@agent-native/core 0.98.17 → 0.99.1

package/dist/mcp/oauth-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-route.js","sourceRoot":"","sources":["../../src/mcp/oauth-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAO1B,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,WAAmB,EACnB,MAAM,GAAG,GAAG;IAEZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,iBAAiB,CACtB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB;IAC9B,KAAK,MAAM,GAAG,IAAI;QAChB,wBAAwB;QACxB,6BAA6B;QAC7B,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9D,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,uBAAuB,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,GAAG,QAAQ,oBAAoB,CAAC;IACzC,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,uCAAuC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,QAAQ,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,OAAO,QAAQ;QACb,CAAC,CAAC,6BAA6B,QAAQ,aAAa,KAAK,GAAG;QAC5D,CAAC,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,oCAAoC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,cAAc,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,QAAQ;QACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,gBAAgB;QAClC,sBAAsB,EAAE,MAAM;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,cAAc,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,MAAM;QACN,sBAAsB,EAAE,SAAS;QACjC,cAAc,EAAE,KAAK;QACrB,qBAAqB,EAAE,QAAQ;QAC/B,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,gBAAgB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,sBAAsB;AACtB,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,gEAAgE;AAChE,SAAS,0BAA0B,CAAC,QAAgB;IAClD,IAAI,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,8EAA8E;IAC9E,4EAA4E;IAC5E,2CAA2C;IAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,WAAW;gBAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;gBAC5B,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,GAAG,CAAC,QAAQ,KAAK,OAAO,CACzB,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAG5D,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,IACE,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,EAAE;QACxB,CAAC,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,UAAU,CACf,yBAAyB,EACzB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,IACE,UAAU,CAAC,MAAM;QACjB,CAAC,UAAU,CAAC,KAAK,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,eAAe,CAC3D,EACD,CAAC;QACD,OAAO,UAAU,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,0BAA0B,KAAK,QAAQ;QACjD,CAAC,CAAC,IAAI,CAAC,0BAA0B;QACjC,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,UAAU,CACf,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACjC,UAAU;YACV,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YACxC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACtD,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,uBAAuB,EAAE,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,WAAW,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CACT;QACE,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QACxE,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;QAC3C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;KAC3D,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAK/B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,MAI7B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAIzB;IACC,OAAO,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAOvB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,MAAM;QACT,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAOzB;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CACzB,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAyB,EACzB,QAOC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,eAAe,CACjC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,CACL,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC3C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC/C,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAChC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG;;;;;;;;;sDASwB,CAAC;AAEvD,SAAS,iBAAiB,CAAC,MAM1B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;SACzC,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,8BAA8B,UAAU,CAAC,GAAG,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CACjF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;;;;;mBAKU,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;SACpC,qBAAqB;;;;;;;kBAOZ,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;OACxC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAoC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACrF,MAAM;;MAER,MAAM;;;;;;;;QAQJ,CAAC;AACT,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,oFAAoF;AACpF,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,MAI7B;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACzD,MAAM,YAAY,GAAG,cAAc,IAAI,YAAY,CAAC;IACpD,MAAM,SAAS,GAAG,cAAc;QAC9B,CAAC,CAAC,QAAQ,UAAU,CAAC,cAAc,CAAC,EAAE;QACtC,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO;;;;;;SAMA,qBAAqB;;;;;;;;;;;;;;;;OAgBvB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,UAAU,CAAC,YAAY,CAAC,uBAAuB,UAAU,CAAC,YAAY,CAAC;;oDAEvE,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS;;;;;;;;;;;;;QAaxF,CAAC;AACT,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC7C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc,EACd,OAA6B;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,UAAU,CACf,iBAAiB,EACjB,sCAAsC,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,sBAAsB,CAAC;gBAC5B,WAAW;gBACX,KAAK;gBACL,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,SAAS;YACd,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YACtB,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,CACT,iBAAiB,CAAC;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc;YAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;YAChD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE;gBACN,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,QAAQ;gBACR,KAAK;gBACL,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,qBAAqB,EAAE,MAAM;gBAC7B,aAAa,EAAE,gBAAgB,CAAC;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ;oBACR,WAAW;oBACX,QAAQ;oBACR,KAAK;oBACL,aAAa,EAAE,MAAM,CAAC,cAAc;iBACrC,CAAC;aACH;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IACE,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,cAAc;KACrC,CAAC,EACF,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,mBAAmB,EAAE,MAAM;QAC3B,UAAU,EAAE,OAAO,CAAC,KAAK;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,kFAAkF;IAClF,gFAAgF;IAChF,+EAA+E;IAC/E,kFAAkF;IAClF,uCAAuC;IACvC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QAC/C,kBAAkB;YAChB,QAAQ,KAAK,OAAO;gBACpB,QAAQ,KAAK,QAAQ;gBACrB,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB,GAAG,KAAK,CAAC;IAC7B,CAAC;IACD,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,IAAI,CACT,oBAAoB,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc;YAC3D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACrC,WAAW,EAAE,oBAAoB,CAAC;gBAChC,WAAW;gBACX,KAAK;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAQ5B;IACC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,kCAAkC;QAC9C,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAc,EACd,IAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CACT,MAAM,aAAa,CAAC;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ;QACR,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;KACP,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,IAA4B;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,UAAU,CACf,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;QACV,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,kCAAkC;QAC9C,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,eAAe;YAClB,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C;YACE,OAAO,UAAU,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAc,EACd,OAAe,EACf,OAAO,GAAyB,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,UAAU,CACf,cAAc,EACd,GAAG,EAAE,OAAO,IAAI,sBAAsB,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Standard remote MCP OAuth 2.1 endpoints.\n *\n * These routes let MCP hosts such as Claude Code and ChatGPT authenticate\n * through their native remote-MCP OAuth flow instead of pasting bearer tokens.\n * The issued access tokens are audience-bound to `/_agent-native/mcp`, carry\n * the same user/org identity as the existing connect flow, and are mediated by\n * `verifyAuth` before any MCP tool/resource request runs.\n */\n\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n\nimport type { H3Event } from \"h3\";\nimport { getHeader, getMethod, getQuery, setResponseStatus } from \"h3\";\n\nimport { getOrgDomain } from \"../org/context.js\";\nimport { getConfiguredLoginHtml, getSession } from \"../server/auth.js\";\nimport { getAuthSecret } from \"../server/better-auth-instance.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  createOAuthCode,\n  createOAuthRefreshToken,\n  consumeOAuthCode,\n  generateOpaqueToken,\n  getOAuthClient,\n  getOAuthCode,\n  getOAuthRefreshToken,\n  registerOAuthClient,\n  touchOAuthRefreshToken,\n} from \"./oauth-store.js\";\nimport {\n  MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n  MCP_OAUTH_DEFAULT_SCOPE,\n  MCP_OAUTH_SCOPES,\n  normalizeOAuthScope,\n  signMcpOAuthAccessToken,\n} from \"./oauth-token.js\";\n\nexport interface McpOAuthRouteOptions {\n  appId?: string;\n  appName?: string;\n}\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json\",\n      \"Cache-Control\": \"no-store\",\n      Pragma: \"no-cache\",\n    },\n  });\n}\n\nfunction html(body: string, status = 200): Response {\n  return new Response(body, {\n    status,\n    headers: {\n      \"Content-Type\": \"text/html; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n    },\n  });\n}\n\nfunction redirect(location: string): Response {\n  return new Response(null, {\n    status: 302,\n    headers: { Location: location, \"Cache-Control\": \"no-store\" },\n  });\n}\n\nfunction isSameOriginPost(event: H3Event): boolean {\n  const origin = getHeader(event, \"origin\");\n  if (!origin) return true;\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return false;\n  try {\n    return new URL(origin).origin === new URL(issuer).origin;\n  } catch {\n    return false;\n  }\n}\n\nfunction oauthError(\n  error: string,\n  description: string,\n  status = 400,\n): Response {\n  return json({ error, error_description: description }, status);\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nfunction normalizeBasePath(raw: string | undefined): string {\n  const trimmed = (raw ?? \"\").trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const withSlash = trimmed.startsWith(\"/\") ? trimmed : `/${trimmed}`;\n  return withSlash.replace(/\\/+$/, \"\");\n}\n\nfunction configuredBasePath(): string {\n  return normalizeBasePath(\n    process.env.APP_BASE_PATH || process.env.VITE_APP_BASE_PATH,\n  );\n}\n\nfunction stripTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction configuredPublicBaseUrl(): string | undefined {\n  for (const key of [\n    \"WORKSPACE_OAUTH_ORIGIN\",\n    \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n    \"APP_URL\",\n    \"VITE_APP_URL\",\n    \"BETTER_AUTH_URL\",\n    \"VITE_BETTER_AUTH_URL\",\n  ]) {\n    const raw = process.env[key]?.trim();\n    if (!raw) continue;\n    try {\n      const url = new URL(raw);\n      url.search = \"\";\n      url.hash = \"\";\n      return stripTrailingSlash(`${url.origin}${url.pathname}`);\n    } catch {\n      // Ignore invalid operator-provided URL values and fall back to headers.\n    }\n  }\n  return undefined;\n}\n\nfunction appendConfiguredBasePath(baseUrl: string): string {\n  const basePath = configuredBasePath();\n  if (!basePath) return stripTrailingSlash(baseUrl);\n  try {\n    const url = new URL(baseUrl);\n    const pathname = normalizeBasePath(url.pathname);\n    if (pathname === basePath || pathname.endsWith(`${basePath}`)) {\n      return stripTrailingSlash(`${url.origin}${pathname}`);\n    }\n    return stripTrailingSlash(`${url.origin}${pathname}${basePath}`);\n  } catch {\n    return `${stripTrailingSlash(baseUrl)}${basePath}`;\n  }\n}\n\nfunction deriveOrigin(event: H3Event): string {\n  const forwardedProto = getHeader(event, \"x-forwarded-proto\");\n  const host = getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1|\\[::1\\])(:|$)/.test(host)\n      ? \"http\"\n      : \"https\");\n  return host ? `${proto}://${host}` : \"\";\n}\n\nexport function getMcpOAuthIssuer(event: H3Event): string | undefined {\n  const baseUrl = configuredPublicBaseUrl() || deriveOrigin(event);\n  if (!baseUrl) return undefined;\n  return appendConfiguredBasePath(baseUrl);\n}\n\nexport function getMcpOAuthResource(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/_agent-native/mcp`;\n}\n\n/**\n * All plausible MCP OAuth resource audiences for the given request, deduped.\n *\n * When a configured public base URL differs from the request-derived origin\n * (e.g. during Netlify deploy-preview or behind a reverse proxy), a token\n * minted against the configured URL must still verify against the request-\n * derived URL and vice-versa.  Returns both so `verifyMcpOAuthAccessToken`\n * accepts either without issuing a 401.\n */\nexport function getMcpOAuthAudiences(event: H3Event): string[] {\n  const derived = getMcpOAuthResource(event);\n  const configured = (() => {\n    const base = configuredPublicBaseUrl();\n    if (!base) return undefined;\n    // Re-apply base path if present so the configured resource is also\n    // base-path-aware, consistent with how getMcpOAuthResource computes it.\n    const withPath = appendConfiguredBasePath(base);\n    return `${withPath}/_agent-native/mcp`;\n  })();\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const r of [derived, configured]) {\n    const n = r?.replace(/\\/+$/, \"\");\n    if (n && !seen.has(n)) {\n      seen.add(n);\n      out.push(n);\n    }\n  }\n  return out;\n}\n\nexport function getMcpOAuthProtectedResourceMetadataUrl(\n  event: H3Event,\n): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/.well-known/oauth-protected-resource`;\n}\n\nexport function buildMcpOAuthChallenge(event: H3Event): string {\n  const metadata = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const scope = MCP_OAUTH_DEFAULT_SCOPE;\n  return metadata\n    ? `Bearer resource_metadata=\"${metadata}\", scope=\"${scope}\"`\n    : `Bearer scope=\"${scope}\"`;\n}\n\nfunction authorizationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/authorize` : undefined;\n}\n\nfunction tokenEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/token` : undefined;\n}\n\nfunction registrationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}/_agent-native/mcp/oauth/register` : undefined;\n}\n\nexport function handleMcpOAuthProtectedResourceMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const resource = getMcpOAuthResource(event);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!resource || !issuer) {\n    return oauthError(\"server_error\", \"Unable to derive MCP resource\", 500);\n  }\n  return json({\n    resource,\n    authorization_servers: [issuer],\n    scopes_supported: MCP_OAUTH_SCOPES,\n    resource_documentation: issuer,\n  });\n}\n\nexport function handleMcpOAuthAuthorizationServerMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const issuer = getMcpOAuthIssuer(event);\n  const authorize = authorizationEndpoint(event);\n  const token = tokenEndpoint(event);\n  const register = registrationEndpoint(event);\n  if (!issuer || !authorize || !token || !register) {\n    return oauthError(\"server_error\", \"Unable to derive OAuth endpoints\", 500);\n  }\n  return json({\n    issuer,\n    authorization_endpoint: authorize,\n    token_endpoint: token,\n    registration_endpoint: register,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: MCP_OAUTH_SCOPES,\n  });\n}\n\n// Schemes that must never be accepted as a redirect target: they can execute\n// script or read local resources if a redirect is ever rendered in a browser\n// or webview context.\nconst DISALLOWED_REDIRECT_SCHEMES = new Set([\n  \"javascript:\",\n  \"data:\",\n  \"vbscript:\",\n  \"file:\",\n  \"blob:\",\n  \"about:\",\n]);\n\n// Native/desktop IDE clients (Cursor, VS Code, …) register a private-use URI\n// scheme callback such as `cursor://` or `vscode://` (RFC 8252 §7.1) instead of\n// an https/loopback URL. The authorization code is bound by PKCE (S256), so\n// delivering it through a client-registered app scheme is safe.\nfunction isPrivateUseRedirectScheme(protocol: string): boolean {\n  if (DISALLOWED_REDIRECT_SCHEMES.has(protocol)) return false;\n  // RFC 3986 scheme grammar: ALPHA *( ALPHA / DIGIT / \"+\" / \"-\" / \".\" ), with a\n  // trailing \":\" from URL.protocol. Require a non-http(s) custom scheme here;\n  // http/https are handled explicitly above.\n  return /^[a-z][a-z0-9+.