}\n\nfunction defaultGenerateState(): string {\n  return randomBytes(32).toString('base64url');\n}\n\n/**\n * Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n */\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n  // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n  // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n  // `InvalidGrantError`). Malformed responses come through as\n  // `ServerError` with the raw body in `message`, so the redaction pass\n  // covers both cases.\n  const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n  const message = err instanceof Error ? err.message : String(err);\n  const status = (err as { status?: number })?.status ?? 0;\n  const rawBody = (err as { body?: string })?.body ?? message;\n  const body = redactTokens(rawBody);\n  const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n  return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/**\n * Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n */\nfunction redactTokens(input: string): string {\n  let out = input;\n  for (const key of SENSITIVE_TOKEN_KEYS) {\n    // JSON form: \"key\":\"…\"\n    out = out.replace(new RegExp(`(\"${key}\"\\\\s*:\\\\s*\")[^\"]*(\")`, 'gi'), '$1<redacted>$2');\n    // form-encoded: key=…\n    out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n  }\n  return out;\n}\n"],"mappings":"AA+BA,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,gCAAgC;AAW/D,SAAS,yBAAyB,mBAAmB,eAAe,YAAY,uBAAuB;AAOhG,MAAM,0BAA0B,KAAK,KAAK;AAoF1C,MAAM,kCAAkC,WAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,WAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,WAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,WAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAgFA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,WAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,KAAK,UAAU;AACjB,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,MAAM,oCAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,WAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,KAAK,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,yBAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAE1G,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,MAAM,mBAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,cAAc,IAAI;AAEvF,MAAI,kBAAkB,UAAa,kBAAkB,OAAO;AAC1D,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,QAAM,aAAa,MAAM,oCAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,sBAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAChB,UAAM,QAAQ,MAAM,aAAa,UAAU,KAAK,OAAO;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,IACrD;AACA,UAAM,eAAe,cAAc,MAAM;AACzC,WAAO,MAAM;AACb,UAAM,aAAa,UAAU,KAAK;AAClC,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,MAAM,uCAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,YAAY,yBAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,CAAC,qBAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,WAAO,gBAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,MAAM,eAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,eAAe,kBAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"sourcesContent":["/**\n * Web (server-side) OAuth flow helpers for `@adcp/sdk`.\n *\n * Companion to `CLIFlowHandler` for environments where `/oauth/start` and\n * `/oauth/callback` may be served by different processes. Discovery, PKCE,\n * URL construction, and token exchange are delegated to the MCP SDK's\n * `client/auth.js` primitives so this module is glue plus a pending-flow\n * store interface — not reimplemented protocol logic.\n *\n * Wire contract:\n *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of\n *     truth for the RFC 8707 `resource` indicator. We fall back to\n *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource\n *     server does not implement PRM (404). Connection / parse / 5xx\n *     errors throw `ProtectedResourceMetadataError` — never silently\n *     downgrade to local guessing.\n *   - `prm.resource` must share an origin with the agent URL; the MCP\n *     SDK's `checkResourceAllowed` guards against a poisoned PRM\n *     pointing the audience at a third party.\n *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else\n *     the agent origin.\n *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401\n *     `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`\n *     > `clientMetadata.scope`.\n *   - Refresh is NOT this module's concern. Once `oauth_tokens` are\n *     persisted, `MCPOAuthProvider` handles refresh on the next agent\n *     call and the MCP SDK forwards `resource` into the refresh request.\n *     Callers who DIY refresh against `oauth_tokens` are responsible for\n *     forwarding `resource` themselves.\n */\n\nimport { randomBytes } from 'crypto';\nimport {\n  discoverAuthorizationServerMetadata,\n  discoverOAuthProtectedResourceMetadata,\n  exchangeAuthorization,\n  registerClient,\n  startAuthorization,\n} from '@modelcontextprotocol/sdk/client/auth.js';\nimport { checkResourceAllowed, resourceUrlFromServerUrl } from '@modelcontextprotocol/sdk/shared/auth-utils.js';\nimport type {\n  AuthorizationServerMetadata,\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthProtectedResourceMetadata,\n  OAuthTokens,\n} from '@modelcontextprotocol/sdk/shared/auth.js';\n\nimport type { AgentConfig, OAuthConfigStorage } from './types';\nimport { DEFAULT_CLIENT_METADATA, fromMCPClientInfo, fromMCPTokens, OAuthError, toMCPClientInfo } from './types';\n\n/**\n * Default TTL for a pending web flow row. RFC 6749 §10.12 recommends\n * short-lived state; 10 minutes covers slow-typing users without leaving\n * the PKCE verifier on disk longer than necessary.\n */\nexport const DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1000;\n\n/**\n * State persisted between `/oauth/start` and `/oauth/callback`.\n *\n * `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it\n * at rest if persistence crosses a trust boundary (shared DB, cross-tenant\n * Redis, etc.).\n *\n * `carry` is preserved verbatim and round-tripped to the callback. It\n * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be\n * treated as attacker-influenced data (the caller typically populates it\n * from the `/start` request).\n */\nexport interface PendingWebFlow {\n  state: string;\n  agentId: string;\n  agentUrl: string;\n  codeVerifier: string;\n  redirectUri: string;\n  resource?: string;\n  scope?: string;\n  authorizationServerUrl: string;\n  /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */\n  clientInformation: OAuthClientInformation;\n  createdAt: Date;\n  expiresAt: Date;\n  /** JSON-serializable, no secrets, attacker-influenced. */\n  carry?: Record<string, unknown>;\n}\n\n/**\n * Persistence interface for in-flight web OAuth flows.\n *\n * Canonical implementations:\n *\n * Postgres:\n * ```sql\n * INSERT INTO pending_oauth_flows (state, payload, expires_at)\n *   VALUES ($1, $2, $3);\n * -- consume:\n * DELETE FROM pending_oauth_flows\n *   WHERE state = $1 AND expires_at > now()\n *   RETURNING payload;\n * ```\n *\n * Redis:\n * ```\n * SET pending:flow:<state> <payload> EX 600 NX     -- put\n * GETDEL pending:flow:<state>                      -- consume\n * ```\n *\n * `consume` MUST be a single atomic operation that deletes and returns the\n * row (or returns null). A `SELECT` followed by a separate `DELETE` is a\n * replay vulnerability and DOES NOT satisfy this contract — a callback\n * replayed before the first one commits would mint two tokens.\n *\n * `consume` MUST treat expired rows as absent (return null) and SHOULD\n * delete them on read so a separate sweep is not strictly required.\n *\n * **Tradeoff: consume runs before token exchange.** `completeWebOAuthFlow`\n * consumes the pending row before attempting `exchangeAuthorization`. If\n * the AS returns a transient 5xx (or the network blips between us and the\n * AS), the row is gone and the user must restart from `/oauth/start`.\n * This is the right call for `invalid_grant` (replay protection — the\n * authorization code is one-shot at the AS regardless), but it means\n * transient AS failures cost the user a click. Revisit only if you see\n * real retry-loss in the field.\n */\nexport interface PendingWebFlowStore {\n  /** Insert a new flow. MUST reject duplicate `state`. */\n  put(flow: PendingWebFlow): Promise<void>;\n  /**\n   * Atomic delete-and-return. MUST NOT return the same row twice.\n   * Returns null if the row is absent or expired.\n   */\n  consume(state: string): Promise<PendingWebFlow | null>;\n  /** Optional housekeeping for expired rows that were never claimed. */\n  cleanupExpired?