@agent-native/core 0.48.3 → 0.49.0

package/dist/mcp/oauth-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-route.js","sourceRoot":"","sources":["../../src/mcp/oauth-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAO1B,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,WAAmB,EACnB,MAAM,GAAG,GAAG;IAEZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,iBAAiB,CACtB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB;IAC9B,KAAK,MAAM,GAAG,IAAI;QAChB,wBAAwB;QACxB,6BAA6B;QAC7B,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9D,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,uBAAuB,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,uCAAuC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,QAAQ,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,OAAO,QAAQ;QACb,CAAC,CAAC,6BAA6B,QAAQ,aAAa,KAAK,GAAG;QAC5D,CAAC,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,oCAAoC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,cAAc,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,QAAQ;QACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,gBAAgB;QAClC,sBAAsB,EAAE,MAAM;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,cAAc,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,MAAM;QACN,sBAAsB,EAAE,SAAS;QACjC,cAAc,EAAE,KAAK;QACrB,qBAAqB,EAAE,QAAQ;QAC/B,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,gBAAgB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,GAAG,CAAC,QAAQ,KAAK,KAAK;YACtB,GAAG,CAAC,QAAQ,KAAK,OAAO,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAG5D,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,IACE,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,EAAE;QACxB,CAAC,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,UAAU,CACf,yBAAyB,EACzB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,IACE,UAAU,CAAC,MAAM;QACjB,CAAC,UAAU,CAAC,KAAK,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,eAAe,CAC3D,EACD,CAAC;QACD,OAAO,UAAU,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,0BAA0B,KAAK,QAAQ;QACjD,CAAC,CAAC,IAAI,CAAC,0BAA0B;QACjC,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,UAAU,CACf,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACjC,UAAU;YACV,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YACxC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACtD,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,uBAAuB,EAAE,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,WAAW,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CACT;QACE,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QACxE,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;QAC3C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;KAC3D,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAK/B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAIzB;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAOvB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,MAAM;QACT,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAOzB;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CACzB,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAyB,EACzB,QAOC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,eAAe,CACjC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,CACL,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC3C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC/C,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAChC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAM1B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;SACzC,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,8BAA8B,UAAU,CAAC,GAAG,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CACjF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;;;;;mBAKU,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;kBAiB3B,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;OACxC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAoC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACrF,MAAM;;MAER,MAAM;;;;;;;;QAQJ,CAAC;AACT,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC7C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc,EACd,OAA6B;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,UAAU,CACf,iBAAiB,EACjB,sCAAsC,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,sBAAsB,CAAC;gBAC5B,WAAW;gBACX,KAAK;gBACL,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,SAAS;YACd,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YACtB,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,CACT,iBAAiB,CAAC;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc;YAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;YAChD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE;gBACN,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,QAAQ;gBACR,KAAK;gBACL,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,qBAAqB,EAAE,MAAM;gBAC7B,aAAa,EAAE,gBAAgB,CAAC;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ;oBACR,WAAW;oBACX,QAAQ;oBACR,KAAK;oBACL,aAAa,EAAE,MAAM,CAAC,cAAc;iBACrC,CAAC;aACH;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IACE,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,cAAc;KACrC,CAAC,EACF,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,mBAAmB,EAAE,MAAM;QAC3B,UAAU,EAAE,OAAO,CAAC,KAAK;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAQ5B;IACC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAc,EACd,IAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CACT,MAAM,aAAa,CAAC;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ;QACR,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;KACP,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,IAA4B;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,UAAU,CACf,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;QACV,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,eAAe;YAClB,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C;YACE,OAAO,UAAU,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAc,EACd,OAAe,EACf,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,UAAU,CACf,cAAc,EACd,GAAG,EAAE,OAAO,IAAI,sBAAsB,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Standard remote MCP OAuth 2.1 endpoints.\n *\n * These routes let MCP hosts such as Claude Code and ChatGPT authenticate\n * through their native remote-MCP OAuth flow instead of pasting bearer tokens.\n * The issued access tokens are audience-bound to `/_agent-native/mcp`, carry\n * the same user/org identity as the existing connect flow, and are mediated by\n * `verifyAuth` before any MCP tool/resource request runs.\n */\n\nimport type { H3Event } from \"h3\";\nimport { getHeader, getMethod, getQuery, setResponseStatus } from \"h3\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getConfiguredLoginHtml, getSession } from \"../server/auth.js\";\nimport { getAuthSecret } from \"../server/better-auth-instance.js\";\nimport { getOrgDomain } from \"../org/context.js\";\nimport {\n  createOAuthCode,\n  createOAuthRefreshToken,\n  consumeOAuthCode,\n  generateOpaqueToken,\n  getOAuthClient,\n  getOAuthCode,\n  getOAuthRefreshToken,\n  registerOAuthClient,\n  touchOAuthRefreshToken,\n} from \"./oauth-store.js\";\nimport {\n  MCP_OAUTH_DEFAULT_SCOPE,\n  MCP_OAUTH_SCOPES,\n  normalizeOAuthScope,\n  signMcpOAuthAccessToken,\n} from \"./oauth-token.js\";\n\nexport interface McpOAuthRouteOptions {\n  appId?: string;\n  appName?: string;\n}\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json\",\n      \"Cache-Control\": \"no-store\",\n      Pragma: \"no-cache\",\n    },\n  });\n}\n\nfunction html(body: string, status = 200): Response {\n  return new Response(body, {\n    status,\n    headers: {\n      \"Content-Type\": \"text/html; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n    },\n  });\n}\n\nfunction redirect(location: string): Response {\n  return new Response(null, {\n    status: 302,\n    headers: { Location: location, \"Cache-Control\": \"no-store\" },\n  });\n}\n\nfunction isSameOriginPost(event: H3Event): boolean {\n  const origin = getHeader(event, \"origin\");\n  if (!origin) return true;\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return false;\n  try {\n    return new URL(origin).origin === new URL(issuer).origin;\n  } catch {\n    return false;\n  }\n}\n\nfunction oauthError(\n  error: string,\n  description: string,\n  status = 400,\n): Response {\n  return json({ error, error_description: description }, status);\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nfunction normalizeBasePath(raw: string | undefined): string {\n  const trimmed = (raw ?? \"\").trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const withSlash = trimmed.startsWith(\"/\") ? trimmed : `/${trimmed}`;\n  return withSlash.replace(/\\/+$/, \"\");\n}\n\nfunction configuredBasePath(): string {\n  return normalizeBasePath(\n    process.env.APP_BASE_PATH || process.env.VITE_APP_BASE_PATH,\n  );\n}\n\nfunction stripTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction configuredPublicBaseUrl(): string | undefined {\n  for (const key of [\n    \"WORKSPACE_OAUTH_ORIGIN\",\n    \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n    \"APP_URL\",\n    \"VITE_APP_URL\",\n    \"BETTER_AUTH_URL\",\n    \"VITE_BETTER_AUTH_URL\",\n  ]) {\n    const raw = process.env[key]?.trim();\n    if (!raw) continue;\n    try {\n      const url = new URL(raw);\n      url.search = \"\";\n      url.hash = \"\";\n      return stripTrailingSlash(`${url.origin}${url.pathname}`);\n    } catch {\n      // Ignore invalid operator-provided URL values and fall back to headers.\n    }\n  }\n  return undefined;\n}\n\nfunction appendConfiguredBasePath(baseUrl: string): string {\n  const basePath = configuredBasePath();\n  if (!basePath) return stripTrailingSlash(baseUrl);\n  try {\n    const url = new URL(baseUrl);\n    const pathname = normalizeBasePath(url.pathname);\n    if (pathname === basePath || pathname.endsWith(`${basePath}`)) {\n      return stripTrailingSlash(`${url.origin}${pathname}`);\n    }\n    return stripTrailingSlash(`${url.origin}${pathname}${basePath}`);\n  } catch {\n    return `${stripTrailingSlash(baseUrl)}${basePath}`;\n  }\n}\n\nfunction deriveOrigin(event: H3Event): string {\n  const forwardedProto = getHeader(event, \"x-forwarded-proto\");\n  const host = getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1|\\[::1\\])(:|$)/.test(host)\n      ? \"http\"\n      : \"https\");\n  return host ? `${proto}://${host}` : \"\";\n}\n\nexport function getMcpOAuthIssuer(event: H3Event): string | undefined {\n  const baseUrl = configuredPublicBaseUrl() || deriveOrigin(event);\n  if (!baseUrl) return undefined;\n  return appendConfiguredBasePath(baseUrl);\n}\n\nexport function getMcpOAuthResource(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/_agent-native/mcp`;\n}\n\nexport function getMcpOAuthProtectedResourceMetadataUrl(\n  event: H3Event,\n): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/.well-known/oauth-protected-resource`;\n}\n\nexport function buildMcpOAuthChallenge(event: H3Event): string {\n  const metadata = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const scope = MCP_OAUTH_DEFAULT_SCOPE;\n  return metadata\n    ? `Bearer resource_metadata=\"${metadata}\", scope=\"${scope}\"`\n    : `Bearer scope=\"${scope}\"`;\n}\n\nfunction authorizationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/authorize` : undefined;\n}\n\nfunction tokenEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/token` : undefined;\n}\n\nfunction registrationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/register` : undefined;\n}\n\nexport function handleMcpOAuthProtectedResourceMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const resource = getMcpOAuthResource(event);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!resource || !issuer) {\n    return oauthError(\"server_error\", \"Unable to derive MCP resource\", 500);\n  }\n  return json({\n    resource,\n    authorization_servers: [issuer],\n    scopes_supported: MCP_OAUTH_SCOPES,\n    resource_documentation: issuer,\n  });\n}\n\nexport function handleMcpOAuthAuthorizationServerMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const issuer = getMcpOAuthIssuer(event);\n  const authorize = authorizationEndpoint(event);\n  const token = tokenEndpoint(event);\n  const register = registrationEndpoint(event);\n  if (!issuer || !authorize || !token || !register) {\n    return oauthError(\"server_error\", \"Unable to derive OAuth endpoints\", 500);\n  }\n  return json({\n    issuer,\n    authorization_endpoint: authorize,\n    token_endpoint: token,\n    registration_endpoint: register,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: MCP_OAUTH_SCOPES,\n  });\n}\n\nfunction isAllowedRedirectUri(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length > 2048) return false;\n  try {\n    const url = new URL(value);\n    if (url.hash) return false;\n    if (url.username || url.password) return false;\n    if (url.protocol === \"https:\") return true;\n    if (url.protocol !== \"http:\") return false;\n    return (\n      url.hostname === \"localhost\" ||\n      url.hostname === \"127.0.0.1\" ||\n      url.hostname === \"::1\" ||\n      url.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction parseStringArray(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === \"string\")\n    : [];\n}\n\nasync function handleRegister(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = ((await readBody(event).catch(() => ({}))) ?? {}) as Record<\n    string,\n    unknown\n  >;\n  const redirectUris = parseStringArray(body.redirect_uris);\n  if (\n    redirectUris.length === 0 ||\n    redirectUris.length > 20 ||\n    !redirectUris.every(isAllowedRedirectUri)\n  ) {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"redirect_uris must contain valid HTTPS or localhost callback URLs\",\n    );\n  }\n\n  const grantTypes = parseStringArray(body.grant_types);\n  if (\n    grantTypes.length &&\n    !grantTypes.every(\n      (g) => g === \"authorization_code\" || g === \"refresh_token\",\n    )\n  ) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported grant_type\");\n  }\n  const responseTypes = parseStringArray(body.response_types);\n  if (responseTypes.length && !responseTypes.every((r) => r === \"code\")) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported response_type\");\n  }\n  const method =\n    typeof body.token_endpoint_auth_method === \"string\"\n      ? body.token_endpoint_auth_method\n      : \"none\";\n  if (method !