@adcp/sdk 6.18.0 → 6.19.1

package/ADCP_VERSION

@@ -1 +1 @@
-3.0.9
+3.0.11

package/bin/adcp.js

@@ -14,6 +14,14 @@
  *   adcp mcp https://agent.example.com/mcp create_media_buy @payload.json --auth $AGENT_TOKEN
  */
 
+// `--allow-http` is the CLI's single switch for local dev loops. The probe
+// policy reads `ADCP_ALLOW_INTERNAL_PROBES` once at module load, so this MUST
+// run before any `require('../dist/lib/...')` below — flipping it later has
+// no effect on `isInternalProbesAllowed()` / `detectProtocol`'s SSRF gate.
+if (process.argv.includes('--allow-http')) {
+  process.env.ADCP_ALLOW_INTERNAL_PROBES = '1';
+}
+
 const { AdCPClient, detectProtocol, usesDeprecatedAssetsField } = require('../dist/lib/index.js');
 const { readFileSync, statSync } = require('fs');
 const path = require('path');
@@ -948,7 +956,10 @@ async function maybeRunInlineOAuth(agentArg, args, { jsonOutput } = {}) {
     const saved = getAgent(agentArg);
     if (!saved) return;
     try {
-      await ensureOAuthTokensForAlias(agentArg, saved.url, { quiet: jsonOutput });
+      await ensureOAuthTokensForAlias(agentArg, saved.url, {
+        quiet: jsonOutput,
+        allowHttp: args.includes('--allow-http'),
+      });
     } catch (err) {
       const hint = `Run: adcp --save-auth ${agentArg} ${saved.url} --oauth to re-register`;
       if (jsonOutput) {
@@ -1006,7 +1017,7 @@ async function maybeRunInlineOAuth(agentArg, args, { jsonOutput } = {}) {
  *
  * @returns The updated saved agent record (with oauth_tokens and oauth_client).
  */
-async function ensureOAuthTokensForAlias(alias, url, { quiet = false } = {}) {
+async function ensureOAuthTokensForAlias(alias, url, { quiet = false, allowHttp = false } = {}) {
   const existing = getAgent(alias);
   if (existing && hasValidOAuthTokens(existing)) {
     if (!quiet) console.log(`Using saved OAuth tokens for '${alias}'.`);
@@ -1030,7 +1041,7 @@ async function ensureOAuthTokensForAlias(alias, url, { quiet = false } = {}) {
   const { StreamableHTTPClientTransport } = require('@modelcontextprotocol/sdk/client/streamableHttp.js');
   const { UnauthorizedError } = require('@modelcontextprotocol/sdk/client/auth.js');
 
-  const oauthProvider = createCLIOAuthProvider(tempAgent, { quiet });
+  const oauthProvider = createCLIOAuthProvider(tempAgent, { quiet, allowHttp });
   const mcpClient = new MCPClient({ name: 'adcp-cli', version: '1.0.0' });
   const transport = new StreamableHTTPClientTransport(new URL(url), { authProvider: oauthProvider });
 
@@ -5044,7 +5055,7 @@ credential material — never sync or commit.
       const { StreamableHTTPClientTransport } = require('@modelcontextprotocol/sdk/client/streamableHttp.js');
       const { UnauthorizedError } = require('@modelcontextprotocol/sdk/client/auth.js');
 
-      const oauthProvider = createCLIOAuthProvider(tempAgent);
+      const oauthProvider = createCLIOAuthProvider(tempAgent, { allowHttp: args.includes('--allow-http') });
       const mcpClient = new MCPClient({ name: 'adcp-cli', version: '1.0.0' });
       const createTransport = () => new StreamableHTTPClientTransport(new URL(url), { authProvider: oauthProvider });
 
@@ -5464,7 +5475,10 @@ credential material — never sync or commit.
         const { StreamableHTTPClientTransport } = require('@modelcontextprotocol/sdk/client/streamableHttp.js');
         const { UnauthorizedError } = require('@modelcontextprotocol/sdk/client/auth.js');
 