(): Promise<number>;\n}\n\n/** @deprecated Renamed to `PendingWebFlowStore`. */\nexport type PendingFlowStore = PendingWebFlowStore;\n\nexport class InvalidOrExpiredFlowError extends OAuthError {\n  constructor(state: string) {\n    super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');\n    this.name = 'InvalidOrExpiredFlowError';\n  }\n}\n\nexport class StateMismatchError extends OAuthError {\n  constructor() {\n    super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');\n    this.name = 'StateMismatchError';\n  }\n}\n\nexport class TokenExchangeError extends OAuthError {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: string,\n    /**\n     * RFC 6749 §5.2 error code when the authorization server returned a\n     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).\n     * Undefined when the AS returned a non-OAuth-shaped failure.\n     */\n    public readonly oauthErrorCode?: string\n  ) {\n    super(message, 'token_exchange_failed');\n    this.name = 'TokenExchangeError';\n  }\n}\n\nexport class ProtectedResourceMetadataError extends OAuthError {\n  constructor(message: string) {\n    super(message, 'protected_resource_metadata_error');\n    this.name = 'ProtectedResourceMetadataError';\n  }\n}\n\nexport class AgentVanishedDuringFlowError extends OAuthError {\n  constructor(agentId: string) {\n    super(\n      `Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`,\n      'agent_vanished_during_flow',\n      agentId\n    );\n    this.name = 'AgentVanishedDuringFlowError';\n  }\n}\n\nexport class ConfidentialClientNotAllowedError extends OAuthError {\n  constructor(agentId: string | undefined) {\n    super(\n      'Authorization server issued a confidential client (client_secret) during dynamic registration. ' +\n        'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.',\n      'confidential_client_not_allowed',\n      agentId\n    );\n    this.name = 'ConfidentialClientNotAllowedError';\n  }\n}\n\nexport class BrowserBindingRequiredError extends OAuthError {\n  constructor() {\n    super(\n      'completeWebOAuthFlow called with requireBrowserBinding:true but expectedState was not supplied — ' +\n        'pass the state value from the session cookie set at /oauth/start',\n      'browser_binding_required'\n    );\n    this.name = 'BrowserBindingRequiredError';\n  }\n}\n\nexport interface StartWebFlowOptions {\n  /** Agent the flow is for. Must include `agent_uri`. */\n  agent: AgentConfig;\n  /** Absolute URL of the consumer's `/callback` route (must match what the AS sees). */\n  redirectUri: string;\n  /** Where to persist the pending flow until callback. */\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, dynamic-registration results land in `agent.oauth_client`. */\n  agentStorage?: OAuthConfigStorage;\n  /**\n   * Free-form caller payload, round-tripped to `completeWebOAuthFlow`.\n   * Must be JSON-serializable. Do not store secrets here. Treated as\n   * attacker-influenced — validate before reflecting (e.g. via\n   * {@link safeReturnTo} for redirect targets).\n   */\n  carry?: Record<string, unknown>;\n  /**\n   * Scope hint (highest priority per SEP-835). Pass through the `scope`\n   * value from a prior 401 `WWW-Authenticate` challenge if you have one.\n   */\n  scopeHint?: string;\n  /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */\n  ttlMs?: number;\n  /** Override the random-state generator (defaults to 32 bytes base64url). */\n  generateState?: () => string;\n  /** Override `fetch` (timeouts, signing, mocks). */\n  fetch?: typeof fetch;\n  /**\n   * Override base client metadata. `redirect_uris` is always replaced\n   * with `[redirectUri]` regardless of what's passed here.\n   */\n  clientMetadata?: Partial<OAuthClientMetadata>;\n  /**\n   * Permit the AS to register a confidential client (i.e. one that\n   * returns a `client_secret` from dynamic registration). Default false:\n   * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}\n   * rather than silently persisting a long-lived credential to your\n   * agent storage.\n   */\n  allowConfidentialClient?: boolean;\n}\n\nexport interface StartWebFlowResult {\n  authorizationUrl: string;\n  state: string;\n  expiresAt: Date;\n}\n\nexport interface CompleteWebFlowOptions {\n  state: string;\n  code: string;\n  pendingFlowStore: PendingWebFlowStore;\n  /** When provided, the issued tokens are persisted to `agent.oauth_tokens`. */\n  agentStorage?: OAuthConfigStorage;\n  fetch?: typeof fetch;\n  /**\n   * The caller-bound expected state (e.g. from a session cookie set at\n   * `/oauth/start`). When provided, must equal `state`; mismatch throws\n   * {@link StateMismatchError}. Without this, `state` is replay-protected\n   * but not browser-bound — see WEB-OAUTH.md.\n   */\n  expectedState?: string;\n  /**\n   * When `true`, throws {@link BrowserBindingRequiredError} if `expectedState`\n   * is omitted instead of emitting a `console.warn`. Use this in frameworks\n   * where session cookies are always available so that a missing bind is caught\n   * at development time rather than silently permitted in production.\n   *\n   * Default: `false`.\n   */\n  requireBrowserBinding?: boolean;\n}\n\nexport interface CompleteWebFlowResult {\n  agentId: string;\n  agentUrl: string;\n  tokens: OAuthTokens;\n  carry?: Record<string, unknown>;\n  /** True if `agentStorage` was provided AND `saveAgent` succeeded. */\n  persisted: boolean;\n}\n\n/**\n * Begin a web OAuth flow. Returns the authorization URL the consumer\n * should redirect the browser to. Persists the PKCE verifier and other\n * flow state via `pendingFlowStore.put` so a different process can complete it.\n */\nexport async function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult> {\n  const {\n    agent,\n    redirectUri,\n    pendingFlowStore,\n    agentStorage,\n    carry,\n    scopeHint,\n    ttlMs = DEFAULT_WEB_FLOW_TTL_MS,\n    generateState,\n    fetch: fetchFn,\n    clientMetadata: clientMetadataOverrides,\n    allowConfidentialClient = false,\n  } = opts;\n\n  if (!agent.agent_uri) {\n    throw new OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);\n  }\n\n  const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);\n  if (prm?.resource) {\n    assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);\n  }\n\n  const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);\n\n  const asMetadata = await discoverAuthorizationServerMetadata(asUrl.toString(), { fetchFn });\n  if (!asMetadata) {\n    throw new OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);\n  }\n\n  const resource = prm?.resource ? new URL(prm.resource) : resourceUrlFromServerUrl(new URL(agent.agent_uri));\n\n  const baseClientMetadata: OAuthClientMetadata = {\n    ...DEFAULT_CLIENT_METADATA,\n    ...clientMetadataOverrides,\n    redirect_uris: [redirectUri],\n  };\n\n  const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;\n\n  const clientInformation = await resolveClientInformation({\n    agent,\n    agentStorage,\n    asUrl,\n    asMetadata,\n    clientMetadata: baseClientMetadata,\n    fetchFn,\n    allowConfidentialClient,\n  });\n\n  const state = (generateState ?? defaultGenerateState)();\n  const { authorizationUrl, codeVerifier } = await startAuthorization(asUrl.toString(), {\n    metadata: asMetadata,\n    clientInformation,\n    redirectUrl: redirectUri,\n    scope,\n    state,\n    resource,\n  });\n\n  const now = new Date();\n  const expiresAt = new Date(now.getTime() + ttlMs);\n  const flow: PendingWebFlow = {\n    state,\n    agentId: agent.id,\n    agentUrl: agent.agent_uri,\n    codeVerifier,\n    redirectUri,\n    resource: resource.href,\n    scope,\n    authorizationServerUrl: asUrl.toString(),\n    clientInformation,\n    createdAt: now,\n    expiresAt,\n    carry,\n  };\n  await pendingFlowStore.put(flow);\n\n  return {\n    authorizationUrl: authorizationUrl.toString(),\n    state,\n    expiresAt,\n  };\n}\n\n/**\n * Finish a web OAuth flow. Atomically consumes the pending row, exchanges\n * the authorization code for tokens, and (if storage is provided)\n * persists tokens to `agent.oauth_tokens`. Returns whatever the caller\n * stashed in `carry` so the consumer can route the user appropriately.\n *\n * The pending row is consumed BEFORE `exchangeAuthorization` runs. A\n * transient AS failure leaves the user with no row to retry against and\n * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}\n * for the full tradeoff discussion.