-]*:$/.test(protocol);\n}\n\nfunction isAllowedRedirectUri(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length > 2048) return false;\n  try {\n    const url = new URL(value);\n    if (url.hash) return false;\n    if (url.username || url.password) return false;\n    if (url.protocol === \"https:\") return true;\n    if (url.protocol === \"http:\") {\n      return (\n        url.hostname === \"localhost\" ||\n        url.hostname === \"127.0.0.1\" ||\n        url.hostname === \"::1\" ||\n        url.hostname === \"[::1]\"\n      );\n    }\n    return isPrivateUseRedirectScheme(url.protocol);\n  } catch {\n    return false;\n  }\n}\n\nfunction parseStringArray(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === \"string\")\n    : [];\n}\n\nasync function handleRegister(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = ((await readBody(event).catch(() => ({}))) ?? {}) as Record<\n    string,\n    unknown\n  >;\n  const redirectUris = parseStringArray(body.redirect_uris);\n  if (\n    redirectUris.length === 0 ||\n    redirectUris.length > 20 ||\n    !redirectUris.every(isAllowedRedirectUri)\n  ) {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"redirect_uris must contain valid HTTPS or localhost callback URLs\",\n    );\n  }\n\n  const grantTypes = parseStringArray(body.grant_types);\n  if (\n    grantTypes.length &&\n    !grantTypes.every(\n      (g) => g === \"authorization_code\" || g === \"refresh_token\",\n    )\n  ) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported grant_type\");\n  }\n  const responseTypes = parseStringArray(body.response_types);\n  if (responseTypes.length && !responseTypes.every((r) => r === \"code\")) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported response_type\");\n  }\n  const method =\n    typeof body.token_endpoint_auth_method === \"string\"\n      ? body.token_endpoint_auth_method\n      : \"none\";\n  if (method !== \"none\") {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"Only public OAuth clients are supported\",\n    );\n  }\n\n  const clientName =\n    typeof body.client_name === \"string\"\n      ? body.client_name.trim().slice(0, 120)\n      : null;\n  let client;\n  try {\n    client = await registerOAuthClient({\n      clientName,\n      redirectUris: [...new Set(redirectUris)],\n      grantTypes: grantTypes.length ? grantTypes : undefined,\n      responseTypes: responseTypes.length ? responseTypes : undefined,\n      tokenEndpointAuthMethod: method,\n    });\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") {\n      return oauthError(\"slow_down\", \"Too many client registrations\", 429);\n    }\n    throw err;\n  }\n  return json(\n    {\n      client_id: client.clientId,\n      client_id_issued_at: Math.floor((client.createdAt ?? Date.now()) / 1000),\n      client_name: client.clientName ?? undefined,\n      redirect_uris: client.redirectUris,\n      grant_types: client.grantTypes,\n      response_types: client.responseTypes,\n      token_endpoint_auth_method: client.tokenEndpointAuthMethod,\n    },\n    201,\n  );\n}\n\nfunction redirectWithOAuthError(params: {\n  redirectUri: string;\n  state?: string;\n  error: string;\n  description?: string;\n}): Response {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"error\", params.error);\n  if (params.description) {\n    url.searchParams.set(\"error_description\", params.description);\n  }\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return redirect(url.toString());\n}\n\nfunction buildCodeRedirectUrl(params: {\n  redirectUri: string;\n  code: string;\n  state?: string;\n}): string {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"code\", params.code);\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return url.toString();\n}\n\nfunction redirectWithCode(params: {\n  redirectUri: string;\n  code: string;\n  state?: string;\n}): Response {\n  return redirect(buildCodeRedirectUrl(params));\n}\n\nfunction codeChallengeForVerifier(verifier: string): string {\n  return createHash(\"sha256\").update(verifier).digest(\"base64url\");\n}\n\nfunction safeEqual(a: string, b: string): boolean {\n  const aa = Buffer.from(a);\n  const bb = Buffer.from(b);\n  return aa.length === bb.length && timingSafeEqual(aa, bb);\n}\n\nfunction base64UrlEncode(value: Buffer | string): string {\n  const buf = typeof value === \"string\" ? Buffer.from(value, \"utf8\") : value;\n  return buf.toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): Buffer {\n  return Buffer.from(value, \"base64url\");\n}\n\nfunction consentSigningKey(): string {\n  return process.env.A2A_SECRET?.trim() || getAuthSecret();\n}\n\nfunction consentPayload(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  return JSON.stringify({\n    ...params,\n    exp: Math.floor(Date.now() / 1000) + 10 * 60,\n  });\n}\n\nfunction signConsentToken(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  const payload = base64UrlEncode(consentPayload(params));\n  const sig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  return `${payload}.${sig}`;\n}\n\nfunction verifyConsentToken(\n  token: string | undefined,\n  expected: {\n    email: string;\n    clientId: string;\n    redirectUri: string;\n    resource: string;\n    scope: string;\n    codeChallenge: string;\n  },\n): boolean {\n  if (!token || !token.includes(\".\")) return false;\n  const [payload, sig] = token.split(\".\", 2);\n  if (!payload || !sig) return false;\n  const expectedSig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  if (!safeEqual(sig, expectedSig)) return false;\n  try {\n    const parsed = JSON.parse(base64UrlDecode(payload).toString(\"utf8\"));\n    return (\n      parsed.email === expected.email &&\n      parsed.clientId === expected.clientId &&\n      parsed.redirectUri === expected.redirectUri &&\n      parsed.resource === expected.resource &&\n      parsed.scope === expected.scope &&\n      parsed.codeChallenge === expected.codeChallenge &&\n      typeof parsed.exp === \"number\" &&\n      parsed.exp * 1000 >= Date.now()\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isValidCodeVerifier(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 43 &&\n    value.length <= 128 &&\n    /^[A-Za-z0-9._~-]+$/.test(value)\n  );\n}\n\n// Shared styling for the browser-facing OAuth pages (consent + post-authorize\n// confirmation) so they read as one coherent dark surface.\nconst OAUTH_PAGE_BASE_STYLE = `\n  :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: #09090b; color: #f4f4f5; }\n  body { min-height: 100vh; display: grid; place-items: center; margin: 0; padding: 24px; }\n  main { width: min(520px, 100%); border: 1px solid #27272a; border-radius: 8px; background: #111113; padding: 24px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }\n  h1 { font-size: 22px; line-height: 1.2; margin: 0 0 10px; }\n  p { color: #a1a1aa; line-height: 1.5; margin: 0 0 18px; }\n  .actions { display: flex; gap: 10px; justify-content: flex-end; }\n  button, .btn { border: 0; border-radius: 6px; padding: 10px 14px; font: inherit; font-weight: 650; cursor: pointer; text-decoration: none; display: inline-block; }\n  .primary { background: #f4f4f5; color: #09090b; }\n  .secondary { background: #27272a; color: #f4f4f5; }`;\n\nfunction renderConsentPage(params: {\n  appName: string;\n  email: string;\n  clientName: string;\n  scopes: string[];\n  fields: Record<string, string>;\n}): string {\n  const hidden = Object.entries(params.fields)\n    .map(\n      ([key, value]) =>\n        `<input type=\"hidden\" name=\"${escapeHtml(key)}\" value=\"${escapeHtml(value)}\">`,\n    )\n    .join(\"\\n\");\n  const scopes = params.scopes\n    .map((scope) => `<li><code>${escapeHtml(scope)}</code></li>`)\n    .join(\"\");\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize ${escapeHtml(params.appName)}</title>\n<style>${OAUTH_PAGE_BASE_STYLE}\n  ul { margin: 0 0 22px; padding-left: 22px; color: #d4d4d8; }\n  code { color: #67e8f9; }\n</style>\n</head>\n<body>\n<main>\n  <h1>Authorize ${escapeHtml(params.clientName)}</h1>\n  <p>${escapeHtml(params.appName)} will let this MCP client act as ${escapeHtml(params.email)} for these scopes:</p>\n  <ul>${scopes}</ul>\n  <form method=\"post\">\n    ${hidden}\n    <div class=\"actions\">\n      <button class=\"secondary\" type=\"submit\" name=\"decision\" value=\"deny\">Deny</button>\n      <button class=\"primary\" type=\"submit\" name=\"decision\" value=\"approve\">Authorize</button>\n    </div>\n  </form>\n</main>\n</body>\n</html>`;\n}\n\n// Shown after the user approves a native/desktop client (cursor://, vscode://, …)\n// whose redirect is a private-use scheme. A bare 302 to a custom scheme hands the\n// code to the OS app but leaves the browser tab dangling on a blank/error page, so\n// we render a friendly confirmation that also re-fires the deep link (so the client\n// still receives the code) and tells the user they can return to their agent.\nfunction renderAuthorizedPage(params: {\n  appName: string;\n  clientName: string | null;\n  redirectUrl: string;\n}): string {\n  const friendlyClient = params.clientName?.trim() || null;\n  const returnTarget = friendlyClient ?? \"your agent\";\n  const openLabel = friendlyClient\n    ? `Open ${escapeHtml(friendlyClient)}`\n    : \"Return to your agent\";\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorized</title>\n<style>${OAUTH_PAGE_BASE_STYLE}\n  main.success { text-align: center; }\n  .check { width: 56px; height: 56px; margin: 4px auto 16px; display: grid; place-items: center; border-radius: 999px; background: rgba(34,197,94,.12); }\n  .check svg { width: 30px; height: 30px; }\n  .success .actions { justify-content: center; margin-top: 4px; }\n  .hint { color: #71717a; font-size: 13px; margin: 18px 0 0; }\n</style>\n</head>\n<body>\n<main class=\"success\">\n  <div class=\"check\">\n    <svg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <path d=\"M20 6 9 17l-5-5\"></path>\n    </svg>\n  </div>\n  <h1>You're all set</h1>\n  <p>${escapeHtml(params.appName)} has authorized ${escapeHtml(returnTarget)}. You can return to ${escapeHtml(returnTarget)} to continue.</p>\n  <div class=\"actions\">\n    <a class=\"btn primary\" id=\"return-link\" href=\"${escapeHtml(params.redirectUrl)}\">${openLabel}</a>\n  </div>\n  <p class=\"hint\">You can close this tab.</p>\n</main>\n<script>\n  (function () {\n    var link = document.getElementById(\"return-link\");\n    if (link && link.href) {\n      try { window.location.href = link.href; } catch (e) {}\n    }\n  })();\n</script>\n</body>\n</html>`;\n}\n\nasync function resolveOrgDomain(\n  orgId: string | undefined,\n): Promise<string | undefined> {\n  if (!orgId) return undefined;\n  try {\n    return (await getOrgDomain(orgId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function readOAuthParams(\n  event: H3Event,\n): Promise<Record<string, string>> {\n  if (getMethod(event) === \"GET\") {\n    const query = getQuery(event);\n    return Object.fromEntries(\n      Object.entries(query).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  const body = await readBody(event).catch(() => ({}));\n  if (typeof body === \"string\") {\n    return Object.fromEntries(new URLSearchParams(body));\n  }\n  if (body && typeof body === \"object\") {\n    return Object.fromEntries(\n      Object.entries(body as Record<string, unknown>).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  return {};\n}\n\nasync function handleAuthorize(\n  event: H3Event,\n  options: McpOAuthRouteOptions,\n): Promise<Response> {\n  const method = getMethod(event);\n  if (method !== \"GET\" && method !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  if (method === \"POST\" && !isSameOriginPost(event)) {\n    return oauthError(\n      \"invalid_request\",\n      \"Cross-origin authorize POST rejected\",\n      403,\n    );\n  }\n  const params = await readOAuthParams(event);\n  const state = params.state;\n  const clientId = params.client_id;\n  const redirectUri = params.redirect_uri;\n  const resource = params.resource || getMcpOAuthResource(event);\n  const expectedResource = getMcpOAuthResource(event);\n\n  if (params.response_type !== \"code\") {\n    return oauthError(\n      \"unsupported_response_type\",\n      \"response_type must be code\",\n    );\n  }\n  if (!clientId || !redirectUri || !resource || resource !== expectedResource) {\n    return oauthError(\"invalid_request\", \"Invalid OAuth authorization request\");\n  }\n  if (params.code_challenge_method !== \"S256\" || !params.code_challenge) {\n    return oauthError(\"invalid_request\", \"PKCE S256 is required\");\n  }\n\n  const client = await getOAuthClient(clientId);\n  if (!client || !client.redirectUris.includes(redirectUri)) {\n    return oauthError(\"invalid_client\", \"Unknown client or redirect_uri\");\n  }\n\n  const session = await getSession(event);\n  if (!session?.email) {\n    if (params.prompt === \"none\") {\n      return redirectWithOAuthError({\n        redirectUri,\n        state,\n        error: \"login_required\",\n      });\n    }\n    const loginHtml = getConfiguredLoginHtml(event);\n    return loginHtml\n      ? html(loginHtml, 200)\n      : oauthError(\"login_required\", \"Sign in required\", 401);\n  }\n\n  const scope = normalizeOAuthScope(params.scope);\n  if (!scope) {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"invalid_scope\",\n    });\n  }\n  if (method === \"GET\") {\n    return html(\n      renderConsentPage({\n        appName: options.appName || options.appId || \"Agent Native\",\n        email: session.email,\n        clientName: client.clientName || client.clientId,\n        scopes: scope.split(/\\s+/),\n        fields: {\n          response_type: \"code\",\n          client_id: clientId,\n          redirect_uri: redirectUri,\n          resource,\n          scope,\n          state: state ?? \"\",\n          code_challenge: params.code_challenge,\n          code_challenge_method: \"S256\",\n          consent_token: signConsentToken({\n            email: session.email,\n            clientId,\n            redirectUri,\n            resource,\n            scope,\n            codeChallenge: params.code_challenge,\n          }),\n        },\n      }),\n    );\n  }\n\n  if (\n    !verifyConsentToken(params.consent_token, {\n      email: session.email,\n      clientId,\n      redirectUri,\n      resource,\n      scope,\n      codeChallenge: params.code_challenge,\n    })\n  ) {\n    return oauthError(\"invalid_request\", \"Invalid authorization consent token\");\n  }\n\n  if (params.decision !== \"approve\") {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"access_denied\",\n    });\n  }\n\n  const orgDomain = await resolveOrgDomain(session.orgId);\n  const code = await createOAuthCode({\n    clientId,\n    redirectUri,\n    codeChallenge: params.code_challenge,\n    codeChallengeMethod: \"S256\",\n    ownerEmail: session.email,\n    orgId: session.orgId ?? null,\n    orgDomain: orgDomain ?? null,\n    scope,\n    resource,\n  });\n\n  // Native/desktop clients register a private-use scheme (cursor://, vscode://, …).\n  // A 302 to that scheme opens the app but leaves the browser tab dangling, so we\n  // render a friendly confirmation page that re-fires the deep link instead. For\n  // https/loopback callbacks the client (or its local server) renders its own page,\n  // so keep the standard redirect there.\n  let isDeepLinkRedirect = false;\n  try {\n    const protocol = new URL(redirectUri).protocol;\n    isDeepLinkRedirect =\n      protocol !== \"http:\" &&\n      protocol !== \"https:\" &&\n      isPrivateUseRedirectScheme(protocol);\n  } catch {\n    isDeepLinkRedirect = false;\n  }\n  if (isDeepLinkRedirect) {\n    return html(\n      renderAuthorizedPage({\n        appName: options.appName || options.appId || \"Agent Native\",\n        clientName: client.clientName ?? null,\n        redirectUrl: buildCodeRedirectUrl({\n          redirectUri,\n          state,\n          code: code.code,\n        }),\n      }),\n    );\n  }\n  return redirectWithCode({ redirectUri, state, code: code.code });\n}\n\nasync function issueTokenSet(params: {\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  clientId: string;\n  scope: string;\n  resource: string;\n  issuer: string;\n}): Promise<Record<string, unknown>> {\n  const refreshToken = generateOpaqueToken();\n  await createOAuthRefreshToken({\n    refreshToken,\n    clientId: params.clientId,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n  });\n  const accessToken = await signMcpOAuthAccessToken(params);\n  return {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n    refresh_token: refreshToken,\n    scope: params.scope,\n  };\n}\n\nasync function handleAuthorizationCodeGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const code = body.code;\n  const clientId = body.client_id;\n  const redirectUri = body.redirect_uri;\n  const verifier = body.code_verifier;\n  if (!code || !clientId || !redirectUri || !isValidCodeVerifier(verifier)) {\n    return oauthError(\"invalid_request\", \"Missing authorization-code fields\");\n  }\n  const row = await getOAuthCode(code);\n  if (!row) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  if (row.clientId !