@agent-native/core 0.105.0 → 0.106.0

package/dist/mcp-client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp-client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,iCAAiC,EACjC,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAM1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GAKvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,iBAAiB,GAIlB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GAIrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAM1B,MAAM,UAAU,uBAAuB,CACrC,OAAyB,EACzB,OAAO,GAA0B,EAAE;IAEnC,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyB,EACzB,MAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAyB,EACzB,IAAa,EACb,OAAO,GAA0B,EAAE;IAEnC,OAAO;QACL,IAAI,EAAE;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,WAAkB;SACpC;QACD,IAAI,EAAE,KAAK;QACX,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,EAAE,KAAK,EAAE,IAA6B,EAAE,EAAE;YAC3C,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,yBAAyB,CAC9B,IAAI,EACJ,IAAI,EACJ,mBAAmB,IAAI,CAAC,IAAI,iDAAiD,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,yBAAyB,CACxC,OAAO,CAAC,gBAAgB,EACxB,IAAI,EACJ,IAAI,CACL,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,yBAAyB,CAC9B,IAAI,EACJ,IAAI,EACJ,mBAAmB,IAAI,CAAC,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvD,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,yBAAyB,CAC9B,IAAI,EACJ,IAAI,EACJ,0BAA0B,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IACE,MAAM;QACN,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC,EACtC,CAAC;QACD,MAAM,KAAK,GAAI,MAAc,CAAC,OAAqC,CAAC;QACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,QAAQ,GACZ,IAAI;YACJ,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAE,MAAc,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC,CAAC,aAAa,CAAC,CAAC;QACrB,IAAK,MAAc,CAAC,OAAO;YAAE,OAAO,UAAU,QAAQ,EAAE,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAyB;IACrD,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,WAAW,IAAI,EAAE,QAAQ,IAAI,SAAS,GAAG,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,cAAc,QAAQ,CAAC,QAAQ,IAAI,SAAS,GAAG,GAAG,GAAG,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,GAAG,GAAG,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,CACL,CAAC,CAAC,MAAM;QACR,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAe;IAEf,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC;QACtC,MAAc,CAAC,OAAO,EACvB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,UAAU,GAAK,MAAc,CAAC,OAAsC;SACvE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;SACzE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,IAAI,EAAE,IAAI,CAAC,IAAc;QACzB,SAAS,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC,CAAC,CAAC;IACN,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAyB,EACzB,IAAa,EACb,KAA8B,EAC9B,GAAY;IAEZ,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO;QACL,CAAC,wBAAwB,CAAC,EAAE,IAAI;QAChC,IAAI;QACJ,GAAG;QACH,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,YAAY;QACnC,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAa,EACb,KAA8B,EAC9B,IAAY;IAEZ,OAAO;QACL,CAAC,wBAAwB,CAAC,EAAE,IAAI;QAChC,IAAI;QACJ,GAAG,EAAE;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAClC;QACD,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,YAAY;QACnC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAyB,EACzB,IAAa,EACb,KAA8B,EAC9B,GAAY;IAEZ,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,cAAc,EAAE,GAAG;QACnB,mBAAmB,CAAC,IAAI,CAAC;QACzB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,QAAQ,GACZ,cAAc,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,YAAY;QACnC,WAAW;QACX,SAAS,EAAE,KAAK;QAChB,UAAU,EACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAE,EAAE,GAAI,GAA+B,EAA8B;YACtE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;QAC9D,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAI,GAAW,CAAC,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAClE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,wBAAwB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAAY;IAEZ,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAE,GAAW,CAAC,OAAO,CAAC;QACjD,CAAC,CAAG,GAAW,CAAC,OAAqB;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa;IAEb,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,SAAS,GACZ,IAAY,CAAC,IAAI,KAAK,UAAU;QAC/B,CAAC,CAAE,IAAY,CAAC,QAAQ;QACxB,CAAC,CAAC,CAAE,IAAY,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAI,SAAiB,CAAC,GAAG,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,QAAQ,GACZ,OAAQ,SAAiB,CAAC,QAAQ,KAAK,QAAQ;QAC7C,CAAC,CAAE,SAAiB,CAAC,QAAQ;QAC7B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,IAAI,GACR,OAAQ,SAAiB,CAAC,IAAI,KAAK,QAAQ;QACzC,CAAC,CAAE,SAAiB,CAAC,IAAI;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GACR,OAAQ,SAAiB,CAAC,IAAI,KAAK,QAAQ;QACzC,CAAC,CAAE,SAAiB,CAAC,IAAI;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GACP,SAAiB,CAAC,KAAK,IAAI,OAAQ,SAAiB,CAAC,KAAK,KAAK,QAAQ;QACtE,CAAC,CAAG,SAAiB,CAAC,KAAiC;QACvD,CAAC,CAAE,IAAY,CAAC,KAAK,IAAI,OAAQ,IAAY,CAAC,KAAK,KAAK,QAAQ;YAC9D,CAAC,CAAG,IAAY,CAAC,KAAiC;YAClD,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,GAAG;QACH,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAyB,EACzB,IAAa,EACb,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,EAAE,QAAQ,CAAC;YACvD,CAAC,CAAG,MAAc,CAAC,QAAsB;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YACzD,IACE,QAAQ,EAAE,GAAG,KAAK,WAAW;gBAC7B,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACnC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,gDAAgD,WAAW,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * MCP client module — symmetric counterpart to `@agent-native/core/mcp`\n * (the MCP server). Connects to local MCP servers configured in\n * `mcp.config.json` or the `MCP_SERVERS` env var and exposes their tools\n * to the agent-chat tool-use loop.\n */\n\nexport {\n  loadMcpConfig,\n  autoDetectMcpConfig,\n  type McpConfig,\n  type McpServerConfig,\n} from \"./config.js\";\n\nexport {\n  McpClientManager,\n  buildMcpToolName,\n  parseMcpToolName,\n  MCP_TOOL_PREFIX,\n  type McpTool,\n  type McpClientManagerOptions,\n} from \"./manager.js\";\n\nexport {\n  listRemoteServers,\n  addRemoteServer,\n  addFirstPartyRemoteServer,\n  isFirstPartyRemoteEndpointTrusted,\n  removeRemoteServer,\n  validateRemoteUrl,\n  normalizeServerName,\n  mergedConfigKey,\n  parseMergedKey,\n  hashEmail,\n  toHttpServerConfig,\n  toHttpServerConfigAsync,\n  materializeHeaders,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\n\nexport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\n\nexport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  type StoredBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\n\nexport {\n  mountMcpServersRoutes,\n  buildMergedConfig,\n  builtinMergedConfigKey,\n  startMcpConfigRefresh,\n  type ClientBuiltinCapability,\n} from \"./routes.js\";\n\nexport {\n  mountMcpHubRoutes,\n  listHubServers,\n  getHubStatus,\n  isHubServeEnabled,\n  isHubConsumeEnabled,\n  type HubServerRecord,\n  type HubServersResponse,\n} from \"./hub-routes.js\";\n\nexport { fetchHubServers } from \"./hub-client.js\";\n\nexport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nexport {\n  classifyMcpToolCall,\n  evaluateMcpToolCallPolicy,\n  type McpToolCallClassification,\n  type McpToolEffect,\n  type McpToolFamily,\n  type McpToolInvocationPolicy,\n  type McpToolPolicyDecision,\n} from \"./tool-policy.js\";\nexport {\n  configureScreenMemory,\n  queryScreenMemoryContext,\n  readScreenMemoryStatus,\n  type ScreenMemoryConfig,\n  type ScreenMemoryContextItem,\n  type ScreenMemoryQueryResult,\n  type ScreenMemoryStatus,\n} from \"./screen-memory-local.js\";\nexport {\n  MCP_ACTION_RESULT_MARKER,\n  isMcpActionResult,\n  type AgentMcpAppPayload,\n  type AgentMcpAppResourceContent,\n  type McpActionResult,\n} from \"./app-result.js\";\nimport {\n  getToolUiResourceUri,\n  isToolVisibilityAppOnly,\n  isToolVisibilityModelOnly,\n} from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nimport { MCP_APP_MIME_TYPE } from \"../action.js\";\nimport type { EngineToolResultImagePart } from \"../agent/engine/types.js\";\n/**\n * Convert MCP tools into `ActionEntry` values suitable for registration in\n * the agent's action registry. Each tool is marked `http: false` so it's\n * never auto-mounted as an HTTP endpoint — MCP tools are agent-only.\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { normalizeToolResultImages } from \"../agent/tool-result-images.js\";\nimport {\n  MCP_ACTION_RESULT_MARKER,\n  toolForMcpAppPayload,\n  type AgentMcpAppPayload,\n  type AgentMcpAppResourceContent,\n  type McpActionResult,\n} from \"./app-result.js\";\nimport type { McpClientManager, McpTool } from \"./manager.js\";\nimport {\n  evaluateMcpToolCallPolicy,\n  type McpToolInvocationPolicy,\n} from \"./tool-policy.js\";\n\nexport interface McpActionEntryOptions {\n  invocationPolicy?: McpToolInvocationPolicy;\n}\n\nexport function mcpToolsToActionEntries(\n  manager: McpClientManager,\n  options: McpActionEntryOptions = {},\n): Record<string, ActionEntry> {\n  const entries: Record<string, ActionEntry> = {};\n  for (const tool of manager.getTools().filter(isVisibleToModel)) {\n    entries[tool.name] = mcpToolToActionEntry(manager, tool, options);\n  }\n  return entries;\n}\n\n/**\n * Mutate a target action dict in place so it matches the current MCP tool set:\n * - adds new `mcp__*` keys that aren't in target,\n * - removes `mcp__*` keys that no longer exist in the manager,\n * - leaves non-MCP keys untouched.\n *\n * Used by the agent-chat plugin to keep its `prodActions` / `devActions`\n * registries in sync after `McpClientManager.reconfigure()` runs.\n */\nexport function syncMcpActionEntries(\n  manager: McpClientManager,\n  target: Record<string, ActionEntry>,\n): void {\n  const current = new Set<string>();\n  for (const tool of manager.getTools().filter(isVisibleToModel)) {\n    current.add(tool.name);\n    target[tool.name] = mcpToolToActionEntry(manager, tool);\n  }\n  for (const key of Object.keys(target)) {\n    if (key.startsWith(\"mcp__\") && !current.has(key)) {\n      delete target[key];\n    }\n  }\n}\n\nfunction mcpToolToActionEntry(\n  manager: McpClientManager,\n  tool: McpTool,\n  options: McpActionEntryOptions = {},\n): ActionEntry {\n  return {\n    tool: {\n      description: tool.description,\n      parameters: tool.inputSchema as any,\n    },\n    http: false,\n    ...