\n */\nexport async function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult> {\n  const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState, requireBrowserBinding } = opts;\n\n  if (expectedState === undefined) {\n    if (requireBrowserBinding) {\n      throw new BrowserBindingRequiredError();\n    }\n    // Warn callers who omit expectedState: the flow is replay-protected via\n    // atomic consume but is not browser-bound (any request carrying the correct\n    // state + code would be accepted). Pass expectedState from a session cookie\n    // set at /oauth/start to fully bind the callback to the initiating browser.\n    // Set requireBrowserBinding:true to make this a hard error instead.\n    console.warn(\n      '[adcp/sdk] completeWebOAuthFlow: expectedState not supplied — the callback is replay-protected ' +\n        'but not browser-bound. Pass expectedState from a session cookie set at /oauth/start, ' +\n        'or set requireBrowserBinding:true to enforce it.'\n    );\n  } else if (expectedState !== state) {\n    throw new StateMismatchError();\n  }\n\n  const flow = await pendingFlowStore.consume(state);\n  if (!flow || flow.expiresAt.getTime() < Date.now()) {\n    throw new InvalidOrExpiredFlowError(state);\n  }\n\n  const asMetadata = await discoverAuthorizationServerMetadata(flow.authorizationServerUrl, {\n    fetchFn,\n  });\n\n  let tokens: OAuthTokens;\n  try {\n    tokens = await exchangeAuthorization(flow.authorizationServerUrl, {\n      metadata: asMetadata ?? undefined,\n      clientInformation: flow.clientInformation,\n      authorizationCode: code,\n      codeVerifier: flow.codeVerifier,\n      redirectUri: flow.redirectUri,\n      resource: flow.resource ? new URL(flow.resource) : undefined,\n      fetchFn,\n    });\n  } catch (err) {\n    throw wrapTokenExchangeError(err);\n  }\n\n  let persisted = false;\n  if (agentStorage) {\n    const agent = await agentStorage.loadAgent(flow.agentId);\n    if (!agent) {\n      throw new AgentVanishedDuringFlowError(flow.agentId);\n    }\n    agent.oauth_tokens = fromMCPTokens(tokens);\n    delete agent.oauth_code_verifier;\n    await agentStorage.saveAgent(agent);\n    persisted = true;\n  }\n\n  return {\n    agentId: flow.agentId,\n    agentUrl: flow.agentUrl,\n    tokens,\n    carry: flow.carry,\n    persisted,\n  };\n}\n\n/**\n * Validate a redirect target supplied via `carry`.\n *\n * Treats `value` as attacker-influenced. Returns a string that is safe to\n * pass to `res.redirect`, or `undefined` if the value is invalid.\n *\n * Defaults to **path-only** redirects (must start with a single `/` and\n * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`\n * to permit absolute URLs against an allowlist.\n *\n * @example\n * ```ts\n * res.redirect(safeReturnTo(carry?.return_to) ?? '/');\n * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');\n * ```\n */\nexport function safeReturnTo(value: unknown, options: { allowedReturnHosts?: string[] } = {}): string | undefined {\n  if (typeof value !== 'string' || value.length === 0) return undefined;\n\n  // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\\...`.\n  if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\\\')) {\n    return value;\n  }\n\n  const allowed = options.allowedReturnHosts;\n  if (!allowed || allowed.length === 0) return undefined;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return undefined;\n  }\n  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined;\n  if (!allowed.includes(parsed.host)) return undefined;\n  return parsed.toString();\n}\n\n/**\n * In-memory pending-flow store for tests and single-instance dev.\n *\n * Production deployments MUST implement `PendingWebFlowStore` against a\n * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so\n * `/start` and `/callback` can hit different processes.\n */\nexport class InMemoryPendingFlowStore implements PendingWebFlowStore {\n  private readonly flows = new Map<string, PendingWebFlow>();\n\n  async put(flow: PendingWebFlow): Promise<void> {\n    if (this.flows.has(flow.state)) {\n      throw new Error(`Pending flow already exists for state ${flow.state}`);\n    }\n    this.flows.set(flow.state, flow);\n  }\n\n  async consume(state: string): Promise<PendingWebFlow | null> {\n    const flow = this.flows.get(state);\n    if (!flow) return null;\n    this.flows.delete(state);\n    if (flow.expiresAt.getTime() < Date.now()) return null;\n    return flow;\n  }\n\n  async cleanupExpired(): Promise<number> {\n    const now = Date.now();\n    let removed = 0;\n    for (const [state, flow] of this.flows) {\n      if (flow.expiresAt.getTime() < now) {\n        this.flows.delete(state);\n        removed++;\n      }\n    }\n    return removed;\n  }\n}\n\n// ============================================================\n// Internals\n// ============================================================\n\n/**\n * The MCP SDK reports a 404 PRM lookup with this exact message; treat it\n * as \"PRM is genuinely absent\" and fall back. Anything else is a\n * connection, parse, or 5xx error and is allowed to bubble.\n *\n * Source (verified against `@modelcontextprotocol/sdk@1.29.0`):\n *   `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`\n *   throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`\n *   when `response.status === 404` (or no response was returned).\n *\n * If a future MCP SDK reword this message, the test\n * \"falls back to server-derived resource on a 404 PRM\" at\n * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real\n * SDK against a 404 fixture and is the canary for this regression.\n */\nconst PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';\n\nasync function tryDiscoverPRM(\n  agentUrl: string,\n  fetchFn: typeof fetch | undefined\n): Promise<OAuthProtectedResourceMetadata | undefined> {\n  try {\n    return await discoverOAuthProtectedResourceMetadata(agentUrl, undefined, fetchFn);\n  } catch (err) {\n    if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {\n      // PRM is optional under RFC 9728 — fall back to local resource\n      // derivation. Connection/parse/5xx errors fall through.\n      return undefined;\n    }\n    const message = err instanceof Error ? err.message : String(err);\n    throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);\n  }\n}\n\nfunction assertPrmResourceMatchesAgentOrigin(agentUrl: string, prmResource: string): void {\n  const requested = resourceUrlFromServerUrl(new URL(agentUrl));\n  if (!checkResourceAllowed({ requestedResource: requested, configuredResource: prmResource })) {\n    throw new ProtectedResourceMetadataError(\n      `PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`\n    );\n  }\n}\n\nfunction resolveAuthorizationServerUrl(agentUrl: string, prm: OAuthProtectedResourceMetadata | undefined): URL {\n  const first = prm?.authorization_servers?.[0];\n  if (first) {\n    return new URL(first);\n  }\n  return new URL(new URL(agentUrl).origin);\n}\n\nasync function resolveClientInformation(args: {\n  agent: AgentConfig;\n  agentStorage?: OAuthConfigStorage;\n  asUrl: URL;\n  asMetadata: AuthorizationServerMetadata;\n  clientMetadata: OAuthClientMetadata;\n  fetchFn?: typeof fetch;\n  allowConfidentialClient: boolean;\n}): Promise<OAuthClientInformation> {\n  const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;\n\n  if (agent.oauth_client) {\n    return toMCPClientInfo(agent.oauth_client);\n  }\n\n  if (!asMetadata.registration_endpoint) {\n    throw new OAuthError(\n      'Agent has no oauth_client and authorization server does not advertise dynamic client registration',\n      'no_client_credentials',\n      agent.id\n    );\n  }\n\n  const registered: OAuthClientInformationFull = await registerClient(asUrl.toString(), {\n    metadata: asMetadata,\n    clientMetadata,\n    fetchFn,\n  });\n\n  if (registered.client_secret && !allowConfidentialClient) {\n    throw new ConfidentialClientNotAllowedError(agent.id);\n  }\n\n  if (agentStorage) {\n    // Load fresh and save fresh so two concurrent /start calls for the\n    // same agentId do not trample each other's `oauth_client` via a\n    // shared in-memory reference.\n    const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;\n    fresh.oauth_client = fromMCPClientInfo(registered);\n    await agentStorage.saveAgent(fresh);\n  }\n\n  return registered;\n}\n\nfunction defaultGenerateState(): string {\n  return randomBytes(32).toString('base64url');\n}\n\n/**\n * Map an MCP SDK token-exchange failure to {@link TokenExchangeError},\n * redacting bearer/refresh tokens that some authorization servers echo\n * back in error responses for debugging.\n */\nfunction wrapTokenExchangeError(err: unknown): TokenExchangeError {\n  // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error\n  // envelope into an `OAuthError` subclass with `errorCode` (e.g.