-        const oauthProvider = createCLIOAuthProvider(agentConfig, { quiet: jsonOutput });
+        const oauthProvider = createCLIOAuthProvider(agentConfig, {
+          quiet: jsonOutput,
+          allowHttp: args.includes('--allow-http'),
+        });
         const mcpClient = new MCPClient({ name: 'adcp-cli', version: '1.0.0' });
         const createTransport = () =>
           new StreamableHTTPClientTransport(new URL(agentUrl), { authProvider: oauthProvider });
@@ -5594,6 +5608,7 @@ credential material — never sync or commit.
       // Create OAuth provider
       const oauthProvider = createCLIOAuthProvider(agentConfig, {
         quiet: jsonOutput,
+        allowHttp: args.includes('--allow-http'),
       });
 
       // Create MCP client
@@ -5963,7 +5978,10 @@ credential material — never sync or commit.
       const { StreamableHTTPClientTransport } = require('@modelcontextprotocol/sdk/client/streamableHttp.js');
       const { UnauthorizedError } = require('@modelcontextprotocol/sdk/client/auth.js');
 
-      const oauthProvider = createCLIOAuthProvider(agentConfig, { quiet: jsonOutput });
+      const oauthProvider = createCLIOAuthProvider(agentConfig, {
+        quiet: jsonOutput,
+        allowHttp: args.includes('--allow-http'),
+      });
       const mcpClient = new MCPClient({ name: 'adcp-cli', version: '1.0.0' });
       const createTransport = () =>
         new StreamableHTTPClientTransport(new URL(agentUrl), { authProvider: oauthProvider });

package/compliance/cache/{3.0.9.previous → 3.0.11}/domains/governance/index.yaml

@@ -247,7 +247,7 @@ phases:
           - human_review_required: set when the plan mandates escalation
 
         sample_request:
-          idempotency_key: "media-buy-governance-escalation-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-escalation-sync"
           plans:
             - plan_id: "gov_acme_q2_2027"
               brand:

package/compliance/cache/{3.0.9 → 3.0.11}/index.json

@@ -1,6 +1,6 @@
 {
-  "adcp_version": "3.0.9",
-  "generated_at": "2026-05-09T20:40:15.272Z",
+  "adcp_version": "3.0.11",
+  "generated_at": "2026-05-11T08:45:20.345Z",
   "universal": [
     "capability-discovery",
     "collection-lists-pagination-integrity",

package/compliance/cache/{3.0.9 → 3.0.11}/protocols/governance/index.yaml

@@ -247,7 +247,7 @@ phases:
           - human_review_required: set when the plan mandates escalation
 
         sample_request:
-          idempotency_key: "media-buy-governance-escalation-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-escalation-sync"
           plans:
             - plan_id: "gov_acme_q2_2027"
               brand:

package/compliance/cache/{3.0.9 → 3.0.11}/specialisms/creative-ad-server/index.yaml

@@ -355,7 +355,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+          idempotency_key: "$generate:uuid_v4#creative-ad-server-report-usage"
           reporting_period:
             start: "2026-03-01T00:00:00Z"
             end: "2026-03-31T23:59:59Z"

package/compliance/cache/{3.0.9.previous → 3.0.11}/specialisms/governance-delivery-monitor/index.yaml

@@ -164,7 +164,7 @@ phases:
           - budget.reallocation_threshold: amount above which reallocation requires re-evaluation
 
         sample_request:
-          idempotency_key: "governance-delivery-monitor-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-delivery-monitor-sync"
           plans:
             - plan_id: "gov_acme_delivery_monitor"
               brand:

package/compliance/cache/{3.0.9.previous → 3.0.11}/specialisms/governance-spend-authority/denied.yaml

@@ -110,7 +110,7 @@ phases:
           - budget.total: $10K cap that any single buy above will exceed
 
         sample_request:
-          idempotency_key: "governance-spend-authority-denied-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-spend-authority-denied-sync"
           plans:
             - plan_id: "gov_acme_strict"
               brand:

package/compliance/cache/{3.0.9.previous → 3.0.11}/specialisms/governance-spend-authority/index.yaml

@@ -159,7 +159,7 @@ phases:
           - custom_policies: policy conditions registered
 
         sample_request:
-          idempotency_key: "governance-spend-authority-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-spend-authority-sync"
           plans:
             - plan_id: "gov_acme_spend_authority_q2_2027"
               brand:

package/compliance/cache/{3.0.9 → 3.0.11}/specialisms/signal-marketplace/scenarios/governance_denied.yaml