== \"none\") {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"Only public OAuth clients are supported\",\n    );\n  }\n\n  const clientName =\n    typeof body.client_name === \"string\"\n      ? body.client_name.trim().slice(0, 120)\n      : null;\n  let client;\n  try {\n    client = await registerOAuthClient({\n      clientName,\n      redirectUris: [...new Set(redirectUris)],\n      grantTypes: grantTypes.length ? grantTypes : undefined,\n      responseTypes: responseTypes.length ? responseTypes : undefined,\n      tokenEndpointAuthMethod: method,\n    });\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") {\n      return oauthError(\"slow_down\", \"Too many client registrations\", 429);\n    }\n    throw err;\n  }\n  return json(\n    {\n      client_id: client.clientId,\n      client_id_issued_at: Math.floor((client.createdAt ?? Date.now()) / 1000),\n      client_name: client.clientName ?? undefined,\n      redirect_uris: client.redirectUris,\n      grant_types: client.grantTypes,\n      response_types: client.responseTypes,\n      token_endpoint_auth_method: client.tokenEndpointAuthMethod,\n    },\n    201,\n  );\n}\n\nfunction redirectWithOAuthError(params: {\n  redirectUri: string;\n  state?: string;\n  error: string;\n  description?: string;\n}): Response {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"error\", params.error);\n  if (params.description) {\n    url.searchParams.set(\"error_description\", params.description);\n  }\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return redirect(url.toString());\n}\n\nfunction redirectWithCode(params: {\n  redirectUri: string;\n  code: string;\n  state?: string;\n}): Response {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"code\", params.code);\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return redirect(url.toString());\n}\n\nfunction codeChallengeForVerifier(verifier: string): string {\n  return createHash(\"sha256\").update(verifier).digest(\"base64url\");\n}\n\nfunction safeEqual(a: string, b: string): boolean {\n  const aa = Buffer.from(a);\n  const bb = Buffer.from(b);\n  return aa.length === bb.length && timingSafeEqual(aa, bb);\n}\n\nfunction base64UrlEncode(value: Buffer | string): string {\n  const buf = typeof value === \"string\" ? Buffer.from(value, \"utf8\") : value;\n  return buf.toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): Buffer {\n  return Buffer.from(value, \"base64url\");\n}\n\nfunction consentSigningKey(): string {\n  return process.env.A2A_SECRET?.trim() || getAuthSecret();\n}\n\nfunction consentPayload(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  return JSON.stringify({\n    ...params,\n    exp: Math.floor(Date.now() / 1000) + 10 * 60,\n  });\n}\n\nfunction signConsentToken(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  const payload = base64UrlEncode(consentPayload(params));\n  const sig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  return `${payload}.${sig}`;\n}\n\nfunction verifyConsentToken(\n  token: string | undefined,\n  expected: {\n    email: string;\n    clientId: string;\n    redirectUri: string;\n    resource: string;\n    scope: string;\n    codeChallenge: string;\n  },\n): boolean {\n  if (!token || !token.includes(\".\")) return false;\n  const [payload, sig] = token.split(\".\", 2);\n  if (!payload || !sig) return false;\n  const expectedSig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  if (!safeEqual(sig, expectedSig)) return false;\n  try {\n    const parsed = JSON.parse(base64UrlDecode(payload).toString(\"utf8\"));\n    return (\n      parsed.email === expected.email &&\n      parsed.clientId === expected.clientId &&\n      parsed.redirectUri === expected.redirectUri &&\n      parsed.resource === expected.resource &&\n      parsed.scope === expected.scope &&\n      parsed.codeChallenge === expected.codeChallenge &&\n      typeof parsed.exp === \"number\" &&\n      parsed.exp * 1000 >= Date.now()\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isValidCodeVerifier(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 43 &&\n    value.length <= 128 &&\n    /^[A-Za-z0-9._~-]+$/.test(value)\n  );\n}\n\nfunction renderConsentPage(params: {\n  appName: string;\n  email: string;\n  clientName: string;\n  scopes: string[];\n  fields: Record<string, string>;\n}): string {\n  const hidden = Object.entries(params.fields)\n    .map(\n      ([key, value]) =>\n        `<input type=\"hidden\" name=\"${escapeHtml(key)}\" value=\"${escapeHtml(value)}\">`,\n    )\n    .join(\"\\n\");\n  const scopes = params.scopes\n    .map((scope) => `<li><code>${escapeHtml(scope)}</code></li>`)\n    .join(\"\");\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize ${escapeHtml(params.appName)}</title>\n<style>\n  :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: #09090b; color: #f4f4f5; }\n  body { min-height: 100vh; display: grid; place-items: center; margin: 0; padding: 24px; }\n  main { width: min(520px, 100%); border: 1px solid #27272a; border-radius: 8px; background: #111113; padding: 24px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }\n  h1 { font-size: 22px; line-height: 1.2; margin: 0 0 10px; }\n  p { color: #a1a1aa; line-height: 1.5; margin: 0 0 18px; }\n  ul { margin: 0 0 22px; padding-left: 22px; color: #d4d4d8; }\n  code { color: #67e8f9; }\n  .actions { display: flex; gap: 10px; justify-content: flex-end; }\n  button { border: 0; border-radius: 6px; padding: 10px 14px; font-weight: 650; cursor: pointer; }\n  .primary { background: #f4f4f5; color: #09090b; }\n  .secondary { background: #27272a; color: #f4f4f5; }\n</style>\n</head>\n<body>\n<main>\n  <h1>Authorize ${escapeHtml(params.clientName)}</h1>\n  <p>${escapeHtml(params.appName)} will let this MCP client act as ${escapeHtml(params.email)} for these scopes:</p>\n  <ul>${scopes}</ul>\n  <form method=\"post\">\n    ${hidden}\n    <div class=\"actions\">\n      <button class=\"secondary\" type=\"submit\" name=\"decision\" value=\"deny\">Deny</button>\n      <button class=\"primary\" type=\"submit\" name=\"decision\" value=\"approve\">Authorize</button>\n    </div>\n  </form>\n</main>\n</body>\n</html>`;\n}\n\nasync function resolveOrgDomain(\n  orgId: string | undefined,\n): Promise<string | undefined> {\n  if (!orgId) return undefined;\n  try {\n    return (await getOrgDomain(orgId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function readOAuthParams(\n  event: H3Event,\n): Promise<Record<string, string>> {\n  if (getMethod(event) === \"GET\") {\n    const query = getQuery(event);\n    return Object.fromEntries(\n      Object.entries(query).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  const body = await readBody(event).catch(() => ({}));\n  if (typeof body === \"string\") {\n    return Object.fromEntries(new URLSearchParams(body));\n  }\n  if (body && typeof body === \"object\") {\n    return Object.fromEntries(\n      Object.entries(body as Record<string, unknown>).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  return {};\n}\n\nasync function handleAuthorize(\n  event: H3Event,\n  options: McpOAuthRouteOptions,\n): Promise<Response> {\n  const method = getMethod(event);\n  if (method !== \"GET\" && method !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  if (method === \"POST\" && !isSameOriginPost(event)) {\n    return oauthError(\n      \"invalid_request\",\n      \"Cross-origin authorize POST rejected\",\n      403,\n    );\n  }\n  const params = await readOAuthParams(event);\n  const state = params.state;\n  const clientId = params.client_id;\n  const redirectUri = params.redirect_uri;\n  const resource = params.resource || getMcpOAuthResource(event);\n  const expectedResource = getMcpOAuthResource(event);\n\n  if (params.response_type !== \"code\") {\n    return oauthError(\n      \"unsupported_response_type\",\n      \"response_type must be code\",\n    );\n  }\n  if (!clientId || !redirectUri || !resource || resource !== expectedResource) {\n    return oauthError(\"invalid_request\", \"Invalid OAuth authorization request\");\n  }\n  if (params.code_challenge_method !== \"S256\" || !params.code_challenge) {\n    return oauthError(\"invalid_request\", \"PKCE S256 is required\");\n  }\n\n  const client = await getOAuthClient(clientId);\n  if (!client || !client.redirectUris.includes(redirectUri)) {\n    return oauthError(\"invalid_client\", \"Unknown client or redirect_uri\");\n  }\n\n  const session = await getSession(event);\n  if (!session?.email) {\n    if (params.prompt === \"none\") {\n      return redirectWithOAuthError({\n        redirectUri,\n        state,\n        error: \"login_required\",\n      });\n    }\n    const loginHtml = getConfiguredLoginHtml(event);\n    return loginHtml\n      ? html(loginHtml, 200)\n      : oauthError(\"login_required\", \"Sign in required\", 401);\n  }\n\n  const scope = normalizeOAuthScope(params.scope);\n  if (!scope) {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"invalid_scope\",\n    });\n  }\n  if (method === \"GET\") {\n    return html(\n      renderConsentPage({\n        appName: options.appName || options.appId || \"Agent Native\",\n        email: session.email,\n        clientName: client.clientName || client.clientId,\n        scopes: scope.split(/\\s+/),\n        fields: {\n          response_type: \"code\",\n          client_id: clientId,\n          redirect_uri: redirectUri,\n          resource,\n          scope,\n          state: state ?? \"\",\n          code_challenge: params.code_challenge,\n          code_challenge_method: \"S256\",\n          consent_token: signConsentToken({\n            email: session.email,\n            clientId,\n            redirectUri,\n            resource,\n            scope,\n            codeChallenge: params.code_challenge,\n          }),\n        },\n      }),\n    );\n  }\n\n  if (\n    !verifyConsentToken(params.consent_token, {\n      email: session.email,\n      clientId,\n      redirectUri,\n      resource,\n      scope,\n      codeChallenge: params.code_challenge,\n    })\n  ) {\n    return oauthError(\"invalid_request\", \"Invalid authorization consent token\");\n  }\n\n  if (params.decision !== \"approve\") {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"access_denied\",\n    });\n  }\n\n  const orgDomain = await resolveOrgDomain(session.orgId);\n  const code = await createOAuthCode({\n    clientId,\n    redirectUri,\n    codeChallenge: params.code_challenge,\n    codeChallengeMethod: \"S256\",\n    ownerEmail: session.email,\n    orgId: session.orgId ?? null,\n    orgDomain: orgDomain ?? null,\n    scope,\n    resource,\n  });\n  return redirectWithCode({ redirectUri, state, code: code.code });\n}\n\nasync function issueTokenSet(params: {\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  clientId: string;\n  scope: string;\n  resource: string;\n  issuer: string;\n}): Promise<Record<string, unknown>> {\n  const refreshToken = generateOpaqueToken();\n  await createOAuthRefreshToken({\n    refreshToken,\n    clientId: params.clientId,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n  });\n  const accessToken = await signMcpOAuthAccessToken(params);\n  return {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: 3600,\n    refresh_token: refreshToken,\n    scope: params.scope,\n  };\n}\n\nasync function handleAuthorizationCodeGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const code = body.code;\n  const clientId = body.client_id;\n  const redirectUri = body.redirect_uri;\n  const verifier = body.code_verifier;\n  if (!code || !clientId || !redirectUri || !isValidCodeVerifier(verifier)) {\n    return oauthError(\"invalid_request\", \"Missing authorization-code fields\");\n  }\n  const row = await getOAuthCode(code);\n  if (!row) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  if (row.clientId !== clientId || row.redirectUri !== redirectUri) {\n    return oauthError(\"invalid_grant\", \"Code was issued to another client\");\n  }\n  const expectedChallenge = codeChallengeForVerifier(verifier);\n  if (!safeEqual(expectedChallenge, row.codeChallenge)) {\n    return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n  }\n  const consumed = await consumeOAuthCode(code);\n  if (!consumed) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  return json(\n    await issueTokenSet({\n      ownerEmail: row.ownerEmail,\n      orgId: row.orgId,\n      orgDomain: row.orgDomain,\n      clientId,\n      scope: row.scope,\n      resource: row.resource,\n      issuer,\n    }),\n  );\n}\n\nasync function handleRefreshTokenGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const refreshToken = body.refresh_token;\n  const clientId = body.client_id;\n  if (!refreshToken) {\n    return oauthError(\"invalid_request\", \"refresh_token is required\");\n  }\n  if (!clientId) {\n    return oauthError(\"invalid_request\", \"client_id is required\");\n  }\n  const existing = await getOAuthRefreshToken(refreshToken);\n  if (!existing) return oauthError(\"invalid_grant\", \"Invalid refresh token\");\n  if (existing.clientId !== clientId) {\n    return oauthError(\n      \"invalid_grant\",\n      \"Refresh token belongs to another client\",\n    );\n  }\n  await touchOAuthRefreshToken(refreshToken).catch(() => undefined);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  const accessToken = await signMcpOAuthAccessToken({\n    ownerEmail: existing.ownerEmail,\n    orgId: existing.orgId,\n    orgDomain: existing.orgDomain,\n    clientId: existing.clientId,\n    scope: existing.scope,\n    resource: existing.resource,\n    issuer,\n  });\n  return json({\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: 3600,\n    refresh_token: refreshToken,\n    scope: existing.scope,\n  });\n}\n\nasync function handleToken(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = await readOAuthParams(event);\n  switch (body.grant_type) {\n    case \"authorization_code\":\n      return handleAuthorizationCodeGrant(event, body);\n    case \"refresh_token\":\n      return handleRefreshTokenGrant(event, body);\n    default:\n      return oauthError(\"unsupported_grant_type\", \"Unsupported grant_type\");\n  }\n}\n\nexport async function handleMcpOAuth(\n  event: H3Event,\n  subpath: string,\n  options: McpOAuthRouteOptions = {},\n): Promise<Response> {\n  const path = subpath.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  try {\n    if (path === \"authorize\") return await handleAuthorize(event, options);\n    if (path === \"token\") return await handleToken(event);\n    if (path === \"register\") return await handleRegister(event);\n    setResponseStatus(event, 404);\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    return oauthError(\n      \"server_error\",\n      err?.message || \"OAuth request failed\",\n      500,\n    );\n  }\n}\n"]}