\n  // `InvalidGrantError`). Malformed responses come through as\n  // `ServerError` with the raw body in `message`, so the redaction pass\n  // covers both cases.\n  const oauthErrorCode = (err as { errorCode?: string })?.errorCode;\n  const message = err instanceof Error ? err.message : String(err);\n  const status = (err as { status?: number })?.status ?? 0;\n  const rawBody = (err as { body?: string })?.body ?? message;\n  const body = redactTokens(rawBody);\n  const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;\n  return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);\n}\n\nconst SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];\n\n/**\n * Best-effort redaction of bearer/refresh tokens from an AS error body\n * (which may be JSON, form-encoded, or freeform). Adopters MUST still\n * treat `TokenExchangeError.body` as sensitive — do not reflect it to\n * the browser or write it to access logs unredacted.\n */\nfunction redactTokens(input: string): string {\n  let out = input;\n  for (const key of SENSITIVE_TOKEN_KEYS) {\n    // JSON form: \"key\":\"…\"\n    out = out.replace(new RegExp(`(\"${key}\"\\\\s*:\\\\s*\")[^\"]*(\")`, 'gi'), '$1<redacted>$2');\n    // form-encoded: key=…\n    out = out.replace(new RegExp(`(\\\\b${key}=)[^&\\\\s]+`, 'gi'), '$1<redacted>');\n  }\n  return out;\n}\n"],"mappings":"AA+BA,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,gCAAgC;AAW/D,SAAS,yBAAyB,mBAAmB,eAAe,YAAY,uBAAuB;AAOhG,MAAM,0BAA0B,KAAK,KAAK;AAoF1C,MAAM,kCAAkC,WAAW;AAAA,EACxD,YAAY,OAAe;AACzB,UAAM,0CAA0C,KAAK,KAAK,yBAAyB;AACnF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,cAAc;AACZ,UAAM,yEAAyE,gBAAgB;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,WAAW;AAAA,EACjD,YACE,SACgB,QACA,MAMA,gBAChB;AACA,UAAM,SAAS,uBAAuB;AATtB;AACA;AAMA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAAA,EACA;AAAA,EAMA;AAKpB;AAEO,MAAM,uCAAuC,WAAW;AAAA,EAC7D,YAAY,SAAiB;AAC3B,UAAM,SAAS,mCAAmC;AAClD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qCAAqC,WAAW;AAAA,EAC3D,YAAY,SAAiB;AAC3B;AAAA,MACE,SAAS,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0CAA0C,WAAW;AAAA,EAChE,YAAY,SAA6B;AACvC;AAAA,MACE;AAAA,MAEA;AAAA,MACA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,oCAAoC,WAAW;AAAA,EAC1D,cAAc;AACZ;AAAA,MACE;AAAA,MAEA;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAyFA,eAAsB,kBAAkB,MAAwD;AAC9F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,OAAO;AAAA,IACP,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,IAAI;AAEJ,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,WAAW,2BAA2B,iBAAiB,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,eAAe,MAAM,WAAW,OAAO;AACzD,MAAI,KAAK,UAAU;AACjB,wCAAoC,MAAM,WAAW,IAAI,QAAQ;AAAA,EACnE;AAEA,QAAM,QAAQ,8BAA8B,MAAM,WAAW,GAAG;AAEhE,QAAM,aAAa,MAAM,oCAAoC,MAAM,SAAS,GAAG,EAAE,QAAQ,CAAC;AAC1F,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,WAAW,wBAAwB,MAAM,SAAS,CAAC,IAAI,oCAAoC,MAAM,EAAE;AAAA,EAC/G;AAEA,QAAM,WAAW,KAAK,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,yBAAyB,IAAI,IAAI,MAAM,SAAS,CAAC;AAE1G,QAAM,qBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe,CAAC,WAAW;AAAA,EAC7B;AAEA,QAAM,QAAQ,aAAa,KAAK,kBAAkB,KAAK,GAAG,KAAK,mBAAmB;AAElF,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,SAAS,iBAAiB,sBAAsB;AACtD,QAAM,EAAE,kBAAkB,aAAa,IAAI,MAAM,mBAAmB,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK;AAChD,QAAM,OAAuB;AAAA,IAC3B;AAAA,IACA,SAAS,MAAM;AAAA,IACf,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,wBAAwB,MAAM,SAAS;AAAA,IACvC;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,IAAI,IAAI;AAE/B,SAAO;AAAA,IACL,kBAAkB,iBAAiB,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACF;AAaA,eAAsB,qBAAqB,MAA8D;AACvG,QAAM,EAAE,OAAO,MAAM,kBAAkB,cAAc,OAAO,SAAS,eAAe,sBAAsB,IAAI;AAE9G,MAAI,kBAAkB,QAAW;AAC/B,QAAI,uBAAuB;AACzB,YAAM,IAAI,4BAA4B;AAAA,IACxC;AAMA,YAAQ;AAAA,MACN;AAAA,IAGF;AAAA,EACF,WAAW,kBAAkB,OAAO;AAClC,UAAM,IAAI,mBAAmB;AAAA,EAC/B;AAEA,QAAM,OAAO,MAAM,iBAAiB,QAAQ,KAAK;AACjD,MAAI,CAAC,QAAQ,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAClD,UAAM,IAAI,0BAA0B,KAAK;AAAA,EAC3C;AAEA,QAAM,aAAa,MAAM,oCAAoC,KAAK,wBAAwB;AAAA,IACxF;AAAA,EACF,CAAC;AAED,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,sBAAsB,KAAK,wBAAwB;AAAA,MAChE,UAAU,cAAc;AAAA,MACxB,mBAAmB,KAAK;AAAA,MACxB,mBAAmB;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,uBAAuB,GAAG;AAAA,EAClC;AAEA,MAAI,YAAY;AAChB,MAAI,cAAc;AAChB,UAAM,QAAQ,MAAM,aAAa,UAAU,KAAK,OAAO;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,6BAA6B,KAAK,OAAO;AAAA,IACrD;AACA,UAAM,eAAe,cAAc,MAAM;AACzC,WAAO,MAAM;AACb,UAAM,aAAa,UAAU,KAAK;AAClC,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAkBO,SAAS,aAAa,OAAgB,UAA6C,CAAC,GAAuB;AAChH,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAG5D,MAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,GAAG;AAChF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAE7C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,YAAY,OAAO,aAAa,QAAS,QAAO;AACxE,MAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AAC3C,SAAO,OAAO,SAAS;AACzB;AASO,MAAM,yBAAwD;AAAA,EAClD,QAAQ,oBAAI,IAA4B;AAAA,EAEzD,MAAM,IAAI,MAAqC;AAC7C,QAAI,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,MAAM,yCAAyC,KAAK,KAAK,EAAE;AAAA,IACvE;AACA,SAAK,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,OAA+C;AAC3D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAClD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,eAAW,CAAC,OAAO,IAAI,KAAK,KAAK,OAAO;AACtC,UAAI,KAAK,UAAU,QAAQ,IAAI,KAAK;AAClC,aAAK,MAAM,OAAO,KAAK;AACvB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAqBA,MAAM,oBAAoB;AAE1B,eAAe,eACb,UACA,SACqD;AACrD,MAAI;AACF,WAAO,MAAM,uCAAuC,UAAU,QAAW,OAAO;AAAA,EAClF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,IAAI,QAAQ,SAAS,iBAAiB,GAAG;AAGnE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,IAAI,+BAA+B,yBAAyB,OAAO,EAAE;AAAA,EAC7E;AACF;AAEA,SAAS,oCAAoC,UAAkB,aAA2B;AACxF,QAAM,YAAY,yBAAyB,IAAI,IAAI,QAAQ,CAAC;AAC5D,MAAI,CAAC,qBAAqB,EAAE,mBAAmB,WAAW,oBAAoB,YAAY,CAAC,GAAG;AAC5F,UAAM,IAAI;AAAA,MACR,2BAA2B,WAAW,mDAAmD,QAAQ;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAAkB,KAAsD;AAC7G,QAAM,QAAQ,KAAK,wBAAwB,CAAC;AAC5C,MAAI,OAAO;AACT,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB;AACA,SAAO,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,MAAM;AACzC;AAEA,eAAe,yBAAyB,MAQJ;AAClC,QAAM,EAAE,OAAO,cAAc,OAAO,YAAY,gBAAgB,SAAS,wBAAwB,IAAI;AAErG,MAAI,MAAM,cAAc;AACtB,WAAO,gBAAgB,MAAM,YAAY;AAAA,EAC3C;AAEA,MAAI,CAAC,WAAW,uBAAuB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,aAAyC,MAAM,eAAe,MAAM,SAAS,GAAG;AAAA,IACpF,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,iBAAiB,CAAC,yBAAyB;AACxD,UAAM,IAAI,kCAAkC,MAAM,EAAE;AAAA,EACtD;AAEA,MAAI,cAAc;AAIhB,UAAM,QAAS,MAAM,aAAa,UAAU,MAAM,EAAE,KAAM;AAC1D,UAAM,eAAe,kBAAkB,UAAU;AACjD,UAAM,aAAa,UAAU,KAAK;AAAA,EACpC;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAOA,SAAS,uBAAuB,KAAkC;AAMhE,QAAM,iBAAkB,KAAgC;AACxD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,SAAU,KAA6B,UAAU;AACvD,QAAM,UAAW,KAA2B,QAAQ;AACpD,QAAM,OAAO,aAAa,OAAO;AACjC,QAAM,UAAU,iBAAiB,GAAG,cAAc,KAAK,OAAO,KAAK;AACnE,SAAO,IAAI,mBAAmB,0BAA0B,aAAa,OAAO,CAAC,IAAI,QAAQ,MAAM,cAAc;AAC/G;AAEA,MAAM,uBAAuB,CAAC,gBAAgB,iBAAiB,YAAY,OAAO;AAQlF,SAAS,aAAa,OAAuB;AAC3C,MAAI,MAAM;AACV,aAAW,OAAO,sBAAsB;AAEtC,UAAM,IAAI,QAAQ,IAAI,OAAO,KAAK,GAAG,wBAAwB,IAAI,GAAG,gBAAgB;AAEpF,UAAM,IAAI,QAAQ,IAAI,OAAO,OAAO,GAAG,cAAc,IAAI,GAAG,cAAc;AAAA,EAC5E;AACA,SAAO;AACT;","names":[]}

package/dist/lib/core/AgentClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/AgentClient.