@@ -184,7 +184,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "signal-gov-denied-v1"
+          idempotency_key: "$generate:uuid_v4#signal-gov-denied"
 
           context:
             correlation_id: "signal_marketplace--governance_denied--activate"

package/compliance/cache/{3.0.9 → 3.0.11}/universal/error-compliance.yaml

@@ -117,7 +117,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-test-negative-budget"
+          idempotency_key: "$generate:uuid_v4#error-negative-budget"
           start_time: "2026-05-01T00:00:00Z"
           end_time: "2026-05-31T23:59:59Z"
           packages:
@@ -165,7 +165,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-test-nonexistent-product"
+          idempotency_key: "$generate:uuid_v4#error-nonexistent-product"
           start_time: "2026-05-01T00:00:00Z"
           end_time: "2026-05-31T23:59:59Z"
           packages:
@@ -252,7 +252,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-test-reversed-dates"
+          idempotency_key: "$generate:uuid_v4#error-reversed-dates"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:
@@ -308,7 +308,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-structure-test"
+          idempotency_key: "$generate:uuid_v4#error-structure"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:
@@ -452,7 +452,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-transport-test"
+          idempotency_key: "$generate:uuid_v4#error-transport"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:

package/compliance/cache/{3.0.9.previous → 3.0.11}/universal/idempotency.yaml

@@ -211,12 +211,28 @@ phases:
             description: "Context correlation_id returned unchanged"
 
   - id: replay_same_payload
-    title: "Replay returns cached response"
+    title: "Replay returns cached response; key reuse with different payload conflicts"
     narrative: |
-      The canonical retry-safety case: a buyer's first request times out but actually
-      succeeded on the server. The buyer retries with the same idempotency_key and
-      the same payload. The seller MUST return the same response — same media_buy_id,
-      no new side effects.
+      Two halves of the same key-reuse contract, exercised against a single cached
+      entry on the seller:
+
+      1. Same key + same payload (the canonical retry-safety case): a buyer's first
+         request times out but actually succeeded on the server. The buyer retries
+         with the same idempotency_key and the same payload. The seller MUST return
+         the same response — same media_buy_id, no new side effects.
+
+      2. Same key + materially different payload (key reuse): the buyer reuses the
+         same idempotency_key with a different payload within the replay window. The
+         seller MUST reject with IDEMPOTENCY_CONFLICT. Silently applying the new
+         payload would break the at-most-once guarantee; silently returning the old
+         response would hide a real bug in the buyer's retry logic.
+
+      Both branches share a single `$generate:uuid_v4#replay_key` placeholder. They
+      live in the same phase so the alias resolves to one UUID across all four steps
+      — the seller sees one cached idempotency entry that the conflict step probes
+      with a different body. Splitting these into separate phases would reset the
+      alias cache at the phase boundary (adcp-client#1657) and mint a fresh UUID for
+      the conflict step, defeating the test.
 
     steps:
       - id: create_media_buy_initial
@@ -409,24 +425,21 @@ phases:
           duplicate_webhook_on_replay. Not_applicable when the runner does not
           host a webhook receiver.
 
-  - id: key_reuse_conflict
-    title: "Key reuse with different payload returns IDEMPOTENCY_CONFLICT"
-    narrative: |
-      When a buyer reuses an idempotency_key with a different payload within the
-      replay window, the seller MUST reject the second request with
-      IDEMPOTENCY_CONFLICT. Silently applying the new payload would break the
-      at-most-once guarantee; silently returning the old response would hide a
-      real bug in the buyer's retry logic.
-
-    steps:
       - id: create_media_buy_conflict
         title: "Same key, different payload returns IDEMPOTENCY_CONFLICT"
         narrative: |
-          Re-send create_media_buy with the same idempotency_key as the replay
-          phase but a materially different payload — a different end_time and
-          a different budget. The seller MUST reject this with IDEMPOTENCY_CONFLICT.
-          CONFLICT is accepted as a fallback for sellers that haven't adopted the
-          new error code yet.
+          Re-send create_media_buy with the same idempotency_key as the prior
+          replay steps but a materially different payload — a different end_time
+          and a different budget. The seller MUST reject this with
+          IDEMPOTENCY_CONFLICT. CONFLICT is accepted as a fallback for sellers
+          that haven't adopted the new error code yet.
+
+          This step shares the `$generate:uuid_v4#replay_key` alias with the
+          initial and replay steps above, so the runner injects the same UUID
+          on the wire. Lives in the same phase as those steps because the
+          runner's alias cache resets at phase boundaries (adcp-client#1657);
+          a separate phase would mint a fresh UUID and the seller would treat
+          the call as a new request rather than a conflicting key reuse.
         task: create_media_buy
         schema_ref: "media-buy/create-media-buy-request.json"
         response_schema_ref: "media-buy/create-media-buy-response.json"