+{"version":3,"file":"oauth-route.js","sourceRoot":"","sources":["../../src/mcp/oauth-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAO1B,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,WAAmB,EACnB,MAAM,GAAG,GAAG;IAEZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,iBAAiB,CACtB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB;IAC9B,KAAK,MAAM,GAAG,IAAI;QAChB,wBAAwB;QACxB,6BAA6B;QAC7B,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9D,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,uBAAuB,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,GAAG,QAAQ,oBAAoB,CAAC;IACzC,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,uCAAuC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,QAAQ,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,OAAO,QAAQ;QACb,CAAC,CAAC,6BAA6B,QAAQ,aAAa,KAAK,GAAG;QAC5D,CAAC,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,oCAAoC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,cAAc,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,QAAQ;QACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,gBAAgB;QAClC,sBAAsB,EAAE,MAAM;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,cAAc,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,MAAM;QACN,sBAAsB,EAAE,SAAS;QACjC,cAAc,EAAE,KAAK;QACrB,qBAAqB,EAAE,QAAQ;QAC/B,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,gBAAgB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;YAC5B,GAAG,CAAC,QAAQ,KAAK,KAAK;YACtB,GAAG,CAAC,QAAQ,KAAK,OAAO,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAG5D,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,IACE,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,EAAE;QACxB,CAAC,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,UAAU,CACf,yBAAyB,EACzB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,IACE,UAAU,CAAC,MAAM;QACjB,CAAC,UAAU,CAAC,KAAK,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,eAAe,CAC3D,EACD,CAAC;QACD,OAAO,UAAU,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,0BAA0B,KAAK,QAAQ;QACjD,CAAC,CAAC,IAAI,CAAC,0BAA0B;QACjC,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,UAAU,CACf,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACjC,UAAU;YACV,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YACxC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACtD,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,uBAAuB,EAAE,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,WAAW,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CACT;QACE,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QACxE,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;QAC3C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;KAC3D,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAK/B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAIzB;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAOvB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,MAAM;QACT,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAOzB;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CACzB,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAyB,EACzB,QAOC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,eAAe,CACjC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,CACL,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC3C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC/C,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAChC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAM1B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;SACzC,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,8BAA8B,UAAU,CAAC,GAAG,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CACjF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;;;;;mBAKU,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;kBAiB3B,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;OACxC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAoC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACrF,MAAM;;MAER,MAAM;;;;;;;;QAQJ,CAAC;AACT,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC7C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc,EACd,OAA6B;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,UAAU,CACf,iBAAiB,EACjB,sCAAsC,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,sBAAsB,CAAC;gBAC5B,WAAW;gBACX,KAAK;gBACL,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,SAAS;YACd,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YACtB,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,CACT,iBAAiB,CAAC;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc;YAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;YAChD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE;gBACN,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,QAAQ;gBACR,KAAK;gBACL,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,qBAAqB,EAAE,MAAM;gBAC7B,aAAa,EAAE,gBAAgB,CAAC;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ;oBACR,WAAW;oBACX,QAAQ;oBACR,KAAK;oBACL,aAAa,EAAE,MAAM,CAAC,cAAc;iBACrC,CAAC;aACH;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IACE,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,cAAc;KACrC,CAAC,EACF,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,mBAAmB,EAAE,MAAM;QAC3B,UAAU,EAAE,OAAO,CAAC,KAAK;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAQ5B;IACC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,kCAAkC;QAC9C,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAc,EACd,IAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CACT,MAAM,aAAa,CAAC;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ;QACR,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;KACP,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,IAA4B;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,UAAU,CACf,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;QACV,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,kCAAkC;QAC9C,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,eAAe;YAClB,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C;YACE,OAAO,UAAU,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAc,EACd,OAAe,EACf,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,UAAU,CACf,cAAc,EACd,GAAG,EAAE,OAAO,IAAI,sBAAsB,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Standard remote MCP OAuth 2.1 endpoints.\n *\n * These routes let MCP hosts such as Claude Code and ChatGPT authenticate\n * through their native remote-MCP OAuth flow instead of pasting bearer tokens.\n * The issued access tokens are audience-bound to `/_agent-native/mcp`, carry\n * the same user/org identity as the existing connect flow, and are mediated by\n * `verifyAuth` before any MCP tool/resource request runs.\n */\n\nimport type { H3Event } from \"h3\";\nimport { getHeader, getMethod, getQuery, setResponseStatus } from \"h3\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getConfiguredLoginHtml, getSession } from \"../server/auth.js\";\nimport { getAuthSecret } from \"../server/better-auth-instance.js\";\nimport { getOrgDomain } from \"../org/context.js\";\nimport {\n  createOAuthCode,\n  createOAuthRefreshToken,\n  consumeOAuthCode,\n  generateOpaqueToken,\n  getOAuthClient,\n  getOAuthCode,\n  getOAuthRefreshToken,\n  registerOAuthClient,\n  touchOAuthRefreshToken,\n} from \"./oauth-store.js\";\nimport {\n  MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n  MCP_OAUTH_DEFAULT_SCOPE,\n  MCP_OAUTH_SCOPES,\n  normalizeOAuthScope,\n  signMcpOAuthAccessToken,\n} from \"./oauth-token.js\";\n\nexport interface McpOAuthRouteOptions {\n  appId?: string;\n  appName?: string;\n}\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json\",\n      \"Cache-Control\": \"no-store\",\n      Pragma: \"no-cache\",\n    },\n  });\n}\n\nfunction html(body: string, status = 200): Response {\n  return new Response(body, {\n    status,\n    headers: {\n      \"Content-Type\": \"text/html; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n    },\n  });\n}\n\nfunction redirect(location: string): Response {\n  return new Response(null, {\n    status: 302,\n    headers: { Location: location, \"Cache-Control\": \"no-store\" },\n  });\n}\n\nfunction isSameOriginPost(event: H3Event): boolean {\n  const origin = getHeader(event, \"origin\");\n  if (!origin) return true;\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return false;\n  try {\n    return new URL(origin).origin === new URL(issuer).origin;\n  } catch {\n    return false;\n  }\n}\n\nfunction oauthError(\n  error: string,\n  description: string,\n  status = 400,\n): Response {\n  return json({ error, error_description: description }, status);\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nfunction normalizeBasePath(raw: string | undefined): string {\n  const trimmed = (raw ?? \"\").trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const withSlash = trimmed.startsWith(\"/\") ? trimmed : `/${trimmed}`;\n  return withSlash.replace(/\\/+$/, \"\");\n}\n\nfunction configuredBasePath(): string {\n  return normalizeBasePath(\n    process.env.APP_BASE_PATH || process.env.VITE_APP_BASE_PATH,\n  );\n}\n\nfunction stripTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction configuredPublicBaseUrl(): string | undefined {\n  for (const key of [\n    \"WORKSPACE_OAUTH_ORIGIN\",\n    \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n    \"APP_URL\",\n    \"VITE_APP_URL\",\n    \"BETTER_AUTH_URL\",\n    \"VITE_BETTER_AUTH_URL\",\n  ]) {\n    const raw = process.env[key]?.trim();\n    if (!raw) continue;\n    try {\n      const url = new URL(raw);\n      url.search = \"\";\n      url.hash = \"\";\n      return stripTrailingSlash(`${url.origin}${url.pathname}`);\n    } catch {\n      // Ignore invalid operator-provided URL values and fall back to headers.\n    }\n  }\n  return undefined;\n}\n\nfunction appendConfiguredBasePath(baseUrl: string): string {\n  const basePath = configuredBasePath();\n  if (!basePath) return stripTrailingSlash(baseUrl);\n  try {\n    const url = new URL(baseUrl);\n    const pathname = normalizeBasePath(url.pathname);\n    if (pathname === basePath || pathname.endsWith(`${basePath}`)) {\n      return stripTrailingSlash(`${url.origin}${pathname}`);\n    }\n    return stripTrailingSlash(`${url.origin}${pathname}${basePath}`);\n  } catch {\n    return `${stripTrailingSlash(baseUrl)}${basePath}`;\n  }\n}\n\nfunction deriveOrigin(event: H3Event): string {\n  const forwardedProto = getHeader(event, \"x-forwarded-proto\");\n  const host = getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1|\\[::1\\])(:|$)/.test(host)\n      ? \"http\"\n      : \"https\");\n  return host ? `${proto}://${host}` : \"\";\n}\n\nexport function getMcpOAuthIssuer(event: H3Event): string | undefined {\n  const baseUrl = configuredPublicBaseUrl() || deriveOrigin(event);\n  if (!baseUrl) return undefined;\n  return appendConfiguredBasePath(baseUrl);\n}\n\nexport function getMcpOAuthResource(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/_agent-native/mcp`;\n}\n\n/**\n * All plausible MCP OAuth resource audiences for the given request, deduped.\n *\n * When a configured public base URL differs from the request-derived origin\n * (e.g. during Netlify deploy-preview or behind a reverse proxy), a token\n * minted against the configured URL must still verify against the request-\n * derived URL and vice-versa.  Returns both so `verifyMcpOAuthAccessToken`\n * accepts either without issuing a 401.\n */\nexport function getMcpOAuthAudiences(event: H3Event): string[] {\n  const derived = getMcpOAuthResource(event);\n  const configured = (() => {\n    const base = configuredPublicBaseUrl();\n    if (!base) return undefined;\n    // Re-apply base path if present so the configured resource is also\n    // base-path-aware, consistent with how getMcpOAuthResource computes it.\n    const withPath = appendConfiguredBasePath(base);\n    return `${withPath}/_agent-native/mcp`;\n  })();\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const r of [derived, configured]) {\n    const n = r?.replace(/\\/+$/, \"\");\n    if (n && !seen.has(n)) {\n      seen.add(n);\n      out.push(n);\n    }\n  }\n  return out;\n}\n\nexport function getMcpOAuthProtectedResourceMetadataUrl(\n  event: H3Event,\n): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/.well-known/oauth-protected-resource`;\n}\n\nexport function buildMcpOAuthChallenge(event: H3Event): string {\n  const metadata = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const scope = MCP_OAUTH_DEFAULT_SCOPE;\n  return metadata\n    ? `Bearer resource_metadata=\"${metadata}\", scope=\"${scope}\"`\n    : `Bearer scope=\"${scope}\"`;\n}\n\nfunction authorizationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/authorize` : undefined;\n}\n\nfunction tokenEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/token` : undefined;\n}\n\nfunction registrationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/register` : undefined;\n}\n\nexport function handleMcpOAuthProtectedResourceMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const resource = getMcpOAuthResource(event);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!resource || !issuer) {\n    return oauthError(\"server_error\", \"Unable to derive MCP resource\", 500);\n  }\n  return json({\n    resource,\n    authorization_servers: [issuer],\n    scopes_supported: MCP_OAUTH_SCOPES,\n    resource_documentation: issuer,\n  });\n}\n\nexport function handleMcpOAuthAuthorizationServerMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const issuer = getMcpOAuthIssuer(event);\n  const authorize = authorizationEndpoint(event);\n  const token = tokenEndpoint(event);\n  const register = registrationEndpoint(event);\n  if (!issuer || !authorize || !token || !register) {\n    return oauthError(\"server_error\", \"Unable to derive OAuth endpoints\", 500);\n  }\n  return json({\n    issuer,\n    authorization_endpoint: authorize,\n    token_endpoint: token,\n    registration_endpoint: register,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: MCP_OAUTH_SCOPES,\n  });\n}\n\nfunction isAllowedRedirectUri(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length > 2048) return false;\n  try {\n    const url = new URL(value);\n    if (url.hash) return false;\n    if (url.username || url.password) return false;\n    if (url.protocol === \"https:\") return true;\n    if (url.protocol !== \"http:\") return false;\n    return (\n      url.hostname === \"localhost\" ||\n      url.hostname === \"127.0.0.1\" ||\n      url.hostname === \"::1\" ||\n      url.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction parseStringArray(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === \"string\")\n    : [];\n}\n\nasync function handleRegister(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = ((await readBody(event).catch(() => ({}))) ?? {}) as Record<\n    string,\n    unknown\n  >;\n  const redirectUris = parseStringArray(body.redirect_uris);\n  if (\n    redirectUris.length === 0 ||\n    redirectUris.length > 20 ||\n    !redirectUris.every(isAllowedRedirectUri)\n  ) {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"redirect_uris must contain valid HTTPS or localhost callback URLs\",\n    );\n  }\n\n  const grantTypes = parseStringArray(body.grant_types);\n  if (\n    grantTypes.length &&\n    !grantTypes.every(\n      (g) => g === \"authorization_code\" || g === \"refresh_token\",\n    )\n  ) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported grant_type\");\n  }\n  const responseTypes = parseStringArray(body.response_types);\n  if (responseTypes.length && !responseTypes.every((r) => r === \"code\")) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported response_type\");\n  }\n  const method =\n    typeof body.token_endpoint_auth_method === \"string\"\n      ? body.token_endpoint_auth_method\n      : \"none\";\n  if (method !