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EAKxB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAG1B,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EACV,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAE9B,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAEvF,MAAM,MAAM,8BAA8B,GAAG,WAAW,GAAG;IACzD,+FAA+F;IAC/F,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC3D,CAAC;AAEF;;;;;;;;GAQG;AACH;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE1E;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,4BAA4B,CAAC;IAC3C,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,cAAc,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;IACjE,cAAc,EAAE,8BAA8B,CAAC;IAC/C,cAAc,EAAE,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;IAChE,sBAAsB,EAAE,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;IAC/E,qBAAqB,EAAE,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;IAC9E,4BAA4B,EAAE,kCAAkC,CAAC;IACjE,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,eAAe,EAAE,qBAAqB,CAAC;IACvC,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,qBAAqB,CAAC;IACvC,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,UAAU,EAAE,iBAAiB,CAAC;IAC9B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,qBAAqB,CAAC;CACvC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC;AAErD,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,2BAA2B,CAAC;IAC1C,gBAAgB,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;IACvE,gBAAgB,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;IACvE,cAAc,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IACpE,cAAc,EAAE,6BAA6B,CAAC;IAC9C,cAAc,EAAE,mBAAmB,CAAC;IACpC,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,4BAA4B,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,CAAC;IACtF,WAAW,EAAE,iBAAiB,CAAC;IAC/B,eAAe,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,aAAa,EAAE,mBAAmB,CAAC;IACnC,aAAa,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACzD,cAAc,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACtE,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACtE,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACtE,eAAe,EAAE,oBAAoB,CAAC;IACtC,mBAAmB,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACpE,eAAe,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAC5D,oBAAoB,EAAE,yBAAyB,CAAC;IAChD,kBAAkB,EAAE,uBAAuB,CAAC;IAC5C,UAAU,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,mBAAmB,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACpE,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,mBAAmB,CAAC;IACnC,cAAc,EAAE,oBAAoB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,uBAAuB,EACrB,aAAa,GACb,iBAAiB,GACjB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,uBAAuB,GACvB,oBAAoB,GACpB,+BAA+B,GAC/B,kBAAkB,GAClB,uBAAuB,GACvB,SAAS,GACT,gBAAgB,GAChB,0BAA0B,GAC1B,sBAAsB,CACzB,GAAG;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AA4CF,qBAAa,WAAW;IAOpB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAPhB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAG7B,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IA2B9C;;;OAGG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,GAAE,0BAA+B,GAAG,WAAW;IA8BhG;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,WAAW;IAenB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAInB;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI/F;;;;;;;;;;;OAWG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAMV;;;;;;;;;;;;;;;OAeG;IACG,WAAW,CACf,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAUpD,wEAAwE;IAClE,iBAAiB,CACrB,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAQ3C,0EAA0E;IACpE,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,uBAAuB,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAQhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAUzE,iHAAiH;IAC3G,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;;;;;;OAWG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAUzE,iHAAiH;IAC3G,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,EAC3D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAUxE,gHAAgH;IAC1G,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,6BAA6B,EACrC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAUtD;;;;OAIG;IACG,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAUvE;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAU9E,4EAA4E;IACtE,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAS9E;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAQ1C;;OAEG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;OAKG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIrG;;;;;OAKG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAInE;;;;OAIG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;OAGG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,sFAAsF;IAChF,qBAAqB,CACzB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C,8FAA8F;IACxF,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAQpD;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAQnD;;OAEG;IACG,sBAAsB,CAC1B,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAQhD;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAUvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;;;;;;;;;;;;;;;OAgBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAYzB;;OAEG;IACH,UAAU,IAAI,OAAO,EAAE,GAAG,SAAS;IAOnC;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAIpB;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAQjC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;IACH,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMrC;;OAEG;IACH,QAAQ,IAAI,WAAW;IAIvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;OAKG;IACH,eAAe,IAAI,MAAM;IAIzB;;;;;;;;OAQG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAU5C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO;IAQtD;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7E;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAI9C;;OAEG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC;;;;;;;uBAsM6ilK,CAAC;uBAA2B,CAAC;sBAA2C,CAAC;;;IAlM5rlK;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;OAEG;IACH,cAAc;IAMd;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,CAAC,SAAS,YAAY,EACtC,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IA+C9C,gFAAgF;IAC1E,iBAAiB,CAAC,CAAC,GAAG,OAAO,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IASzB;;;OAGG;IACG,iBAAiB,CAAC,CAAC,GAAG,OAAO,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAUzB;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAI3D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAI5D;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAId;;;;;OAKG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAU5D;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CASzC"}
+{"version":3,"file":"AgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/AgentClient.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EAKxB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAG1B,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EACV,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAE9B,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAEvF,MAAM,MAAM,8BAA8B,GAAG,WAAW,GAAG;IACzD,+FAA+F;IAC/F,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC3D,CAAC;AAEF;;;;;;;;GAQG;AACH;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE1E;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,4BAA4B,CAAC;IAC3C,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,cAAc,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;IACjE,cAAc,EAAE,8BAA8B,CAAC;IAC/C,cAAc,EAAE,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;IAChE,sBAAsB,EAAE,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;IAC/E,qBAAqB,EAAE,yBAAyB,CAAC,2BAA2B,CAAC,CAAC;IAC9E,4BAA4B,EAAE,kCAAkC,CAAC;IACjE,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,aAAa,EAAE,oBAAoB,CAAC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,qBAAqB,CAAC;IACtC,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,eAAe,EAAE,qBAAqB,CAAC;IACvC,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,eAAe,EAAE,qBAAqB,CAAC;IACvC,oBAAoB,EAAE,0BAA0B,CAAC;IACjD,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,UAAU,EAAE,iBAAiB,CAAC;IAC9B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,mBAAmB,EAAE,yBAAyB,CAAC;IAC/C,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,aAAa,EAAE,oBAAoB,CAAC;IACpC,cAAc,EAAE,qBAAqB,CAAC;CACvC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC;AAErD,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,2BAA2B,CAAC;IAC1C,gBAAgB,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;IACvE,gBAAgB,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;IACvE,cAAc,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IACpE,cAAc,EAAE,6BAA6B,CAAC;IAC9C,cAAc,EAAE,mBAAmB,CAAC;IACpC,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,4BAA4B,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,CAAC;IACtF,WAAW,EAAE,iBAAiB,CAAC;IAC/B,eAAe,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,aAAa,EAAE,mBAAmB,CAAC;IACnC,aAAa,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACzD,cAAc,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACtE,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACtE,mBAAmB,EAAE,wBAAwB,CAAC;IAC9C,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACtE,eAAe,EAAE,oBAAoB,CAAC;IACtC,mBAAmB,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACpE,eAAe,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAC5D,oBAAoB,EAAE,yBAAyB,CAAC;IAChD,kBAAkB,EAAE,uBAAuB,CAAC;IAC5C,UAAU,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,mBAAmB,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACpE,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,mBAAmB,CAAC;IACnC,cAAc,EAAE,oBAAoB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,uBAAuB,EACrB,aAAa,GACb,iBAAiB,GACjB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,uBAAuB,GACvB,oBAAoB,GACpB,+BAA+B,GAC/B,kBAAkB,GAClB,uBAAuB,GACvB,SAAS,GACT,gBAAgB,GAChB,0BAA0B,GAC1B,sBAAsB,CACzB,GAAG;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AA4CF,qBAAa,WAAW;IAOpB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAPhB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAG7B,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IA2B9C;;;OAGG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,GAAE,0BAA+B,GAAG,WAAW;IA8BhG;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,WAAW;IAenB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAInB;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI/F;;;;;;;;;;;OAWG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAMV;;;;;;;;;;;;;;;OAeG;IACG,WAAW,CACf,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAUpD,wEAAwE;IAClE,iBAAiB,CACrB,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAQ3C,0EAA0E;IACpE,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,uBAAuB,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAQhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAUzE,iHAAiH;IAC3G,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;;;;;;OAWG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAUzE,iHAAiH;IAC3G,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,EAC3D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAUxE,gHAAgH;IAC1G,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,6BAA6B,EACrC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAUtD;;;;OAIG;IACG,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAUvE;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAU9E,4EAA4E;IACtE,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAS9E;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAQ1C;;OAEG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;OAEG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;;;;OAKG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIrG;;;;;OAKG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAInE;;;;OAIG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;OAGG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,sFAAsF;IAChF,qBAAqB,CACzB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C,8FAA8F;IACxF,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAQ5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAQ/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAQlD;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAQpD;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAQnD;;OAEG;IACG,sBAAsB,CAC1B,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAQhD;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAUvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAQjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;;;;;;;;;;;;;;;OAgBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAYzB;;OAEG;IACH,UAAU,IAAI,OAAO,EAAE,GAAG,SAAS;IAOnC;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAIpB;;;;;;;;OAQG;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAQjC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAIlC;;;;;;;;OAQG;IACH,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMrC;;OAEG;IACH,QAAQ,IAAI,WAAW;IAIvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;OAKG;IACH,eAAe,IAAI,MAAM;IAIzB;;;;;;;;OAQG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAU5C;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO;IAQtD;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7E;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAI9C;;OAEG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC;;;;;;;uBAsMgutK,CAAC;uBAA2B,CAAC;sBAA2C,CAAC;;;IAlM/2tK;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;OAEG;IACH,cAAc;IAMd;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,CAAC,SAAS,YAAY,EACtC,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IA+C9C,gFAAgF;IAC1E,iBAAiB,CAAC,CAAC,GAAG,OAAO,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IASzB;;;OAGG;IACG,iBAAiB,CAAC,CAAC,GAAG,OAAO,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAUzB;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAItC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAI3D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAI5D;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAId;;;;;OAKG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAU5D;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CASzC"}

package/dist/lib/core/SingleAgentClient.d.mts

@@ -80,7 +80,16 @@ export interface ClientProductPropertyPolicy extends BuyerPropertyPolicy {
      */
     message?: string;
 }
-export type WebhookParseErrorCode = 'webhook_signature_invalid' | 'webhook_timestamp_invalid' | 'webhook_unsupported_payload' | 'webhook_envelope_invalid' | 'webhook_result_invalid';
+export type WebhookParseErrorCode = 'webhook_signature_invalid' | 'webhook_timestamp_invalid' | 'webhook_unsupported_payload' | 'webhook_envelope_invalid' | 'webhook_result_invalid'
+/**
+ * The receiver has no way to authenticate this webhook: no `webhookSecret` is
+ * configured, so the legacy HMAC profile has nothing to verify against, and
+ * this client does not yet verify the RFC 9421 webhook profile that an
+ * omitted `authentication` block selects. Distinct from
+ * `webhook_signature_invalid` — nothing was checked and found wrong; there was
+ * no check to perform.
+ */
+ | 'webhook_unverifiable';
 export interface VerifyAndParseWebhookOptions {
     /** Raw HTTP body bytes captured before JSON parsing. Required when `webhookSecret` is configured. */
     rawBody?: string | Buffer | Uint8Array;
@@ -192,6 +201,23 @@ export interface SingleAgentClientConfig extends ConversationConfig {
     handlers?: AsyncHandlerConfig;
     /** Webhook secret for signature verification (recommended for production) */
     webhookSecret?: string;
+    /**
+     * Accept inbound webhooks that carry no verifiable authenticity at all.
+     *
+     * Without `webhookSecret` the legacy HMAC profile has nothing to verify
+     * against, and this client does not yet verify the RFC 9421 webhook profile
+     * that an omitted `authentication` block selects. `verifyAndParseWebhook`
+     * therefore refuses such webhooks with `webhook_unverifiable` by default:
+     * anyone who can reach the receiver route could otherwise forge task
+     * completions and status changes.
+     *
+     * Set this only when the receiver is genuinely unreachable from outside your
+     * network (in-process test harnesses, a route bound to loopback). It is not a
+     * substitute for a secret on any route an agent can reach over the internet.
+     *
+     * @default false
+     */
+    allowUnauthenticatedWebhooks?: boolean;
     /**
      * Webhook URL template with macro substitution
      *

package/dist/lib/core/SingleAgentClient.d.ts

@@ -80,7 +80,16 @@ export interface ClientProductPropertyPolicy extends BuyerPropertyPolicy {
      */
     message?: string;
 }
-export type WebhookParseErrorCode = 'webhook_signature_invalid' | 'webhook_timestamp_invalid' | 'webhook_unsupported_payload' | 'webhook_envelope_invalid' | 'webhook_result_invalid';
+export type WebhookParseErrorCode = 'webhook_signature_invalid' | 'webhook_timestamp_invalid' | 'webhook_unsupported_payload' | 'webhook_envelope_invalid' | 'webhook_result_invalid'
+/**
+ * The receiver has no way to authenticate this webhook: no `webhookSecret` is
+ * configured, so the legacy HMAC profile has nothing to verify against, and
+ * this client does not yet verify the RFC 9421 webhook profile that an
+ * omitted `authentication` block selects. Distinct from
+ * `webhook_signature_invalid` — nothing was checked and found wrong; there was
+ * no check to perform.
+ */
+ | 'webhook_unverifiable';
 export interface VerifyAndParseWebhookOptions {
     /** Raw HTTP body bytes captured before JSON parsing. Required when `webhookSecret` is configured. */
     rawBody?: string | Buffer | Uint8Array;
@@ -192,6 +201,23 @@ export interface SingleAgentClientConfig extends ConversationConfig {
     handlers?: AsyncHandlerConfig;
     /** Webhook secret for signature verification (recommended for production) */
     webhookSecret?: string;
+    /**
+     * Accept inbound webhooks that carry no verifiable authenticity at all.
+     *
+     * Without `webhookSecret` the legacy HMAC profile has nothing to verify
+     * against, and this client does not yet verify the RFC 9421 webhook profile
+     * that an omitted `authentication` block selects. `verifyAndParseWebhook`
+     * therefore refuses such webhooks with `webhook_unverifiable` by default:
+     * anyone who can reach the receiver route could otherwise forge task
+     * completions and status changes.
+     *
+     * Set this only when the receiver is genuinely unreachable from outside your
+     * network (in-process test harnesses, a route bound to loopback). It is not a
+     * substitute for a secret on any route an agent can reach over the internet.