package/compliance/cache/{3.0.9 → 3.0.11}/universal/schema-validation.yaml

@@ -333,7 +333,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "schema-validation-reversed-dates-v1"
+          idempotency_key: "$generate:uuid_v4#schema-validation-reversed-dates"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:

package/compliance/cache/{3.0.9 → 3.0.11.previous}/domains/governance/index.yaml

@@ -247,7 +247,7 @@ phases:
           - human_review_required: set when the plan mandates escalation
 
         sample_request:
-          idempotency_key: "media-buy-governance-escalation-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-escalation-sync"
           plans:
             - plan_id: "gov_acme_q2_2027"
               brand:

package/compliance/cache/{3.0.9.previous → 3.0.11.previous}/index.json

@@ -1,6 +1,6 @@
 {
-  "adcp_version": "3.0.9",
-  "generated_at": "2026-05-09T20:40:15.272Z",
+  "adcp_version": "3.0.11",
+  "generated_at": "2026-05-11T08:45:20.345Z",
   "universal": [
     "capability-discovery",
     "collection-lists-pagination-integrity",

package/compliance/cache/{3.0.9.previous → 3.0.11.previous}/protocols/governance/index.yaml

@@ -247,7 +247,7 @@ phases:
           - human_review_required: set when the plan mandates escalation
 
         sample_request:
-          idempotency_key: "media-buy-governance-escalation-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-escalation-sync"
           plans:
             - plan_id: "gov_acme_q2_2027"
               brand:

package/compliance/cache/{3.0.9.previous → 3.0.11.previous}/specialisms/creative-ad-server/index.yaml

@@ -355,7 +355,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+          idempotency_key: "$generate:uuid_v4#creative-ad-server-report-usage"
           reporting_period:
             start: "2026-03-01T00:00:00Z"
             end: "2026-03-31T23:59:59Z"

package/compliance/cache/{3.0.9 → 3.0.11.previous}/specialisms/governance-delivery-monitor/index.yaml

@@ -164,7 +164,7 @@ phases:
           - budget.reallocation_threshold: amount above which reallocation requires re-evaluation
 
         sample_request:
-          idempotency_key: "governance-delivery-monitor-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-delivery-monitor-sync"
           plans:
             - plan_id: "gov_acme_delivery_monitor"
               brand:

package/compliance/cache/{3.0.9 → 3.0.11.previous}/specialisms/governance-spend-authority/denied.yaml

@@ -110,7 +110,7 @@ phases:
           - budget.total: $10K cap that any single buy above will exceed
 
         sample_request:
-          idempotency_key: "governance-spend-authority-denied-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-spend-authority-denied-sync"
           plans:
             - plan_id: "gov_acme_strict"
               brand:

package/compliance/cache/{3.0.9 → 3.0.11.previous}/specialisms/governance-spend-authority/index.yaml

@@ -159,7 +159,7 @@ phases:
           - custom_policies: policy conditions registered
 
         sample_request:
-          idempotency_key: "governance-spend-authority-sync-plans-v1"
+          idempotency_key: "$generate:uuid_v4#gov-spend-authority-sync"
           plans:
             - plan_id: "gov_acme_spend_authority_q2_2027"
               brand:

package/compliance/cache/{3.0.9.previous → 3.0.11.previous}/specialisms/signal-marketplace/scenarios/governance_denied.yaml