== \"none\") {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"Only public OAuth clients are supported\",\n    );\n  }\n\n  const clientName =\n    typeof body.client_name === \"string\"\n      ? body.client_name.trim().slice(0, 120)\n      : null;\n  let client;\n  try {\n    client = await registerOAuthClient({\n      clientName,\n      redirectUris: [...new Set(redirectUris)],\n      grantTypes: grantTypes.length ? grantTypes : undefined,\n      responseTypes: responseTypes.length ? responseTypes : undefined,\n      tokenEndpointAuthMethod: method,\n    });\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") {\n      return oauthError(\"slow_down\", \"Too many client registrations\", 429);\n    }\n    throw err;\n  }\n  return json(\n    {\n      client_id: client.clientId,\n      client_id_issued_at: Math.floor((client.createdAt ?? Date.now()) / 1000),\n      client_name: client.clientName ?? undefined,\n      redirect_uris: client.redirectUris,\n      grant_types: client.grantTypes,\n      response_types: client.responseTypes,\n      token_endpoint_auth_method: client.tokenEndpointAuthMethod,\n    },\n    201,\n  );\n}\n\nfunction redirectWithOAuthError(params: {\n  redirectUri: string;\n  state?: string;\n  error: string;\n  description?: string;\n}): Response {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"error\", params.error);\n  if (params.description) {\n    url.searchParams.set(\"error_description\", params.description);\n  }\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return redirect(url.toString());\n}\n\nfunction redirectWithCode(params: {\n  redirectUri: string;\n  code: string;\n  state?: string;\n}): Response {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"code\", params.code);\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return redirect(url.toString());\n}\n\nfunction codeChallengeForVerifier(verifier: string): string {\n  return createHash(\"sha256\").update(verifier).digest(\"base64url\");\n}\n\nfunction safeEqual(a: string, b: string): boolean {\n  const aa = Buffer.from(a);\n  const bb = Buffer.from(b);\n  return aa.length === bb.length && timingSafeEqual(aa, bb);\n}\n\nfunction base64UrlEncode(value: Buffer | string): string {\n  const buf = typeof value === \"string\" ? Buffer.from(value, \"utf8\") : value;\n  return buf.toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): Buffer {\n  return Buffer.from(value, \"base64url\");\n}\n\nfunction consentSigningKey(): string {\n  return process.env.A2A_SECRET?.trim() || getAuthSecret();\n}\n\nfunction consentPayload(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  return JSON.stringify({\n    ...params,\n    exp: Math.floor(Date.now() / 1000) + 10 * 60,\n  });\n}\n\nfunction signConsentToken(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  const payload = base64UrlEncode(consentPayload(params));\n  const sig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  return `${payload}.${sig}`;\n}\n\nfunction verifyConsentToken(\n  token: string | undefined,\n  expected: {\n    email: string;\n    clientId: string;\n    redirectUri: string;\n    resource: string;\n    scope: string;\n    codeChallenge: string;\n  },\n): boolean {\n  if (!token || !token.includes(\".\")) return false;\n  const [payload, sig] = token.split(\".\", 2);\n  if (!payload || !sig) return false;\n  const expectedSig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  if (!safeEqual(sig, expectedSig)) return false;\n  try {\n    const parsed = JSON.parse(base64UrlDecode(payload).toString(\"utf8\"));\n    return (\n      parsed.email === expected.email &&\n      parsed.clientId === expected.clientId &&\n      parsed.redirectUri === expected.redirectUri &&\n      parsed.resource === expected.resource &&\n      parsed.scope === expected.scope &&\n      parsed.codeChallenge === expected.codeChallenge &&\n      typeof parsed.exp === \"number\" &&\n      parsed.exp * 1000 >= Date.now()\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isValidCodeVerifier(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 43 &&\n    value.length <= 128 &&\n    /^[A-Za-z0-9._~-]+$/.test(value)\n  );\n}\n\nfunction renderConsentPage(params: {\n  appName: string;\n  email: string;\n  clientName: string;\n  scopes: string[];\n  fields: Record<string, string>;\n}): string {\n  const hidden = Object.entries(params.fields)\n    .map(\n      ([key, value]) =>\n        `<input type=\"hidden\" name=\"${escapeHtml(key)}\" value=\"${escapeHtml(value)}\">`,\n    )\n    .join(\"\\n\");\n  const scopes = params.scopes\n    .map((scope) => `<li><code>${escapeHtml(scope)}</code></li>`)\n    .join(\"\");\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize ${escapeHtml(params.appName)}</title>\n<style>\n  :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: #09090b; color: #f4f4f5; }\n  body { min-height: 100vh; display: grid; place-items: center; margin: 0; padding: 24px; }\n  main { width: min(520px, 100%); border: 1px solid #27272a; border-radius: 8px; background: #111113; padding: 24px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }\n  h1 { font-size: 22px; line-height: 1.2; margin: 0 0 10px; }\n  p { color: #a1a1aa; line-height: 1.5; margin: 0 0 18px; }\n  ul { margin: 0 0 22px; padding-left: 22px; color: #d4d4d8; }\n  code { color: #67e8f9; }\n  .actions { display: flex; gap: 10px; justify-content: flex-end; }\n  button { border: 0; border-radius: 6px; padding: 10px 14px; font-weight: 650; cursor: pointer; }\n  .primary { background: #f4f4f5; color: #09090b; }\n  .secondary { background: #27272a; color: #f4f4f5; }\n</style>\n</head>\n<body>\n<main>\n  <h1>Authorize ${escapeHtml(params.clientName)}</h1>\n  <p>${escapeHtml(params.appName)} will let this MCP client act as ${escapeHtml(params.email)} for these scopes:</p>\n  <ul>${scopes}</ul>\n  <form method=\"post\">\n    ${hidden}\n    <div class=\"actions\">\n      <button class=\"secondary\" type=\"submit\" name=\"decision\" value=\"deny\">Deny</button>\n      <button class=\"primary\" type=\"submit\" name=\"decision\" value=\"approve\">Authorize</button>\n    </div>\n  </form>\n</main>\n</body>\n</html>`;\n}\n\nasync function resolveOrgDomain(\n  orgId: string | undefined,\n): Promise<string | undefined> {\n  if (!orgId) return undefined;\n  try {\n    return (await getOrgDomain(orgId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function readOAuthParams(\n  event: H3Event,\n): Promise<Record<string, string>> {\n  if (getMethod(event) === \"GET\") {\n    const query = getQuery(event);\n    return Object.fromEntries(\n      Object.entries(query).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  const body = await readBody(event).catch(() => ({}));\n  if (typeof body === \"string\") {\n    return Object.fromEntries(new URLSearchParams(body));\n  }\n  if (body && typeof body === \"object\") {\n    return Object.fromEntries(\n      Object.entries(body as Record<string, unknown>).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  return {};\n}\n\nasync function handleAuthorize(\n  event: H3Event,\n  options: McpOAuthRouteOptions,\n): Promise<Response> {\n  const method = getMethod(event);\n  if (method !== \"GET\" && method !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  if (method === \"POST\" && !isSameOriginPost(event)) {\n    return oauthError(\n      \"invalid_request\",\n      \"Cross-origin authorize POST rejected\",\n      403,\n    );\n  }\n  const params = await readOAuthParams(event);\n  const state = params.state;\n  const clientId = params.client_id;\n  const redirectUri = params.redirect_uri;\n  const resource = params.resource || getMcpOAuthResource(event);\n  const expectedResource = getMcpOAuthResource(event);\n\n  if (params.response_type !== \"code\") {\n    return oauthError(\n      \"unsupported_response_type\",\n      \"response_type must be code\",\n    );\n  }\n  if (!clientId || !redirectUri || !resource || resource !== expectedResource) {\n    return oauthError(\"invalid_request\", \"Invalid OAuth authorization request\");\n  }\n  if (params.code_challenge_method !== \"S256\" || !params.code_challenge) {\n    return oauthError(\"invalid_request\", \"PKCE S256 is required\");\n  }\n\n  const client = await getOAuthClient(clientId);\n  if (!client || !client.redirectUris.includes(redirectUri)) {\n    return oauthError(\"invalid_client\", \"Unknown client or redirect_uri\");\n  }\n\n  const session = await getSession(event);\n  if (!session?.email) {\n    if (params.prompt === \"none\") {\n      return redirectWithOAuthError({\n        redirectUri,\n        state,\n        error: \"login_required\",\n      });\n    }\n    const loginHtml = getConfiguredLoginHtml(event);\n    return loginHtml\n      ? html(loginHtml, 200)\n      : oauthError(\"login_required\", \"Sign in required\", 401);\n  }\n\n  const scope = normalizeOAuthScope(params.scope);\n  if (!scope) {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"invalid_scope\",\n    });\n  }\n  if (method === \"GET\") {\n    return html(\n      renderConsentPage({\n        appName: options.appName || options.appId || \"Agent Native\",\n        email: session.email,\n        clientName: client.clientName || client.clientId,\n        scopes: scope.split(/\\s+/),\n        fields: {\n          response_type: \"code\",\n          client_id: clientId,\n          redirect_uri: redirectUri,\n          resource,\n          scope,\n          state: state ?? \"\",\n          code_challenge: params.code_challenge,\n          code_challenge_method: \"S256\",\n          consent_token: signConsentToken({\n            email: session.email,\n            clientId,\n            redirectUri,\n            resource,\n            scope,\n            codeChallenge: params.code_challenge,\n          }),\n        },\n      }),\n    );\n  }\n\n  if (\n    !verifyConsentToken(params.consent_token, {\n      email: session.email,\n      clientId,\n      redirectUri,\n      resource,\n      scope,\n      codeChallenge: params.code_challenge,\n    })\n  ) {\n    return oauthError(\"invalid_request\", \"Invalid authorization consent token\");\n  }\n\n  if (params.decision !== \"approve\") {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"access_denied\",\n    });\n  }\n\n  const orgDomain = await resolveOrgDomain(session.orgId);\n  const code = await createOAuthCode({\n    clientId,\n    redirectUri,\n    codeChallenge: params.code_challenge,\n    codeChallengeMethod: \"S256\",\n    ownerEmail: session.email,\n    orgId: session.orgId ?? null,\n    orgDomain: orgDomain ?? null,\n    scope,\n    resource,\n  });\n  return redirectWithCode({ redirectUri, state, code: code.code });\n}\n\nasync function issueTokenSet(params: {\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  clientId: string;\n  scope: string;\n  resource: string;\n  issuer: string;\n}): Promise<Record<string, unknown>> {\n  const refreshToken = generateOpaqueToken();\n  await createOAuthRefreshToken({\n    refreshToken,\n    clientId: params.clientId,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n  });\n  const accessToken = await signMcpOAuthAccessToken(params);\n  return {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n    refresh_token: refreshToken,\n    scope: params.scope,\n  };\n}\n\nasync function handleAuthorizationCodeGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const code = body.code;\n  const clientId = body.client_id;\n  const redirectUri = body.redirect_uri;\n  const verifier = body.code_verifier;\n  if (!code || !clientId || !redirectUri || !isValidCodeVerifier(verifier)) {\n    return oauthError(\"invalid_request\", \"Missing authorization-code fields\");\n  }\n  const row = await getOAuthCode(code);\n  if (!row) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  if (row.clientId !== clientId || row.redirectUri !== redirectUri) {\n    return oauthError(\"invalid_grant\", \"Code was issued to another client\");\n  }\n  const expectedChallenge = codeChallengeForVerifier(verifier);\n  if (!safeEqual(expectedChallenge, row.codeChallenge)) {\n    return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n  }\n  const consumed = await consumeOAuthCode(code);\n  if (!consumed) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  return json(\n    await issueTokenSet({\n      ownerEmail: row.ownerEmail,\n      orgId: row.orgId,\n      orgDomain: row.orgDomain,\n      clientId,\n      scope: row.scope,\n      resource: row.resource,\n      issuer,\n    }),\n  );\n}\n\nasync function handleRefreshTokenGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const refreshToken = body.refresh_token;\n  const clientId = body.client_id;\n  if (!refreshToken) {\n    return oauthError(\"invalid_request\", \"refresh_token is required\");\n  }\n  if (!clientId) {\n    return oauthError(\"invalid_request\", \"client_id is required\");\n  }\n  const existing = await getOAuthRefreshToken(refreshToken);\n  if (!existing) return oauthError(\"invalid_grant\", \"Invalid refresh token\");\n  if (existing.clientId !== clientId) {\n    return oauthError(\n      \"invalid_grant\",\n      \"Refresh token belongs to another client\",\n    );\n  }\n  await touchOAuthRefreshToken(refreshToken).catch(() => undefined);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  const accessToken = await signMcpOAuthAccessToken({\n    ownerEmail: existing.ownerEmail,\n    orgId: existing.orgId,\n    orgDomain: existing.orgDomain,\n    clientId: existing.clientId,\n    scope: existing.scope,\n    resource: existing.resource,\n    issuer,\n  });\n  return json({\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n    refresh_token: refreshToken,\n    scope: existing.scope,\n  });\n}\n\nasync function handleToken(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = await readOAuthParams(event);\n  switch (body.grant_type) {\n    case \"authorization_code\":\n      return handleAuthorizationCodeGrant(event, body);\n    case \"refresh_token\":\n      return handleRefreshTokenGrant(event, body);\n    default:\n      return oauthError(\"unsupported_grant_type\", \"Unsupported grant_type\");\n  }\n}\n\nexport async function handleMcpOAuth(\n  event: H3Event,\n  subpath: string,\n  options: McpOAuthRouteOptions = {},\n): Promise<Response> {\n  const path = subpath.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  try {\n    if (path === \"authorize\") return await handleAuthorize(event, options);\n    if (path === \"token\") return await handleToken(event);\n    if (path === \"register\") return await handleRegister(event);\n    setResponseStatus(event, 404);\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    return oauthError(\n      \"server_error\",\n      err?.message || \"OAuth request failed\",\n      500,\n    );\n  }\n}\n"]}

package/dist/mcp/oauth-store.d.ts

@@ -6,7 +6,16 @@
  * are signed JWTs and are never persisted.