== clientId || row.redirectUri !== redirectUri) {\n    return oauthError(\"invalid_grant\", \"Code was issued to another client\");\n  }\n  const expectedChallenge = codeChallengeForVerifier(verifier);\n  if (!safeEqual(expectedChallenge, row.codeChallenge)) {\n    return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n  }\n  const consumed = await consumeOAuthCode(code);\n  if (!consumed) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  return json(\n    await issueTokenSet({\n      ownerEmail: row.ownerEmail,\n      orgId: row.orgId,\n      orgDomain: row.orgDomain,\n      clientId,\n      scope: row.scope,\n      resource: row.resource,\n      issuer,\n    }),\n  );\n}\n\nasync function handleRefreshTokenGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const refreshToken = body.refresh_token;\n  const clientId = body.client_id;\n  if (!refreshToken) {\n    return oauthError(\"invalid_request\", \"refresh_token is required\");\n  }\n  if (!clientId) {\n    return oauthError(\"invalid_request\", \"client_id is required\");\n  }\n  const existing = await getOAuthRefreshToken(refreshToken);\n  if (!existing) return oauthError(\"invalid_grant\", \"Invalid refresh token\");\n  if (existing.clientId !== clientId) {\n    return oauthError(\n      \"invalid_grant\",\n      \"Refresh token belongs to another client\",\n    );\n  }\n  await touchOAuthRefreshToken(refreshToken).catch(() => undefined);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  const accessToken = await signMcpOAuthAccessToken({\n    ownerEmail: existing.ownerEmail,\n    orgId: existing.orgId,\n    orgDomain: existing.orgDomain,\n    clientId: existing.clientId,\n    scope: existing.scope,\n    resource: existing.resource,\n    issuer,\n  });\n  return json({\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n    refresh_token: refreshToken,\n    scope: existing.scope,\n  });\n}\n\nasync function handleToken(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = await readOAuthParams(event);\n  switch (body.grant_type) {\n    case \"authorization_code\":\n      return handleAuthorizationCodeGrant(event, body);\n    case \"refresh_token\":\n      return handleRefreshTokenGrant(event, body);\n    default:\n      return oauthError(\"unsupported_grant_type\", \"Unsupported grant_type\");\n  }\n}\n\nexport async function handleMcpOAuth(\n  event: H3Event,\n  subpath: string,\n  options: McpOAuthRouteOptions = {},\n): Promise<Response> {\n  const path = subpath.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  try {\n    if (path === \"authorize\") return await handleAuthorize(event, options);\n    if (path === \"token\") return await handleToken(event);\n    if (path === \"register\") return await handleRegister(event);\n    setResponseStatus(event, 404);\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    return oauthError(\n      \"server_error\",\n      err?.message || \"OAuth request failed\",\n      500,\n    );\n  }\n}\n"]}
+{"version":3,"file":"oauth-route.js","sourceRoot":"","sources":["../../src/mcp/oauth-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAO/E,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,WAAmB,EACnB,MAAM,GAAG,GAAG;IAEZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,iBAAiB,CACtB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB;IAC9B,KAAK,MAAM,GAAG,IAAI;QAChB,wBAAwB;QACxB,6BAA6B;QAC7B,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC9D,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC,CAAC;IACf,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,uBAAuB,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,GAAG,uBAAuB,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO;QACL,uBAAuB;QACvB,GAAG,kBAAkB,CAAC,MAAM,CAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,uBAAuB,CAC/C;KACF,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE;QAC7B,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,mEAAmE;QACnE,wEAAwE;QACxE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI;QACd,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,KAAK,CAAW,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,MAAM,uCAAuC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,QAAQ,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,OAAO,QAAQ;QACb,CAAC,CAAC,6BAA6B,QAAQ,aAAa,KAAK,GAAG;QAC5D,CAAC,CAAC,iBAAiB,KAAK,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM;QACX,CAAC,CAAC,GAAG,MAAM,GAAG,uBAAuB,kBAAkB;QACvD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,uBAAuB,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM;QACX,CAAC,CAAC,GAAG,MAAM,GAAG,uBAAuB,iBAAiB;QACtD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,cAAc,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,QAAQ;QACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,gBAAgB;QAClC,sBAAsB,EAAE,MAAM;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC,cAAc,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;QACV,MAAM;QACN,sBAAsB,EAAE,SAAS;QACjC,cAAc,EAAE,KAAK;QACrB,qBAAqB,EAAE,QAAQ;QAC/B,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,gBAAgB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,sBAAsB;AACtB,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,gEAAgE;AAChE,SAAS,0BAA0B,CAAC,QAAgB;IAClD,IAAI,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,8EAA8E;IAC9E,4EAA4E;IAC5E,2CAA2C;IAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,WAAW;gBAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;gBAC5B,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,GAAG,CAAC,QAAQ,KAAK,OAAO,CACzB,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAG5D,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,IACE,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,EAAE;QACxB,CAAC,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,UAAU,CACf,yBAAyB,EACzB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,IACE,UAAU,CAAC,MAAM;QACjB,CAAC,UAAU,CAAC,KAAK,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,eAAe,CAC3D,EACD,CAAC;QACD,OAAO,UAAU,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,0BAA0B,KAAK,QAAQ;QACjD,CAAC,CAAC,IAAI,CAAC,0BAA0B;QACjC,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,UAAU,CACf,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACjC,UAAU;YACV,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YACxC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACtD,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC/D,uBAAuB,EAAE,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,WAAW,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CACT;QACE,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QACxE,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;QAC3C,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;KAC3D,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAK/B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,MAI7B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAIzB;IACC,OAAO,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAOvB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,MAAM;QACT,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAOzB;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CACzB,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAyB,EACzB,QAOC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,eAAe,CACjC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACnE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,CACL,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC3C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YACrC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC/B,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC/C,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAChC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG;;;;;;;;;sDASwB,CAAC;AAEvD,SAAS,iBAAiB,CAAC,MAM1B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;SACzC,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,8BAA8B,UAAU,CAAC,GAAG,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CACjF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;;;;;mBAKU,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;SACpC,qBAAqB;;;;;;;kBAOZ,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;OACxC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAoC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACrF,MAAM;;MAER,MAAM;;;;;;;;QAQJ,CAAC;AACT,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,oFAAoF;AACpF,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,MAI7B;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACzD,MAAM,YAAY,GAAG,cAAc,IAAI,YAAY,CAAC;IACpD,MAAM,SAAS,GAAG,cAAc;QAC9B,CAAC,CAAC,QAAQ,UAAU,CAAC,cAAc,CAAC,EAAE;QACtC,CAAC,CAAC,sBAAsB,CAAC;IAC3B,OAAO;;;;;;SAMA,qBAAqB;;;;;;;;;;;;;;;;OAgBvB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,UAAU,CAAC,YAAY,CAAC,uBAAuB,UAAU,CAAC,YAAY,CAAC;;oDAEvE,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS;;;;;;;;;;;;;QAaxF,CAAC;AACT,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc;IAEd,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC7C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAc,EACd,OAA6B;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,UAAU,CACf,iBAAiB,EACjB,sCAAsC,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CACvE,MAAM,EACN,EAAE,CACH,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IACE,CAAC,QAAQ;QACT,CAAC,WAAW;QACZ,CAAC,QAAQ;QACT,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrC,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,UAAU,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,sBAAsB,CAAC;gBAC5B,WAAW;gBACX,KAAK;gBACL,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,SAAS;YACd,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YACtB,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,CACT,iBAAiB,CAAC;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc;YAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;YAChD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE;gBACN,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,QAAQ;gBACR,KAAK;gBACL,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,qBAAqB,EAAE,MAAM;gBAC7B,aAAa,EAAE,gBAAgB,CAAC;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ;oBACR,WAAW;oBACX,QAAQ;oBACR,KAAK;oBACL,aAAa,EAAE,MAAM,CAAC,cAAc;iBACrC,CAAC;aACH;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IACE,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,cAAc;KACrC,CAAC,EACF,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,QAAQ;QACR,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,mBAAmB,EAAE,MAAM;QAC3B,UAAU,EAAE,OAAO,CAAC,KAAK;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,kFAAkF;IAClF,gFAAgF;IAChF,+EAA+E;IAC/E,kFAAkF;IAClF,uCAAuC;IACvC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QAC/C,kBAAkB;YAChB,QAAQ,KAAK,OAAO;gBACpB,QAAQ,KAAK,QAAQ;gBACrB,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB,GAAG,KAAK,CAAC;IAC7B,CAAC;IACD,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,IAAI,CACT,oBAAoB,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,cAAc;YAC3D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACrC,WAAW,EAAE,oBAAoB,CAAC;gBAChC,WAAW;gBACX,KAAK;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAQ5B;IACC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,kCAAkC;QAC9C,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAc,EACd,IAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CACT,MAAM,aAAa,CAAC;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ;QACR,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM;KACP,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,IAA4B;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,UAAU,CACf,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QACT,OAAO,UAAU,CAAC,cAAc,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;QACV,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,kCAAkC;QAC9C,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,eAAe;YAClB,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C;YACE,OAAO,UAAU,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAc,EACd,OAAe,EACf,OAAO,GAAyB,EAAE;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,UAAU,CACf,cAAc,EACd,GAAG,EAAE,OAAO,IAAI,sBAAsB,EACtC,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Standard remote MCP OAuth 2.1 endpoints.\n *\n * These routes let MCP hosts such as Claude Code and ChatGPT authenticate\n * through their native remote-MCP OAuth flow instead of pasting bearer tokens.\n * The issued access tokens are audience-bound to `/mcp`, carry\n * the same user/org identity as the existing connect flow, and are mediated by\n * `verifyAuth` before any MCP tool/resource request runs.\n */\n\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n\nimport type { H3Event } from \"h3\";\nimport { getHeader, getMethod, getQuery, setResponseStatus } from \"h3\";\n\nimport { getOrgDomain } from \"../org/context.js\";\nimport { getConfiguredLoginHtml, getSession } from \"../server/auth.js\";\nimport { getAuthSecret } from \"../server/better-auth-instance.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  createOAuthCode,\n  createOAuthRefreshToken,\n  consumeOAuthCode,\n  generateOpaqueToken,\n  getOAuthClient,\n  getOAuthCode,\n  getOAuthRefreshToken,\n  registerOAuthClient,\n  touchOAuthRefreshToken,\n} from \"./oauth-store.js\";\nimport {\n  MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n  MCP_OAUTH_DEFAULT_SCOPE,\n  MCP_OAUTH_SCOPES,\n  normalizeOAuthScope,\n  signMcpOAuthAccessToken,\n} from \"./oauth-token.js\";\nimport { MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES } from \"./route-paths.js\";\n\nexport interface McpOAuthRouteOptions {\n  appId?: string;\n  appName?: string;\n}\n\nfunction json(body: unknown, status = 200): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json\",\n      \"Cache-Control\": \"no-store\",\n      Pragma: \"no-cache\",\n    },\n  });\n}\n\nfunction html(body: string, status = 200): Response {\n  return new Response(body, {\n    status,\n    headers: {\n      \"Content-Type\": \"text/html; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n    },\n  });\n}\n\nfunction redirect(location: string): Response {\n  return new Response(null, {\n    status: 302,\n    headers: { Location: location, \"Cache-Control\": \"no-store\" },\n  });\n}\n\nfunction isSameOriginPost(event: H3Event): boolean {\n  const origin = getHeader(event, \"origin\");\n  if (!origin) return true;\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return false;\n  try {\n    return new URL(origin).origin === new URL(issuer).origin;\n  } catch {\n    return false;\n  }\n}\n\nfunction oauthError(\n  error: string,\n  description: string,\n  status = 400,\n): Response {\n  return json({ error, error_description: description }, status);\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nfunction normalizeBasePath(raw: string | undefined): string {\n  const trimmed = (raw ?? \"\").trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const withSlash = trimmed.startsWith(\"/\") ? trimmed : `/${trimmed}`;\n  return withSlash.replace(/\\/+$/, \"\");\n}\n\nfunction configuredBasePath(): string {\n  return normalizeBasePath(\n    process.env.APP_BASE_PATH || process.env.VITE_APP_BASE_PATH,\n  );\n}\n\nfunction stripTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction configuredPublicBaseUrl(): string | undefined {\n  for (const key of [\n    \"WORKSPACE_OAUTH_ORIGIN\",\n    \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n    \"APP_URL\",\n    \"VITE_APP_URL\",\n    \"BETTER_AUTH_URL\",\n    \"VITE_BETTER_AUTH_URL\",\n  ]) {\n    const raw = process.env[key]?.trim();\n    if (!raw) continue;\n    try {\n      const url = new URL(raw);\n      url.search = \"\";\n      url.hash = \"\";\n      return stripTrailingSlash(`${url.origin}${url.pathname}`);\n    } catch {\n      // Ignore invalid operator-provided URL values and fall back to headers.\n    }\n  }\n  return undefined;\n}\n\nfunction appendConfiguredBasePath(baseUrl: string): string {\n  const basePath = configuredBasePath();\n  if (!basePath) return stripTrailingSlash(baseUrl);\n  try {\n    const url = new URL(baseUrl);\n    const pathname = normalizeBasePath(url.pathname);\n    if (pathname === basePath || pathname.endsWith(`${basePath}`)) {\n      return stripTrailingSlash(`${url.origin}${pathname}`);\n    }\n    return stripTrailingSlash(`${url.origin}${pathname}${basePath}`);\n  } catch {\n    return `${stripTrailingSlash(baseUrl)}${basePath}`;\n  }\n}\n\nfunction deriveOrigin(event: H3Event): string {\n  const forwardedProto = getHeader(event, \"x-forwarded-proto\");\n  const host = getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1|\\[::1\\])(:|$)/.test(host)\n      ? \"http\"\n      : \"https\");\n  return host ? `${proto}://${host}` : \"\";\n}\n\nexport function getMcpOAuthIssuer(event: H3Event): string | undefined {\n  const baseUrl = configuredPublicBaseUrl() || deriveOrigin(event);\n  if (!baseUrl) return undefined;\n  return appendConfiguredBasePath(baseUrl);\n}\n\nexport function getMcpOAuthResource(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}`;\n}\n\nfunction mcpResourcesForIssuer(issuer: string): string[] {\n  return [\n    MCP_PUBLIC_ROUTE_PREFIX,\n    ...MCP_ROUTE_PREFIXES.filter(\n      (prefix) => prefix !