(tool.annotations?.readOnlyHint === true ? { readOnly: true } : {}),\n    run: async (args: Record<string, unknown>) => {\n      // Defense-in-depth: even if a cross-scope MCP tool somehow makes it\n      // into the LLM's visible tool list, reject invocation here so we never\n      // execute a user's credentials on behalf of another user.\n      if (!isMcpToolAllowedForRequest(tool.name)) {\n        return buildMcpErrorActionResult(\n          tool,\n          args,\n          `Error: MCP tool ${tool.name} is not available in the current request scope.`,\n        );\n      }\n      if (options.invocationPolicy) {\n        const decision = evaluateMcpToolCallPolicy(\n          options.invocationPolicy,\n          tool,\n          args,\n        );\n        if (!decision.allowed) {\n          return buildMcpErrorActionResult(\n            tool,\n            args,\n            `Error: MCP tool ${tool.name} is unavailable in read-only mode: ${decision.reason}.`,\n          );\n        }\n      }\n      try {\n        const result = await manager.callTool(tool.name, args);\n        return await buildMcpActionResult(manager, tool, args, result);\n      } catch (err: any) {\n        return buildMcpErrorActionResult(\n          tool,\n          args,\n          `Error calling MCP tool ${tool.name}: ${err?.message ?? err}`,\n        );\n      }\n    },\n  };\n}\n\nfunction isVisibleToModel(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityAppOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nexport function isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nexport function flattenMcpToolResult(result: unknown): string {\n  if (\n    result &&\n    typeof result === \"object\" &&\n    Array.isArray((result as any).content)\n  ) {\n    const parts = (result as any).content as Array<Record<string, any>>;\n    const text = parts.map(formatMcpContentPart).join(\"\\n\");\n    const fallback =\n      text ||\n      (hasStructuredContent(result)\n        ? JSON.stringify((result as any).structuredContent, null, 2)\n        : \"(no output)\");\n    if ((result as any).isError) return `Error: ${fallback}`;\n    return fallback;\n  }\n  return typeof result === \"string\" ? result : JSON.stringify(result);\n}\n\nfunction formatMcpContentPart(part: Record<string, any>): string {\n  if (part?.type === \"text\" && typeof part.text === \"string\") {\n    return part.text;\n  }\n  if (part?.type === \"image\") {\n    return `[image: ${part?.mimeType ?? \"unknown\"}]`;\n  }\n  if (part?.type === \"resource\") {\n    const resource = part.resource ?? {};\n    const uri = typeof resource.uri === \"string\" ? ` ${resource.uri}` : \"\";\n    return `[resource: ${resource.mimeType ?? \"unknown\"}${uri}]`;\n  }\n  if (part?.type === \"resource_link\") {\n    const uri = typeof part.uri === \"string\" ? ` ${part.uri}` : \"\";\n    return `[resource: ${part.mimeType ?? \"unknown\"}${uri}]`;\n  }\n  return JSON.stringify(part);\n}\n\nfunction hasStructuredContent(result: unknown): boolean {\n  return (\n    !!result &&\n    typeof result === \"object\" &&\n    Object.prototype.hasOwnProperty.call(result, \"structuredContent\")\n  );\n}\n\n/**\n * Extract vision images from a raw MCP tool result so the model can SEE\n * screenshots/previews returned by external MCP tools instead of only the\n * `[image: <mime>]` placeholder that `flattenMcpToolResult` leaves in the\n * text. Shares the per-result caps with `_agentImages` (max count, max base64\n * size); over-cap or unsupported images stay placeholder-only. Never throws.\n */\nexport function extractMcpToolResultImages(\n  result: unknown,\n): EngineToolResultImagePart[] {\n  if (\n    !result ||\n    typeof result !== \"object\" ||\n    !Array.isArray((result as any).content) ||\n    (result as any).isError\n  ) {\n    return [];\n  }\n  const candidates = ((result as any).content as Array<Record<string, any>>)\n    .filter((part) => part?.type === \"image\" && typeof part.data === \"string\")\n    .map((part) => ({\n      data: part.data as string,\n      mediaType: typeof part.mimeType === \"string\" ? part.mimeType : undefined,\n    }));\n  return normalizeToolResultImages(candidates).images;\n}\n\nasync function buildMcpActionResult(\n  manager: McpClientManager,\n  tool: McpTool,\n  input: Record<string, unknown>,\n  raw: unknown,\n): Promise<McpActionResult> {\n  const text = flattenMcpToolResult(raw);\n  const mcpApp = await extractMcpAppPayload(manager, tool, input, raw);\n  return {\n    [MCP_ACTION_RESULT_MARKER]: true,\n    text,\n    raw,\n    serverId: tool.source,\n    toolName: tool.name,\n    originalToolName: tool.originalName,\n    input,\n    ...(mcpApp ? { mcpApp } : {}),\n  };\n}\n\nfunction buildMcpErrorActionResult(\n  tool: McpTool,\n  input: Record<string, unknown>,\n  text: string,\n): McpActionResult {\n  return {\n    [MCP_ACTION_RESULT_MARKER]: true,\n    text,\n    raw: {\n      isError: true,\n      content: [{ type: \"text\", text }],\n    },\n    serverId: tool.source,\n    toolName: tool.name,\n    originalToolName: tool.originalName,\n    input,\n  };\n}\n\nasync function extractMcpAppPayload(\n  manager: McpClientManager,\n  tool: McpTool,\n  input: Record<string, unknown>,\n  raw: unknown,\n): Promise<AgentMcpAppPayload | undefined> {\n  const inlineResource = findInlineMcpAppResource(raw);\n  const resourceUri =\n    inlineResource?.uri ??\n    resourceUriFromTool(tool) ??\n    resourceUriFromResult(raw);\n  if (!resourceUri) return undefined;\n\n  const resource =\n    inlineResource ?? (await readMcpAppResource(manager, tool, resourceUri));\n\n  return {\n    serverId: tool.source,\n    toolName: tool.name,\n    originalToolName: tool.originalName,\n    resourceUri,\n    toolInput: input,\n    toolResult:\n      raw && typeof raw === \"object\"\n        ? ({ ...(raw as Record<string, unknown>) } as Record<string, unknown>)\n        : { content: [{ type: \"text\", text: String(raw ?? \"\") }] },\n    tool: toolForMcpAppPayload(tool),\n    ...(resource ? { resource } : {}),\n  };\n}\n\nfunction resourceUriFromTool(tool: McpTool): string | undefined {\n  try {\n    return getToolUiResourceUri(tool.raw as any);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resourceUriFromResult(raw: unknown): string | undefined {\n  if (!raw || typeof raw !== \"object\") return undefined;\n  const meta = (raw as any)._meta;\n  const nested = meta?.ui?.resourceUri;\n  if (typeof nested === \"string\" && nested.startsWith(\"ui://\")) return nested;\n  const flat = meta?.[\"ui/resourceUri\"] ?? meta?.[\"ui.resourceUri\"];\n  if (typeof flat === \"string\" && flat.startsWith(\"ui://\")) return flat;\n  return findInlineMcpAppResource(raw)?.uri;\n}\n\nfunction findInlineMcpAppResource(\n  raw: unknown,\n): AgentMcpAppResourceContent | undefined {\n  if (!raw || typeof raw !== \"object\") return undefined;\n  const content = Array.isArray((raw as any).content)\n    ? ((raw as any).content as unknown[])\n    : [];\n  for (const part of content) {\n    const resource = normalizeMcpAppResourceContent(part);\n    if (resource) return resource;\n  }\n  return undefined;\n}\n\nfunction normalizeMcpAppResourceContent(\n  part: unknown,\n): AgentMcpAppResourceContent | undefined {\n  if (!part || typeof part !== \"object\") return undefined;\n  const candidate =\n    (part as any).type === \"resource\"\n      ? (part as any).resource\n      : ((part as any).resource ?? part);\n  if (!candidate || typeof candidate !== \"object\") return undefined;\n  const uri = (candidate as any).uri;\n  if (typeof uri !== \"string\" || !uri.startsWith(\"ui://\")) return undefined;\n  const mimeType =\n    typeof (candidate as any).mimeType === \"string\"\n      ? (candidate as any).mimeType\n      : undefined;\n  if (mimeType && !mimeType.includes(MCP_APP_MIME_TYPE)) return undefined;\n  const text =\n    typeof (candidate as any).text === \"string\"\n      ? (candidate as any).text\n      : undefined;\n  const blob =\n    typeof (candidate as any).blob === \"string\"\n      ? (candidate as any).blob\n      : undefined;\n  const meta =\n    (candidate as any)._meta && typeof (candidate as any)._meta === \"object\"\n      ? ((candidate as any)._meta as Record<string, unknown>)\n      : (part as any)._meta && typeof (part as any)._meta === \"object\"\n        ? ((part as any)._meta as Record<string, unknown>)\n        : undefined;\n  return {\n    uri,\n    ...(mimeType ? { mimeType } : {}),\n    ...(text ? { text } : {}),\n    ...(blob ? { blob } : {}),\n    ...