@@ -184,7 +184,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "signal-gov-denied-v1"
+          idempotency_key: "$generate:uuid_v4#signal-gov-denied"
 
           context:
             correlation_id: "signal_marketplace--governance_denied--activate"

package/compliance/cache/{3.0.9.previous → 3.0.11.previous}/universal/error-compliance.yaml

@@ -117,7 +117,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-test-negative-budget"
+          idempotency_key: "$generate:uuid_v4#error-negative-budget"
           start_time: "2026-05-01T00:00:00Z"
           end_time: "2026-05-31T23:59:59Z"
           packages:
@@ -165,7 +165,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-test-nonexistent-product"
+          idempotency_key: "$generate:uuid_v4#error-nonexistent-product"
           start_time: "2026-05-01T00:00:00Z"
           end_time: "2026-05-31T23:59:59Z"
           packages:
@@ -252,7 +252,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-test-reversed-dates"
+          idempotency_key: "$generate:uuid_v4#error-reversed-dates"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:
@@ -308,7 +308,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-structure-test"
+          idempotency_key: "$generate:uuid_v4#error-structure"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:
@@ -452,7 +452,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "error-transport-test"
+          idempotency_key: "$generate:uuid_v4#error-transport"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:

package/compliance/cache/{3.0.9 → 3.0.11.previous}/universal/idempotency.yaml

@@ -211,12 +211,28 @@ phases:
             description: "Context correlation_id returned unchanged"
 
   - id: replay_same_payload
-    title: "Replay returns cached response"
+    title: "Replay returns cached response; key reuse with different payload conflicts"
     narrative: |
-      The canonical retry-safety case: a buyer's first request times out but actually
-      succeeded on the server. The buyer retries with the same idempotency_key and
-      the same payload. The seller MUST return the same response — same media_buy_id,
-      no new side effects.
+      Two halves of the same key-reuse contract, exercised against a single cached
+      entry on the seller:
+
+      1. Same key + same payload (the canonical retry-safety case): a buyer's first
+         request times out but actually succeeded on the server. The buyer retries
+         with the same idempotency_key and the same payload. The seller MUST return
+         the same response — same media_buy_id, no new side effects.
+
+      2. Same key + materially different payload (key reuse): the buyer reuses the
+         same idempotency_key with a different payload within the replay window. The
+         seller MUST reject with IDEMPOTENCY_CONFLICT. Silently applying the new
+         payload would break the at-most-once guarantee; silently returning the old
+         response would hide a real bug in the buyer's retry logic.
+
+      Both branches share a single `$generate:uuid_v4#replay_key` placeholder. They
+      live in the same phase so the alias resolves to one UUID across all four steps
+      — the seller sees one cached idempotency entry that the conflict step probes
+      with a different body. Splitting these into separate phases would reset the
+      alias cache at the phase boundary (adcp-client#1657) and mint a fresh UUID for
+      the conflict step, defeating the test.
 
     steps:
       - id: create_media_buy_initial
@@ -409,24 +425,21 @@ phases:
           duplicate_webhook_on_replay. Not_applicable when the runner does not
           host a webhook receiver.
 
-  - id: key_reuse_conflict
-    title: "Key reuse with different payload returns IDEMPOTENCY_CONFLICT"
-    narrative: |
-      When a buyer reuses an idempotency_key with a different payload within the
-      replay window, the seller MUST reject the second request with
-      IDEMPOTENCY_CONFLICT. Silently applying the new payload would break the
-      at-most-once guarantee; silently returning the old response would hide a
-      real bug in the buyer's retry logic.
-
-    steps:
       - id: create_media_buy_conflict
         title: "Same key, different payload returns IDEMPOTENCY_CONFLICT"
         narrative: |
-          Re-send create_media_buy with the same idempotency_key as the replay
-          phase but a materially different payload — a different end_time and
-          a different budget. The seller MUST reject this with IDEMPOTENCY_CONFLICT.
-          CONFLICT is accepted as a fallback for sellers that haven't adopted the
-          new error code yet.
+          Re-send create_media_buy with the same idempotency_key as the prior
+          replay steps but a materially different payload — a different end_time
+          and a different budget. The seller MUST reject this with
+          IDEMPOTENCY_CONFLICT. CONFLICT is accepted as a fallback for sellers
+          that haven't adopted the new error code yet.
+
+          This step shares the `$generate:uuid_v4#replay_key` alias with the
+          initial and replay steps above, so the runner injects the same UUID
+          on the wire. Lives in the same phase as those steps because the
+          runner's alias cache resets at phase boundaries (adcp-client#1657);
+          a separate phase would mint a fresh UUID and the seller would treat
+          the call as a new request rather than a conflicting key reuse.
         task: create_media_buy
         schema_ref: "media-buy/create-media-buy-request.json"
         response_schema_ref: "media-buy/create-media-buy-response.json"