== MCP_PUBLIC_ROUTE_PREFIX,\n    ),\n  ].map((prefix) => `${issuer}${prefix}`);\n}\n\n/**\n * All plausible MCP OAuth resource audiences for the given request, deduped.\n *\n * When a configured public base URL differs from the request-derived origin\n * (e.g. during Netlify deploy-preview or behind a reverse proxy), a token\n * minted against the configured URL must still verify against the request-\n * derived URL and vice-versa.  Returns both so `verifyMcpOAuthAccessToken`\n * accepts either without issuing a 401.\n */\nexport function getMcpOAuthAudiences(event: H3Event): string[] {\n  const configuredIssuer = (() => {\n    const base = configuredPublicBaseUrl();\n    if (!base) return undefined;\n    // Re-apply base path if present so the configured resource is also\n    // base-path-aware, consistent with how getMcpOAuthResource computes it.\n    return appendConfiguredBasePath(base);\n  })();\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const r of [\n    ...(getMcpOAuthIssuer(event)\n      ? mcpResourcesForIssuer(getMcpOAuthIssuer(event) as string)\n      : []),\n    ...(configuredIssuer ? mcpResourcesForIssuer(configuredIssuer) : []),\n  ]) {\n    const n = r?.replace(/\\/+$/, \"\");\n    if (n && !seen.has(n)) {\n      seen.add(n);\n      out.push(n);\n    }\n  }\n  return out;\n}\n\nexport function getMcpOAuthProtectedResourceMetadataUrl(\n  event: H3Event,\n): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer) return undefined;\n  return `${issuer}/.well-known/oauth-protected-resource`;\n}\n\nexport function buildMcpOAuthChallenge(event: H3Event): string {\n  const metadata = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const scope = MCP_OAUTH_DEFAULT_SCOPE;\n  return metadata\n    ? `Bearer resource_metadata=\"${metadata}\", scope=\"${scope}\"`\n    : `Bearer scope=\"${scope}\"`;\n}\n\nfunction authorizationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer\n    ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/authorize`\n    : undefined;\n}\n\nfunction tokenEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/token` : undefined;\n}\n\nfunction registrationEndpoint(event: H3Event): string | undefined {\n  const issuer = getMcpOAuthIssuer(event);\n  return issuer\n    ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/register`\n    : undefined;\n}\n\nexport function handleMcpOAuthProtectedResourceMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const resource = getMcpOAuthResource(event);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!resource || !issuer) {\n    return oauthError(\"server_error\", \"Unable to derive MCP resource\", 500);\n  }\n  return json({\n    resource,\n    authorization_servers: [issuer],\n    scopes_supported: MCP_OAUTH_SCOPES,\n    resource_documentation: issuer,\n  });\n}\n\nexport function handleMcpOAuthAuthorizationServerMetadata(\n  event: H3Event,\n): Response {\n  if (getMethod(event) !== \"GET\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const issuer = getMcpOAuthIssuer(event);\n  const authorize = authorizationEndpoint(event);\n  const token = tokenEndpoint(event);\n  const register = registrationEndpoint(event);\n  if (!issuer || !authorize || !token || !register) {\n    return oauthError(\"server_error\", \"Unable to derive OAuth endpoints\", 500);\n  }\n  return json({\n    issuer,\n    authorization_endpoint: authorize,\n    token_endpoint: token,\n    registration_endpoint: register,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: MCP_OAUTH_SCOPES,\n  });\n}\n\n// Schemes that must never be accepted as a redirect target: they can execute\n// script or read local resources if a redirect is ever rendered in a browser\n// or webview context.\nconst DISALLOWED_REDIRECT_SCHEMES = new Set([\n  \"javascript:\",\n  \"data:\",\n  \"vbscript:\",\n  \"file:\",\n  \"blob:\",\n  \"about:\",\n]);\n\n// Native/desktop IDE clients (Cursor, VS Code, …) register a private-use URI\n// scheme callback such as `cursor://` or `vscode://` (RFC 8252 §7.1) instead of\n// an https/loopback URL. The authorization code is bound by PKCE (S256), so\n// delivering it through a client-registered app scheme is safe.\nfunction isPrivateUseRedirectScheme(protocol: string): boolean {\n  if (DISALLOWED_REDIRECT_SCHEMES.has(protocol)) return false;\n  // RFC 3986 scheme grammar: ALPHA *( ALPHA / DIGIT / \"+\" / \"-\" / \".\" ), with a\n  // trailing \":\" from URL.protocol. Require a non-http(s) custom scheme here;\n  // http/https are handled explicitly above.\n  return /^[a-z][a-z0-9+.-]*:$/.test(protocol);\n}\n\nfunction isAllowedRedirectUri(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length > 2048) return false;\n  try {\n    const url = new URL(value);\n    if (url.hash) return false;\n    if (url.username || url.password) return false;\n    if (url.protocol === \"https:\") return true;\n    if (url.protocol === \"http:\") {\n      return (\n        url.hostname === \"localhost\" ||\n        url.hostname === \"127.0.0.1\" ||\n        url.hostname === \"::1\" ||\n        url.hostname === \"[::1]\"\n      );\n    }\n    return isPrivateUseRedirectScheme(url.protocol);\n  } catch {\n    return false;\n  }\n}\n\nfunction parseStringArray(value: unknown): string[] {\n  return Array.isArray(value)\n    ? value.filter((item): item is string => typeof item === \"string\")\n    : [];\n}\n\nasync function handleRegister(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = ((await readBody(event).catch(() => ({}))) ?? {}) as Record<\n    string,\n    unknown\n  >;\n  const redirectUris = parseStringArray(body.redirect_uris);\n  if (\n    redirectUris.length === 0 ||\n    redirectUris.length > 20 ||\n    !redirectUris.every(isAllowedRedirectUri)\n  ) {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"redirect_uris must contain valid HTTPS or localhost callback URLs\",\n    );\n  }\n\n  const grantTypes = parseStringArray(body.grant_types);\n  if (\n    grantTypes.length &&\n    !grantTypes.every(\n      (g) => g === \"authorization_code\" || g === \"refresh_token\",\n    )\n  ) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported grant_type\");\n  }\n  const responseTypes = parseStringArray(body.response_types);\n  if (responseTypes.length && !responseTypes.every((r) => r === \"code\")) {\n    return oauthError(\"invalid_client_metadata\", \"Unsupported response_type\");\n  }\n  const method =\n    typeof body.token_endpoint_auth_method === \"string\"\n      ? body.token_endpoint_auth_method\n      : \"none\";\n  if (method !== \"none\") {\n    return oauthError(\n      \"invalid_client_metadata\",\n      \"Only public OAuth clients are supported\",\n    );\n  }\n\n  const clientName =\n    typeof body.client_name === \"string\"\n      ? body.client_name.trim().slice(0, 120)\n      : null;\n  let client;\n  try {\n    client = await registerOAuthClient({\n      clientName,\n      redirectUris: [...new Set(redirectUris)],\n      grantTypes: grantTypes.length ? grantTypes : undefined,\n      responseTypes: responseTypes.length ? responseTypes : undefined,\n      tokenEndpointAuthMethod: method,\n    });\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") {\n      return oauthError(\"slow_down\", \"Too many client registrations\", 429);\n    }\n    throw err;\n  }\n  return json(\n    {\n      client_id: client.clientId,\n      client_id_issued_at: Math.floor((client.createdAt ?? Date.now()) / 1000),\n      client_name: client.clientName ?? undefined,\n      redirect_uris: client.redirectUris,\n      grant_types: client.grantTypes,\n      response_types: client.responseTypes,\n      token_endpoint_auth_method: client.tokenEndpointAuthMethod,\n    },\n    201,\n  );\n}\n\nfunction redirectWithOAuthError(params: {\n  redirectUri: string;\n  state?: string;\n  error: string;\n  description?: string;\n}): Response {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"error\", params.error);\n  if (params.description) {\n    url.searchParams.set(\"error_description\", params.description);\n  }\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return redirect(url.toString());\n}\n\nfunction buildCodeRedirectUrl(params: {\n  redirectUri: string;\n  code: string;\n  state?: string;\n}): string {\n  const url = new URL(params.redirectUri);\n  url.searchParams.set(\"code\", params.code);\n  if (params.state) url.searchParams.set(\"state\", params.state);\n  return url.toString();\n}\n\nfunction redirectWithCode(params: {\n  redirectUri: string;\n  code: string;\n  state?: string;\n}): Response {\n  return redirect(buildCodeRedirectUrl(params));\n}\n\nfunction codeChallengeForVerifier(verifier: string): string {\n  return createHash(\"sha256\").update(verifier).digest(\"base64url\");\n}\n\nfunction safeEqual(a: string, b: string): boolean {\n  const aa = Buffer.from(a);\n  const bb = Buffer.from(b);\n  return aa.length === bb.length && timingSafeEqual(aa, bb);\n}\n\nfunction base64UrlEncode(value: Buffer | string): string {\n  const buf = typeof value === \"string\" ? Buffer.from(value, \"utf8\") : value;\n  return buf.toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): Buffer {\n  return Buffer.from(value, \"base64url\");\n}\n\nfunction consentSigningKey(): string {\n  return process.env.A2A_SECRET?.trim() || getAuthSecret();\n}\n\nfunction consentPayload(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  return JSON.stringify({\n    ...params,\n    exp: Math.floor(Date.now() / 1000) + 10 * 60,\n  });\n}\n\nfunction signConsentToken(params: {\n  email: string;\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scope: string;\n  codeChallenge: string;\n}): string {\n  const payload = base64UrlEncode(consentPayload(params));\n  const sig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  return `${payload}.${sig}`;\n}\n\nfunction verifyConsentToken(\n  token: string | undefined,\n  expected: {\n    email: string;\n    clientId: string;\n    redirectUri: string;\n    resource: string;\n    scope: string;\n    codeChallenge: string;\n  },\n): boolean {\n  if (!token || !token.includes(\".\")) return false;\n  const [payload, sig] = token.split(\".\", 2);\n  if (!payload || !sig) return false;\n  const expectedSig = base64UrlEncode(\n    createHmac(\"sha256\", consentSigningKey()).update(payload).digest(),\n  );\n  if (!safeEqual(sig, expectedSig)) return false;\n  try {\n    const parsed = JSON.parse(base64UrlDecode(payload).toString(\"utf8\"));\n    return (\n      parsed.email === expected.email &&\n      parsed.clientId === expected.clientId &&\n      parsed.redirectUri === expected.redirectUri &&\n      parsed.resource === expected.resource &&\n      parsed.scope === expected.scope &&\n      parsed.codeChallenge === expected.codeChallenge &&\n      typeof parsed.exp === \"number\" &&\n      parsed.exp * 1000 >= Date.now()\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isValidCodeVerifier(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    value.length >= 43 &&\n    value.length <= 128 &&\n    /^[A-Za-z0-9._~-]+$/.test(value)\n  );\n}\n\n// Shared styling for the browser-facing OAuth pages (consent + post-authorize\n// confirmation) so they read as one coherent dark surface.\nconst OAUTH_PAGE_BASE_STYLE = `\n  :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: #09090b; color: #f4f4f5; }\n  body { min-height: 100vh; display: grid; place-items: center; margin: 0; padding: 24px; }\n  main { width: min(520px, 100%); border: 1px solid #27272a; border-radius: 8px; background: #111113; padding: 24px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }\n  h1 { font-size: 22px; line-height: 1.2; margin: 0 0 10px; }\n  p { color: #a1a1aa; line-height: 1.5; margin: 0 0 18px; }\n  .actions { display: flex; gap: 10px; justify-content: flex-end; }\n  button, .btn { border: 0; border-radius: 6px; padding: 10px 14px; font: inherit; font-weight: 650; cursor: pointer; text-decoration: none; display: inline-block; }\n  .primary { background: #f4f4f5; color: #09090b; }\n  .secondary { background: #27272a; color: #f4f4f5; }`;\n\nfunction renderConsentPage(params: {\n  appName: string;\n  email: string;\n  clientName: string;\n  scopes: string[];\n  fields: Record<string, string>;\n}): string {\n  const hidden = Object.entries(params.fields)\n    .map(\n      ([key, value]) =>\n        `<input type=\"hidden\" name=\"${escapeHtml(key)}\" value=\"${escapeHtml(value)}\">`,\n    )\n    .join(\"\\n\");\n  const scopes = params.scopes\n    .map((scope) => `<li><code>${escapeHtml(scope)}</code></li>`)\n    .join(\"\");\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorize ${escapeHtml(params.appName)}</title>\n<style>${OAUTH_PAGE_BASE_STYLE}\n  ul { margin: 0 0 22px; padding-left: 22px; color: #d4d4d8; }\n  code { color: #67e8f9; }\n</style>\n</head>\n<body>\n<main>\n  <h1>Authorize ${escapeHtml(params.clientName)}</h1>\n  <p>${escapeHtml(params.appName)} will let this MCP client act as ${escapeHtml(params.email)} for these scopes:</p>\n  <ul>${scopes}</ul>\n  <form method=\"post\">\n    ${hidden}\n    <div class=\"actions\">\n      <button class=\"secondary\" type=\"submit\" name=\"decision\" value=\"deny\">Deny</button>\n      <button class=\"primary\" type=\"submit\" name=\"decision\" value=\"approve\">Authorize</button>\n    </div>\n  </form>\n</main>\n</body>\n</html>`;\n}\n\n// Shown after the user approves a native/desktop client (cursor://, vscode://, …)\n// whose redirect is a private-use scheme. A bare 302 to a custom scheme hands the\n// code to the OS app but leaves the browser tab dangling on a blank/error page, so\n// we render a friendly confirmation that also re-fires the deep link (so the client\n// still receives the code) and tells the user they can return to their agent.\nfunction renderAuthorizedPage(params: {\n  appName: string;\n  clientName: string | null;\n  redirectUrl: string;\n}): string {\n  const friendlyClient = params.clientName?.trim() || null;\n  const returnTarget = friendlyClient ?? \"your agent\";\n  const openLabel = friendlyClient\n    ? `Open ${escapeHtml(friendlyClient)}`\n    : \"Return to your agent\";\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Authorized</title>\n<style>${OAUTH_PAGE_BASE_STYLE}\n  main.success { text-align: center; }\n  .check { width: 56px; height: 56px; margin: 4px auto 16px; display: grid; place-items: center; border-radius: 999px; background: rgba(34,197,94,.12); }\n  .check svg { width: 30px; height: 30px; }\n  .success .actions { justify-content: center; margin-top: 4px; }\n  .hint { color: #71717a; font-size: 13px; margin: 18px 0 0; }\n</style>\n</head>\n<body>\n<main class=\"success\">\n  <div class=\"check\">\n    <svg viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\">\n      <path d=\"M20 6 9 17l-5-5\"></path>\n    </svg>\n  </div>\n  <h1>You're all set</h1>\n  <p>${escapeHtml(params.appName)} has authorized ${escapeHtml(returnTarget)}. You can return to ${escapeHtml(returnTarget)} to continue.</p>\n  <div class=\"actions\">\n    <a class=\"btn primary\" id=\"return-link\" href=\"${escapeHtml(params.redirectUrl)}\">${openLabel}</a>\n  </div>\n  <p class=\"hint\">You can close this tab.</p>\n</main>\n<script>\n  (function () {\n    var link = document.getElementById(\"return-link\");\n    if (link && link.href) {\n      try { window.location.href = link.href; } catch (e) {}\n    }\n  })();\n</script>\n</body>\n</html>`;\n}\n\nasync function resolveOrgDomain(\n  orgId: string | undefined,\n): Promise<string | undefined> {\n  if (!orgId) return undefined;\n  try {\n    return (await getOrgDomain(orgId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function readOAuthParams(\n  event: H3Event,\n): Promise<Record<string, string>> {\n  if (getMethod(event) === \"GET\") {\n    const query = getQuery(event);\n    return Object.fromEntries(\n      Object.entries(query).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  const body = await readBody(event).catch(() => ({}));\n  if (typeof body === \"string\") {\n    return Object.fromEntries(new URLSearchParams(body));\n  }\n  if (body && typeof body === \"object\") {\n    return Object.fromEntries(\n      Object.entries(body as Record<string, unknown>).flatMap(([key, value]) =>\n        typeof value === \"string\" ? [[key, value]] : [],\n      ),\n    );\n  }\n  return {};\n}\n\nasync function handleAuthorize(\n  event: H3Event,\n  options: McpOAuthRouteOptions,\n): Promise<Response> {\n  const method = getMethod(event);\n  if (method !== \"GET\" && method !