(meta ? { _meta: meta } : {}),\n  };\n}\n\nasync function readMcpAppResource(\n  manager: McpClientManager,\n  tool: McpTool,\n  resourceUri: string,\n): Promise<AgentMcpAppResourceContent | undefined> {\n  try {\n    const result = await manager.readResourceForTool(tool.name, resourceUri);\n    const contents = Array.isArray((result as any)?.contents)\n      ? ((result as any).contents as unknown[])\n      : [];\n    for (const content of contents) {\n      const resource = normalizeMcpAppResourceContent(content);\n      if (\n        resource?.uri === resourceUri ||\n        (resource && contents.length === 1)\n      ) {\n        return resource;\n      }\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to read MCP App resource ${resourceUri}: ${err?.message ?? err}`,\n    );\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp-client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,iCAAiC,EACjC,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,GAM3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,GAGf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAM1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GAKvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,iBAAiB,GAIlB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GAIrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAM1B,MAAM,UAAU,uBAAuB,CACrC,OAAyB,EACzB,OAAO,GAA0B,EAAE;IAEnC,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyB,EACzB,MAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAyB,EACzB,IAAa,EACb,OAAO,GAA0B,EAAE;IAEnC,OAAO;QACL,IAAI,EAAE;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,WAAkB;SACpC;QACD,IAAI,EAAE,KAAK;QACX,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,EAAE,KAAK,EAAE,IAA6B,EAAE,EAAE;YAC3C,oEAAoE;YACpE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,yBAAyB,CAC9B,IAAI,EACJ,IAAI,EACJ,mBAAmB,IAAI,CAAC,IAAI,iDAAiD,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,yBAAyB,CACxC,OAAO,CAAC,gBAAgB,EACxB,IAAI,EACJ,IAAI,CACL,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,yBAAyB,CAC9B,IAAI,EACJ,IAAI,EACJ,mBAAmB,IAAI,CAAC,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CACrF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvD,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,yBAAyB,CAC9B,IAAI,EACJ,IAAI,EACJ,0BAA0B,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IACE,MAAM;QACN,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC,EACtC,CAAC;QACD,MAAM,KAAK,GAAI,MAAc,CAAC,OAAqC,CAAC;QACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,QAAQ,GACZ,IAAI;YACJ,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAE,MAAc,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC,CAAC,aAAa,CAAC,CAAC;QACrB,IAAK,MAAc,CAAC,OAAO;YAAE,OAAO,UAAU,QAAQ,EAAE,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAyB;IACrD,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,WAAW,IAAI,EAAE,QAAQ,IAAI,SAAS,GAAG,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,cAAc,QAAQ,CAAC,QAAQ,IAAI,SAAS,GAAG,GAAG,GAAG,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,cAAc,IAAI,CAAC,QAAQ,IAAI,SAAS,GAAG,GAAG,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,CACL,CAAC,CAAC,MAAM;QACR,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAClE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAe;IAEf,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC;QACtC,MAAc,CAAC,OAAO,EACvB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,UAAU,GAAK,MAAc,CAAC,OAAsC;SACvE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;SACzE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,IAAI,EAAE,IAAI,CAAC,IAAc;QACzB,SAAS,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC,CAAC,CAAC;IACN,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAyB,EACzB,IAAa,EACb,KAA8B,EAC9B,GAAY;IAEZ,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO;QACL,CAAC,wBAAwB,CAAC,EAAE,IAAI;QAChC,IAAI;QACJ,GAAG;QACH,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,YAAY;QACnC,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,IAAa,EACb,KAA8B,EAC9B,IAAY;IAEZ,OAAO;QACL,CAAC,wBAAwB,CAAC,EAAE,IAAI;QAChC,IAAI;QACJ,GAAG,EAAE;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAClC;QACD,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,YAAY;QACnC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAyB,EACzB,IAAa,EACb,KAA8B,EAC9B,GAAY;IAEZ,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,cAAc,EAAE,GAAG;QACnB,mBAAmB,CAAC,IAAI,CAAC;QACzB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,QAAQ,GACZ,cAAc,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,gBAAgB,EAAE,IAAI,CAAC,YAAY;QACnC,WAAW;QACX,SAAS,EAAE,KAAK;QAChB,UAAU,EACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAE,EAAE,GAAI,GAA+B,EAA8B;YACtE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;QAC9D,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAI,GAAW,CAAC,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAClE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,wBAAwB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,wBAAwB,CAC/B,GAAY;IAEZ,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAE,GAAW,CAAC,OAAO,CAAC;QACjD,CAAC,CAAG,GAAW,CAAC,OAAqB;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa;IAEb,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,SAAS,GACZ,IAAY,CAAC,IAAI,KAAK,UAAU;QAC/B,CAAC,CAAE,IAAY,CAAC,QAAQ;QACxB,CAAC,CAAC,CAAE,IAAY,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAI,SAAiB,CAAC,GAAG,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,QAAQ,GACZ,OAAQ,SAAiB,CAAC,QAAQ,KAAK,QAAQ;QAC7C,CAAC,CAAE,SAAiB,CAAC,QAAQ;QAC7B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,IAAI,GACR,OAAQ,SAAiB,CAAC,IAAI,KAAK,QAAQ;QACzC,CAAC,CAAE,SAAiB,CAAC,IAAI;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GACR,OAAQ,SAAiB,CAAC,IAAI,KAAK,QAAQ;QACzC,CAAC,CAAE,SAAiB,CAAC,IAAI;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GACP,SAAiB,CAAC,KAAK,IAAI,OAAQ,SAAiB,CAAC,KAAK,KAAK,QAAQ;QACtE,CAAC,CAAG,SAAiB,CAAC,KAAiC;QACvD,CAAC,CAAE,IAAY,CAAC,KAAK,IAAI,OAAQ,IAAY,CAAC,KAAK,KAAK,QAAQ;YAC9D,CAAC,CAAG,IAAY,CAAC,KAAiC;YAClD,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,GAAG;QACH,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAyB,EACzB,IAAa,EACb,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,EAAE,QAAQ,CAAC;YACvD,CAAC,CAAG,MAAc,CAAC,QAAsB;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YACzD,IACE,QAAQ,EAAE,GAAG,KAAK,WAAW;gBAC7B,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACnC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,gDAAgD,WAAW,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * MCP client module — symmetric counterpart to `@agent-native/core/mcp`\n * (the MCP server). Connects to local MCP servers configured in\n * `mcp.config.json` or the `MCP_SERVERS` env var and exposes their tools\n * to the agent-chat tool-use loop.\n */\n\nexport {\n  loadMcpConfig,\n  autoDetectMcpConfig,\n  type McpConfig,\n  type McpServerConfig,\n} from \"./config.js\";\n\nexport {\n  McpClientManager,\n  buildMcpToolName,\n  parseMcpToolName,\n  MCP_TOOL_PREFIX,\n  type McpTool,\n  type McpClientManagerOptions,\n} from \"./manager.js\";\n\nexport {\n  listRemoteServers,\n  addRemoteServer,\n  addOAuthRemoteServer,\n  addFirstPartyRemoteServer,\n  isFirstPartyRemoteEndpointTrusted,\n  removeRemoteServer,\n  validateRemoteUrl,\n  normalizeServerName,\n  mergedConfigKey,\n  parseMergedKey,\n  hashEmail,\n  toHttpServerConfig,\n  toHttpServerConfigAsync,\n  materializeHeaders,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\n\nexport {\n  finishMcpOAuthAuthorization,\n  getMcpOAuthAccessToken,\n  readMcpOAuthCredentials,\n  saveMcpOAuthCredentials,\n  startMcpOAuthAuthorization,\n  type McpOAuthCallbackResult,\n  type McpOAuthCredentialBundle,\n  type McpOAuthDiscoveryState,\n  type McpOAuthProviderOptions,\n  type McpOAuthStartResult,\n} from \"./oauth-client.js\";\n\nexport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\n\nexport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  type StoredBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\n\nexport {\n  mountMcpServersRoutes,\n  buildMergedConfig,\n  builtinMergedConfigKey,\n  startMcpConfigRefresh,\n  type ClientBuiltinCapability,\n} from \"./routes.js\";\n\nexport {\n  mountMcpHubRoutes,\n  listHubServers,\n  getHubStatus,\n  isHubServeEnabled,\n  isHubConsumeEnabled,\n  type HubServerRecord,\n  type HubServersResponse,\n} from \"./hub-routes.js\";\n\nexport { fetchHubServers } from \"./hub-client.js\";\n\nexport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nexport {\n  callMcpTool,\n  listVisibleMcpTools,\n  McpAppApiError,\n  type AppMcpTool,\n  type ListVisibleMcpToolsOptions,\n} from \"./app-api.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nexport {\n  classifyMcpToolCall,\n  evaluateMcpToolCallPolicy,\n  type McpToolCallClassification,\n  type McpToolEffect,\n  type McpToolFamily,\n  type McpToolInvocationPolicy,\n  type McpToolPolicyDecision,\n} from \"./tool-policy.js\";\nexport {\n  configureScreenMemory,\n  queryScreenMemoryContext,\n  readScreenMemoryStatus,\n  type ScreenMemoryConfig,\n  type ScreenMemoryContextItem,\n  type ScreenMemoryQueryResult,\n  type ScreenMemoryStatus,\n} from \"./screen-memory-local.js\";\nexport {\n  MCP_ACTION_RESULT_MARKER,\n  isMcpActionResult,\n  type AgentMcpAppPayload,\n  type AgentMcpAppResourceContent,\n  type McpActionResult,\n} from \"./app-result.js\";\nimport {\n  getToolUiResourceUri,\n  isToolVisibilityAppOnly,\n  isToolVisibilityModelOnly,\n} from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nimport { MCP_APP_MIME_TYPE } from \"../action.js\";\nimport type { EngineToolResultImagePart } from \"../agent/engine/types.js\";\n/**\n * Convert MCP tools into `ActionEntry` values suitable for registration in\n * the agent's action registry. Each tool is marked `http: false` so it's\n * never auto-mounted as an HTTP endpoint — MCP tools are agent-only.\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { normalizeToolResultImages } from \"../agent/tool-result-images.js\";\nimport {\n  MCP_ACTION_RESULT_MARKER,\n  toolForMcpAppPayload,\n  type AgentMcpAppPayload,\n  type AgentMcpAppResourceContent,\n  type McpActionResult,\n} from \"./app-result.js\";\nimport type { McpClientManager, McpTool } from \"./manager.js\";\nimport {\n  evaluateMcpToolCallPolicy,\n  type McpToolInvocationPolicy,\n} from \"./tool-policy.js\";\n\nexport interface McpActionEntryOptions {\n  invocationPolicy?: McpToolInvocationPolicy;\n}\n\nexport function mcpToolsToActionEntries(\n  manager: McpClientManager,\n  options: McpActionEntryOptions = {},\n): Record<string, ActionEntry> {\n  const entries: Record<string, ActionEntry> = {};\n  for (const tool of manager.getTools().filter(isVisibleToModel)) {\n    entries[tool.name] = mcpToolToActionEntry(manager, tool, options);\n  }\n  return entries;\n}\n\n/**\n * Mutate a target action dict in place so it matches the current MCP tool set:\n * - adds new `mcp__*` keys that aren't in target,\n * - removes `mcp__*` keys that no longer exist in the manager,\n * - leaves non-MCP keys untouched.\n *\n * Used by the agent-chat plugin to keep its `prodActions` / `devActions`\n * registries in sync after `McpClientManager.reconfigure()` runs.