  */
 export declare const MCP_OAUTH_CODE_TTL_MS: number;
-export declare const MCP_OAUTH_ACCESS_TOKEN_TTL = "1h";
+/**
+ * Access-token TTL as a jose-compatible duration string.
+ * Defaults to "30d"; override with MCP_OAUTH_ACCESS_TOKEN_TTL env var.
+ */
+export declare const MCP_OAUTH_ACCESS_TOKEN_TTL: string;
+/**
+ * Access-token TTL in seconds (derived from the same env var).
+ * Used to populate the OAuth `expires_in` response field.
+ */
+export declare const MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
 export declare const MCP_OAUTH_REFRESH_TOKEN_TTL_MS: number;
 export declare const MCP_OAUTH_REGISTER_MAX = 60;
 export declare const MCP_OAUTH_REGISTER_WINDOW_MS = 60000;
@@ -86,5 +95,10 @@ export declare function rotateOAuthRefreshToken(params: {
     newRefreshToken: string;
 }): Promise<OAuthRefreshTokenRow | null>;
 export declare function getOAuthRefreshToken(refreshToken: string): Promise<OAuthRefreshTokenRow | null>;
+/**
+ * Slide the refresh-token's expiry window on each successful use so that active
+ * users never hit the TTL. Records `last_used_at` and extends `expires_at` to
+ * `now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS`.
+ */
 export declare function touchOAuthRefreshToken(refreshToken: string): Promise<void>;
 //# sourceMappingURL=oauth-store.d.ts.map

package/dist/mcp/oauth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,eAAO,MAAM,qBAAqB,QAAc,CAAC;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,8BAA8B,QAAwB,CAAC;AACpE,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AA2DnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AA8ED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,cAAc,CAAC,CA+C1B;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuCxB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAa7E;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB9B;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsChC;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiDvC;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CActC;AAED,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf"}
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,eAAO,MAAM,qBAAqB,QAAc,CAAC;AA8CjD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAA4B,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,kCAAkC,EAAE,MACxB,CAAC;AAE1B,eAAO,MAAM,8BAA8B,QAAyB,CAAC;AACrE,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,4BAA4B,QAAS,CAAC;AA2DnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AA8ED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,cAAc,CAAC,CA+C1B;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuCxB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAa7E;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB9B;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsChC;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiDvC;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CActC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/mcp/oauth-store.js

@@ -9,8 +9,58 @@ import { getDbExec, isConnectionError, intType } from "../db/client.js";
 import { randomBytes, randomUUID, createHash } from "node:crypto";
 let _initPromise;
 export const MCP_OAUTH_CODE_TTL_MS = 10 * 60_000;
-export const MCP_OAUTH_ACCESS_TOKEN_TTL = "1h";
-export const MCP_OAUTH_REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60_000;
+/**
+ * Parse a duration string like "30d", "1h", "7d" into seconds.
+ * Returns `null` when the input is not a valid recognised pattern.
+ */
+function parseDurationSeconds(raw) {
+    const trimmed = raw.trim();
+    const match = trimmed.match(/^(\d+(?:\.\d+)?)\s*([smhd])$/i);
+    if (!match)
+        return null;
+    const value = parseFloat(match[1]);
+    if (!Number.isFinite(value) || value <= 0)
+        return null;
+    switch (match[2].toLowerCase()) {
+        case "s":
+            return value;
+        case "m":
+            return value * 60;
+        case "h":
+            return value * 3600;
+        case "d":
+            return value * 86400;
+    }
+    return null;
+}
+const DEFAULT_ACCESS_TOKEN_TTL = "30d";
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 30 * 86400;
+function resolveAccessTokenTtl() {
+    const env = process.env.MCP_OAUTH_ACCESS_TOKEN_TTL?.trim();
+    if (env) {
+        const secs = parseDurationSeconds(env);
+        if (secs !== null)
+            return { str: env, seconds: secs };
+        // Garbage value — fall back to default rather than silently breaking.
+        console.warn(`[mcp-oauth] Invalid MCP_OAUTH_ACCESS_TOKEN_TTL="${env}", using default "${DEFAULT_ACCESS_TOKEN_TTL}"`);
+    }
+    return {
+        str: DEFAULT_ACCESS_TOKEN_TTL,
+        seconds: DEFAULT_ACCESS_TOKEN_TTL_SECONDS,
+    };
+}
+const _accessTokenTtl = resolveAccessTokenTtl();
+/**
+ * Access-token TTL as a jose-compatible duration string.
+ * Defaults to "30d"; override with MCP_OAUTH_ACCESS_TOKEN_TTL env var.
+ */
+export const MCP_OAUTH_ACCESS_TOKEN_TTL = _accessTokenTtl.str;
+/**
+ * Access-token TTL in seconds (derived from the same env var).
+ * Used to populate the OAuth `expires_in` response field.
+ */
+export const MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS = _accessTokenTtl.seconds;
+export const MCP_OAUTH_REFRESH_TOKEN_TTL_MS = 365 * 24 * 60 * 60_000;
 export const MCP_OAUTH_REGISTER_MAX = 60;
 export const MCP_OAUTH_REGISTER_WINDOW_MS = 60_000;
 async function ensureTable() {
@@ -388,13 +438,19 @@ export async function getOAuthRefreshToken(refreshToken) {
     }
     return row;
 }
+/**
+ * Slide the refresh-token's expiry window on each successful use so that active
+ * users never hit the TTL. Records `last_used_at` and extends `expires_at` to
+ * `now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS`.
+ */
 export async function touchOAuthRefreshToken(refreshToken) {
     await ensureTable();
     const client = getDbExec();
     const tokenHash = hashOAuthToken(refreshToken);
+    const now = Date.now();
     await client.execute({
-        sql: `UPDATE mcp_oauth_refresh_tokens SET last_used_at = ? WHERE token_hash = ? AND revoked_at IS NULL`,
-        args: [Date.now(), tokenHash],
+        sql: `UPDATE mcp_oauth_refresh_tokens SET last_used_at = ?, expires_at = ? WHERE token_hash = ? AND revoked_at IS NULL`,
+        args: [now, now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS, tokenHash],
     });
 }
 //# sourceMappingURL=oauth-store.js.map

package/dist/mcp/oauth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../../src/mcp/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;uBAQJ,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;;;uBAYJ,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;uBAUJ,OAAO,EAAE;uBACT,OAAO,EAAE;yBACP,OAAO,EAAE;uBACX,OAAO,EAAE;;;OAGzB,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AA4CD,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc,EACd,WAAqB,EAAE;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YACnE,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ;IAC5B,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACvC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QACrD,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,YAAY,CAAC;QACzE,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,EAAE;YAClE,oBAAoB;YACpB,eAAe;SAChB,CAAC;QACF,aAAa,EAAE,oBAAoB,CACjC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa,EACvC,CAAC,MAAM,CAAC,CACT;QACD,uBAAuB,EACrB,GAAG,CAAC,0BAA0B,IAAI,GAAG,CAAC,uBAAuB,IAAI,MAAM;QACzE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,WAAW;QAChD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa;QACtD,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,mBAAmB;QACzE,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU;QAC7C,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;QAClD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC7B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS;QAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACvC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU;QAC7C,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;QAClD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC;QACzD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,cAAc,EAAE,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAMzC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,kEAAkE;YACvE,IAAI,EAAE,CAAC,GAAG,GAAG,4BAA4B,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,sBAAsB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc;YAAE,MAAM,GAAG,CAAC;QAC/C,yEAAyE;QACzE,gEAAgE;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,6BAA6B,UAAU,EAAE,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM;QAC1C,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,MAAM;QAChD,CAAC,CAAC,MAAM,CAAC,aAAa;QACtB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACb,MAAM,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC;IACzE,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,yKAAyK;QAC9K,IAAI,EAAE;YACJ,QAAQ;YACR,MAAM,CAAC,UAAU,IAAI,IAAI;YACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAC7B,uBAAuB;YACvB,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU;QACV,aAAa;QACb,uBAAuB;QACvB,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,qDAAqD;YAC1D,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAUrC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,GAAG,qBAAqB,CAAC;IAC9C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,0OAA0O;QAC/O,IAAI,EAAE;YACJ,IAAI;YACJ,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,MAAM,CAAC,SAAS,IAAI,IAAI;YACxB,MAAM,CAAC,KAAK;YACZ,MAAM,CAAC,QAAQ;YACf,GAAG;YACH,SAAS;YACT,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,GAAG;QACd,SAAS;QACT,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,8CAA8C;QACnD,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY;IAEZ,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,8CAA8C;QACnD,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,mFAAmF;QACxF,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;KACzB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAQ7C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAyB;QAChC,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,8BAA8B;QAC/C,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,uOAAuO;QAC5O,IAAI,EAAE;YACJ,GAAG,CAAC,EAAE;YACN,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,UAAU;YACd,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,UAAU;YACd,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,cAAc;SACnB;KACF,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAG7C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,6DAA6D;QAClE,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,wIAAwI;QAC7I,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAyB;QACjC,GAAG,GAAG;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,8BAA8B;QAC/C,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,uOAAuO;QAC5O,IAAI,EAAE;YACJ,IAAI,CAAC,EAAE;YACP,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,cAAc;SACpB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,6DAA6D;QAClE,IAAI,EAAE,CAAC,SAAS,CAAC;KAClB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,kGAAkG;QACvG,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SQL-backed storage for standard remote MCP OAuth.\n *\n * Additive framework tables only. We store OAuth client registrations,\n * short-lived authorization codes, and hashed refresh tokens. Access tokens\n * are signed JWTs and are never persisted.