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  if (method === \"POST\" && !isSameOriginPost(event)) {\n    return oauthError(\n      \"invalid_request\",\n      \"Cross-origin authorize POST rejected\",\n      403,\n    );\n  }\n  const params = await readOAuthParams(event);\n  const state = params.state;\n  const clientId = params.client_id;\n  const redirectUri = params.redirect_uri;\n  const resource = (params.resource || getMcpOAuthResource(event))?.replace(\n    /\\/+$/,\n    \"\",\n  );\n  const expectedResources = getMcpOAuthAudiences(event);\n\n  if (params.response_type !== \"code\") {\n    return oauthError(\n      \"unsupported_response_type\",\n      \"response_type must be code\",\n    );\n  }\n  if (\n    !clientId ||\n    !redirectUri ||\n    !resource ||\n    !expectedResources.includes(resource)\n  ) {\n    return oauthError(\"invalid_request\", \"Invalid OAuth authorization request\");\n  }\n  if (params.code_challenge_method !== \"S256\" || !params.code_challenge) {\n    return oauthError(\"invalid_request\", \"PKCE S256 is required\");\n  }\n\n  const client = await getOAuthClient(clientId);\n  if (!client || !client.redirectUris.includes(redirectUri)) {\n    return oauthError(\"invalid_client\", \"Unknown client or redirect_uri\");\n  }\n\n  const session = await getSession(event);\n  if (!session?.email) {\n    if (params.prompt === \"none\") {\n      return redirectWithOAuthError({\n        redirectUri,\n        state,\n        error: \"login_required\",\n      });\n    }\n    const loginHtml = getConfiguredLoginHtml(event);\n    return loginHtml\n      ? html(loginHtml, 200)\n      : oauthError(\"login_required\", \"Sign in required\", 401);\n  }\n\n  const scope = normalizeOAuthScope(params.scope);\n  if (!scope) {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"invalid_scope\",\n    });\n  }\n  if (method === \"GET\") {\n    return html(\n      renderConsentPage({\n        appName: options.appName || options.appId || \"Agent Native\",\n        email: session.email,\n        clientName: client.clientName || client.clientId,\n        scopes: scope.split(/\\s+/),\n        fields: {\n          response_type: \"code\",\n          client_id: clientId,\n          redirect_uri: redirectUri,\n          resource,\n          scope,\n          state: state ?? \"\",\n          code_challenge: params.code_challenge,\n          code_challenge_method: \"S256\",\n          consent_token: signConsentToken({\n            email: session.email,\n            clientId,\n            redirectUri,\n            resource,\n            scope,\n            codeChallenge: params.code_challenge,\n          }),\n        },\n      }),\n    );\n  }\n\n  if (\n    !verifyConsentToken(params.consent_token, {\n      email: session.email,\n      clientId,\n      redirectUri,\n      resource,\n      scope,\n      codeChallenge: params.code_challenge,\n    })\n  ) {\n    return oauthError(\"invalid_request\", \"Invalid authorization consent token\");\n  }\n\n  if (params.decision !== \"approve\") {\n    return redirectWithOAuthError({\n      redirectUri,\n      state,\n      error: \"access_denied\",\n    });\n  }\n\n  const orgDomain = await resolveOrgDomain(session.orgId);\n  const code = await createOAuthCode({\n    clientId,\n    redirectUri,\n    codeChallenge: params.code_challenge,\n    codeChallengeMethod: \"S256\",\n    ownerEmail: session.email,\n    orgId: session.orgId ?? null,\n    orgDomain: orgDomain ?? null,\n    scope,\n    resource,\n  });\n\n  // Native/desktop clients register a private-use scheme (cursor://, vscode://, …).\n  // A 302 to that scheme opens the app but leaves the browser tab dangling, so we\n  // render a friendly confirmation page that re-fires the deep link instead. For\n  // https/loopback callbacks the client (or its local server) renders its own page,\n  // so keep the standard redirect there.\n  let isDeepLinkRedirect = false;\n  try {\n    const protocol = new URL(redirectUri).protocol;\n    isDeepLinkRedirect =\n      protocol !== \"http:\" &&\n      protocol !== \"https:\" &&\n      isPrivateUseRedirectScheme(protocol);\n  } catch {\n    isDeepLinkRedirect = false;\n  }\n  if (isDeepLinkRedirect) {\n    return html(\n      renderAuthorizedPage({\n        appName: options.appName || options.appId || \"Agent Native\",\n        clientName: client.clientName ?? null,\n        redirectUrl: buildCodeRedirectUrl({\n          redirectUri,\n          state,\n          code: code.code,\n        }),\n      }),\n    );\n  }\n  return redirectWithCode({ redirectUri, state, code: code.code });\n}\n\nasync function issueTokenSet(params: {\n  ownerEmail: string;\n  orgId?: string | null;\n  orgDomain?: string | null;\n  clientId: string;\n  scope: string;\n  resource: string;\n  issuer: string;\n}): Promise<Record<string, unknown>> {\n  const refreshToken = generateOpaqueToken();\n  await createOAuthRefreshToken({\n    refreshToken,\n    clientId: params.clientId,\n    ownerEmail: params.ownerEmail,\n    orgId: params.orgId ?? null,\n    orgDomain: params.orgDomain ?? null,\n    scope: params.scope,\n    resource: params.resource,\n  });\n  const accessToken = await signMcpOAuthAccessToken(params);\n  return {\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n    refresh_token: refreshToken,\n    scope: params.scope,\n  };\n}\n\nasync function handleAuthorizationCodeGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const code = body.code;\n  const clientId = body.client_id;\n  const redirectUri = body.redirect_uri;\n  const verifier = body.code_verifier;\n  if (!code || !clientId || !redirectUri || !isValidCodeVerifier(verifier)) {\n    return oauthError(\"invalid_request\", \"Missing authorization-code fields\");\n  }\n  const row = await getOAuthCode(code);\n  if (!row) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  if (row.clientId !== clientId || row.redirectUri !== redirectUri) {\n    return oauthError(\"invalid_grant\", \"Code was issued to another client\");\n  }\n  const expectedChallenge = codeChallengeForVerifier(verifier);\n  if (!safeEqual(expectedChallenge, row.codeChallenge)) {\n    return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n  }\n  const consumed = await consumeOAuthCode(code);\n  if (!consumed) return oauthError(\"invalid_grant\", \"Invalid or expired code\");\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  return json(\n    await issueTokenSet({\n      ownerEmail: row.ownerEmail,\n      orgId: row.orgId,\n      orgDomain: row.orgDomain,\n      clientId,\n      scope: row.scope,\n      resource: row.resource,\n      issuer,\n    }),\n  );\n}\n\nasync function handleRefreshTokenGrant(\n  event: H3Event,\n  body: Record<string, string>,\n): Promise<Response> {\n  const refreshToken = body.refresh_token;\n  const clientId = body.client_id;\n  if (!refreshToken) {\n    return oauthError(\"invalid_request\", \"refresh_token is required\");\n  }\n  if (!clientId) {\n    return oauthError(\"invalid_request\", \"client_id is required\");\n  }\n  const existing = await getOAuthRefreshToken(refreshToken);\n  if (!existing) return oauthError(\"invalid_grant\", \"Invalid refresh token\");\n  if (existing.clientId !== clientId) {\n    return oauthError(\n      \"invalid_grant\",\n      \"Refresh token belongs to another client\",\n    );\n  }\n  await touchOAuthRefreshToken(refreshToken).catch(() => undefined);\n  const issuer = getMcpOAuthIssuer(event);\n  if (!issuer)\n    return oauthError(\"server_error\", \"Unable to derive issuer\", 500);\n  const accessToken = await signMcpOAuthAccessToken({\n    ownerEmail: existing.ownerEmail,\n    orgId: existing.orgId,\n    orgDomain: existing.orgDomain,\n    clientId: existing.clientId,\n    scope: existing.scope,\n    resource: existing.resource,\n    issuer,\n  });\n  return json({\n    access_token: accessToken,\n    token_type: \"Bearer\",\n    expires_in: MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,\n    refresh_token: refreshToken,\n    scope: existing.scope,\n  });\n}\n\nasync function handleToken(event: H3Event): Promise<Response> {\n  if (getMethod(event) !== \"POST\") {\n    return oauthError(\"invalid_request\", \"Method not allowed\", 405);\n  }\n  const body = await readOAuthParams(event);\n  switch (body.grant_type) {\n    case \"authorization_code\":\n      return handleAuthorizationCodeGrant(event, body);\n    case \"refresh_token\":\n      return handleRefreshTokenGrant(event, body);\n    default:\n      return oauthError(\"unsupported_grant_type\", \"Unsupported grant_type\");\n  }\n}\n\nexport async function handleMcpOAuth(\n  event: H3Event,\n  subpath: string,\n  options: McpOAuthRouteOptions = {},\n): Promise<Response> {\n  const path = subpath.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  try {\n    if (path === \"authorize\") return await handleAuthorize(event, options);\n    if (path === \"token\") return await handleToken(event);\n    if (path === \"register\") return await handleRegister(event);\n    setResponseStatus(event, 404);\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    return oauthError(\n      \"server_error\",\n      err?.message || \"OAuth request failed\",\n      500,\n    );\n  }\n}\n"]}

package/dist/mcp/route-paths.d.ts

@@ -0,0 +1,13 @@
+/**
+ * MCP's public protocol path and the framework path kept for compatibility.
+ *
+ * Only the protocol and its OAuth/connect companions use the public alias.
+ * Other framework-owned MCP management routes remain under `/_agent-native`.
+ */
+export declare const MCP_PUBLIC_ROUTE_PREFIX = "/mcp";
+export declare const MCP_LEGACY_ROUTE_PREFIX = "/_agent-native/mcp";
+export declare const MCP_ROUTE_PREFIXES: readonly ["/_agent-native/mcp", "/mcp"];
+export declare function joinMcpRoute(prefix: string, suffix: string): string;
+export declare function isMcpPublicPath(pathname: string): boolean;
+export declare function isMcpProtocolPath(pathname: string): boolean;
+//# sourceMappingURL=route-paths.d.ts.map

package/dist/mcp/route-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-paths.d.ts","sourceRoot":"","sources":["../../src/mcp/route-paths.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,eAAO,MAAM,kBAAkB,yCAGrB,CAAC;AAEX,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO3D"}

package/dist/mcp/route-paths.js

@@ -0,0 +1,27 @@
+/**
+ * MCP's public protocol path and the framework path kept for compatibility.
+ *
+ * Only the protocol and its OAuth/connect companions use the public alias.
+ * Other framework-owned MCP management routes remain under `/_agent-native`.
+ */
+export const MCP_PUBLIC_ROUTE_PREFIX = "/mcp";
+export const MCP_LEGACY_ROUTE_PREFIX = "/_agent-native/mcp";
+export const MCP_ROUTE_PREFIXES = [
+    MCP_LEGACY_ROUTE_PREFIX,
+    MCP_PUBLIC_ROUTE_PREFIX,
+];
+export function joinMcpRoute(prefix, suffix) {
+    const normalizedSuffix = suffix.startsWith("/") ? suffix : `/${suffix}`;
+    return `${prefix}${normalizedSuffix}` || normalizedSuffix;
+}
+export function isMcpPublicPath(pathname) {
+    return (pathname === MCP_PUBLIC_ROUTE_PREFIX ||
+        pathname.startsWith(`${MCP_PUBLIC_ROUTE_PREFIX}/`));
+}
+export function isMcpProtocolPath(pathname) {
+    return (pathname === MCP_PUBLIC_ROUTE_PREFIX ||
+        pathname === MCP_LEGACY_ROUTE_PREFIX ||
+        pathname === `${MCP_PUBLIC_ROUTE_PREFIX}/` ||
+        pathname === `${MCP_LEGACY_ROUTE_PREFIX}/`);
+}
+//# sourceMappingURL=route-paths.js.map

package/dist/mcp/route-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-paths.js","sourceRoot":"","sources":["../../src/mcp/route-paths.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,uBAAuB;IACvB,uBAAuB;CACf,CAAC;AAEX,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;IACzD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IACxE,OAAO,GAAG,MAAM,GAAG,gBAAgB,EAAE,IAAI,gBAAgB,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,KAAK,uBAAuB;QACpC,QAAQ,CAAC,UAAU,CAAC,GAAG,uBAAuB,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,CACL,QAAQ,KAAK,uBAAuB;QACpC,QAAQ,KAAK,uBAAuB;QACpC,QAAQ,KAAK,GAAG,uBAAuB,GAAG;QAC1C,QAAQ,KAAK,GAAG,uBAAuB,GAAG,CAC3C,CAAC;AACJ,CAAC","sourcesContent":["/**\n * MCP's public protocol path and the framework path kept for compatibility.\n *\n * Only the protocol and its OAuth/connect companions use the public alias.\n * Other framework-owned MCP management routes remain under `/_agent-native`.\n */\nexport const MCP_PUBLIC_ROUTE_PREFIX = \"/mcp\";\nexport const MCP_LEGACY_ROUTE_PREFIX = \"/_agent-native/mcp\";\n\nexport const MCP_ROUTE_PREFIXES = [\n  MCP_LEGACY_ROUTE_PREFIX,\n  MCP_PUBLIC_ROUTE_PREFIX,\n] as const;\n\nexport function joinMcpRoute(prefix: string, suffix: string): string {\n  const normalizedSuffix = suffix.startsWith(\"/\") ? suffix : `/${suffix}`;\n  return `${prefix}${normalizedSuffix}` || normalizedSuffix;\n}\n\nexport function isMcpPublicPath(pathname: string): boolean {\n  return (\n    pathname === MCP_PUBLIC_ROUTE_PREFIX ||\n    pathname.startsWith(`${MCP_PUBLIC_ROUTE_PREFIX}/`)\n  );\n}\n\nexport function isMcpProtocolPath(pathname: string): boolean {\n  return (\n    pathname === MCP_PUBLIC_ROUTE_PREFIX ||\n    pathname === MCP_LEGACY_ROUTE_PREFIX ||\n    pathname === `${MCP_PUBLIC_ROUTE_PREFIX}/` ||\n    pathname === `${MCP_LEGACY_ROUTE_PREFIX}/`\n  );\n}\n"]}

package/dist/mcp/server.d.ts

@@ -35,7 +35,8 @@ export declare function handleMcpRequest(event: H3Event, config: MCPConfig): Pro
 /**
  * Mount an MCP remote server on an H3/Nitro app.
  *
- * Endpoint: `{routePrefix}/mcp` (default `/_agent-native/mcp`)
+ * Endpoints: `/mcp` (public) and `/_agent-native/mcp` (compatibility).
+ * A custom route prefix only mounts that custom endpoint.
  *
  * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON
  * request/response (no SSE), and no standalone GET stream, so it survives

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAalC,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,CAAC;AACF,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AA+M7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,SAAS,GAChB,OAAO,CACR,QAAQ,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAC5E,CAuKA;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAYN"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAalC,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,CAAC;AACF,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AA+M7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,SAAS,GAChB,OAAO,CACR,QAAQ,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAC5E,CAuKA;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAiBN"}

package/dist/mcp/server.js

@@ -5,6 +5,7 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
 import { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, } from "./build-server.js";
 import { buildMcpOAuthChallenge, getMcpOAuthAudiences, getMcpOAuthIssuer, getMcpOAuthProtectedResourceMetadataUrl, getMcpOAuthResource, } from "./oauth-route.js";
+import { MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES, joinMcpRoute, } from "./route-paths.js";
 // Re-export the shared MCP server builder + types so the stdio transport and
 // any (future) external importer of `@agent-native/core/mcp` keep resolving
 // against `./server.js` exactly as before this refactor.
@@ -124,7 +125,7 @@ function buildWebRequest(event, method) {
     const proto = forwardedProto?.split(",")[0]?.trim() ||
         (/^(localhost|127\.0\.0\.1)(:|$)/.test(host) ? "http" : "https");
     const basePath = getConfiguredAppBasePath();
-    const url = `${proto}://${host}${basePath}/_agent-native/mcp`;
+    const url = `${proto}://${host}${basePath}${MCP_PUBLIC_ROUTE_PREFIX}`;
     // No body here on purpose: the JSON-RPC payload is forwarded via the
     // transport's `parsedBody` option (the same mechanism the Node transport
     // uses), so the request stream is never read twice.
@@ -149,7 +150,7 @@ function buildUnauthorizedBody(event) {
         ? `npx @agent-native/core@latest connect ${issuer}`
         : undefined;
     const authorizeUrl = issuer
-        ? `${issuer}/_agent-native/mcp/oauth/authorize`
+        ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/authorize`
         : undefined;
     const message = command
         ? `Authentication required. Run \`${command}\` to re-authenticate this ` +
@@ -347,7 +348,8 @@ export async function handleMcpRequest(event, config) {
 /**
  * Mount an MCP remote server on an H3/Nitro app.
  *
- * Endpoint: `{routePrefix}/mcp` (default `/_agent-native/mcp`)
+ * Endpoints: `/mcp` (public) and `/_agent-native/mcp` (compatibility).
+ * A custom route prefix only mounts that custom endpoint.
  *
  * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON
  * request/response (no SSE), and no standalone GET stream, so it survives
@@ -362,10 +364,16 @@ export async function handleMcpRequest(event, config) {
  * No auth required when neither is configured (dev mode).