\n */\nexport function syncMcpActionEntries(\n  manager: McpClientManager,\n  target: Record<string, ActionEntry>,\n): void {\n  const current = new Set<string>();\n  for (const tool of manager.getTools().filter(isVisibleToModel)) {\n    current.add(tool.name);\n    target[tool.name] = mcpToolToActionEntry(manager, tool);\n  }\n  for (const key of Object.keys(target)) {\n    if (key.startsWith(\"mcp__\") && !current.has(key)) {\n      delete target[key];\n    }\n  }\n}\n\nfunction mcpToolToActionEntry(\n  manager: McpClientManager,\n  tool: McpTool,\n  options: McpActionEntryOptions = {},\n): ActionEntry {\n  return {\n    tool: {\n      description: tool.description,\n      parameters: tool.inputSchema as any,\n    },\n    http: false,\n    ...(tool.annotations?.readOnlyHint === true ? { readOnly: true } : {}),\n    run: async (args: Record<string, unknown>) => {\n      // Defense-in-depth: even if a cross-scope MCP tool somehow makes it\n      // into the LLM's visible tool list, reject invocation here so we never\n      // execute a user's credentials on behalf of another user.\n      if (!isMcpToolAllowedForRequest(tool.name)) {\n        return buildMcpErrorActionResult(\n          tool,\n          args,\n          `Error: MCP tool ${tool.name} is not available in the current request scope.`,\n        );\n      }\n      if (options.invocationPolicy) {\n        const decision = evaluateMcpToolCallPolicy(\n          options.invocationPolicy,\n          tool,\n          args,\n        );\n        if (!decision.allowed) {\n          return buildMcpErrorActionResult(\n            tool,\n            args,\n            `Error: MCP tool ${tool.name} is unavailable in read-only mode: ${decision.reason}.`,\n          );\n        }\n      }\n      try {\n        const result = await manager.callTool(tool.name, args);\n        return await buildMcpActionResult(manager, tool, args, result);\n      } catch (err: any) {\n        return buildMcpErrorActionResult(\n          tool,\n          args,\n          `Error calling MCP tool ${tool.name}: ${err?.message ?? err}`,\n        );\n      }\n    },\n  };\n}\n\nfunction isVisibleToModel(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityAppOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nexport function isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nexport function flattenMcpToolResult(result: unknown): string {\n  if (\n    result &&\n    typeof result === \"object\" &&\n    Array.isArray((result as any).content)\n  ) {\n    const parts = (result as any).content as Array<Record<string, any>>;\n    const text = parts.map(formatMcpContentPart).join(\"\\n\");\n    const fallback =\n      text ||\n      (hasStructuredContent(result)\n        ? JSON.stringify((result as any).structuredContent, null, 2)\n        : \"(no output)\");\n    if ((result as any).isError) return `Error: ${fallback}`;\n    return fallback;\n  }\n  return typeof result === \"string\" ? result : JSON.stringify(result);\n}\n\nfunction formatMcpContentPart(part: Record<string, any>): string {\n  if (part?.type === \"text\" && typeof part.text === \"string\") {\n    return part.text;\n  }\n  if (part?.type === \"image\") {\n    return `[image: ${part?.mimeType ?? \"unknown\"}]`;\n  }\n  if (part?.type === \"resource\") {\n    const resource = part.resource ?? {};\n    const uri = typeof resource.uri === \"string\" ? ` ${resource.uri}` : \"\";\n    return `[resource: ${resource.mimeType ?? \"unknown\"}${uri}]`;\n  }\n  if (part?.type === \"resource_link\") {\n    const uri = typeof part.uri === \"string\" ? ` ${part.uri}` : \"\";\n    return `[resource: ${part.mimeType ?? \"unknown\"}${uri}]`;\n  }\n  return JSON.stringify(part);\n}\n\nfunction hasStructuredContent(result: unknown): boolean {\n  return (\n    !!result &&\n    typeof result === \"object\" &&\n    Object.prototype.hasOwnProperty.call(result, \"structuredContent\")\n  );\n}\n\n/**\n * Extract vision images from a raw MCP tool result so the model can SEE\n * screenshots/previews returned by external MCP tools instead of only the\n * `[image: <mime>]` placeholder that `flattenMcpToolResult` leaves in the\n * text. Shares the per-result caps with `_agentImages` (max count, max base64\n * size); over-cap or unsupported images stay placeholder-only. Never throws.\n */\nexport function extractMcpToolResultImages(\n  result: unknown,\n): EngineToolResultImagePart[] {\n  if (\n    !result ||\n    typeof result !== \"object\" ||\n    !Array.isArray((result as any).content) ||\n    (result as any).isError\n  ) {\n    return [];\n  }\n  const candidates = ((result as any).content as Array<Record<string, any>>)\n    .filter((part) => part?.type === \"image\" && typeof part.data === \"string\")\n    .map((part) => ({\n      data: part.data as string,\n      mediaType: typeof part.mimeType === \"string\" ? part.mimeType : undefined,\n    }));\n  return normalizeToolResultImages(candidates).images;\n}\n\nasync function buildMcpActionResult(\n  manager: McpClientManager,\n  tool: McpTool,\n  input: Record<string, unknown>,\n  raw: unknown,\n): Promise<McpActionResult> {\n  const text = flattenMcpToolResult(raw);\n  const mcpApp = await extractMcpAppPayload(manager, tool, input, raw);\n  return {\n    [MCP_ACTION_RESULT_MARKER]: true,\n    text,\n    raw,\n    serverId: tool.source,\n    toolName: tool.name,\n    originalToolName: tool.originalName,\n    input,\n    ...(mcpApp ? { mcpApp } : {}),\n  };\n}\n\nfunction buildMcpErrorActionResult(\n  tool: McpTool,\n  input: Record<string, unknown>,\n  text: string,\n): McpActionResult {\n  return {\n    [MCP_ACTION_RESULT_MARKER]: true,\n    text,\n    raw: {\n      isError: true,\n      content: [{ type: \"text\", text }],\n    },\n    serverId: tool.source,\n    toolName: tool.name,\n    originalToolName: tool.originalName,\n    input,\n  };\n}\n\nasync function extractMcpAppPayload(\n  manager: McpClientManager,\n  tool: McpTool,\n  input: Record<string, unknown>,\n  raw: unknown,\n): Promise<AgentMcpAppPayload | undefined> {\n  const inlineResource = findInlineMcpAppResource(raw);\n  const resourceUri =\n    inlineResource?.uri ??\n    resourceUriFromTool(tool) ??\n    resourceUriFromResult(raw);\n  if (!resourceUri) return undefined;\n\n  const resource =\n    inlineResource ?? (await readMcpAppResource(manager, tool, resourceUri));\n\n  return {\n    serverId: tool.source,\n    toolName: tool.name,\n    originalToolName: tool.originalName,\n    resourceUri,\n    toolInput: input,\n    toolResult:\n      raw && typeof raw === \"object\"\n        ? ({ ...(raw as Record<string, unknown>) } as Record<string, unknown>)\n        : { content: [{ type: \"text\", text: String(raw ?? \"\") }] },\n    tool: toolForMcpAppPayload(tool),\n    ...(resource ? { resource } : {}),\n  };\n}\n\nfunction resourceUriFromTool(tool: McpTool): string | undefined {\n  try {\n    return getToolUiResourceUri(tool.raw as any);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resourceUriFromResult(raw: unknown): string | undefined {\n  if (!raw || typeof raw !== \"object\") return undefined;\n  const meta = (raw as any)._meta;\n  const nested = meta?.ui?.resourceUri;\n  if (typeof nested === \"string\" && nested.startsWith(\"ui://\")) return nested;\n  const flat = meta?.[\"ui/resourceUri\"] ?? meta?.[\"ui.resourceUri\"];\n  if (typeof flat === \"string\" && flat.startsWith(\"ui://\")) return flat;\n  return findInlineMcpAppResource(raw)?.uri;\n}\n\nfunction findInlineMcpAppResource(\n  raw: unknown,\n): AgentMcpAppResourceContent | undefined {\n  if (!raw || typeof raw !== \"object\") return undefined;\n  const content = Array.isArray((raw as any).content)\n    ? ((raw as any).content as unknown[])\n    : [];\n  for (const part of content) {\n    const resource = normalizeMcpAppResourceContent(part);\n    if (resource) return resource;\n  }\n  return undefined;\n}\n\nfunction normalizeMcpAppResourceContent(\n  part: unknown,\n): AgentMcpAppResourceContent | undefined {\n  if (!part || typeof part !== \"object\") return undefined;\n  const candidate =\n    (part as any).type === \"resource\"\n      ? (part as any).resource\n      : ((part as any).resource ?? part);\n  if (!candidate || typeof candidate !== \"object\") return undefined;\n  const uri = (candidate as any).uri;\n  if (typeof uri !== \"string\" || !uri.startsWith(\"ui://\")) return undefined;\n  const mimeType =\n    typeof (candidate as any).mimeType === \"string\"\n      ? (candidate as any).mimeType\n      : undefined;\n  if (mimeType && !mimeType.includes(MCP_APP_MIME_TYPE)) return undefined;\n  const text =\n    typeof (candidate as any).text === \"string\"\n      ? (candidate as any).text\n      : undefined;\n  const blob =\n    typeof (candidate as any).blob === \"string\"\n      ? (candidate as any).blob\n      : undefined;\n  const meta =\n    (candidate as any)._meta && typeof (candidate as any)._meta === \"object\"\n      ? ((candidate as any)._meta as Record<string, unknown>)\n      : (part as any)._meta && typeof (part as any)._meta === \"object\"\n        ? ((part as any)._meta as Record<string, unknown>)\n        : undefined;\n  return {\n    uri,\n    ...(mimeType ? { mimeType } : {}),\n    ...(text ? { text } : {}),\n    ...(blob ? { blob } : {}),\n    ...(meta ? { _meta: meta } : {}),\n  };\n}\n\nasync function readMcpAppResource(\n  manager: McpClientManager,\n  tool: McpTool,\n  resourceUri: string,\n): Promise<AgentMcpAppResourceContent | undefined> {\n  try {\n    const result = await manager.readResourceForTool(tool.name, resourceUri);\n    const contents = Array.isArray((result as any)?.contents)\n      ? ((result as any).contents as unknown[])\n      : [];\n    for (const content of contents) {\n      const resource = normalizeMcpAppResourceContent(content);\n      if (\n        resource?.uri === resourceUri ||\n        (resource && contents.length === 1)\n      ) {\n        return resource;\n      }\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to read MCP App resource ${resourceUri}: ${err?.message ?? err}`,\n    );\n  }\n  return undefined;\n}\n"]}

package/dist/mcp-client/oauth-client.d.ts

@@ -0,0 +1,113 @@
+/**
+ * OAuth 2.1 client support for remote MCP servers.