\n */\n\nimport { getDbExec, isConnectionError, intType } from \"../db/client.js\";\nimport { randomBytes, randomUUID, createHash } from \"node:crypto\";\n\nlet _initPromise: Promise<void> | undefined;\n\nexport const MCP_OAUTH_CODE_TTL_MS = 10 * 60_000;\nexport const MCP_OAUTH_ACCESS_TOKEN_TTL = \"1h\";\nexport const MCP_OAUTH_REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60_000;\nexport const MCP_OAUTH_REGISTER_MAX = 60;\nexport const MCP_OAUTH_REGISTER_WINDOW_MS = 60_000;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_oauth_clients (\n          client_id TEXT PRIMARY KEY,\n          client_name TEXT,\n          redirect_uris TEXT NOT NULL,\n          grant_types TEXT,\n          response_types TEXT,\n          token_endpoint_auth_method TEXT,\n          created_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_oauth_codes (\n          code TEXT PRIMARY KEY,\n          client_id TEXT NOT NULL,\n          redirect_uri TEXT NOT NULL,\n          code_challenge TEXT NOT NULL,\n          code_challenge_method TEXT NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          org_domain TEXT,\n          scope TEXT NOT NULL,\n          resource TEXT NOT NULL,\n          created_at ${intType()},\n          expires_at ${intType()},\n          consumed_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_oauth_refresh_tokens (\n          id TEXT PRIMARY KEY,\n          token_hash TEXT UNIQUE NOT NULL,\n          client_id TEXT NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          org_domain TEXT,\n          scope TEXT NOT NULL,\n          resource TEXT NOT NULL,\n          created_at ${intType()},\n          expires_at ${intType()},\n          last_used_at ${intType()},\n          revoked_at ${intType()},\n          replaced_by_hash TEXT\n        )\n      `);\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport interface OAuthClientRow {\n  clientId: string;\n  clientName: string | null;\n  redirectUris: string[];\n  grantTypes: string[];\n  responseTypes: string[];\n  tokenEndpointAuthMethod: string;\n  createdAt: number | null;\n}\n\nexport interface OAuthCodeRow {\n  code: string;\n  clientId: string;\n  redirectUri: string;\n  codeChallenge: string;\n  codeChallengeMethod: string;\n  ownerEmail: string;\n  orgId: string | null;\n  orgDomain: string | null;\n  scope: string;\n  resource: string;\n  createdAt: number | null;\n  expiresAt: number | null;\n  consumedAt: number | null;\n}\n\nexport interface OAuthRefreshTokenRow {\n  id: string;\n  tokenHash: string;\n  clientId: string;\n  ownerEmail: string;\n  orgId: string | null;\n  orgDomain: string | null;\n  scope: string;\n  resource: string;\n  createdAt: number | null;\n  expiresAt: number | null;\n  lastUsedAt: number | null;\n  revokedAt: number | null;\n  replacedByHash: string | null;\n}\n\nexport function generateOpaqueToken(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\nexport function hashOAuthToken(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"base64url\");\n}\n\nfunction parseJsonStringArray(\n  value: unknown,\n  fallback: string[] = [],\n): string[] {\n  if (typeof value !== \"string\") return fallback;\n  try {\n    const parsed = JSON.parse(value);\n    return Array.isArray(parsed)\n      ? parsed.filter((item): item is string => typeof item === \"string\")\n      : fallback;\n  } catch {\n    return fallback;\n  }\n}\n\nfunction numOrNull(v: unknown): number | null {\n  if (v == null) return null;\n  const n = Number(v);\n  return Number.isFinite(n) ? n : null;\n}\n\nfunction mapClientRow(row: any): OAuthClientRow {\n  return {\n    clientId: row.client_id ?? row.clientId,\n    clientName: row.client_name ?? row.clientName ?? null,\n    redirectUris: parseJsonStringArray(row.redirect_uris ?? row.redirectUris),\n    grantTypes: parseJsonStringArray(row.grant_types ?? row.grantTypes, [\n      \"authorization_code\",\n      \"refresh_token\",\n    ]),\n    responseTypes: parseJsonStringArray(\n      row.response_types ?? row.responseTypes,\n      [\"code\"],\n    ),\n    tokenEndpointAuthMethod:\n      row.token_endpoint_auth_method ?? row.tokenEndpointAuthMethod ?? \"none\",\n    createdAt: numOrNull(row.created_at ?? row.createdAt),\n  };\n}\n\nfunction mapCodeRow(row: any): OAuthCodeRow {\n  return {\n    code: row.code,\n    clientId: row.client_id ?? row.clientId,\n    redirectUri: row.redirect_uri ?? row.redirectUri,\n    codeChallenge: row.code_challenge ?? row.codeChallenge,\n    codeChallengeMethod: row.code_challenge_method ?? row.codeChallengeMethod,\n    ownerEmail: row.owner_email ?? row.ownerEmail,\n    orgId: row.org_id ?? row.orgId ?? null,\n    orgDomain: row.org_domain ?? row.orgDomain ?? null,\n    scope: row.scope,\n    resource: row.resource,\n    createdAt: numOrNull(row.created_at ?? row.createdAt),\n    expiresAt: numOrNull(row.expires_at ?? row.expiresAt),\n    consumedAt: numOrNull(row.consumed_at ?? row.consumedAt),\n  };\n}\n\nfunction mapRefreshRow(row: any): OAuthRefreshTokenRow {\n  return {\n    id: row.id,\n    tokenHash: row.token_hash ?? row.tokenHash,\n    clientId: row.client_id ?? row.clientId,\n    ownerEmail: row.owner_email ?? row.ownerEmail,\n    orgId: row.org_id ?? row.orgId ?? null,\n    orgDomain: row.org_domain ?? row.orgDomain ?? null,\n    scope: row.scope,\n    resource: row.resource,\n    createdAt: numOrNull(row.created_at ?? row.createdAt),\n    expiresAt: numOrNull(row.expires_at ?? row.expiresAt),\n    lastUsedAt: numOrNull(row.last_used_at ?? row.lastUsedAt),\n    revokedAt: numOrNull(row.revoked_at ?? row.revokedAt),\n    replacedByHash: row.replaced_by_hash ?? row.replacedByHash ?? null,\n  };\n}\n\nexport async function registerOAuthClient(params: {\n  clientName?: string | null;\n  redirectUris: string[];\n  grantTypes?: string[];\n  responseTypes?: string[];\n  tokenEndpointAuthMethod?: string;\n}): Promise<OAuthClientRow> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT COUNT(*) AS n FROM mcp_oauth_clients WHERE created_at > ?`,\n      args: [now - MCP_OAUTH_REGISTER_WINDOW_MS],\n    });\n    const n = Number(rows[0]?.n ?? rows[0]?.[\"COUNT(*)\"] ?? 0);\n    if (Number.isFinite(n) && n >= MCP_OAUTH_REGISTER_MAX) {\n      throw new Error(\"RATE_LIMITED\");\n    }\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") throw err;\n    // Registration stays possible through transient count-read failures; the\n    // exact redirect URI allowlist remains the primary safety gate.\n  }\n  const clientId = `agent-native-oauth-client-${randomUUID()}`;\n  const grantTypes = params.grantTypes?.length\n    ? params.grantTypes\n    : [\"authorization_code\", \"refresh_token\"];\n  const responseTypes = params.responseTypes?.length\n    ? params.responseTypes\n    : [\"code\"];\n  const tokenEndpointAuthMethod = params.tokenEndpointAuthMethod || \"none\";\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_clients (client_id, client_name, redirect_uris, grant_types, response_types, token_endpoint_auth_method, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      clientId,\n      params.clientName ?? null,\n      JSON.stringify(params.redirectUris),\n      JSON.stringify(grantTypes),\n      JSON.stringify(responseTypes),\n      tokenEndpointAuthMethod,\n      now,\n    ],\n  });\n  return {\n    clientId,\n    clientName: params.clientName ?? null,\n    redirectUris: params.redirectUris,\n    grantTypes,\n    responseTypes,\n    tokenEndpointAuthMethod,\n    createdAt: now,\n  };\n}\n\nexport async function getOAuthClient(\n  clientId: string,\n): Promise<OAuthClientRow | null> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM mcp_oauth_clients WHERE client_id = ?`,\n      args: [clientId],\n    });\n    return rows.length ? mapClientRow(rows[0]) : null;\n  } catch (err) {\n    if (isConnectionError(err)) return null;\n    throw err;\n  }\n}\n\nexport async function createOAuthCode(params: {\n  clientId: string;\n  redirectUri: string;\n  codeChallenge: string;\n  codeChallengeMethod: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  scope: string;\n  resource: string;\n}): Promise<OAuthCodeRow> {\n  await ensureTable();\n  const client = getDbExec();\n  const code = generateOpaqueToken();\n  const now = Date.now();\n  const expiresAt = now + MCP_OAUTH_CODE_TTL_MS;\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_codes (code, client_id, redirect_uri, code_challenge, code_challenge_method, owner_email, org_id, org_domain, scope, resource, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      code,\n      params.clientId,\n      params.redirectUri,\n      params.codeChallenge,\n      params.codeChallengeMethod,\n      params.ownerEmail,\n      params.orgId ?? null,\n      params.orgDomain ?? null,\n      params.scope,\n      params.resource,\n      now,\n      expiresAt,\n      null,\n    ],\n  });\n  return {\n    code,\n    clientId: params.clientId,\n    redirectUri: params.redirectUri,\n    codeChallenge: params.codeChallenge,\n    codeChallengeMethod: params.codeChallengeMethod,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n    createdAt: now,\n    expiresAt,\n    consumedAt: null,\n  };\n}\n\nexport async function getOAuthCode(code: string): Promise<OAuthCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_codes WHERE code = ?`,\n    args: [code],\n  });\n  if (rows.length === 0) return null;\n  const row = mapCodeRow(rows[0]);\n  if (row.consumedAt != null || (row.expiresAt ?? 0) < Date.now()) {\n    return null;\n  }\n  return row;\n}\n\nexport async function consumeOAuthCode(\n  code: string,\n): Promise<OAuthCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_codes WHERE code = ?`,\n    args: [code],\n  });\n  if (rows.length === 0) return null;\n  const row = mapCodeRow(rows[0]);\n  if (row.consumedAt != null || (row.expiresAt ?? 0) < Date.now()) {\n    return null;\n  }\n  const result = await client.execute({\n    sql: `UPDATE mcp_oauth_codes SET consumed_at = ? WHERE code = ? AND consumed_at IS NULL`,\n    args: [Date.now(), code],\n  });\n  return result.rowsAffected > 0 ? row : null;\n}\n\nexport async function createOAuthRefreshToken(params: {\n  refreshToken: string;\n  clientId: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  scope: string;\n  resource: string;\n}): Promise<OAuthRefreshTokenRow> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const row: OAuthRefreshTokenRow = {\n    id: randomUUID(),\n    tokenHash: hashOAuthToken(params.refreshToken),\n    clientId: params.clientId,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n    createdAt: now,\n    expiresAt: now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS,\n    lastUsedAt: null,\n    revokedAt: null,\n    replacedByHash: null,\n  };\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_refresh_tokens (id, token_hash, client_id, owner_email, org_id, org_domain, scope, resource, created_at, expires_at, last_used_at, revoked_at, replaced_by_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      row.id,\n      row.tokenHash,\n      row.clientId,\n      row.ownerEmail,\n      row.orgId,\n      row.orgDomain,\n      row.scope,\n      row.resource,\n      row.createdAt,\n      row.expiresAt,\n      row.lastUsedAt,\n      row.revokedAt,\n      row.replacedByHash,\n    ],\n  });\n  return row;\n}\n\nexport async function rotateOAuthRefreshToken(params: {\n  oldRefreshToken: string;\n  newRefreshToken: string;\n}): Promise<OAuthRefreshTokenRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const oldHash = hashOAuthToken(params.oldRefreshToken);\n  const newHash = hashOAuthToken(params.newRefreshToken);\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_refresh_tokens WHERE token_hash = ?`,\n    args: [oldHash],\n  });\n  if (rows.length === 0) return null;\n  const old = mapRefreshRow(rows[0]);\n  if (old.revokedAt != null || (old.expiresAt ?? 0) < Date.now()) return null;\n\n  const now = Date.now();\n  const update = await client.execute({\n    sql: `UPDATE mcp_oauth_refresh_tokens SET revoked_at = ?, last_used_at = ?, replaced_by_hash = ? WHERE token_hash = ? AND revoked_at IS NULL`,\n    args: [now, now, newHash, oldHash],\n  });\n  if (update.rowsAffected === 0) return null;\n\n  const next: OAuthRefreshTokenRow = {\n    ...old,\n    id: randomUUID(),\n    tokenHash: newHash,\n    createdAt: now,\n    expiresAt: now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS,\n    lastUsedAt: null,\n    revokedAt: null,\n    replacedByHash: null,\n  };\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_refresh_tokens (id, token_hash, client_id, owner_email, org_id, org_domain, scope, resource, created_at, expires_at, last_used_at, revoked_at, replaced_by_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      next.id,\n      next.tokenHash,\n      next.clientId,\n      next.ownerEmail,\n      next.orgId,\n      next.orgDomain,\n      next.scope,\n      next.resource,\n      next.createdAt,\n      next.expiresAt,\n      next.lastUsedAt,\n      next.revokedAt,\n      next.replacedByHash,\n    ],\n  });\n  return next;\n}\n\nexport async function getOAuthRefreshToken(\n  refreshToken: string,\n): Promise<OAuthRefreshTokenRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const tokenHash = hashOAuthToken(refreshToken);\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_refresh_tokens WHERE token_hash = ?`,\n    args: [tokenHash],\n  });\n  if (rows.length === 0) return null;\n  const row = mapRefreshRow(rows[0]);\n  if (row.revokedAt != null || (row.expiresAt ?? 0) < Date.now()) {\n    return null;\n  }\n  return row;\n}\n\nexport async function touchOAuthRefreshToken(\n  refreshToken: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const tokenHash = hashOAuthToken(refreshToken);\n  await client.execute({\n    sql: `UPDATE mcp_oauth_refresh_tokens SET last_used_at = ? WHERE token_hash = ? AND revoked_at IS NULL`,\n    args: [Date.now(), tokenHash],\n  });\n}\n"]}