+     *
+     * @default false
+     */
+    allowUnauthenticatedWebhooks?: boolean;
     /**
      * Webhook URL template with macro substitution
      *

package/dist/lib/core/SingleAgentClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SingleAgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/SingleAgentClient.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAIrE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EAEnB,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,EACN,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,oBAAoB,EAA0C,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EACV,iBAAiB,EAEjB,UAAU,EACV,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0B1E,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBrG,OAAO,KAAK,EAAE,gBAAgB,EAA8B,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAiBvG,OAAO,EAGL,KAAK,mBAAmB,EAGxB,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAQL,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EAGnC,KAAK,4BAA4B,EAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAA0C,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAMvH,KAAK,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;AA6epE,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG;IACtD,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC1D,oGAAoG;IACpG,6BAA6B,CAAC,EAAE,6BAA6B,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG;IACnD,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,GAAG;IACnE,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;CACzD,CAAC;AA2DF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,OAAO,EAAE,MAAM;aACf,aAAa,EAAE,IAAI,GAAG,IAAI;gBAD1B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,IAAI,GAAG,IAAI,EAC1C,OAAO,CAAC,EAAE,MAAM;CAKnB;AAqBD,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;IACjC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,kBAAkB,CAAC;IAChD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,0BAA0B,GAC1B,wBAAwB,CAAC;AAE7B,MAAM,WAAW,4BAA4B;IAC3C,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;IACvC,+GAA+G;IAC/G,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC9C,+BAA+B;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,QAAQ,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,CAAC;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM1E;AAuBD;;GAEG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,8GAA8G;IAC9G,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC1D,6FAA6F;IAC7F,6BAA6B,CAAC,EAAE,6BAA6B,CAAC;IAC9D;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1C;;;OAGG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,cAAc,EAAE,mBAAmB,CAAC;IAC7D,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;kEAC8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,cAAc,EAAE,wBAAwB,CAAC;IACtE;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3D;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAC/D;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAChE;;;;;;WAMG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;;;WAWG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC;;;;;;;;;;;;;;;;;WAiBG;QACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;QAC9C;;;;;;;;;;WAUG;QACH,qBAAqB,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;KAC7D,CAAC;IACF,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;IAC1D;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,CAAC;CACrD;AA8ID,qBAAa,iBAAiB;IAoB1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IApBhB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,eAAe,CAAC,CAAc;IACtC,OAAO,CAAC,gBAAgB,CAAC,CAAsB;IAC/C,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAmB;IAC9C,OAAO,CAAC,iBAAiB,CAAC,CAAuC;IACjE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAgD;IACjG,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAuD;IACzG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA2C;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAGnC,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IAkD9C,OAAO,CAAC,4BAA4B;IAOpC,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,uBAAuB;IAoB/B,OAAO,CAAC,8BAA8B;IAItC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,4BAA4B;IAapC,OAAO,CAAC,gCAAgC;IAgBxC,OAAO,CAAC,8BAA8B;IAoCtC,OAAO,CAAC,cAAc;IA8BtB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,yBAAyB;IAqEjC,OAAO,CAAC,8BAA8B;IA+DtC,OAAO,CAAC,qCAAqC;IAM7C,OAAO,CAAC,oCAAoC;IAQ5C;;;;;;;;;OASG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;YACW,wBAAwB;IA+DtC;;;;;OAKG;YACW,0BAA0B;IAqCxC;;;;;;OAMG;YACW,oBAAoB;IAoGlC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;OAcG;YACW,mBAAmB;IAyKjC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAmC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;;OASG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6JjF,qBAAqB;IA4DnC,OAAO,CAAC,uCAAuC;IAe/C,OAAO,CAAC,iCAAiC;IAuCzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAuH/B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAY5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,oBAAoB,KAEhB,KAAK;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC5C,IAAI,EAAE,OAAO,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,EACD,KAAK;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;SAAE,CAAC;QAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;QACnE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KAC7B;IA4DL;;;;;;;;;;;;;;;;;;;OAmBG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAqBV;;;;OAIG;YACW,gBAAgB;IAuL9B,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,4BAA4B;IA2DpC,OAAO,CAAC,8BAA8B;IA6DtC,OAAO,CAAC,4BAA4B;IAqBpC,OAAO,CAAC,kCAAkC;IAkF1C,OAAO,CAAC,gCAAgC;IAmBxC,OAAO,CAAC,wCAAwC;IAuBhD,OAAO,CAAC,gCAAgC;IAWxC,OAAO,CAAC,0CAA0C;IAMlD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;YAsDtB,0BAA0B;IAwLxC,OAAO,CAAC,kCAAkC;IAc1C,OAAO,CAAC,iCAAiC;IA4BzC,OAAO,CAAC,6BAA6B;IAqBrC,OAAO,CAAC,+BAA+B;IASvC,OAAO,CAAC,gCAAgC;IAmBxC,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,sCAAsC;YAmEhC,oCAAoC;IAwClD,OAAO,CAAC,oCAAoC;IAW5C,OAAO,CAAC,gCAAgC;YAS1B,yCAAyC;IA+CvD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IA+JpB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;OAQG;YACW,oCAAoC;IAuElD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,WAAW,CACf,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IA8BpD,wEAAwE;IAClE,iBAAiB,CACrB,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAI3C;;;;;;;OAOG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,uBAAuB,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAIhD;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAkFzE,+GAA+G;IACzG,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAwCzE,+GAA+G;IACzG,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,EAC3D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAuDxE,+GAA+G;IACzG,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C,OAAO,CAAC,6BAA6B;IAwBrC,wFAAwF;IACxF,OAAO,CAAC,qCAAqC;IAc7C;;;;;;;;;;OAUG;IACG,aAAa,CACjB,MAAM,EAAE,6BAA6B,EACrC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAgCtD,wEAAwE;IAClE,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAI7C;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAevE;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAa9E,4EAA4E;IACtE,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAa9E;;;;;;OAMG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;;;;;OAMG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAU1C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;;;;;OAMG;IACG,SAAS,CACb,MAAM,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,EAC9C,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAUzC;;;;;;OAMG;IACG,gBAAgB,CACpB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAYhD;;;;;;OAMG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAQrE,OAAO,CAAC,kBAAkB;IAY1B;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAcnD;;;OAGG;IACG,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAUpD;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;OAEG;IACG,sBAAsB,CAC1B,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAUhD;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAYvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAYlD;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,CAAC,SAAS,YAAY,EACtC,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAwC9C;;;;;;OAMG;IACG,iBAAiB,CAAC,CAAC,GAAG,OAAO,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAUzB;;;OAGG;IACG,iBAAiB,CAAC,CAAC,GAAG,GAAG,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAIX,sBAAsB;IAsIpC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IASpG;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAoCzB;;OAEG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,SAAS;IAY7D;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ9C;;;;;;;;OAQG;IACH,QAAQ,IAAI,WAAW;IAevB;;;;;;;;OAQG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAK9C;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;;;;;;;;;OAaG;IACH,eAAe,IAAI,MAAM;IAUzB;;;;;;;;;;OAUG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAc5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO;IAa5D;;;;;;;;OAQG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAcnF;;OAEG;IACH,cAAc;IAyBd;;;;;;;;;;;;OAYG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IActC;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAiB5D;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAuBd;;;;;;;;;;OAUG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,KAAK,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC,CAAC;KACJ,CAAC;IA4OF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgL9E;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK7E;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAKvC;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAKvD;;;;;;;;;;;OAWG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYnE;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAKtD;;;;;OAKG;YACW,oBAAoB;IAalC;;;;;;OAMG;IACH,OAAO,CAAC,yCAAyC;IA8BjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,4BAA4B;IAuBpC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CtG;;;;;;;OAOG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,OAAO,CAAC,WAAW;IAOnB;;;;;;;;;;;OAWG;WACU,6BAA6B,CACxC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,GAAE,KAAK,GAAG,KAAa,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;IAoBpB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;CAiDxB;AAoED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAE/G"}