+ *
+ * MCP servers advertise their OAuth endpoints through the standard protected
+ * resource and authorization-server metadata documents. The SDK handles the
+ * protocol details; this module owns the framework-specific encrypted storage
+ * and refresh boundary.
+ */
+import { type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { AuthorizationServerMetadata, OAuthClientInformationMixed, OAuthClientMetadata, OAuthProtectedResourceMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+export interface McpOAuthDiscoveryState {
+    authorizationServerUrl: string;
+    authorizationServerMetadata?: AuthorizationServerMetadata;
+    resourceMetadata?: OAuthProtectedResourceMetadata;
+    resourceMetadataUrl?: string;
+}
+export interface McpOAuthCredentialBundle {
+    serverUrl: string;
+    clientInformation: OAuthClientInformationMixed;
+    discoveryState?: McpOAuthDiscoveryState;
+    tokens: OAuthTokens;
+    tokenExpiresAt?: number;
+}
+export interface McpOAuthStartResult {
+    authorizationUrl: URL;
+    codeVerifier: string;
+    state: string;
+    clientInformation: OAuthClientInformationMixed;
+    discoveryState?: McpOAuthDiscoveryState;
+}
+export interface McpOAuthCallbackResult {
+    credentials: McpOAuthCredentialBundle;
+}
+export interface McpOAuthProviderOptions {
+    serverUrl: string;
+    redirectUrl: string;
+    state: string;
+    clientInformation?: OAuthClientInformationMixed;
+    codeVerifier?: string;
+    discoveryState?: McpOAuthDiscoveryState;
+}
+/**
+ * A small adapter around the MCP SDK's OAuth provider interface. The route
+ * stores the adapter's state in an encrypted, short-lived browser cookie; the
+ * durable credential bundle is written only after the callback succeeds.
+ */
+export declare class McpOAuthClientProvider implements OAuthClientProvider {
+    private readonly redirectUrlValue;
+    private readonly stateValue;
+    private readonly metadata;
+    private clientInfo?;
+    private savedTokens?;
+    private savedCodeVerifier?;
+    private savedDiscovery?;
+    private authorizationUrl?;
+    constructor(options: McpOAuthProviderOptions);
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    state(): string;
+    clientInformation(): OAuthClientInformationMixed | undefined;
+    saveClientInformation(info: OAuthClientInformationMixed): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(authorizationUrl: URL): void;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    saveDiscoveryState(state: {
+        authorizationServerUrl: string;
+        authorizationServerMetadata?: AuthorizationServerMetadata;
+        resourceMetadata?: OAuthProtectedResourceMetadata;
+        resourceMetadataUrl?: string;
+    }): void;
+    discoveryState(): McpOAuthDiscoveryState | undefined;
+    get authorizationRedirect(): URL | undefined;
+    get savedCodeVerifierValue(): string | undefined;
+    get savedTokensValue(): OAuthTokens | undefined;
+    get savedClientInformation(): OAuthClientInformationMixed | undefined;
+}
+export declare function startMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
+    scope?: string;
+}): Promise<McpOAuthStartResult>;
+export declare function finishMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
+    authorizationCode: string;
+}): Promise<McpOAuthCallbackResult>;
+export declare function tokenExpiresAt(tokens: OAuthTokens): number | undefined;
+export declare function saveMcpOAuthCredentials(options: {
+    key: string;
+    scope: "user" | "org";
+    scopeId: string;
+    credentials: McpOAuthCredentialBundle;
+}): Promise<void>;
+export declare function readMcpOAuthCredentials(options: {
+    key: string;
+    scope: "user" | "org";
+    scopeId: string;
+}): Promise<McpOAuthCredentialBundle | null>;
+export declare function deleteMcpOAuthCredentials(options: {
+    key: string;
+    scope: "user" | "org";
+    scopeId: string;
+}): Promise<boolean>;
+/**
+ * Resolve an access token for the MCP manager. Refreshing happens only when a
+ * token is near expiry, so ordinary manager reconfiguration does not perform
+ * a network request for every connector.
+ */
+export declare function getMcpOAuthAccessToken(options: {
+    key: string;
+    scope: "user" | "org";
+    scopeId: string;
+    serverUrl: string;
+}): Promise<string | null>;
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/mcp-client/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../src/mcp-client/oauth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,EAC9B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAiHlD,MAAM,WAAW,sBAAsB;IACrC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAC1D,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,GAAG,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,wBAAwB,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,UAAU,CAAC,CAA8B;IACjD,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,iBAAiB,CAAC,CAAS;IACnC,OAAO,CAAC,cAAc,CAAC,CAAyB;IAChD,OAAO,CAAC,gBAAgB,CAAC,CAAM;IAE/B,YAAY,OAAO,EAAE,uBAAuB,EAa3C;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAE3D;IAED,qBAAqB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE7D;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAED,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAEpC;IAED,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAKnD;IAED,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE3C;IAED,YAAY,IAAI,MAAM,CAKrB;IAED,kBAAkB,CAAC,KAAK,EAAE;QACxB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;QAC1D,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;QAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,GAAG,IAAI,CAGP;IAED,cAAc,IAAI,sBAAsB,GAAG,SAAS,CAEnD;IAED,IAAI,qBAAqB,IAAI,GAAG,GAAG,SAAS,CAE3C;IAED,IAAI,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAE/C;IAED,IAAI,gBAAgB,IAAI,WAAW,GAAG,SAAS,CAE9C;IAED,IAAI,sBAAsB,IAAI,2BAA2B,GAAG,SAAS,CAEpE;CACF;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,uBAAuB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,uBAAuB,GAAG;IAAE,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,sBAAsB,CAAC,CAqBjC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAyB3C;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2DzB"}

package/dist/mcp-client/oauth-client.js

@@ -0,0 +1,316 @@
+/**
+ * OAuth 2.1 client support for remote MCP servers.
+ *
+ * MCP servers advertise their OAuth endpoints through the standard protected
+ * resource and authorization-server metadata documents. The SDK handles the
+ * protocol details; this module owns the framework-specific encrypted storage
+ * and refresh boundary.
+ */
+import { auth, refreshAuthorization, } from "@modelcontextprotocol/sdk/client/auth.js";
+import { deleteOAuthTokens, getOAuthTokens, saveOAuthTokens, } from "../oauth-tokens/store.js";
+import { validateRemoteUrl } from "./remote-url.js";
+const TOKEN_EXPIRY_SKEW_MS = 60_000;
+const MAX_OAUTH_REDIRECTS = 5;
+function checkedRemoteUrl(value, label) {
+    const result = validateRemoteUrl(String(value));
+    if (!result.ok || !result.url) {
+        throw new Error(`MCP OAuth ${label} is not allowed: ${result.error ?? "invalid URL"}`);
+    }
+    return result.url;
+}
+function guardedOAuthFetch() {
+    return async (url, init) => {
+        let currentUrl = checkedRemoteUrl(url, "request");
+        let currentInit = { ...init, redirect: "manual" };
+        for (let redirectCount = 0;; redirectCount += 1) {
+            const response = await fetch(currentUrl, currentInit);
+            if (![301, 302, 303, 307, 308].includes(response.status)) {
+                return response;
+            }
+            if (redirectCount >= MAX_OAUTH_REDIRECTS) {
+                throw new Error("MCP OAuth redirect limit exceeded.");
+            }
+            const location = response.headers.get("location");
+            if (!location)
+                throw new Error("MCP OAuth redirect is missing a target.");
+            let nextUrl;
+            try {
+                nextUrl = checkedRemoteUrl(new URL(location, currentUrl), "redirect target");
+            }
+            catch {
+                throw new Error("MCP OAuth redirect target is not allowed.");
+            }
+            await response.body?.cancel().catch(() => undefined);
+            const nextHeaders = new Headers(currentInit.headers);
+            if (nextUrl.origin !== currentUrl.origin) {
+                nextHeaders.delete("authorization");
+                nextHeaders.delete("cookie");
+                nextHeaders.delete("proxy-authorization");
+            }
+            const nextInit = {
+                ...currentInit,
+                headers: nextHeaders,
+            };
+            if (response.status === 303 ||
+                ((response.status === 301 || response.status === 302) &&
+                    (currentInit.method ?? "GET").toUpperCase() === "POST")) {
+                nextInit.method = "GET";
+                delete nextInit.body;
+                nextHeaders.delete("content-length");
+                nextHeaders.delete("content-type");
+            }
+            currentUrl = nextUrl;
+            currentInit = nextInit;
+        }
+    };
+}
+function validateDiscoveryUrls(state) {
+    checkedRemoteUrl(state.authorizationServerUrl, "authorization server");
+    if (state.resourceMetadataUrl) {
+        checkedRemoteUrl(state.resourceMetadataUrl, "resource metadata");
+    }
+    for (const url of state.resourceMetadata?.authorization_servers ?? []) {
+        checkedRemoteUrl(url, "discovered authorization server");
+    }
+    for (const field of [
+        "authorization_endpoint",
+        "token_endpoint",
+        "registration_endpoint",
+        "introspection_endpoint",
+        "revocation_endpoint",
+    ]) {
+        const url = state.authorizationServerMetadata?.[field];
+        if (typeof url === "string") {
+            checkedRemoteUrl(url, `OAuth ${field}`);
+        }
+    }
+}
+function credentialOwner(options) {
+    return `${options.scope}:${options.scopeId}`;
+}
+/**
+ * A small adapter around the MCP SDK's OAuth provider interface. The route
+ * stores the adapter's state in an encrypted, short-lived browser cookie; the
+ * durable credential bundle is written only after the callback succeeds.