+{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../../src/mcp/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjD;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,GAAG;YACN,OAAO,KAAK,CAAC;QACf,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,IAAI,CAAC;QACtB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,gCAAgC,GAAG,EAAE,GAAG,KAAK,CAAC;AAEpD,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtD,sEAAsE;QACtE,OAAO,CAAC,IAAI,CACV,mDAAmD,GAAG,qBAAqB,wBAAwB,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,wBAAwB;QAC7B,OAAO,EAAE,gCAAgC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAW,eAAe,CAAC,GAAG,CAAC;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,eAAe,CAAC,OAAO,CAAC;AAE1B,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;uBAQJ,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;;;uBAYJ,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;uBAUJ,OAAO,EAAE;uBACT,OAAO,EAAE;yBACP,OAAO,EAAE;uBACX,OAAO,EAAE;;;OAGzB,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AA4CD,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc,EACd,WAAqB,EAAE;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YACnE,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ;IAC5B,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACvC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QACrD,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,YAAY,CAAC;QACzE,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,EAAE;YAClE,oBAAoB;YACpB,eAAe;SAChB,CAAC;QACF,aAAa,EAAE,oBAAoB,CACjC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa,EACvC,CAAC,MAAM,CAAC,CACT;QACD,uBAAuB,EACrB,GAAG,CAAC,0BAA0B,IAAI,GAAG,CAAC,uBAAuB,IAAI,MAAM;QACzE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACvC,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,WAAW;QAChD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,aAAa;QACtD,mBAAmB,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,mBAAmB;QACzE,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU;QAC7C,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;QAClD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC7B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS;QAC1C,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ;QACvC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU;QAC7C,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;QAClD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC;QACzD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;QACrD,cAAc,EAAE,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAMzC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,kEAAkE;YACvE,IAAI,EAAE,CAAC,GAAG,GAAG,4BAA4B,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,sBAAsB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc;YAAE,MAAM,GAAG,CAAC;QAC/C,yEAAyE;QACzE,gEAAgE;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,6BAA6B,UAAU,EAAE,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM;QAC1C,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,MAAM;QAChD,CAAC,CAAC,MAAM,CAAC,aAAa;QACtB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACb,MAAM,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC;IACzE,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,yKAAyK;QAC9K,IAAI,EAAE;YACJ,QAAQ;YACR,MAAM,CAAC,UAAU,IAAI,IAAI;YACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAC7B,uBAAuB;YACvB,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU;QACV,aAAa;QACb,uBAAuB;QACvB,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,qDAAqD;YAC1D,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAUrC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,GAAG,qBAAqB,CAAC;IAC9C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,0OAA0O;QAC/O,IAAI,EAAE;YACJ,IAAI;YACJ,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,MAAM,CAAC,SAAS,IAAI,IAAI;YACxB,MAAM,CAAC,KAAK;YACZ,MAAM,CAAC,QAAQ;YACf,GAAG;YACH,SAAS;YACT,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,GAAG;QACd,SAAS;QACT,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,8CAA8C;QACnD,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY;IAEZ,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,8CAA8C;QACnD,IAAI,EAAE,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,mFAAmF;QACxF,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC;KACzB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAQ7C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAyB;QAChC,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,8BAA8B;QAC/C,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,uOAAuO;QAC5O,IAAI,EAAE;YACJ,GAAG,CAAC,EAAE;YACN,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,UAAU;YACd,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,UAAU;YACd,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,cAAc;SACnB;KACF,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAG7C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,6DAA6D;QAClE,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,wIAAwI;QAC7I,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAyB;QACjC,GAAG,GAAG;QACN,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,8BAA8B;QAC/C,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,uOAAuO;QAC5O,IAAI,EAAE;YACJ,IAAI,CAAC,EAAE;YACP,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,cAAc;SACpB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,6DAA6D;QAClE,IAAI,EAAE,CAAC,SAAS,CAAC;KAClB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,YAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,kHAAkH;QACvH,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,8BAA8B,EAAE,SAAS,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SQL-backed storage for standard remote MCP OAuth.\n *\n * Additive framework tables only. We store OAuth client registrations,\n * short-lived authorization codes, and hashed refresh tokens. Access tokens\n * are signed JWTs and are never persisted.\n */\n\nimport { getDbExec, isConnectionError, intType } from \"../db/client.js\";\nimport { randomBytes, randomUUID, createHash } from \"node:crypto\";\n\nlet _initPromise: Promise<void> | undefined;\n\nexport const MCP_OAUTH_CODE_TTL_MS = 10 * 60_000;\n\n/**\n * Parse a duration string like \"30d\", \"1h\", \"7d\" into seconds.\n * Returns `null` when the input is not a valid recognised pattern.\n */\nfunction parseDurationSeconds(raw: string): number | null {\n  const trimmed = raw.trim();\n  const match = trimmed.match(/^(\\d+(?:\\.\\d+)?)\\s*([smhd])$/i);\n  if (!match) return null;\n  const value = parseFloat(match[1]);\n  if (!Number.isFinite(value) || value <= 0) return null;\n  switch (match[2].toLowerCase()) {\n    case \"s\":\n      return value;\n    case \"m\":\n      return value * 60;\n    case \"h\":\n      return value * 3600;\n    case \"d\":\n      return value * 86400;\n  }\n  return null;\n}\n\nconst DEFAULT_ACCESS_TOKEN_TTL = \"30d\";\nconst DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 30 * 86400;\n\nfunction resolveAccessTokenTtl(): { str: string; seconds: number } {\n  const env = process.env.MCP_OAUTH_ACCESS_TOKEN_TTL?.trim();\n  if (env) {\n    const secs = parseDurationSeconds(env);\n    if (secs !== null) return { str: env, seconds: secs };\n    // Garbage value — fall back to default rather than silently breaking.\n    console.warn(\n      `[mcp-oauth] Invalid MCP_OAUTH_ACCESS_TOKEN_TTL=\"${env}\", using default \"${DEFAULT_ACCESS_TOKEN_TTL}\"`,\n    );\n  }\n  return {\n    str: DEFAULT_ACCESS_TOKEN_TTL,\n    seconds: DEFAULT_ACCESS_TOKEN_TTL_SECONDS,\n  };\n}\n\nconst _accessTokenTtl = resolveAccessTokenTtl();\n\n/**\n * Access-token TTL as a jose-compatible duration string.\n * Defaults to \"30d\"; override with MCP_OAUTH_ACCESS_TOKEN_TTL env var.\n */\nexport const MCP_OAUTH_ACCESS_TOKEN_TTL: string = _accessTokenTtl.str;\n\n/**\n * Access-token TTL in seconds (derived from the same env var).\n * Used to populate the OAuth `expires_in` response field.\n */\nexport const MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS: number =\n  _accessTokenTtl.seconds;\n\nexport const MCP_OAUTH_REFRESH_TOKEN_TTL_MS = 365 * 24 * 60 * 60_000;\nexport const MCP_OAUTH_REGISTER_MAX = 60;\nexport const MCP_OAUTH_REGISTER_WINDOW_MS = 60_000;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_oauth_clients (\n          client_id TEXT PRIMARY KEY,\n          client_name TEXT,\n          redirect_uris TEXT NOT NULL,\n          grant_types TEXT,\n          response_types TEXT,\n          token_endpoint_auth_method TEXT,\n          created_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_oauth_codes (\n          code TEXT PRIMARY KEY,\n          client_id TEXT NOT NULL,\n          redirect_uri TEXT NOT NULL,\n          code_challenge TEXT NOT NULL,\n          code_challenge_method TEXT NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          org_domain TEXT,\n          scope TEXT NOT NULL,\n          resource TEXT NOT NULL,\n          created_at ${intType()},\n          expires_at ${intType()},\n          consumed_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS mcp_oauth_refresh_tokens (\n          id TEXT PRIMARY KEY,\n          token_hash TEXT UNIQUE NOT NULL,\n          client_id TEXT NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          org_domain TEXT,\n          scope TEXT NOT NULL,\n          resource TEXT NOT NULL,\n          created_at ${intType()},\n          expires_at ${intType()},\n          last_used_at ${intType()},\n          revoked_at ${intType()},\n          replaced_by_hash TEXT\n        )\n      `);\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport interface OAuthClientRow {\n  clientId: string;\n  clientName: string | null;\n  redirectUris: string[];\n  grantTypes: string[];\n  responseTypes: string[];\n  tokenEndpointAuthMethod: string;\n  createdAt: number | null;\n}\n\nexport interface OAuthCodeRow {\n  code: string;\n  clientId: string;\n  redirectUri: string;\n  codeChallenge: string;\n  codeChallengeMethod: string;\n  ownerEmail: string;\n  orgId: string | null;\n  orgDomain: string | null;\n  scope: string;\n  resource: string;\n  createdAt: number | null;\n  expiresAt: number | null;\n  consumedAt: number | null;\n}\n\nexport interface OAuthRefreshTokenRow {\n  id: string;\n  tokenHash: string;\n  clientId: string;\n  ownerEmail: string;\n  orgId: string | null;\n  orgDomain: string | null;\n  scope: string;\n  resource: string;\n  createdAt: number | null;\n  expiresAt: number | null;\n  lastUsedAt: number | null;\n  revokedAt: number | null;\n  replacedByHash: string | null;\n}\n\nexport function generateOpaqueToken(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\nexport function hashOAuthToken(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"base64url\");\n}\n\nfunction parseJsonStringArray(\n  value: unknown,\n  fallback: string[] = [],\n): string[] {\n  if (typeof value !