+{"version":3,"file":"SingleAgentClient.d.ts","sourceRoot":"","sources":["../../../src/lib/core/SingleAgentClient.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAIrE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EAEnB,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,EACN,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,oBAAoB,EAA0C,MAAM,sBAAsB,CAAC;AAEzG,OAAO,KAAK,EACV,iBAAiB,EAEjB,UAAU,EACV,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0B1E,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAwB,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBrG,OAAO,KAAK,EAAE,gBAAgB,EAA8B,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAiBvG,OAAO,EAGL,KAAK,mBAAmB,EAGxB,KAAK,yBAAyB,EAE/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAQL,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EAGnC,KAAK,4BAA4B,EAClC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAA0C,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAMvH,KAAK,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;AA6epE,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG;IACtD,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC1D,oGAAoG;IACpG,6BAA6B,CAAC,EAAE,6BAA6B,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG;IACnD,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,GAAG;IACnE,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;CACzD,CAAC;AA2DF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,OAAO,EAAE,MAAM;aACf,aAAa,EAAE,IAAI,GAAG,IAAI;gBAD1B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,IAAI,GAAG,IAAI,EAC1C,OAAO,CAAC,EAAE,MAAM;CAKnB;AAqBD,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;IACjC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,kBAAkB,CAAC;IAChD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,0BAA0B,GAC1B,wBAAwB;AAC1B;;;;;;;GAOG;GACD,sBAAsB,CAAC;AAE3B,MAAM,WAAW,4BAA4B;IAC3C,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;IACvC,+GAA+G;IAC/G,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;IAC9C,+BAA+B;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,mDAAmD;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,QAAQ,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,CAAC;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,UAAU,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM1E;AAuBD;;GAEG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,8GAA8G;IAC9G,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC1D,6FAA6F;IAC7F,6BAA6B,CAAC,EAAE,6BAA6B,CAAC;IAC9D;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1C;;;OAGG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,cAAc,EAAE,mBAAmB,CAAC;IAC7D,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;kEAC8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,cAAc,EAAE,wBAAwB,CAAC;IACtE;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC3D;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAC/D;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;QAChE;;;;;;WAMG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;;;WAWG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC;;;;;;;;;;;;;;;;;WAiBG;QACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;QAC9C;;;;;;;;;;WAUG;QACH,qBAAqB,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;KAC7D,CAAC;IACF,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;IAC1D;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,CAAC;CACrD;AA8ID,qBAAa,iBAAiB;IAoB1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IApBhB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,eAAe,CAAC,CAAc;IACtC,OAAO,CAAC,gBAAgB,CAAC,CAAsB;IAC/C,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAmB;IAC9C,OAAO,CAAC,iBAAiB,CAAC,CAAuC;IACjE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAgD;IACjG,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAuD;IACzG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA2C;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAGnC,KAAK,EAAE,WAAW,EAClB,MAAM,GAAE,uBAA4B;IAkD9C,OAAO,CAAC,4BAA4B;IAOpC,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,uBAAuB;IAoB/B,OAAO,CAAC,8BAA8B;IAItC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,4BAA4B;IAapC,OAAO,CAAC,gCAAgC;IAgBxC,OAAO,CAAC,8BAA8B;IAoCtC,OAAO,CAAC,cAAc;IA8BtB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,yBAAyB;IAqEjC,OAAO,CAAC,8BAA8B;IA+DtC,OAAO,CAAC,qCAAqC;IAM7C,OAAO,CAAC,oCAAoC;IAQ5C;;;;;;;;;OASG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;;OAMG;YACW,wBAAwB;IA+DtC;;;;;OAKG;YACW,0BAA0B;IAqCxC;;;;;;OAMG;YACW,oBAAoB;IAoGlC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;;;;;;;OAcG;YACW,mBAAmB;IAyKjC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAmC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACG,aAAa,CACjB,OAAO,EAAE,iBAAiB,GAAG,OAAO,GAAG,qBAAqB,EAC5D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,kBAAkB,EAC9B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GACrC,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;;;;;;OASG;IACG,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA+KjF,qBAAqB;IA4DnC,OAAO,CAAC,uCAAuC;IAe/C,OAAO,CAAC,iCAAiC;IAuCzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAuH/B;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAY5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,oBAAoB,KAEhB,KAAK;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC5C,IAAI,EAAE,OAAO,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,EACD,KAAK;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;SAAE,CAAC;QAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;QACnE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KAC7B;IA4DL;;;;;;;;;;;;;;;;;;;OAmBG;IACH,sBAAsB,CACpB,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,EACxD,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,kBAAkB,GAC5B,OAAO;IAqBV;;;;OAIG;YACW,gBAAgB;IAuL9B,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,4BAA4B;IA2DpC,OAAO,CAAC,8BAA8B;IA6DtC,OAAO,CAAC,4BAA4B;IAqBpC,OAAO,CAAC,kCAAkC;IAkF1C,OAAO,CAAC,gCAAgC;IAmBxC,OAAO,CAAC,wCAAwC;IAuBhD,OAAO,CAAC,gCAAgC;IAWxC,OAAO,CAAC,0CAA0C;IAMlD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,4BAA4B;YAsDtB,0BAA0B;IAwLxC,OAAO,CAAC,kCAAkC;IAc1C,OAAO,CAAC,iCAAiC;IA4BzC,OAAO,CAAC,6BAA6B;IAqBrC,OAAO,CAAC,+BAA+B;IASvC,OAAO,CAAC,gCAAgC;IAmBxC,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,sCAAsC;YAmEhC,oCAAoC;IAwClD,OAAO,CAAC,oCAAoC;IAW5C,OAAO,CAAC,gCAAgC;YAS1B,yCAAyC;IA+CvD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IA+JpB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;OAQG;YACW,oCAAoC;IAuElD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,WAAW,CACf,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IA8BpD,wEAAwE;IAClE,iBAAiB,CACrB,MAAM,EAAE,kBAAkB,EAC1B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAI3C;;;;;;;OAOG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,uBAAuB,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAIhD;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IA8GzE,+GAA+G;IACzG,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,8BAA8B,CAAC,EAC5D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAwCzE,+GAA+G;IACzG,oBAAoB,CACxB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAQ9C;;;;;;OAMG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,EAC3D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAuDxE,+GAA+G;IACzG,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAQ7C,OAAO,CAAC,6BAA6B;IAwBrC,wFAAwF;IACxF,OAAO,CAAC,qCAAqC;IAc7C;;;;;;;;;;OAUG;IACG,aAAa,CACjB,MAAM,EAAE,6BAA6B,EACrC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAgCtD,wEAAwE;IAClE,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAI7C;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAevE;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAa9E,4EAA4E;IACtE,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAa9E;;;;;;OAMG;IACG,0BAA0B,CAC9B,MAAM,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,EAC/D,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAY1D;;;;;;OAMG;IACG,UAAU,CACd,MAAM,EAAE,iBAAiB,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAU1C;;;;;;OAMG;IACG,cAAc,CAClB,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EACnD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAY9C;;;;;;OAMG;IACG,SAAS,CACb,MAAM,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,EAC9C,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAUzC;;;;;;OAMG;IACG,gBAAgB,CACpB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9C,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAYhD;;;;;;OAMG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAQrE,OAAO,CAAC,kBAAkB;IAY1B;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAcnD;;;OAGG;IACG,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,YAAY,CAChB,MAAM,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EACjD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAU5C;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAY7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,sBAAsB,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAU/C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,wBAAwB,EAChC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,oBAAoB,CAAC,yBAAyB,CAAC,EACvD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAUlD;;OAEG;IACG,0BAA0B,CAC9B,MAAM,EAAE,2BAA2B,EACnC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAUpD;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAUnD;;OAEG;IACG,sBAAsB,CAC1B,MAAM,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EACrD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAUhD;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,8BAA8B,EACtC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IAYvD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,EACtD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;IAUjD;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,EAClD,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAU7C;;OAEG;IACG,kBAAkB,CACtB,MAAM,EAAE,yBAAyB,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;IAYlD;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CAAC,CAAC,SAAS,YAAY,EACtC,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAwC9C;;;;;;OAMG;IACG,iBAAiB,CAAC,CAAC,GAAG,OAAO,EACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAUzB;;;OAGG;IACG,iBAAiB,CAAC,CAAC,GAAG,GAAG,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAIX,sBAAsB;IAsIpC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,kBAAkB,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IASpG;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CAAC,CAAC,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAoCzB;;OAEG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,SAAS;IAY7D;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ9C;;;;;;;;OAQG;IACH,QAAQ,IAAI,WAAW;IAevB;;;;;;;;OAQG;IACG,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC;IAK9C;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,YAAY,IAAI,MAAM;IAItB;;OAEG;IACH,WAAW,IAAI,KAAK,GAAG,KAAK;IAI5B;;;;;;;;;;;;;OAaG;IACH,eAAe,IAAI,MAAM;IAUzB;;;;;;;;;;OAUG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAc5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO;IAa5D;;;;;;;;OAQG;IACG,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAcnF;;OAEG;IACH,cAAc;IAyBd;;;;;;;;;;;;OAYG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IActC;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,IAAI;IAiB5D;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE;QACtB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QACzC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC3C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;KACxD,GAAG,MAAM,IAAI;IAuBd;;;;;;;;;;OAUG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9E;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACxD,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,KAAK,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;SACvB,CAAC,CAAC;KACJ,CAAC;IA4OF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgL9E;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAK7E;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAKvC;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAKvD;;;;;;;;;;;OAWG;IACG,8BAA8B,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYnE;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAKtD;;;;;OAKG;YACW,oBAAoB;IAalC;;;;;;OAMG;IACH,OAAO,CAAC,yCAAyC;IA8BjD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,4BAA4B;IAuBpC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,qBAAqB,CAAC,QAAQ,GAAE,MAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CtG;;;;;;;OAOG;IACG,SAAS,CAAC,QAAQ,GAAE,MAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,OAAO,CAAC,WAAW;IAOnB;;;;;;;;;;;OAWG;WACU,6BAA6B,CACxC,gBAAgB,EAAE,MAAM,EACxB,QAAQ,GAAE,KAAK,GAAG,KAAa,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;IAoBpB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;CAiDxB;AA+GD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAE/G"}