+ */
+export class McpOAuthClientProvider {
+    redirectUrlValue;
+    stateValue;
+    metadata;
+    clientInfo;
+    savedTokens;
+    savedCodeVerifier;
+    savedDiscovery;
+    authorizationUrl;
+    constructor(options) {
+        this.redirectUrlValue = options.redirectUrl;
+        this.stateValue = options.state;
+        this.clientInfo = options.clientInformation;
+        this.savedCodeVerifier = options.codeVerifier;
+        this.savedDiscovery = options.discoveryState;
+        this.metadata = {
+            redirect_uris: [options.redirectUrl],
+            token_endpoint_auth_method: "none",
+            grant_types: ["authorization_code"],
+            response_types: ["code"],
+            client_name: "Agent Native MCP connector",
+        };
+    }
+    get redirectUrl() {
+        return this.redirectUrlValue;
+    }
+    get clientMetadata() {
+        return this.metadata;
+    }
+    state() {
+        return this.stateValue;
+    }
+    clientInformation() {
+        return this.clientInfo;
+    }
+    saveClientInformation(info) {
+        this.clientInfo = info;
+    }
+    tokens() {
+        return this.savedTokens;
+    }
+    saveTokens(tokens) {
+        this.savedTokens = tokens;
+    }
+    redirectToAuthorization(authorizationUrl) {
+        this.authorizationUrl = checkedRemoteUrl(authorizationUrl, "authorization redirect");
+    }
+    saveCodeVerifier(codeVerifier) {
+        this.savedCodeVerifier = codeVerifier;
+    }
+    codeVerifier() {
+        if (!this.savedCodeVerifier) {
+            throw new Error("MCP OAuth code verifier is missing");
+        }
+        return this.savedCodeVerifier;
+    }
+    saveDiscoveryState(state) {
+        validateDiscoveryUrls(state);
+        this.savedDiscovery = state;
+    }
+    discoveryState() {
+        return this.savedDiscovery;
+    }
+    get authorizationRedirect() {
+        return this.authorizationUrl;
+    }
+    get savedCodeVerifierValue() {
+        return this.savedCodeVerifier;
+    }
+    get savedTokensValue() {
+        return this.savedTokens;
+    }
+    get savedClientInformation() {
+        return this.clientInfo;
+    }
+}
+export async function startMcpOAuthAuthorization(options) {
+    checkedRemoteUrl(options.serverUrl, "server");
+    const provider = new McpOAuthClientProvider(options);
+    const result = await auth(provider, {
+        serverUrl: options.serverUrl,
+        scope: options.scope,
+        fetchFn: guardedOAuthFetch(),
+    });
+    if (result !== "REDIRECT" || !provider.authorizationRedirect) {
+        throw new Error("MCP server did not start an interactive OAuth flow");
+    }
+    const clientInformation = provider.savedClientInformation;
+    if (!clientInformation) {
+        throw new Error("MCP OAuth client registration did not complete");
+    }
+    return {
+        authorizationUrl: provider.authorizationRedirect,
+        codeVerifier: provider.savedCodeVerifierValue ?? provider.codeVerifier(),
+        state: options.state,
+        clientInformation,
+        discoveryState: provider.discoveryState(),
+    };
+}
+export async function finishMcpOAuthAuthorization(options) {
+    checkedRemoteUrl(options.serverUrl, "server");
+    const provider = new McpOAuthClientProvider(options);
+    const result = await auth(provider, {
+        serverUrl: options.serverUrl,
+        authorizationCode: options.authorizationCode,
+        fetchFn: guardedOAuthFetch(),
+    });
+    if (result !== "AUTHORIZED" || !provider.savedTokensValue) {
+        throw new Error("MCP OAuth token exchange did not complete");
+    }
+    const tokens = provider.savedTokensValue;
+    return {
+        credentials: {
+            serverUrl: options.serverUrl,
+            clientInformation: provider.savedClientInformation,
+            discoveryState: provider.discoveryState(),
+            tokens,
+            tokenExpiresAt: tokenExpiresAt(tokens),
+        },
+    };
+}
+export function tokenExpiresAt(tokens) {
+    const expiresIn = Number(tokens.expires_in);
+    if (!Number.isFinite(expiresIn) || expiresIn <= 0)
+        return undefined;
+    return Date.now() + expiresIn * 1_000;
+}
+export async function saveMcpOAuthCredentials(options) {
+    checkedRemoteUrl(options.credentials.serverUrl, "server");
+    if (options.credentials.discoveryState) {
+        validateDiscoveryUrls(options.credentials.discoveryState);
+    }
+    await saveOAuthTokens("mcp", options.key, options.credentials, `${options.scope}:${options.scopeId}`);
+}
+export async function readMcpOAuthCredentials(options) {
+    const stored = await getOAuthTokens("mcp", options.key, credentialOwner(options));
+    if (!stored)
+        return null;
+    const parsed = stored;
+    if (typeof parsed.serverUrl !== "string" ||
+        !parsed.clientInformation ||
+        !parsed.tokens ||
+        typeof parsed.tokens.access_token !== "string") {
+        return null;
+    }
+    if (!validateRemoteUrl(parsed.serverUrl).ok)
+        return null;
+    if (parsed.discoveryState) {
+        try {
+            validateDiscoveryUrls(parsed.discoveryState);
+        }
+        catch {
+            return null;
+        }
+    }
+    return parsed;
+}
+export async function deleteMcpOAuthCredentials(options) {
+    return ((await deleteOAuthTokens("mcp", options.key, credentialOwner(options))) > 0);
+}
+/**
+ * Resolve an access token for the MCP manager. Refreshing happens only when a
+ * token is near expiry, so ordinary manager reconfiguration does not perform
+ * a network request for every connector.
+ */
+export async function getMcpOAuthAccessToken(options) {
+    if (!validateRemoteUrl(options.serverUrl).ok)
+        return null;
+    const credentials = await readMcpOAuthCredentials(options);
+    if (!credentials || credentials.serverUrl !== options.serverUrl)
+        return null;
+    const accessToken = credentials.tokens.access_token;
+    if (typeof credentials.tokenExpiresAt !== "number" ||
+        credentials.tokenExpiresAt - Date.now() > TOKEN_EXPIRY_SKEW_MS) {
+        return accessToken;
+    }
+    const refreshToken = credentials.tokens.refresh_token;
+    const discovery = credentials.discoveryState;
+    if (!refreshToken || !discovery?.authorizationServerUrl) {
+        return accessToken;
+    }
+    try {
+        const resource = discovery.resourceMetadata?.resource
+            ? checkedRemoteUrl(discovery.resourceMetadata.resource, "resource")
+            : undefined;
+        const authorizationServerUrl = checkedRemoteUrl(discovery.authorizationServerUrl, "authorization server");
+        const refreshed = await refreshAuthorization(authorizationServerUrl, {
+            metadata: discovery.authorizationServerMetadata,
+            clientInformation: credentials.clientInformation,
+            refreshToken,
+            resource,
+            fetchFn: guardedOAuthFetch(),
+        });
+        const nextTokens = {
+            ...credentials.tokens,
+            ...refreshed,
+            ...(refreshed.refresh_token
+                ? { refresh_token: refreshed.refresh_token }
+                : credentials.tokens.refresh_token
+                    ? { refresh_token: credentials.tokens.refresh_token }
+                    : {}),
+        };
+        const next = {
+            ...credentials,
+            tokens: nextTokens,
+            tokenExpiresAt: tokenExpiresAt(nextTokens),
+        };
+        await saveMcpOAuthCredentials({
+            ...options,
+            credentials: next,
+        });
+        return nextTokens.access_token;
+    }
+    catch {
+        // Keep the old token so the MCP request can return the provider's normal
+        // auth error. A single expired connector must not remove every server from
+        // the process-wide manager during a config refresh.