package/compliance/cache/{3.0.9.previous → 3.0.11.previous}/universal/schema-validation.yaml

@@ -333,7 +333,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
-          idempotency_key: "schema-validation-reversed-dates-v1"
+          idempotency_key: "$generate:uuid_v4#schema-validation-reversed-dates"
           start_time: "2026-12-31T00:00:00Z"
           end_time: "2026-01-01T00:00:00Z"
           packages:

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts

@@ -39,11 +39,14 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
     private readonly storage?;
     private readonly flowHandler;
     private readonly _clientMetadata;
+    private readonly allowHttp;
     constructor(config: OAuthProviderConfig);
     /**
      * Create a provider for CLI usage
      */
-    static forCLI(agent: AgentConfig, flowHandler: OAuthFlowHandler, storage?: OAuthConfigStorage, clientMetadataOverrides?: Partial<OAuthClientMetadata>): MCPOAuthProvider;
+    static forCLI(agent: AgentConfig, flowHandler: OAuthFlowHandler, storage?: OAuthConfigStorage, clientMetadataOverrides?: Partial<OAuthClientMetadata>, options?: {
+        allowHttp?: boolean;
+    }): MCPOAuthProvider;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;
     /**
@@ -54,6 +57,10 @@ export declare class MCPOAuthProvider implements OAuthClientProvider {
      * We allow cross-origin resource URLs because agent configs are pre-configured
      * by the user, not discovered from untrusted sources. The authorization server
      * remains the final gatekeeper for token audience validation.
+     *
+     * Non-HTTPS resource URLs are rejected by default. Construct the provider
+     * with `allowHttp: true` to lift that restriction for local development —
+     * mirrors the CLI's `--allow-http` flag.
      */
     validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
     /**

package/dist/lib/auth/oauth/MCPOAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAE1C,MAAM,EAAE,mBAAmB;IAOvC;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACrD,gBAAgB;IAoBnB,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;;;;;;;OAQG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAc/F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}
+{"version":3,"file":"MCPOAuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACZ,MAAM,SAAS,CAAC;AAIjB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,gBAAiB,YAAW,mBAAmB;IAC1D,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;gBAExB,MAAM,EAAE,mBAAmB;IAQvC;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,EAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EACtD,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,gBAAgB;IAqBnB,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAE9B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAc/F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAI9B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAOtE;;OAEG;IACG,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAOhD;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD;;OAEG;IACG,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAUrC;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3F;;OAEG;YACW,YAAY;IAM1B;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,cAAc,IAAI,OAAO;IAgBzB;;;OAGG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACH,QAAQ,IAAI,WAAW;IAIvB;;;OAGG;IACH,UAAU,IAAI,MAAM;CAGrB"}