  */
 export function mountMCP(nitroApp, config, routePrefix = "/_agent-native") {
-    getH3App(nitroApp).use(`${routePrefix}/mcp`, defineEventHandler(async (event) => {
+    const routePaths = routePrefix === "/_agent-native"
+        ? [...MCP_ROUTE_PREFIXES]
+        : [joinMcpRoute(routePrefix, "/mcp")];
+    const handler = defineEventHandler(async (event) => {
         return handleMcpRequest(event, config);
-    }));
+    });
+    for (const routePath of routePaths) {
+        getH3App(nitroApp).use(routePath, handler);
+    }
     if (process.env.DEBUG)
-        console.log(`[mcp] Mounted MCP server at ${routePrefix}/mcp (${Object.keys(config.actions).length} tools${config.askAgent ? " + ask-agent" : ""})`);
+        console.log(`[mcp] Mounted MCP server at ${routePaths.join(" and ")} (${Object.keys(config.actions).length} tools${config.askAgent ? " + ask-agent" : ""})`);
 }
 //# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GAInB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,uCAAuC,EACvC,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,6EAA6E;AAC7E,4EAA4E;AAC5E,yDAAyD;AACzD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,CAAC;AAGF,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAc;IAInC,MAAM,CAAC,GAAG,KAAY,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,IAAI,GACR,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,YAAY,GAAG,gBAAgB,CACnC,KAAK,EACL,4BAA4B,CAC7B,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,UAAU;QAC3B,YAAY,KAAK,SAAS;QACxB,CAAC,CAAE,YAAyC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9E,MAAM,UAAU,GACd,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5E,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,KAAK,EACL,iCAAiC,CAClC,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,WAAW,GACf,iBAAiB,KAAK,GAAG;QACzB,iBAAiB,KAAK,MAAM;QAC5B,iBAAiB,KAAK,KAAK,CAAC;IAC9B,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,KAAK,EACL,gCAAgC,CACjC,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,mBAAmB,GACvB,gBAAgB,KAAK,GAAG;QACxB,gBAAgB,KAAK,MAAM;QAC3B,gBAAgB,KAAK,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;QACN,UAAU;QACV,UAAU;QACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,KAAK;YAClB,QAAQ,KAAK,OAAO;YACpB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAc;IACrD,MAAM,GAAG,GAAI,KAAa,CAAC,GAA0B,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAI,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAEhC,CAAC;QACd,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK,IAAI,IAAI;oBAAE,SAAS;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IAEjE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,oBAAoB,CAAC;IAE9D,qEAAqE;IACrE,yEAAyE;IACzE,oDAAoD;IACpD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAW3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,8CAA8C,MAAM,EAAE;QACxD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,gBAAgB,GAAG,MAAM;QAC7B,CAAC,CAAC,yCAAyC,MAAM,EAAE;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC,GAAG,MAAM,oCAAoC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,kCAAkC,OAAO,6BAA6B;YACtE,oEAAoE;YACpE,gEAAgE;YAChE,gBAAgB,gBAAgB,KAAK;QACvC,CAAC,CAAC,wEAAwE;YACxE,aAAa,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO;QACP,YAAY,EAAE;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAc,EACd,MAAiB;IAIjB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,uDAAuD;IACvD,+DAA+D;IAC/D,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,oEAAoE;IACpE,4DAA4D;IAC5D,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAChE,YAAY,EACV,iBAAiB,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC;QAClE,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,8EAA8E;IAC9E,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,CAAC,CAAC,EAAsE,EAAE,CACxE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACT,CAA0B,CAAC,MAAM,KAAK,YAAY,CACtD,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CACX,8BAA8B,EAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1E,GAAG,WAAW;QACd,WAAW,EAAE,UAAU,CAAC,WAAW,KAAK,IAAI;QAC5C,aAAa,EACX,WAAW,CAAC,aAAa,KAAK,IAAI;YAClC,UAAU,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI;YACzC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClD,2EAA2E;QAC3E,MAAM,EAAE,6BAA6B,EAAE,GACrC,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,GAAG,EAAE,IAAI,KAAK,4BAA4B;gBAAE,MAAM,GAAG,CAAC;YAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;gBACnB,OAAO,CAAC,GAAG,CACT,2EAA2E,CAC5E,CAAC;QACN,CAAC;QACD,8CAA8C;QAC7C,KAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,qBAAqB;IACrB,MAAM,EAAE,wCAAwC,EAAE,GAChD,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,SAAS,EAAE,oCAAoC;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,UAAU,EACV,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,OAAO,gBAAgB,CAAC,KAAgB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACnB,OAAO,CAAC,GAAG,CACT,+BAA+B,WAAW,SAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CACvI,CAAC;AACN,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\n\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { isLoopbackRequest } from \"../server/auth.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n  type MCPConfig,\n  type MCPCallerIdentity,\n  type MCPRequestMeta,\n} from \"./build-server.js\";\nimport {\n  buildMcpOAuthChallenge,\n  getMcpOAuthAudiences,\n  getMcpOAuthIssuer,\n  getMcpOAuthProtectedResourceMetadataUrl,\n  getMcpOAuthResource,\n} from \"./oauth-route.js\";\n\n// Re-export the shared MCP server builder + types so the stdio transport and\n// any (future) external importer of `@agent-native/core/mcp` keep resolving\n// against `./server.js` exactly as before this refactor.\nexport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n};\nexport type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };\n\n// ---------------------------------------------------------------------------\n// Runtime detection — Node fast-path vs. web-standard fallback\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the underlying Node `http` req/res pair if (and only if) we're\n * running on a real Node HTTP server (local dev, `node` Nitro preset). On the\n * web-standard runtime (Nitro 3 / Netlify web runtime, Cloudflare, Deno, Bun)\n * BOTH of these are undefined — that's the signal to take the web fallback\n * instead of returning 501.\n */\nfunction getNodeReqRes(event: H3Event): {\n  nodeReq: any | undefined;\n  nodeRes: any | undefined;\n} {\n  const e = event as any;\n  const nodeReq = e.node?.req ?? e.req?.runtime?.node?.req;\n  const nodeRes = e.node?.res ?? e.req?.runtime?.node?.res;\n  return { nodeReq, nodeRes };\n}\n\nfunction shouldUseNodeFastPath(event: H3Event): boolean {\n  if (process.env.AGENT_NATIVE_MCP_NODE_FAST_PATH !== \"1\") return false;\n  const { nodeReq, nodeRes } = getNodeReqRes(event);\n  return Boolean(nodeReq && nodeRes);\n}\n\n/**\n * Derive the request origin + the markdown deep-link target from the inbound\n * headers. Identical logic for both the Node and web paths so the absolute\n * deep-link URLs in tool results are computed the same way regardless of\n * runtime.\n */\nfunction deriveRequestMeta(event: H3Event): MCPRequestMeta {\n  const forwardedProto = getRequestHeader(event, \"x-forwarded-proto\");\n  const host =\n    getRequestHeader(event, \"x-forwarded-host\") ||\n    getRequestHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const origin = host ? `${proto}://${host}` : undefined;\n  const targetHeader = getRequestHeader(\n    event,\n    \"x-agent-native-open-target\",\n  )?.toLowerCase();\n  const target =\n    targetHeader === \"desktop\" ||\n    targetHeader === \"terminal\" ||\n    targetHeader === \"browser\"\n      ? (targetHeader as MCPRequestMeta[\"target\"])\n      : undefined;\n  const clientName = getRequestHeader(event, \"user-agent\")?.trim() || undefined;\n  const clientHint =\n    getRequestHeader(event, \"x-agent-native-mcp-client\")?.trim() || undefined;\n  const fullCatalogHeader = getRequestHeader(\n    event,\n    \"x-agent-native-mcp-full-catalog\",\n  )?.toLowerCase();\n  const fullCatalog =\n    fullCatalogHeader === \"1\" ||\n    fullCatalogHeader === \"true\" ||\n    fullCatalogHeader === \"yes\";\n  const inlineAppsHeader = getRequestHeader(\n    event,\n    \"x-agent-native-mcp-inline-apps\",\n  )?.toLowerCase();\n  const inlineAppsRequested =\n    inlineAppsHeader === \"1\" ||\n    inlineAppsHeader === \"true\" ||\n    inlineAppsHeader === \"yes\";\n  const basePath = getConfiguredAppBasePath();\n  return {\n    origin,\n    ...(basePath ? { basePath } : {}),\n    target,\n    clientName,\n    clientHint,\n    ...(fullCatalog ? { fullCatalog } : {}),\n    ...(inlineAppsRequested ? { inlineMcpApps: true } : {}),\n  };\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    const hostname = new URL(origin).hostname;\n    return (\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"::1\" ||\n      hostname === \"[::1]\" ||\n      hostname.startsWith(\"127.\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Reconstruct a Web Standard `Request` for the web-standard MCP transport.\n *\n * On the web runtime h3 v2 exposes the real web `Request` as `event.req`; we\n * prefer it (its `method` / `headers` are exactly what the client sent). But\n * the framework middleware rewrites `event.req.url` when it strips a mount\n * prefix, and the transport reads `req.method` + `req.headers` (never the\n * body — we pass that via `parsedBody`), so we always synthesize a clean\n * `Request` with the verified method + a fresh `Headers` copy. The URL is\n * cosmetic for the SDK (it only does `new URL(req.url)` for `requestInfo`),\n * so a best-effort absolute URL derived from the inbound host is sufficient\n * and never throws.\n */\nfunction buildWebRequest(event: H3Event, method: string): Request {\n  const src = (event as any).req as Request | undefined;\n\n  const headers = new Headers();\n  if (src?.headers && typeof src.headers.forEach === \"function\") {\n    src.headers.forEach((value, key) => headers.set(key, value));\n  } else {\n    const rawHeaders = (event as any).node?.req?.headers as\n      | Record<string, string | string[] | undefined>\n      | undefined;\n    if (rawHeaders) {\n      for (const [key, value] of Object.entries(rawHeaders)) {\n        if (value == null) continue;\n        headers.set(key, Array.isArray(value) ? value.join(\", \") : value);\n      }\n    }\n  }\n\n  // The SDK requires Accept + Content-Type to advertise both JSON and SSE on\n  // a POST. Real MCP clients (Claude Code, `agent-native connect`) always\n  // send these; we never inject/alter them — if they're absent the SDK\n  // returns its spec-mandated 406/415, identical to the Node path.\n\n  const host =\n    headers.get(\"x-forwarded-host\") || headers.get(\"host\") || \"localhost\";\n  const forwardedProto = headers.get(\"x-forwarded-proto\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (/^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const basePath = getConfiguredAppBasePath();\n  const url = `${proto}://${host}${basePath}/_agent-native/mcp`;\n\n  // No body here on purpose: the JSON-RPC payload is forwarded via the\n  // transport's `parsedBody` option (the same mechanism the Node transport\n  // uses), so the request stream is never read twice.\n  return new Request(url, { method, headers });\n}\n\n/**\n * Build an actionable JSON body for the 401 response. OAuth-capable clients\n * follow the `WWW-Authenticate` header automatically, but the JSON body is what\n * a human or a coding agent reads when a tool call comes back unauthorized — so\n * spell out the exact remediation: the `agent-native connect <url>` command and\n * the authorize/metadata URL. Keeping the legacy `error: \"Unauthorized\"` field\n * means existing clients that only check that field still work.\n */\nfunction buildUnauthorizedBody(event: H3Event): {\n  error: string;\n  message: string;\n  authenticate: {\n    command?: string;\n    firstTimeCommand?: string;\n    authorizeUrl?: string;\n    resourceMetadataUrl?: string;\n    mcpUrl?: string;\n  };\n} {\n  const issuer = getMcpOAuthIssuer(event);\n  const mcpUrl = getMcpOAuthResource(event);\n  const resourceMetadataUrl = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const command = issuer\n    ? `npx -y @agent-native/core@latest reconnect ${issuer}`\n    : undefined;\n  const firstTimeCommand = issuer\n    ? `npx @agent-native/core@latest connect ${issuer}`\n    : undefined;\n  const authorizeUrl = issuer\n    ? `${issuer}/_agent-native/mcp/oauth/authorize`\n    : undefined;\n  const message = command\n    ? `Authentication required. Run \\`${command}\\` to re-authenticate this ` +\n      `MCP connector without reinstalling it (or, in a Claude Code host, ` +\n      `run /mcp and choose Authenticate), then retry. For first-time ` +\n      `setup, run \\`${firstTimeCommand}\\`.`\n    : \"Authentication required. Authenticate the MCP connector in your host, \" +\n      \"then retry.\";\n  return {\n    error: \"Unauthorized\",\n    message,\n    authenticate: {\n      ...(command ? { command } : {}),\n      ...(firstTimeCommand ? { firstTimeCommand } : {}),\n      ...(authorizeUrl ? { authorizeUrl } : {}),\n      ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),\n      ...(mcpUrl ? { mcpUrl } : {}),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// handleMcpRequest — runtime-agnostic MCP request handler\n// ---------------------------------------------------------------------------\n\n/**\n * Handle a single `{routePrefix}/mcp` request on either runtime.\n *\n * - **Default path:** build the SAME MCP `Server`\n *   from the SAME config + identity, drive it through the SDK's\n *   `WebStandardStreamableHTTPServerTransport` (which the Node transport is\n *   itself just a thin wrapper around), and return the resulting Web\n *   `Response` as a normal h3 return value. This is used for Nitro local dev\n *   too; the direct Node writer can otherwise race h3 and double-write.\n * - **Opt-in Node fast-path:** set `AGENT_NATIVE_MCP_NODE_FAST_PATH=1` to\n *   delegate directly to the SDK's `StreamableHTTPServerTransport`.\n *\n * Auth, the `runWithRequestContext` identity wrap, the deep-link `_meta` /\n * markdown append, `requestMeta` origin/target derivation and the stateless\n * semantics are IDENTICAL on both paths because both build the same server\n * via `createMCPServerForRequest` and both transports funnel into the same\n * `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n * parsedBody })` with the same options.\n *\n * Returns:\n *   - `undefined` when the request targets a sub-route (so management/status\n *     routes mounted under `/_agent-native/mcp/*` handle it themselves) — the\n *     h3 mount falls through to the next handler.\n *   - a Web `Response` (web fallback) or a string/object (Node path /\n *     auth-error path) otherwise. The Node path also sets `_handled` so h3\n *     doesn't double-write.\n */\nexport async function handleMcpRequest(\n  event: H3Event,\n  config: MCPConfig,\n): Promise<\n  Response | string | { error: string } | Record<string, unknown> | undefined\n> {\n  const pathname = event.url?.pathname || \"/\";\n  const subpath = pathname.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (subpath) {\n    // Let management/status routes mounted under /_agent-native/mcp/* handle\n    // their own requests instead of treating them as MCP protocol traffic.\n    return undefined;\n  }\n\n  const method = getMethod(event);\n\n  // Auth check — extracts the caller's identity from the JWT (`sub`), or, on\n  // the static-token / dev-open path, from the forwarded\n  // `X-Agent-Native-Owner-Email` hint the stdio proxy sends (the\n  // `agent-native mcp install` flow). Without this the install flow would run\n  // every tool unscoped (userEmail === undefined).\n  const authHeader = getRequestHeader(event, \"authorization\");\n  const ownerEmailHeader = getRequestHeader(\n    event,\n    \"x-agent-native-owner-email\",\n  );\n  // Gate header-only dev-open on the REAL socket peer, never a parsed\n  // `Host` header (client-controlled — an attacker could send\n  // `Host: localhost`). A deployed app missing A2A_SECRET / ACCESS_TOKEN\n  // must fail closed rather than trust a spoofable owner-email header that\n  // `fullSurface` would otherwise escalate to the full mutating surface.