+        return accessToken;
+    }
+}
+//# sourceMappingURL=oauth-client.js.map

package/dist/mcp-client/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../src/mcp-client/oauth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,IAAI,EACJ,oBAAoB,GAErB,MAAM,0CAA0C,CAAC;AASlD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAO9B,SAAS,gBAAgB,CAAC,KAAmB,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,oBAAoB,MAAM,CAAC,KAAK,IAAI,aAAa,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,UAAU,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,WAAW,GAAgB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAE/D,KAAK,IAAI,aAAa,GAAG,CAAC,GAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,aAAa,IAAI,mBAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAE1E,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,gBAAgB,CACxB,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC7B,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAErD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACzC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACpC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC7B,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,QAAQ,GAAgB;gBAC5B,GAAG,WAAW;gBACd,OAAO,EAAE,WAAW;aACrB,CAAC;YACF,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;oBACnD,CAAC,WAAW,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EACzD,CAAC;gBACD,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC;gBACxB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACrB,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACrC,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACrC,CAAC;YACD,UAAU,GAAG,OAAO,CAAC;YACrB,WAAW,GAAG,QAAQ,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAK9B;IACC,gBAAgB,CAAC,KAAK,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,gBAAgB,CAAC,KAAK,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,gBAAgB,EAAE,qBAAqB,IAAI,EAAE,EAAE,CAAC;QACtE,gBAAgB,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAClB,wBAAwB;QACxB,gBAAgB;QAChB,uBAAuB;QACvB,wBAAwB;QACxB,qBAAqB;KACb,EAAE,CAAC;QACX,MAAM,GAAG,GACP,KAAK,CAAC,2BACP,EAAE,CAAC,KAAK,CAAC,CAAC;QACX,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,gBAAgB,CAAC,GAAG,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAmD;IAC1E,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;AAC/C,CAAC;AAsCD;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAChB,gBAAgB,CAAS;IACzB,UAAU,CAAS;IACnB,QAAQ,CAAsB;IACvC,UAAU,CAA+B;IACzC,WAAW,CAAe;IAC1B,iBAAiB,CAAU;IAC3B,cAAc,CAA0B;IACxC,gBAAgB,CAAO;IAE/B,YAAY,OAAgC;QAC1C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC;QAC5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG;YACd,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YACpC,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,4BAA4B;SAC1C,CAAC;IACJ,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,qBAAqB,CAAC,IAAiC;QACrD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,CAAC;IAED,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CACtC,gBAAgB,EAChB,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC;IACxC,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,KAKlB;QACC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAqD;IAErD,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,iBAAiB,EAAE;KAC7B,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,sBAAsB,CAAC;IAC1D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,QAAQ,CAAC,qBAAqB;QAChD,YAAY,EAAE,QAAQ,CAAC,sBAAsB,IAAI,QAAQ,CAAC,YAAY,EAAE;QACxE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,iBAAiB;QACjB,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgE;IAEhE,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,OAAO,EAAE,iBAAiB,EAAE;KAC7B,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IACzC,OAAO;QACL,WAAW,EAAE;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,QAAQ,CAAC,sBAAuB;YACnD,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;YACzC,MAAM;YACN,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;SACvC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAK7C;IACC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QACvC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,eAAe,CACnB,KAAK,EACL,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,WAAiD,EACzD,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAI7C;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,KAAK,EACL,OAAO,CAAC,GAAG,EACX,eAAe,CAAC,OAAO,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,MAA2C,CAAC;IAC3D,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,iBAAiB;QACzB,CAAC,MAAM,CAAC,MAAM;QACd,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ,EAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,MAAkC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAI/C;IACC,OAAO,CACL,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C;IACC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC;IACpD,IACE,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ;QAC9C,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,EAC9D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC;IACtD,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;IAC7C,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,sBAAsB,EAAE,CAAC;QACxD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,EAAE,QAAQ;YACnD,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;YACnE,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,sBAAsB,GAAG,gBAAgB,CAC7C,SAAS,CAAC,sBAAsB,EAChC,sBAAsB,CACvB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,EAAE;YACnE,QAAQ,EAAE,SAAS,CAAC,2BAA2B;YAC/C,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;YAChD,YAAY;YACZ,QAAQ;YACR,OAAO,EAAE,iBAAiB,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,UAAU,GAAgB;YAC9B,GAAG,WAAW,CAAC,MAAM;YACrB,GAAG,SAAS;YACZ,GAAG,CAAC,SAAS,CAAC,aAAa;gBACzB,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE;gBAC5C,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa;oBAChC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;SACV,CAAC;QACF,MAAM,IAAI,GAA6B;YACrC,GAAG,WAAW;YACd,MAAM,EAAE,UAAU;YAClB,cAAc,EAAE,cAAc,CAAC,UAAU,CAAC;SAC3C,CAAC;QACF,MAAM,uBAAuB,CAAC;YAC5B,GAAG,OAAO;YACV,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,YAAY,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2EAA2E;QAC3E,oDAAoD;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["/**\n * OAuth 2.1 client support for remote MCP servers.\n *\n * MCP servers advertise their OAuth endpoints through the standard protected\n * resource and authorization-server metadata documents. The SDK handles the\n * protocol details; this module owns the framework-specific encrypted storage\n * and refresh boundary.\n */\n\nimport {\n  auth,\n  refreshAuthorization,\n  type OAuthClientProvider,\n} from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type {\n  AuthorizationServerMetadata,\n  OAuthClientInformationMixed,\n  OAuthClientMetadata,\n  OAuthProtectedResourceMetadata,\n  OAuthTokens,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\n\nimport {\n  deleteOAuthTokens,\n  getOAuthTokens,\n  saveOAuthTokens,\n} from \"../oauth-tokens/store.js\";\nimport { validateRemoteUrl } from \"./remote-url.js\";\n\nconst TOKEN_EXPIRY_SKEW_MS = 60_000;\nconst MAX_OAUTH_REDIRECTS = 5;\n\ntype GuardedFetch = (\n  url: string | URL,\n  init?: RequestInit,\n) => Promise<Response>;\n\nfunction checkedRemoteUrl(value: string | URL, label: string): URL {\n  const result = validateRemoteUrl(String(value));\n  if (!result.ok || !result.url) {\n    throw new Error(\n      `MCP OAuth ${label} is not allowed: ${result.error ?? \"invalid URL\"}`,\n    );\n  }\n  return result.url;\n}\n\nfunction guardedOAuthFetch(): GuardedFetch {\n  return async (url, init) => {\n    let currentUrl = checkedRemoteUrl(url, \"request\");\n    let currentInit: RequestInit = { ...init, redirect: \"manual\" };\n\n    for (let redirectCount = 0; ; redirectCount += 1) {\n      const response = await fetch(currentUrl, currentInit);\n      if (![301, 302, 303, 307, 308].includes(response.status)) {\n        return response;\n      }\n      if (redirectCount >= MAX_OAUTH_REDIRECTS) {\n        throw new Error(\"MCP OAuth redirect limit exceeded.\");\n      }\n      const location = response.headers.get(\"location\");\n      if (!location) throw new Error(\"MCP OAuth redirect is missing a target.\");\n\n      let nextUrl: URL;\n      try {\n        nextUrl = checkedRemoteUrl(\n          new URL(location, currentUrl),\n          \"redirect target\",\n        );\n      } catch {\n        throw new Error(\"MCP OAuth redirect target is not allowed.\");\n      }\n      await response.body?.cancel().catch(() => undefined);\n\n      const nextHeaders = new Headers(currentInit.headers);\n      if (nextUrl.origin !== currentUrl.origin) {\n        nextHeaders.delete(\"authorization\");\n        nextHeaders.delete(\"cookie\");\n        nextHeaders.delete(\"proxy-authorization\");\n      }\n      const nextInit: RequestInit = {\n        ...currentInit,\n        headers: nextHeaders,\n      };\n      if (\n        response.status === 303 ||\n        ((response.status === 301 || response.status === 302) &&\n          (currentInit.method ?? \"GET\").toUpperCase() === \"POST\")\n      ) {\n        nextInit.method = \"GET\";\n        delete nextInit.body;\n        nextHeaders.delete(\"content-length\");\n        nextHeaders.delete(\"content-type\");\n      }\n      currentUrl = nextUrl;\n      currentInit = nextInit;\n    }\n  };\n}\n\nfunction validateDiscoveryUrls(state: {\n  authorizationServerUrl: string;\n  authorizationServerMetadata?: AuthorizationServerMetadata;\n  resourceMetadata?: OAuthProtectedResourceMetadata;\n  resourceMetadataUrl?: string;\n}): void {\n  checkedRemoteUrl(state.authorizationServerUrl, \"authorization server\");\n  if (state.resourceMetadataUrl) {\n    checkedRemoteUrl(state.resourceMetadataUrl, \"resource metadata\");\n  }\n  for (const url of state.resourceMetadata?.authorization_servers ?? []) {\n    checkedRemoteUrl(url, \"discovered authorization server\");\n  }\n  for (const field of [\n    \"authorization_endpoint\",\n    \"token_endpoint\",\n    \"registration_endpoint\",\n    \"introspection_endpoint\",\n    \"revocation_endpoint\",\n  ] as const) {\n    const url = (\n      state.authorizationServerMetadata as Record<string, unknown> | undefined\n    )?.[field];\n    if (typeof url === \"string\") {\n      checkedRemoteUrl(url, `OAuth ${field}`);\n    }\n  }\n}\n\nfunction credentialOwner(options: { scope: \"user\" | \"org\"; scopeId: string }) {\n  return `${options.scope}:${options.scopeId}`;\n}\n\nexport interface McpOAuthDiscoveryState {\n  authorizationServerUrl: string;\n  authorizationServerMetadata?: AuthorizationServerMetadata;\n  resourceMetadata?: OAuthProtectedResourceMetadata;\n  resourceMetadataUrl?: string;\n}\n\nexport interface McpOAuthCredentialBundle {\n  serverUrl: string;\n  clientInformation: OAuthClientInformationMixed;\n  discoveryState?: McpOAuthDiscoveryState;\n  tokens: OAuthTokens;\n  tokenExpiresAt?: number;\n}\n\nexport interface McpOAuthStartResult {\n  authorizationUrl: URL;\n  codeVerifier: string;\n  state: string;\n  clientInformation: OAuthClientInformationMixed;\n  discoveryState?: McpOAuthDiscoveryState;\n}\n\nexport interface McpOAuthCallbackResult {\n  credentials: McpOAuthCredentialBundle;\n}\n\nexport interface McpOAuthProviderOptions {\n  serverUrl: string;\n  redirectUrl: string;\n  state: string;\n  clientInformation?: OAuthClientInformationMixed;\n  codeVerifier?: string;\n  discoveryState?: McpOAuthDiscoveryState;\n}\n\n/**\n * A small adapter around the MCP SDK's OAuth provider interface. The route\n * stores the adapter's state in an encrypted, short-lived browser cookie; the\n * durable credential bundle is written only after the callback succeeds.