package/dist/lib/auth/oauth/MCPOAuthProvider.js

@@ -42,16 +42,18 @@ class MCPOAuthProvider {
     storage;
     flowHandler;
     _clientMetadata;
+    allowHttp;
     constructor(config) {
         this.agent = config.agent;
         this.storage = config.storage;
         this.flowHandler = config.flowHandler;
         this._clientMetadata = config.clientMetadata;
+        this.allowHttp = config.allowHttp === true;
     }
     /**
      * Create a provider for CLI usage
      */
-    static forCLI(agent, flowHandler, storage, clientMetadataOverrides) {
+    static forCLI(agent, flowHandler, storage, clientMetadataOverrides, options) {
         // Build complete client metadata with required fields
         const clientMetadata = {
             ...types_1.DEFAULT_CLIENT_METADATA,
@@ -63,6 +65,7 @@ class MCPOAuthProvider {
             flowHandler,
             storage,
             clientMetadata,
+            allowHttp: options?.allowHttp,
         });
     }
     // ========================================
@@ -82,13 +85,17 @@ class MCPOAuthProvider {
      * We allow cross-origin resource URLs because agent configs are pre-configured
      * by the user, not discovered from untrusted sources. The authorization server
      * remains the final gatekeeper for token audience validation.
+     *
+     * Non-HTTPS resource URLs are rejected by default. Construct the provider
+     * with `allowHttp: true` to lift that restriction for local development —
+     * mirrors the CLI's `--allow-http` flag.
      */
     async validateResourceURL(serverUrl, resource) {
         if (!resource) {
             return undefined;
         }
         const resourceURL = new URL(resource);
-        if (resourceURL.protocol !== 'https:') {
+        if (resourceURL.protocol !== 'https:' && !this.allowHttp) {
             throw new Error(`Server at ${serverUrl} advertised non-HTTPS resource URL: ${resource}`);
         }
         return resourceURL;

package/dist/lib/auth/oauth/MCPOAuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"MCPOAuthProvider.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAaH,mCAAkH;AAClH,mCAAqC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAa,gBAAgB;IACnB,KAAK,CAAc;IACV,OAAO,CAAsB;IAC7B,WAAW,CAAmB;IAC9B,eAAe,CAAsB;IAEtD,YAAY,MAA2B;QACrC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAkB,EAClB,WAA6B,EAC7B,OAA4B,EAC5B,uBAAsD;QAEtD,sDAAsD;QACtD,MAAM,cAAc,GAAwB;YAC1C,GAAG,+BAAuB;YAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;YACxD,GAAG,uBAAuB;SAC3B,CAAC;QAEF,OAAO,IAAI,gBAAgB,CAAC;YAC1B,KAAK;YACL,WAAW;YACX,OAAO;YACP,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAE3C,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAuB,EAAE,QAAiB;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,uCAAuC,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAA,uBAAe,EAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,UAAsC;QAChE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAA,mBAAW,EAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB;QAClC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAC;QAChD,mEAAmE;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACtC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB;QACjD,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,YAAY,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAA+C;QACzE,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBACtC,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBACtC,MAAM;QACV,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,2CAA2C;IAC3C,qBAAqB;IACrB,2CAA2C;IAE3C;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,YAAY;YAAE,OAAO,KAAK,CAAC;QAExC,gCAAgC;QAChC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,qDAAqD;YACrD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACrD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC;CACF;AAzPD,4CAyPC"}
+{"version":3,"file":"MCPOAuthProvider.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/MCPOAuthProvider.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAaH,mCAAkH;AAClH,mCAAqC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAa,gBAAgB;IACnB,KAAK,CAAc;IACV,OAAO,CAAsB;IAC7B,WAAW,CAAmB;IAC9B,eAAe,CAAsB;IACrC,SAAS,CAAU;IAEpC,YAAY,MAA2B;QACrC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CACX,KAAkB,EAClB,WAA6B,EAC7B,OAA4B,EAC5B,uBAAsD,EACtD,OAAiC;QAEjC,sDAAsD;QACtD,MAAM,cAAc,GAAwB;YAC1C,GAAG,+BAAuB;YAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;YACxD,GAAG,uBAAuB;SAC3B,CAAC;QAEF,OAAO,IAAI,gBAAgB,CAAC;YAC1B,KAAK;YACL,WAAW;YACX,OAAO;YACP,cAAc;YACd,SAAS,EAAE,OAAO,EAAE,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAE3C,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAuB,EAAE,QAAiB;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,uCAAuC,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAA,uBAAe,EAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,UAAsC;QAChE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAA,mBAAW,EAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB;QAClC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAC;QAChD,mEAAmE;QACnE,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACtC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB;QACjD,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,YAAY,CAAC;QAC9C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAA+C;QACzE,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBACtC,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBACtC,MAAM;QACV,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,2CAA2C;IAC3C,qBAAqB;IACrB,2CAA2C;IAE3C;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,YAAY;YAAE,OAAO,KAAK,CAAC;QAExC,gCAAgC;QAChC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,qDAAqD;YACrD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACrD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC;CACF;AAjQD,4CAiQC"}