\n  const requestMeta = deriveRequestMeta(event);\n  const authResult = await verifyAuth(authHeader, ownerEmailHeader, {\n    allowDevOpen:\n      isLoopbackRequest(event) && isLoopbackOrigin(requestMeta.origin),\n    resourceUrl: getMcpOAuthAudiences(event),\n  });\n  if (!authResult.authed) {\n    setResponseStatus(event, 401);\n    setResponseHeader(event, \"WWW-Authenticate\", buildMcpOAuthChallenge(event));\n    return buildUnauthorizedBody(event);\n  }\n\n  // Stateless mode: only POST is meaningful. A stateless, per-request transport\n  // on serverless cannot keep the standalone GET SSE stream (server->client\n  // channel) alive across invocations — once the function returns and freezes,\n  // that stream dies and the client reports \"session expired\" / \"not\n  // connected\". The spec lets a server that offers no GET stream answer 405, so\n  // the client falls back to plain POST request/response. Reject GET here\n  // instead of letting the SDK open a doomed stream.\n  if (method === \"DELETE\") {\n    setResponseStatus(event, 204);\n    return \"\";\n  }\n\n  if (method !== \"POST\") {\n    setResponseStatus(event, 405);\n    return { error: \"Method not allowed\" };\n  }\n\n  // Read body for POST (GET has no body). Read it via the h3 helper exactly\n  // once; both transports accept it as a pre-parsed body so the request\n  // stream is never consumed twice.\n  const body = method === \"POST\" ? await readBody(event) : undefined;\n\n  // Optional diagnostics for host capability negotiation. Keep disabled by\n  // default because initialize payloads can include client-specific metadata.\n  if (process.env.MCP_DEBUG_INIT && body) {\n    const msgs = Array.isArray(body) ? body : [body];\n    const init = msgs.find(\n      (m): m is { params?: { capabilities?: unknown; clientInfo?: unknown } } =>\n        typeof m === \"object\" &&\n        m !== null &&\n        (m as { method?: unknown }).method === \"initialize\",\n    );\n    if (init) {\n      console.error(\n        \"[MCP_DEBUG_INIT] clientInfo=\",\n        JSON.stringify(init.params?.clientInfo),\n        \"capabilities=\",\n        JSON.stringify(init.params?.capabilities),\n      );\n    }\n  }\n\n  // Per-request stateless transport + server. Both runtimes build the SAME\n  // server from the SAME config + verified identity + request meta, so\n  // tools/list, tools/call, and the deep-link `_meta` are identical. A\n  // connected real caller (connect-minted token / `mcp install` /\n  // ACCESS_TOKEN / production) gets the full action surface even in local\n  // dev; unauthenticated dev probes stay sparse. See `external-agents` skill.\n  const server = await createMCPServerForRequest(config, authResult.identity, {\n    ...requestMeta,\n    fullSurface: authResult.fullSurface === true,\n    inlineMcpApps:\n      requestMeta.inlineMcpApps === true &&\n      authResult.identity?.firstPartyMcp === true\n        ? true\n        : undefined,\n    // When the caller minted their token with --full-catalog (catalog_scope:\n    // \"full\" JWT claim), bypass the connector-catalog tier filter.\n    ...(authResult.fullCatalog === true ? { fullCatalog: true } : {}),\n  });\n\n  if (shouldUseNodeFastPath(event)) {\n    const { nodeReq, nodeRes } = getNodeReqRes(event);\n    // ---- Opt-in Node fast-path ---------------------------------------------\n    const { StreamableHTTPServerTransport } =\n      await import(\"@modelcontextprotocol/sdk/server/streamableHttp.js\");\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: undefined, // stateless\n      // Return JSON request/response instead of SSE. A stateless serverless\n      // instance can freeze right after returning a streaming Response, before\n      // the deferred SSE result event is flushed — the client then never gets\n      // the tools/call result and reports \"session expired\". JSON mode awaits\n      // the result inside the request lifecycle and returns it as one body.\n      enableJsonResponse: true,\n    });\n    await server.connect(transport);\n    try {\n      // The SDK transport writes directly to the Node response. Node-only by\n      // construction; we only reach here when real Node req/res exist.\n      await transport.handleRequest(nodeReq, nodeRes, body);\n    } catch (err: any) {\n      // The SDK transport writes directly to the Node response. If the socket\n      // is already closed/ended (client disconnected, or the host stream\n      // layer also flushed), Node throws ERR_STREAM_WRITE_AFTER_END *after*\n      // the MCP payload was already delivered correctly. Swallow that benign\n      // post-flush write so an external agent disconnecting mid-stream can\n      // never take down the server process; rethrow anything else.\n      if (err?.code !== \"ERR_STREAM_WRITE_AFTER_END\") throw err;\n      if (process.env.DEBUG)\n        console.log(\n          \"[mcp] ignored post-flush ERR_STREAM_WRITE_AFTER_END (client disconnected)\",\n        );\n    }\n    // Prevent H3 from double-writing the response\n    (event as any)._handled = true;\n    return undefined;\n  }\n\n  // ---- Web-standard response path (Nitro local dev, Netlify web runtime, CF,\n  // Deno, Bun) ---------------------------------------------------------------\n  //\n  // `StreamableHTTPServerTransport` is itself just a thin wrapper that\n  // converts the Node req/res to a web Request/Response and delegates to\n  // `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n  // parsedBody })`. Using the web transport directly with the SAME options +\n  // the same pre-read `parsedBody` produces byte-identical protocol output\n  // (including the deep-link `_meta` built inside createMCPServerForRequest),\n  // and works on every web runtime because it returns a Web `Response`\n  // (JSON for request/response, or an SSE `ReadableStream` body which h3\n  // streams natively).\n  const { WebStandardStreamableHTTPServerTransport } =\n    await import(\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\");\n  const transport = new WebStandardStreamableHTTPServerTransport({\n    sessionIdGenerator: undefined, // stateless — same as the Node path\n    // JSON request/response (not SSE) — see the Node fast-path note above.\n    // This is the serverless-safe framing: the result is computed and returned\n    // within the request, never pushed onto a stream after the instance froze.\n    enableJsonResponse: true,\n  });\n  await server.connect(transport);\n  const webRequest = buildWebRequest(event, method);\n  // `parsedBody: undefined` would make the SDK try to read `req.json()`; our\n  // synthesized request has no body, so only pass the option for POST (where\n  // we actually have a parsed body). For GET the transport reads no body.\n  const response = await transport.handleRequest(\n    webRequest,\n    method === \"POST\" ? { parsedBody: body } : undefined,\n  );\n  return response;\n}\n\n// ---------------------------------------------------------------------------\n// mountMCP — register MCP Streamable HTTP endpoint on H3/Nitro\n// ---------------------------------------------------------------------------\n\n/**\n * Mount an MCP remote server on an H3/Nitro app.\n *\n * Endpoint: `{routePrefix}/mcp` (default `/_agent-native/mcp`)\n *\n * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON\n * request/response (no SSE), and no standalone GET stream, so it survives\n * serverless instances that freeze between invocations (SSE framing there\n * drops the result and clients report \"session expired\"). Runtime-agnostic: a real Node\n * server uses the SDK's Node transport; the web-standard runtime (Nitro 3 /\n * Netlify web runtime, Cloudflare, Deno, Bun) uses the SDK's web-standard\n * transport. Both build the same server and produce identical JSON-RPC\n * output.\n *\n * Auth: Bearer token matching ACCESS_TOKEN/ACCESS_TOKENS or JWT via A2A_SECRET.\n * No auth required when neither is configured (dev mode).\n */\nexport function mountMCP(\n  nitroApp: any,\n  config: MCPConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  getH3App(nitroApp).use(\n    `${routePrefix}/mcp`,\n    defineEventHandler(async (event) => {\n      return handleMcpRequest(event as H3Event, config);\n    }),\n  );\n\n  if (process.env.DEBUG)\n    console.log(\n      `[mcp] Mounted MCP server at ${routePrefix}/mcp (${Object.keys(config.actions).length} tools${config.askAgent ? \" + ask-agent\" : \"\"})`,\n    );\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GAInB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,uCAAuC,EACvC,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,6EAA6E;AAC7E,4EAA4E;AAC5E,yDAAyD;AACzD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,CAAC;AAGF,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAc;IAInC,MAAM,CAAC,GAAG,KAAY,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,IAAI,GACR,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,YAAY,GAAG,gBAAgB,CACnC,KAAK,EACL,4BAA4B,CAC7B,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,UAAU;QAC3B,YAAY,KAAK,SAAS;QACxB,CAAC,CAAE,YAAyC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9E,MAAM,UAAU,GACd,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5E,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,KAAK,EACL,iCAAiC,CAClC,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,WAAW,GACf,iBAAiB,KAAK,GAAG;QACzB,iBAAiB,KAAK,MAAM;QAC5B,iBAAiB,KAAK,KAAK,CAAC;IAC9B,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,KAAK,EACL,gCAAgC,CACjC,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,mBAAmB,GACvB,gBAAgB,KAAK,GAAG;QACxB,gBAAgB,KAAK,MAAM;QAC3B,gBAAgB,KAAK,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;QACN,UAAU;QACV,UAAU;QACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,KAAK;YAClB,QAAQ,KAAK,OAAO;YACpB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAc;IACrD,MAAM,GAAG,GAAI,KAAa,CAAC,GAA0B,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAI,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAEhC,CAAC;QACd,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK,IAAI,IAAI;oBAAE,SAAS;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IAEjE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAEtE,qEAAqE;IACrE,yEAAyE;IACzE,oDAAoD;IACpD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAW3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,8CAA8C,MAAM,EAAE;QACxD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,gBAAgB,GAAG,MAAM;QAC7B,CAAC,CAAC,yCAAyC,MAAM,EAAE;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC,GAAG,MAAM,GAAG,uBAAuB,kBAAkB;QACvD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,kCAAkC,OAAO,6BAA6B;YACtE,oEAAoE;YACpE,gEAAgE;YAChE,gBAAgB,gBAAgB,KAAK;QACvC,CAAC,CAAC,wEAAwE;YACxE,aAAa,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO;QACP,YAAY,EAAE;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAc,EACd,MAAiB;IAIjB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,uDAAuD;IACvD,+DAA+D;IAC/D,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,oEAAoE;IACpE,4DAA4D;IAC5D,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAChE,YAAY,EACV,iBAAiB,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC;QAClE,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,8EAA8E;IAC9E,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,CAAC,CAAC,EAAsE,EAAE,CACxE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACT,CAA0B,CAAC,MAAM,KAAK,YAAY,CACtD,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CACX,8BAA8B,EAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1E,GAAG,WAAW;QACd,WAAW,EAAE,UAAU,CAAC,WAAW,KAAK,IAAI;QAC5C,aAAa,EACX,WAAW,CAAC,aAAa,KAAK,IAAI;YAClC,UAAU,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI;YACzC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClD,2EAA2E;QAC3E,MAAM,EAAE,6BAA6B,EAAE,GACrC,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,GAAG,EAAE,IAAI,KAAK,4BAA4B;gBAAE,MAAM,GAAG,CAAC;YAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;gBACnB,OAAO,CAAC,GAAG,CACT,2EAA2E,CAC5E,CAAC;QACN,CAAC;QACD,8CAA8C;QAC7C,KAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,qBAAqB;IACrB,MAAM,EAAE,wCAAwC,EAAE,GAChD,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,SAAS,EAAE,oCAAoC;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,UAAU,EACV,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,MAAM,UAAU,GACd,WAAW,KAAK,gBAAgB;QAC9B,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC;QACzB,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjD,OAAO,gBAAgB,CAAC,KAAgB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACnB,OAAO,CAAC,GAAG,CACT,+BAA+B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CAChJ,CAAC;AACN,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\n\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { isLoopbackRequest } from \"../server/auth.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n  type MCPConfig,\n  type MCPCallerIdentity,\n  type MCPRequestMeta,\n} from \"./build-server.js\";\nimport {\n  buildMcpOAuthChallenge,\n  getMcpOAuthAudiences,\n  getMcpOAuthIssuer,\n  getMcpOAuthProtectedResourceMetadataUrl,\n  getMcpOAuthResource,\n} from \"./oauth-route.js\";\nimport {\n  MCP_PUBLIC_ROUTE_PREFIX,\n  MCP_ROUTE_PREFIXES,\n  joinMcpRoute,\n} from \"./route-paths.js\";\n\n// Re-export the shared MCP server builder + types so the stdio transport and\n// any (future) external importer of `@agent-native/core/mcp` keep resolving\n// against `./server.js` exactly as before this refactor.\nexport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n};\nexport type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };\n\n// ---------------------------------------------------------------------------\n// Runtime detection — Node fast-path vs. web-standard fallback\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the underlying Node `http` req/res pair if (and only if) we're\n * running on a real Node HTTP server (local dev, `node` Nitro preset). On the\n * web-standard runtime (Nitro 3 / Netlify web runtime, Cloudflare, Deno, Bun)\n * BOTH of these are undefined — that's the signal to take the web fallback\n * instead of returning 501.\n */\nfunction getNodeReqRes(event: H3Event): {\n  nodeReq: any | undefined;\n  nodeRes: any | undefined;\n} {\n  const e = event as any;\n  const nodeReq = e.node?.req ?? e.req?.runtime?.node?.req;\n  const nodeRes = e.node?.res ?? e.req?.runtime?.node?.res;\n  return { nodeReq, nodeRes };\n}\n\nfunction shouldUseNodeFastPath(event: H3Event): boolean {\n  if (process.env.AGENT_NATIVE_MCP_NODE_FAST_PATH !== \"1\") return false;\n  const { nodeReq, nodeRes } = getNodeReqRes(event);\n  return Boolean(nodeReq && nodeRes);\n}\n\n/**\n * Derive the request origin + the markdown deep-link target from the inbound\n * headers. Identical logic for both the Node and web paths so the absolute\n * deep-link URLs in tool results are computed the same way regardless of\n * runtime.\n */\nfunction deriveRequestMeta(event: H3Event): MCPRequestMeta {\n  const forwardedProto = getRequestHeader(event, \"x-forwarded-proto\");\n  const host =\n    getRequestHeader(event, \"x-forwarded-host\") ||\n    getRequestHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const origin = host ? `${proto}://${host}` : undefined;\n  const targetHeader = getRequestHeader(\n    event,\n    \"x-agent-native-open-target\",\n  )?.toLowerCase();\n  const target =\n    targetHeader === \"desktop\" ||\n    targetHeader === \"terminal\" ||\n    targetHeader === \"browser\"\n      ? (targetHeader as MCPRequestMeta[\"target\"])\n      : undefined;\n  const clientName = getRequestHeader(event, \"user-agent\")?.trim() || undefined;\n  const clientHint =\n    getRequestHeader(event, \"x-agent-native-mcp-client\")?.trim() || undefined;\n  const fullCatalogHeader = getRequestHeader(\n    event,\n    \"x-agent-native-mcp-full-catalog\",\n  )?.toLowerCase();\n  const fullCatalog =\n    fullCatalogHeader === \"1\" ||\n    fullCatalogHeader === \"true\" ||\n    fullCatalogHeader === \"yes\";\n  const inlineAppsHeader = getRequestHeader(\n    event,\n    \"x-agent-native-mcp-inline-apps\",\n  )?.toLowerCase();\n  const inlineAppsRequested =\n    inlineAppsHeader === \"1\" ||\n    inlineAppsHeader === \"true\" ||\n    inlineAppsHeader === \"yes\";\n  const basePath = getConfiguredAppBasePath();\n  return {\n    origin,\n    ...(basePath ? { basePath } : {}),\n    target,\n    clientName,\n    clientHint,\n    ...(fullCatalog ? { fullCatalog } : {}),\n    ...(inlineAppsRequested ? { inlineMcpApps: true } : {}),\n  };\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    const hostname = new URL(origin).hostname;\n    return (\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"::1\" ||\n      hostname === \"[::1]\" ||\n      hostname.startsWith(\"127.\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Reconstruct a Web Standard `Request` for the web-standard MCP transport.\n *\n * On the web runtime h3 v2 exposes the real web `Request` as `event.req`; we\n * prefer it (its `method` / `headers` are exactly what the client sent). But\n * the framework middleware rewrites `event.req.url` when it strips a mount\n * prefix, and the transport reads `req.method` + `req.headers` (never the\n * body — we pass that via `parsedBody`), so we always synthesize a clean\n * `Request` with the verified method + a fresh `Headers` copy. The URL is\n * cosmetic for the SDK (it only does `new URL(req.url)` for `requestInfo`),\n * so a best-effort absolute URL derived from the inbound host is sufficient\n * and never throws.