== \"string\") return fallback;\n  try {\n    const parsed = JSON.parse(value);\n    return Array.isArray(parsed)\n      ? parsed.filter((item): item is string => typeof item === \"string\")\n      : fallback;\n  } catch {\n    return fallback;\n  }\n}\n\nfunction numOrNull(v: unknown): number | null {\n  if (v == null) return null;\n  const n = Number(v);\n  return Number.isFinite(n) ? n : null;\n}\n\nfunction mapClientRow(row: any): OAuthClientRow {\n  return {\n    clientId: row.client_id ?? row.clientId,\n    clientName: row.client_name ?? row.clientName ?? null,\n    redirectUris: parseJsonStringArray(row.redirect_uris ?? row.redirectUris),\n    grantTypes: parseJsonStringArray(row.grant_types ?? row.grantTypes, [\n      \"authorization_code\",\n      \"refresh_token\",\n    ]),\n    responseTypes: parseJsonStringArray(\n      row.response_types ?? row.responseTypes,\n      [\"code\"],\n    ),\n    tokenEndpointAuthMethod:\n      row.token_endpoint_auth_method ?? row.tokenEndpointAuthMethod ?? \"none\",\n    createdAt: numOrNull(row.created_at ?? row.createdAt),\n  };\n}\n\nfunction mapCodeRow(row: any): OAuthCodeRow {\n  return {\n    code: row.code,\n    clientId: row.client_id ?? row.clientId,\n    redirectUri: row.redirect_uri ?? row.redirectUri,\n    codeChallenge: row.code_challenge ?? row.codeChallenge,\n    codeChallengeMethod: row.code_challenge_method ?? row.codeChallengeMethod,\n    ownerEmail: row.owner_email ?? row.ownerEmail,\n    orgId: row.org_id ?? row.orgId ?? null,\n    orgDomain: row.org_domain ?? row.orgDomain ?? null,\n    scope: row.scope,\n    resource: row.resource,\n    createdAt: numOrNull(row.created_at ?? row.createdAt),\n    expiresAt: numOrNull(row.expires_at ?? row.expiresAt),\n    consumedAt: numOrNull(row.consumed_at ?? row.consumedAt),\n  };\n}\n\nfunction mapRefreshRow(row: any): OAuthRefreshTokenRow {\n  return {\n    id: row.id,\n    tokenHash: row.token_hash ?? row.tokenHash,\n    clientId: row.client_id ?? row.clientId,\n    ownerEmail: row.owner_email ?? row.ownerEmail,\n    orgId: row.org_id ?? row.orgId ?? null,\n    orgDomain: row.org_domain ?? row.orgDomain ?? null,\n    scope: row.scope,\n    resource: row.resource,\n    createdAt: numOrNull(row.created_at ?? row.createdAt),\n    expiresAt: numOrNull(row.expires_at ?? row.expiresAt),\n    lastUsedAt: numOrNull(row.last_used_at ?? row.lastUsedAt),\n    revokedAt: numOrNull(row.revoked_at ?? row.revokedAt),\n    replacedByHash: row.replaced_by_hash ?? row.replacedByHash ?? null,\n  };\n}\n\nexport async function registerOAuthClient(params: {\n  clientName?: string | null;\n  redirectUris: string[];\n  grantTypes?: string[];\n  responseTypes?: string[];\n  tokenEndpointAuthMethod?: string;\n}): Promise<OAuthClientRow> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT COUNT(*) AS n FROM mcp_oauth_clients WHERE created_at > ?`,\n      args: [now - MCP_OAUTH_REGISTER_WINDOW_MS],\n    });\n    const n = Number(rows[0]?.n ?? rows[0]?.[\"COUNT(*)\"] ?? 0);\n    if (Number.isFinite(n) && n >= MCP_OAUTH_REGISTER_MAX) {\n      throw new Error(\"RATE_LIMITED\");\n    }\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") throw err;\n    // Registration stays possible through transient count-read failures; the\n    // exact redirect URI allowlist remains the primary safety gate.\n  }\n  const clientId = `agent-native-oauth-client-${randomUUID()}`;\n  const grantTypes = params.grantTypes?.length\n    ? params.grantTypes\n    : [\"authorization_code\", \"refresh_token\"];\n  const responseTypes = params.responseTypes?.length\n    ? params.responseTypes\n    : [\"code\"];\n  const tokenEndpointAuthMethod = params.tokenEndpointAuthMethod || \"none\";\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_clients (client_id, client_name, redirect_uris, grant_types, response_types, token_endpoint_auth_method, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      clientId,\n      params.clientName ?? null,\n      JSON.stringify(params.redirectUris),\n      JSON.stringify(grantTypes),\n      JSON.stringify(responseTypes),\n      tokenEndpointAuthMethod,\n      now,\n    ],\n  });\n  return {\n    clientId,\n    clientName: params.clientName ?? null,\n    redirectUris: params.redirectUris,\n    grantTypes,\n    responseTypes,\n    tokenEndpointAuthMethod,\n    createdAt: now,\n  };\n}\n\nexport async function getOAuthClient(\n  clientId: string,\n): Promise<OAuthClientRow | null> {\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM mcp_oauth_clients WHERE client_id = ?`,\n      args: [clientId],\n    });\n    return rows.length ? mapClientRow(rows[0]) : null;\n  } catch (err) {\n    if (isConnectionError(err)) return null;\n    throw err;\n  }\n}\n\nexport async function createOAuthCode(params: {\n  clientId: string;\n  redirectUri: string;\n  codeChallenge: string;\n  codeChallengeMethod: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  scope: string;\n  resource: string;\n}): Promise<OAuthCodeRow> {\n  await ensureTable();\n  const client = getDbExec();\n  const code = generateOpaqueToken();\n  const now = Date.now();\n  const expiresAt = now + MCP_OAUTH_CODE_TTL_MS;\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_codes (code, client_id, redirect_uri, code_challenge, code_challenge_method, owner_email, org_id, org_domain, scope, resource, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      code,\n      params.clientId,\n      params.redirectUri,\n      params.codeChallenge,\n      params.codeChallengeMethod,\n      params.ownerEmail,\n      params.orgId ?? null,\n      params.orgDomain ?? null,\n      params.scope,\n      params.resource,\n      now,\n      expiresAt,\n      null,\n    ],\n  });\n  return {\n    code,\n    clientId: params.clientId,\n    redirectUri: params.redirectUri,\n    codeChallenge: params.codeChallenge,\n    codeChallengeMethod: params.codeChallengeMethod,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n    createdAt: now,\n    expiresAt,\n    consumedAt: null,\n  };\n}\n\nexport async function getOAuthCode(code: string): Promise<OAuthCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_codes WHERE code = ?`,\n    args: [code],\n  });\n  if (rows.length === 0) return null;\n  const row = mapCodeRow(rows[0]);\n  if (row.consumedAt != null || (row.expiresAt ?? 0) < Date.now()) {\n    return null;\n  }\n  return row;\n}\n\nexport async function consumeOAuthCode(\n  code: string,\n): Promise<OAuthCodeRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_codes WHERE code = ?`,\n    args: [code],\n  });\n  if (rows.length === 0) return null;\n  const row = mapCodeRow(rows[0]);\n  if (row.consumedAt != null || (row.expiresAt ?? 0) < Date.now()) {\n    return null;\n  }\n  const result = await client.execute({\n    sql: `UPDATE mcp_oauth_codes SET consumed_at = ? WHERE code = ? AND consumed_at IS NULL`,\n    args: [Date.now(), code],\n  });\n  return result.rowsAffected > 0 ? row : null;\n}\n\nexport async function createOAuthRefreshToken(params: {\n  refreshToken: string;\n  clientId: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  scope: string;\n  resource: string;\n}): Promise<OAuthRefreshTokenRow> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const row: OAuthRefreshTokenRow = {\n    id: randomUUID(),\n    tokenHash: hashOAuthToken(params.refreshToken),\n    clientId: params.clientId,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n    createdAt: now,\n    expiresAt: now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS,\n    lastUsedAt: null,\n    revokedAt: null,\n    replacedByHash: null,\n  };\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_refresh_tokens (id, token_hash, client_id, owner_email, org_id, org_domain, scope, resource, created_at, expires_at, last_used_at, revoked_at, replaced_by_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      row.id,\n      row.tokenHash,\n      row.clientId,\n      row.ownerEmail,\n      row.orgId,\n      row.orgDomain,\n      row.scope,\n      row.resource,\n      row.createdAt,\n      row.expiresAt,\n      row.lastUsedAt,\n      row.revokedAt,\n      row.replacedByHash,\n    ],\n  });\n  return row;\n}\n\nexport async function rotateOAuthRefreshToken(params: {\n  oldRefreshToken: string;\n  newRefreshToken: string;\n}): Promise<OAuthRefreshTokenRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const oldHash = hashOAuthToken(params.oldRefreshToken);\n  const newHash = hashOAuthToken(params.newRefreshToken);\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_refresh_tokens WHERE token_hash = ?`,\n    args: [oldHash],\n  });\n  if (rows.length === 0) return null;\n  const old = mapRefreshRow(rows[0]);\n  if (old.revokedAt != null || (old.expiresAt ?? 0) < Date.now()) return null;\n\n  const now = Date.now();\n  const update = await client.execute({\n    sql: `UPDATE mcp_oauth_refresh_tokens SET revoked_at = ?, last_used_at = ?, replaced_by_hash = ? WHERE token_hash = ? AND revoked_at IS NULL`,\n    args: [now, now, newHash, oldHash],\n  });\n  if (update.rowsAffected === 0) return null;\n\n  const next: OAuthRefreshTokenRow = {\n    ...old,\n    id: randomUUID(),\n    tokenHash: newHash,\n    createdAt: now,\n    expiresAt: now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS,\n    lastUsedAt: null,\n    revokedAt: null,\n    replacedByHash: null,\n  };\n  await client.execute({\n    sql: `INSERT INTO mcp_oauth_refresh_tokens (id, token_hash, client_id, owner_email, org_id, org_domain, scope, resource, created_at, expires_at, last_used_at, revoked_at, replaced_by_hash) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      next.id,\n      next.tokenHash,\n      next.clientId,\n      next.ownerEmail,\n      next.orgId,\n      next.orgDomain,\n      next.scope,\n      next.resource,\n      next.createdAt,\n      next.expiresAt,\n      next.lastUsedAt,\n      next.revokedAt,\n      next.replacedByHash,\n    ],\n  });\n  return next;\n}\n\nexport async function getOAuthRefreshToken(\n  refreshToken: string,\n): Promise<OAuthRefreshTokenRow | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const tokenHash = hashOAuthToken(refreshToken);\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM mcp_oauth_refresh_tokens WHERE token_hash = ?`,\n    args: [tokenHash],\n  });\n  if (rows.length === 0) return null;\n  const row = mapRefreshRow(rows[0]);\n  if (row.revokedAt != null || (row.expiresAt ?? 0) < Date.now()) {\n    return null;\n  }\n  return row;\n}\n\n/**\n * Slide the refresh-token's expiry window on each successful use so that active\n * users never hit the TTL. Records `last_used_at` and extends `expires_at` to\n * `now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS`.\n */\nexport async function touchOAuthRefreshToken(\n  refreshToken: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const tokenHash = hashOAuthToken(refreshToken);\n  const now = Date.now();\n  await client.execute({\n    sql: `UPDATE mcp_oauth_refresh_tokens SET last_used_at = ?, expires_at = ? WHERE token_hash = ? AND revoked_at IS NULL`,\n    args: [now, now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS, tokenHash],\n  });\n}\n"]}

package/dist/mcp/oauth-token.d.ts

@@ -1,3 +1,5 @@
+import { MCP_OAUTH_ACCESS_TOKEN_TTL, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS } from "./oauth-store.js";
+export { MCP_OAUTH_ACCESS_TOKEN_TTL, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS };
 export declare const MCP_OAUTH_SCOPES: readonly ["mcp:read", "mcp:write", "mcp:apps"];
 export declare const MCP_OAUTH_DEFAULT_SCOPE: string;
 export interface McpOAuthAccessTokenClaims {
@@ -31,7 +33,7 @@ export declare function signMcpOAuthAccessToken(params: {
      */
     catalogScope?: "full";
 }): Promise<string>;
-export declare function verifyMcpOAuthAccessToken(token: string, resource: string | undefined): Promise<{
+export declare function verifyMcpOAuthAccessToken(token: string, resource: string | string[] | undefined): Promise<{
     userEmail: string;
     orgId?: string;
     orgDomain?: string;

package/dist/mcp/oauth-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-token.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-token.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,gBAAgB,gDAAiD,CAAC;AAE/E,eAAO,MAAM,uBAAuB,QAA6B,CAAC;AAElE,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,wBAAwB,CAAC;CAC/B;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYjE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAK7D;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAC5B,KAAK,EAAE,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,GACvC,OAAO,CAGT;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,IAAI,CAAC,CA8BR"}
+{"version":3,"file":"oauth-token.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-token.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EACnC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,CAAC;AAE1E,eAAO,MAAM,gBAAgB,gDAAiD,CAAC;AAE/E,eAAO,MAAM,uBAAuB,QAA6B,CAAC;AAElE,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,wBAAwB,CAAC;CAC/B;AAwBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYjE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAK7D;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAC5B,KAAK,EAAE,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,GACvC,OAAO,CAGT;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAgCD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACtC,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;4EACwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,IAAI,CAAC,CA8DR"}