\n */\nexport class McpOAuthClientProvider implements OAuthClientProvider {\n  private readonly redirectUrlValue: string;\n  private readonly stateValue: string;\n  private readonly metadata: OAuthClientMetadata;\n  private clientInfo?: OAuthClientInformationMixed;\n  private savedTokens?: OAuthTokens;\n  private savedCodeVerifier?: string;\n  private savedDiscovery?: McpOAuthDiscoveryState;\n  private authorizationUrl?: URL;\n\n  constructor(options: McpOAuthProviderOptions) {\n    this.redirectUrlValue = options.redirectUrl;\n    this.stateValue = options.state;\n    this.clientInfo = options.clientInformation;\n    this.savedCodeVerifier = options.codeVerifier;\n    this.savedDiscovery = options.discoveryState;\n    this.metadata = {\n      redirect_uris: [options.redirectUrl],\n      token_endpoint_auth_method: \"none\",\n      grant_types: [\"authorization_code\"],\n      response_types: [\"code\"],\n      client_name: \"Agent Native MCP connector\",\n    };\n  }\n\n  get redirectUrl(): string {\n    return this.redirectUrlValue;\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return this.metadata;\n  }\n\n  state(): string {\n    return this.stateValue;\n  }\n\n  clientInformation(): OAuthClientInformationMixed | undefined {\n    return this.clientInfo;\n  }\n\n  saveClientInformation(info: OAuthClientInformationMixed): void {\n    this.clientInfo = info;\n  }\n\n  tokens(): OAuthTokens | undefined {\n    return this.savedTokens;\n  }\n\n  saveTokens(tokens: OAuthTokens): void {\n    this.savedTokens = tokens;\n  }\n\n  redirectToAuthorization(authorizationUrl: URL): void {\n    this.authorizationUrl = checkedRemoteUrl(\n      authorizationUrl,\n      \"authorization redirect\",\n    );\n  }\n\n  saveCodeVerifier(codeVerifier: string): void {\n    this.savedCodeVerifier = codeVerifier;\n  }\n\n  codeVerifier(): string {\n    if (!this.savedCodeVerifier) {\n      throw new Error(\"MCP OAuth code verifier is missing\");\n    }\n    return this.savedCodeVerifier;\n  }\n\n  saveDiscoveryState(state: {\n    authorizationServerUrl: string;\n    authorizationServerMetadata?: AuthorizationServerMetadata;\n    resourceMetadata?: OAuthProtectedResourceMetadata;\n    resourceMetadataUrl?: string;\n  }): void {\n    validateDiscoveryUrls(state);\n    this.savedDiscovery = state;\n  }\n\n  discoveryState(): McpOAuthDiscoveryState | undefined {\n    return this.savedDiscovery;\n  }\n\n  get authorizationRedirect(): URL | undefined {\n    return this.authorizationUrl;\n  }\n\n  get savedCodeVerifierValue(): string | undefined {\n    return this.savedCodeVerifier;\n  }\n\n  get savedTokensValue(): OAuthTokens | undefined {\n    return this.savedTokens;\n  }\n\n  get savedClientInformation(): OAuthClientInformationMixed | undefined {\n    return this.clientInfo;\n  }\n}\n\nexport async function startMcpOAuthAuthorization(\n  options: McpOAuthProviderOptions & { scope?: string },\n): Promise<McpOAuthStartResult> {\n  checkedRemoteUrl(options.serverUrl, \"server\");\n  const provider = new McpOAuthClientProvider(options);\n  const result = await auth(provider, {\n    serverUrl: options.serverUrl,\n    scope: options.scope,\n    fetchFn: guardedOAuthFetch(),\n  });\n  if (result !== \"REDIRECT\" || !provider.authorizationRedirect) {\n    throw new Error(\"MCP server did not start an interactive OAuth flow\");\n  }\n  const clientInformation = provider.savedClientInformation;\n  if (!clientInformation) {\n    throw new Error(\"MCP OAuth client registration did not complete\");\n  }\n  return {\n    authorizationUrl: provider.authorizationRedirect,\n    codeVerifier: provider.savedCodeVerifierValue ?? provider.codeVerifier(),\n    state: options.state,\n    clientInformation,\n    discoveryState: provider.discoveryState(),\n  };\n}\n\nexport async function finishMcpOAuthAuthorization(\n  options: McpOAuthProviderOptions & { authorizationCode: string },\n): Promise<McpOAuthCallbackResult> {\n  checkedRemoteUrl(options.serverUrl, \"server\");\n  const provider = new McpOAuthClientProvider(options);\n  const result = await auth(provider, {\n    serverUrl: options.serverUrl,\n    authorizationCode: options.authorizationCode,\n    fetchFn: guardedOAuthFetch(),\n  });\n  if (result !== \"AUTHORIZED\" || !provider.savedTokensValue) {\n    throw new Error(\"MCP OAuth token exchange did not complete\");\n  }\n  const tokens = provider.savedTokensValue;\n  return {\n    credentials: {\n      serverUrl: options.serverUrl,\n      clientInformation: provider.savedClientInformation!,\n      discoveryState: provider.discoveryState(),\n      tokens,\n      tokenExpiresAt: tokenExpiresAt(tokens),\n    },\n  };\n}\n\nexport function tokenExpiresAt(tokens: OAuthTokens): number | undefined {\n  const expiresIn = Number(tokens.expires_in);\n  if (!Number.isFinite(expiresIn) || expiresIn <= 0) return undefined;\n  return Date.now() + expiresIn * 1_000;\n}\n\nexport async function saveMcpOAuthCredentials(options: {\n  key: string;\n  scope: \"user\" | \"org\";\n  scopeId: string;\n  credentials: McpOAuthCredentialBundle;\n}): Promise<void> {\n  checkedRemoteUrl(options.credentials.serverUrl, \"server\");\n  if (options.credentials.discoveryState) {\n    validateDiscoveryUrls(options.credentials.discoveryState);\n  }\n  await saveOAuthTokens(\n    \"mcp\",\n    options.key,\n    options.credentials as unknown as Record<string, unknown>,\n    `${options.scope}:${options.scopeId}`,\n  );\n}\n\nexport async function readMcpOAuthCredentials(options: {\n  key: string;\n  scope: \"user\" | \"org\";\n  scopeId: string;\n}): Promise<McpOAuthCredentialBundle | null> {\n  const stored = await getOAuthTokens(\n    \"mcp\",\n    options.key,\n    credentialOwner(options),\n  );\n  if (!stored) return null;\n  const parsed = stored as Partial<McpOAuthCredentialBundle>;\n  if (\n    typeof parsed.serverUrl !== \"string\" ||\n    !parsed.clientInformation ||\n    !parsed.tokens ||\n    typeof parsed.tokens.access_token !== \"string\"\n  ) {\n    return null;\n  }\n  if (!validateRemoteUrl(parsed.serverUrl).ok) return null;\n  if (parsed.discoveryState) {\n    try {\n      validateDiscoveryUrls(parsed.discoveryState);\n    } catch {\n      return null;\n    }\n  }\n  return parsed as McpOAuthCredentialBundle;\n}\n\nexport async function deleteMcpOAuthCredentials(options: {\n  key: string;\n  scope: \"user\" | \"org\";\n  scopeId: string;\n}): Promise<boolean> {\n  return (\n    (await deleteOAuthTokens(\"mcp\", options.key, credentialOwner(options))) > 0\n  );\n}\n\n/**\n * Resolve an access token for the MCP manager. Refreshing happens only when a\n * token is near expiry, so ordinary manager reconfiguration does not perform\n * a network request for every connector.\n */\nexport async function getMcpOAuthAccessToken(options: {\n  key: string;\n  scope: \"user\" | \"org\";\n  scopeId: string;\n  serverUrl: string;\n}): Promise<string | null> {\n  if (!validateRemoteUrl(options.serverUrl).ok) return null;\n  const credentials = await readMcpOAuthCredentials(options);\n  if (!credentials || credentials.serverUrl !== options.serverUrl) return null;\n\n  const accessToken = credentials.tokens.access_token;\n  if (\n    typeof credentials.tokenExpiresAt !== \"number\" ||\n    credentials.tokenExpiresAt - Date.now() > TOKEN_EXPIRY_SKEW_MS\n  ) {\n    return accessToken;\n  }\n\n  const refreshToken = credentials.tokens.refresh_token;\n  const discovery = credentials.discoveryState;\n  if (!refreshToken || !discovery?.authorizationServerUrl) {\n    return accessToken;\n  }\n\n  try {\n    const resource = discovery.resourceMetadata?.resource\n      ? checkedRemoteUrl(discovery.resourceMetadata.resource, \"resource\")\n      : undefined;\n    const authorizationServerUrl = checkedRemoteUrl(\n      discovery.authorizationServerUrl,\n      \"authorization server\",\n    );\n    const refreshed = await refreshAuthorization(authorizationServerUrl, {\n      metadata: discovery.authorizationServerMetadata,\n      clientInformation: credentials.clientInformation,\n      refreshToken,\n      resource,\n      fetchFn: guardedOAuthFetch(),\n    });\n    const nextTokens: OAuthTokens = {\n      ...credentials.tokens,\n      ...refreshed,\n      ...(refreshed.refresh_token\n        ? { refresh_token: refreshed.refresh_token }\n        : credentials.tokens.refresh_token\n          ? { refresh_token: credentials.tokens.refresh_token }\n          : {}),\n    };\n    const next: McpOAuthCredentialBundle = {\n      ...credentials,\n      tokens: nextTokens,\n      tokenExpiresAt: tokenExpiresAt(nextTokens),\n    };\n    await saveMcpOAuthCredentials({\n      ...options,\n      credentials: next,\n    });\n    return nextTokens.access_token;\n  } catch {\n    // Keep the old token so the MCP request can return the provider's normal\n    // auth error. A single expired connector must not remove every server from\n    // the process-wide manager during a config refresh.\n    return accessToken;\n  }\n}\n"]}

package/dist/mcp-client/oauth-routes.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { type McpOAuthDiscoveryState } from "./oauth-client.js";
+import { type RemoteMcpScope } from "./remote-store.js";
+export interface McpOAuthFlow {
+    name: string;
+    url: string;
+    description?: string;
+    scope: RemoteMcpScope;
+    scopeId: string;
+    owner: string;
+    orgId?: string;
+    redirectUri: string;
+    state: string;
+    codeVerifier: string;
+    clientInformation: OAuthClientInformationMixed;
+    discoveryState?: McpOAuthDiscoveryState;
+    returnUrl?: string;
+    expiresAt: number;
+}
+export interface McpOAuthRoutesOptions {
+    reconfigure: () => Promise<void>;
+}
+export declare function mountMcpOAuthRoutes(nitroApp: any, options: McpOAuthRoutesOptions): void;
+export declare function isValidMcpOAuthFlow(flow: McpOAuthFlow, email: string, orgId: string | undefined, state: string): boolean;
+//# sourceMappingURL=oauth-routes.d.ts.map

package/dist/mcp-client/oauth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.d.ts","sourceRoot":"","sources":["../../src/mcp-client/oauth-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAkB5F,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAK3B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,qBAAqB,GAC7B,IAAI,CA6BN;AA0LD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAcT"}