\n */\nfunction buildWebRequest(event: H3Event, method: string): Request {\n  const src = (event as any).req as Request | undefined;\n\n  const headers = new Headers();\n  if (src?.headers && typeof src.headers.forEach === \"function\") {\n    src.headers.forEach((value, key) => headers.set(key, value));\n  } else {\n    const rawHeaders = (event as any).node?.req?.headers as\n      | Record<string, string | string[] | undefined>\n      | undefined;\n    if (rawHeaders) {\n      for (const [key, value] of Object.entries(rawHeaders)) {\n        if (value == null) continue;\n        headers.set(key, Array.isArray(value) ? value.join(\", \") : value);\n      }\n    }\n  }\n\n  // The SDK requires Accept + Content-Type to advertise both JSON and SSE on\n  // a POST. Real MCP clients (Claude Code, `agent-native connect`) always\n  // send these; we never inject/alter them — if they're absent the SDK\n  // returns its spec-mandated 406/415, identical to the Node path.\n\n  const host =\n    headers.get(\"x-forwarded-host\") || headers.get(\"host\") || \"localhost\";\n  const forwardedProto = headers.get(\"x-forwarded-proto\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (/^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const basePath = getConfiguredAppBasePath();\n  const url = `${proto}://${host}${basePath}${MCP_PUBLIC_ROUTE_PREFIX}`;\n\n  // No body here on purpose: the JSON-RPC payload is forwarded via the\n  // transport's `parsedBody` option (the same mechanism the Node transport\n  // uses), so the request stream is never read twice.\n  return new Request(url, { method, headers });\n}\n\n/**\n * Build an actionable JSON body for the 401 response. OAuth-capable clients\n * follow the `WWW-Authenticate` header automatically, but the JSON body is what\n * a human or a coding agent reads when a tool call comes back unauthorized — so\n * spell out the exact remediation: the `agent-native connect <url>` command and\n * the authorize/metadata URL. Keeping the legacy `error: \"Unauthorized\"` field\n * means existing clients that only check that field still work.\n */\nfunction buildUnauthorizedBody(event: H3Event): {\n  error: string;\n  message: string;\n  authenticate: {\n    command?: string;\n    firstTimeCommand?: string;\n    authorizeUrl?: string;\n    resourceMetadataUrl?: string;\n    mcpUrl?: string;\n  };\n} {\n  const issuer = getMcpOAuthIssuer(event);\n  const mcpUrl = getMcpOAuthResource(event);\n  const resourceMetadataUrl = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const command = issuer\n    ? `npx -y @agent-native/core@latest reconnect ${issuer}`\n    : undefined;\n  const firstTimeCommand = issuer\n    ? `npx @agent-native/core@latest connect ${issuer}`\n    : undefined;\n  const authorizeUrl = issuer\n    ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/authorize`\n    : undefined;\n  const message = command\n    ? `Authentication required. Run \\`${command}\\` to re-authenticate this ` +\n      `MCP connector without reinstalling it (or, in a Claude Code host, ` +\n      `run /mcp and choose Authenticate), then retry. For first-time ` +\n      `setup, run \\`${firstTimeCommand}\\`.`\n    : \"Authentication required. Authenticate the MCP connector in your host, \" +\n      \"then retry.\";\n  return {\n    error: \"Unauthorized\",\n    message,\n    authenticate: {\n      ...(command ? { command } : {}),\n      ...(firstTimeCommand ? { firstTimeCommand } : {}),\n      ...(authorizeUrl ? { authorizeUrl } : {}),\n      ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),\n      ...(mcpUrl ? { mcpUrl } : {}),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// handleMcpRequest — runtime-agnostic MCP request handler\n// ---------------------------------------------------------------------------\n\n/**\n * Handle a single `{routePrefix}/mcp` request on either runtime.\n *\n * - **Default path:** build the SAME MCP `Server`\n *   from the SAME config + identity, drive it through the SDK's\n *   `WebStandardStreamableHTTPServerTransport` (which the Node transport is\n *   itself just a thin wrapper around), and return the resulting Web\n *   `Response` as a normal h3 return value. This is used for Nitro local dev\n *   too; the direct Node writer can otherwise race h3 and double-write.\n * - **Opt-in Node fast-path:** set `AGENT_NATIVE_MCP_NODE_FAST_PATH=1` to\n *   delegate directly to the SDK's `StreamableHTTPServerTransport`.\n *\n * Auth, the `runWithRequestContext` identity wrap, the deep-link `_meta` /\n * markdown append, `requestMeta` origin/target derivation and the stateless\n * semantics are IDENTICAL on both paths because both build the same server\n * via `createMCPServerForRequest` and both transports funnel into the same\n * `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n * parsedBody })` with the same options.\n *\n * Returns:\n *   - `undefined` when the request targets a sub-route (so management/status\n *     routes mounted under `/_agent-native/mcp/*` handle it themselves) — the\n *     h3 mount falls through to the next handler.\n *   - a Web `Response` (web fallback) or a string/object (Node path /\n *     auth-error path) otherwise. The Node path also sets `_handled` so h3\n *     doesn't double-write.\n */\nexport async function handleMcpRequest(\n  event: H3Event,\n  config: MCPConfig,\n): Promise<\n  Response | string | { error: string } | Record<string, unknown> | undefined\n> {\n  const pathname = event.url?.pathname || \"/\";\n  const subpath = pathname.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (subpath) {\n    // Let management/status routes mounted under /_agent-native/mcp/* handle\n    // their own requests instead of treating them as MCP protocol traffic.\n    return undefined;\n  }\n\n  const method = getMethod(event);\n\n  // Auth check — extracts the caller's identity from the JWT (`sub`), or, on\n  // the static-token / dev-open path, from the forwarded\n  // `X-Agent-Native-Owner-Email` hint the stdio proxy sends (the\n  // `agent-native mcp install` flow). Without this the install flow would run\n  // every tool unscoped (userEmail === undefined).\n  const authHeader = getRequestHeader(event, \"authorization\");\n  const ownerEmailHeader = getRequestHeader(\n    event,\n    \"x-agent-native-owner-email\",\n  );\n  // Gate header-only dev-open on the REAL socket peer, never a parsed\n  // `Host` header (client-controlled — an attacker could send\n  // `Host: localhost`). A deployed app missing A2A_SECRET / ACCESS_TOKEN\n  // must fail closed rather than trust a spoofable owner-email header that\n  // `fullSurface` would otherwise escalate to the full mutating surface.\n  const requestMeta = deriveRequestMeta(event);\n  const authResult = await verifyAuth(authHeader, ownerEmailHeader, {\n    allowDevOpen:\n      isLoopbackRequest(event) && isLoopbackOrigin(requestMeta.origin),\n    resourceUrl: getMcpOAuthAudiences(event),\n  });\n  if (!authResult.authed) {\n    setResponseStatus(event, 401);\n    setResponseHeader(event, \"WWW-Authenticate\", buildMcpOAuthChallenge(event));\n    return buildUnauthorizedBody(event);\n  }\n\n  // Stateless mode: only POST is meaningful. A stateless, per-request transport\n  // on serverless cannot keep the standalone GET SSE stream (server->client\n  // channel) alive across invocations — once the function returns and freezes,\n  // that stream dies and the client reports \"session expired\" / \"not\n  // connected\". The spec lets a server that offers no GET stream answer 405, so\n  // the client falls back to plain POST request/response. Reject GET here\n  // instead of letting the SDK open a doomed stream.\n  if (method === \"DELETE\") {\n    setResponseStatus(event, 204);\n    return \"\";\n  }\n\n  if (method !== \"POST\") {\n    setResponseStatus(event, 405);\n    return { error: \"Method not allowed\" };\n  }\n\n  // Read body for POST (GET has no body). Read it via the h3 helper exactly\n  // once; both transports accept it as a pre-parsed body so the request\n  // stream is never consumed twice.\n  const body = method === \"POST\" ? await readBody(event) : undefined;\n\n  // Optional diagnostics for host capability negotiation. Keep disabled by\n  // default because initialize payloads can include client-specific metadata.\n  if (process.env.MCP_DEBUG_INIT && body) {\n    const msgs = Array.isArray(body) ? body : [body];\n    const init = msgs.find(\n      (m): m is { params?: { capabilities?: unknown; clientInfo?: unknown } } =>\n        typeof m === \"object\" &&\n        m !== null &&\n        (m as { method?: unknown }).method === \"initialize\",\n    );\n    if (init) {\n      console.error(\n        \"[MCP_DEBUG_INIT] clientInfo=\",\n        JSON.stringify(init.params?.clientInfo),\n        \"capabilities=\",\n        JSON.stringify(init.params?.capabilities),\n      );\n    }\n  }\n\n  // Per-request stateless transport + server. Both runtimes build the SAME\n  // server from the SAME config + verified identity + request meta, so\n  // tools/list, tools/call, and the deep-link `_meta` are identical. A\n  // connected real caller (connect-minted token / `mcp install` /\n  // ACCESS_TOKEN / production) gets the full action surface even in local\n  // dev; unauthenticated dev probes stay sparse. See `external-agents` skill.\n  const server = await createMCPServerForRequest(config, authResult.identity, {\n    ...requestMeta,\n    fullSurface: authResult.fullSurface === true,\n    inlineMcpApps:\n      requestMeta.inlineMcpApps === true &&\n      authResult.identity?.firstPartyMcp === true\n        ? true\n        : undefined,\n    // When the caller minted their token with --full-catalog (catalog_scope:\n    // \"full\" JWT claim), bypass the connector-catalog tier filter.\n    ...(authResult.fullCatalog === true ? { fullCatalog: true } : {}),\n  });\n\n  if (shouldUseNodeFastPath(event)) {\n    const { nodeReq, nodeRes } = getNodeReqRes(event);\n    // ---- Opt-in Node fast-path ---------------------------------------------\n    const { StreamableHTTPServerTransport } =\n      await import(\"@modelcontextprotocol/sdk/server/streamableHttp.js\");\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: undefined, // stateless\n      // Return JSON request/response instead of SSE. A stateless serverless\n      // instance can freeze right after returning a streaming Response, before\n      // the deferred SSE result event is flushed — the client then never gets\n      // the tools/call result and reports \"session expired\". JSON mode awaits\n      // the result inside the request lifecycle and returns it as one body.\n      enableJsonResponse: true,\n    });\n    await server.connect(transport);\n    try {\n      // The SDK transport writes directly to the Node response. Node-only by\n      // construction; we only reach here when real Node req/res exist.\n      await transport.handleRequest(nodeReq, nodeRes, body);\n    } catch (err: any) {\n      // The SDK transport writes directly to the Node response. If the socket\n      // is already closed/ended (client disconnected, or the host stream\n      // layer also flushed), Node throws ERR_STREAM_WRITE_AFTER_END *after*\n      // the MCP payload was already delivered correctly. Swallow that benign\n      // post-flush write so an external agent disconnecting mid-stream can\n      // never take down the server process; rethrow anything else.\n      if (err?.code !== \"ERR_STREAM_WRITE_AFTER_END\") throw err;\n      if (process.env.DEBUG)\n        console.log(\n          \"[mcp] ignored post-flush ERR_STREAM_WRITE_AFTER_END (client disconnected)\",\n        );\n    }\n    // Prevent H3 from double-writing the response\n    (event as any)._handled = true;\n    return undefined;\n  }\n\n  // ---- Web-standard response path (Nitro local dev, Netlify web runtime, CF,\n  // Deno, Bun) ---------------------------------------------------------------\n  //\n  // `StreamableHTTPServerTransport` is itself just a thin wrapper that\n  // converts the Node req/res to a web Request/Response and delegates to\n  // `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n  // parsedBody })`. Using the web transport directly with the SAME options +\n  // the same pre-read `parsedBody` produces byte-identical protocol output\n  // (including the deep-link `_meta` built inside createMCPServerForRequest),\n  // and works on every web runtime because it returns a Web `Response`\n  // (JSON for request/response, or an SSE `ReadableStream` body which h3\n  // streams natively).\n  const { WebStandardStreamableHTTPServerTransport } =\n    await import(\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\");\n  const transport = new WebStandardStreamableHTTPServerTransport({\n    sessionIdGenerator: undefined, // stateless — same as the Node path\n    // JSON request/response (not SSE) — see the Node fast-path note above.\n    // This is the serverless-safe framing: the result is computed and returned\n    // within the request, never pushed onto a stream after the instance froze.\n    enableJsonResponse: true,\n  });\n  await server.connect(transport);\n  const webRequest = buildWebRequest(event, method);\n  // `parsedBody: undefined` would make the SDK try to read `req.json()`; our\n  // synthesized request has no body, so only pass the option for POST (where\n  // we actually have a parsed body). For GET the transport reads no body.\n  const response = await transport.handleRequest(\n    webRequest,\n    method === \"POST\" ? { parsedBody: body } : undefined,\n  );\n  return response;\n}\n\n// ---------------------------------------------------------------------------\n// mountMCP — register MCP Streamable HTTP endpoint on H3/Nitro\n// ---------------------------------------------------------------------------\n\n/**\n * Mount an MCP remote server on an H3/Nitro app.\n *\n * Endpoints: `/mcp` (public) and `/_agent-native/mcp` (compatibility).\n * A custom route prefix only mounts that custom endpoint.\n *\n * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON\n * request/response (no SSE), and no standalone GET stream, so it survives\n * serverless instances that freeze between invocations (SSE framing there\n * drops the result and clients report \"session expired\"). Runtime-agnostic: a real Node\n * server uses the SDK's Node transport; the web-standard runtime (Nitro 3 /\n * Netlify web runtime, Cloudflare, Deno, Bun) uses the SDK's web-standard\n * transport. Both build the same server and produce identical JSON-RPC\n * output.\n *\n * Auth: Bearer token matching ACCESS_TOKEN/ACCESS_TOKENS or JWT via A2A_SECRET.\n * No auth required when neither is configured (dev mode).\n */\nexport function mountMCP(\n  nitroApp: any,\n  config: MCPConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  const routePaths =\n    routePrefix === \"/_agent-native\"\n      ? [...MCP_ROUTE_PREFIXES]\n      : [joinMcpRoute(routePrefix, \"/mcp\")];\n  const handler = defineEventHandler(async (event) => {\n    return handleMcpRequest(event as H3Event, config);\n  });\n\n  for (const routePath of routePaths) {\n    getH3App(nitroApp).use(routePath, handler);\n  }\n\n  if (process.env.DEBUG)\n    console.log(\n      `[mcp] Mounted MCP server at ${routePaths.join(\" and \")} (${Object.keys(config.actions).length} tools${config.askAgent ? \" + ask-agent\" : \"\"})`,\n    );\n}\n"]}

package/dist/mcp/stdio.d.ts

@@ -7,12 +7,13 @@
  *
  *   - **proxy (default)** — connect an MCP `Client` over
  *     `StreamableHTTPClientTransport` to the *already-running* local app's
- *     `http://127.0.0.1:<port>/_agent-native/mcp`, and run a stdio `Server`
- *     that forwards tools and optional MCP App resources to it. The live app
- *     is the single source of truth: HMR'd actions, the real registry, correct
- *     per-request deep links, and tenant scoping all come for free. If the
- *     app isn't running, we wait briefly for it (the workspace gateway boots
- *     it lazily on first request).
+ *     `http://127.0.0.1:<port>/mcp` (falling back to the legacy
+ *     `/_agent-native/mcp` path), and run a stdio `Server` that forwards tools
+ *     and optional MCP App resources to it. The live app is the single source
+ *     of truth: HMR'd actions, the real registry, correct per-request deep
+ *     links, and tenant scoping all come for free. If the app isn't running,
+ *     we wait briefly for it (the workspace gateway boots it lazily on first
+ *     request).
  *
  *   - **standalone (`--standalone`)** — no running server, no HMR. Build the
  *     MCP server in-process from `autoDiscoverActions(cwd)` +