@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/services/sessionMcpAuthorization/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/sessionMcpAuthorization/index.ts"],"mappings":";YAcY;qBAMC,6BAA6B;WAC/B,MAAM;EAEf,YAAY,MAAM,0BAA0B;;YAOlC;YACA;iBAWK;WACN;WACA;WACA;WACA;WACA;;iBAGM,gCAAgC;;WAEtC;;iBAGM;WACN;WACA;WACA;WACA;WACA,OAAO;;WAEP,UAAU;WACV;WACA;;YAGC,4CAA4C,KACtD;WAIe;WAA2B;WAAwB;;WACnD;WAA+B;WAAmC;;iBAGlE,wBAAwB;WAC9B;WACA;;iBAGM,8BAA8B;WACpC;;iBAGM;WACN;WACA;WACA;WACA;WACA,OAAO;;iBAGD;WACN;WACA;WACA;WACA;;WAEA;;YAGC;WACG;WAAuB;WAA8B;;WACrD;WAAuB;WAA8C;;iBAEnE;WACN;WACA;WACA;WACA;;YAGC;WAEG;WACA;WACA;WACA;WACA;WACA;;WAGA;WACA;WACA;WACA;;iBAGE;WACN;WACA,OAAO;WACP;;iBAGM;WACN,QAAQ;WACR;WACA;WACA,SAAS,KAAK;WACd;;iBAGM;EACf,aAAa,OAAO,8BAA8B;EAClD,WAAW,mBAAmB;EAC9B,wBAAwB;EACxB,aAAa;EACb,2BAA2B,OAAO,4CAA4C;EAC9E,yBAAyB,mBAAmB;EAC5C,uBACE,kBACA,qBACA,qBACC;EACH,8BAA8B,cAAc,kCAAkC;EAC9E,uBAAuB,OAAO,wCAAwC;EACtE,cAAc,SAAS,yBAAyB;EAChD,cAAc;EACd,qBAAqB,eAAe,mBAAmB;EACvD,wBAAwB,eAAe,mBAAmB;EAC1D,YAAY;EACZ,wBAAwB,mBAAmB;EAC3C,cAAc;;;wBA4IA,qCACd,UAAS,wCACR"}

package/dist/src/services/sessionMcpAuthorization/index.mjs

@@ -0,0 +1,430 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+//#region src/services/sessionMcpAuthorization/index.ts
+const ACCESS_TOKEN_TTL_MS = 9e5;
+const AUTHORIZATION_CODE_TTL_MS = 3e5;
+const CLIENT_ID_BYTES = 18;
+const CLIENT_SECRET_BYTES = 32;
+const DEFAULT_MAX_RECORDS = 1e4;
+const GRANT_ID_BYTES = 18;
+const REFRESH_TOKEN_TTL_MS = 2592e6;
+const TOKEN_BYTES = 32;
+const URL_TOKEN_HEADER = Buffer.from("{\"alg\":\"HS256\",\"typ\":\"JWT\"}").toString("base64url");
+const URL_TOKEN_ISSUER = "doompi-session-mcp";
+const URL_TOKEN_MAX_LENGTH = 4096;
+var SessionMcpOAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SessionMcpOAuthError";
+		this.code = code;
+	}
+};
+/**
+* Conversation routing is mandatory. Legacy registrations are migrated at read time
+* so they cannot continue to share their parent runtime.
+*/
+function sessionMcpRouting(value) {
+	if (value === void 0 || value === "session" || value === "conversation") return "conversation";
+	throw new SessionMcpOAuthError("invalid_request", "Session MCP routing is not supported.");
+}
+function digest(value) {
+	return createHash("sha256").update(value).digest();
+}
+function tokenKey(value) {
+	return digest(value).toString("hex");
+}
+function opaque(bytes = TOKEN_BYTES) {
+	return randomBytes(bytes).toString("base64url");
+}
+function exactSecret(actual, expectedHash) {
+	return timingSafeEqual(digest(actual), expectedHash);
+}
+function urlTokenSignature(input, key) {
+	return createHmac("sha256", key).update(input).digest();
+}
+function parseUrlToken(token) {
+	if (token.length > URL_TOKEN_MAX_LENGTH) return void 0;
+	const parts = token.split(".");
+	if (parts.length !== 3) return void 0;
+	const [header, payload, encodedSignature] = parts;
+	if (header !== URL_TOKEN_HEADER || !/^[A-Za-z0-9_-]{1,2048}$/u.test(payload) || !/^[A-Za-z0-9_-]{43}$/u.test(encodedSignature)) return void 0;
+	try {
+		const payloadBytes = Buffer.from(payload, "base64url");
+		const signature = Buffer.from(encodedSignature, "base64url");
+		if (payloadBytes.toString("base64url") !== payload || signature.length !== 32 || signature.toString("base64url") !== encodedSignature) return void 0;
+		const value = JSON.parse(payloadBytes.toString("utf8"));
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+		const claims = value;
+		if (Object.keys(value).sort().join(",") !== "aud,iat,iss,sid,sub" || claims.iss !== URL_TOKEN_ISSUER || typeof claims.sub !== "string" || claims.sub === "" || typeof claims.sid !== "string" || claims.sid === "" || typeof claims.aud !== "string" || claims.aud === "" || typeof claims.iat !== "number" || !Number.isSafeInteger(claims.iat)) return void 0;
+		return {
+			claims,
+			input: `${header}.${payload}`,
+			signature
+		};
+	} catch {
+		return;
+	}
+}
+function requireHttpsUrl(value, label, allowQuery) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new SessionMcpOAuthError("invalid_request", `${label} must be an absolute HTTPS URL.`);
+	}
+	if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.hash !== "" || !allowQuery && parsed.search !== "") throw new SessionMcpOAuthError("invalid_request", `${label} must be an absolute HTTPS URL without credentials, a query, or a fragment.`);
+	return parsed.href;
+}
+function requireName(value, label) {
+	const normalized = value.trim();
+	if (normalized === "") throw new SessionMcpOAuthError("invalid_request", `${label} must not be empty.`);
+	return normalized;
+}
+function exactUniqueGrants(values, label) {
+	if (values.some((value) => value === "" || value !== value.trim())) throw new SessionMcpOAuthError("invalid_request", `${label} grants must contain exact non-empty names.`);
+	return Object.freeze([...new Set(values)]);
+}
+/** In-memory restricted OAuth authority. It intentionally has no discovery or client registration surface. */
+function createSessionMcpAuthorizationService(options = {}) {
+	const now = options.now ?? Date.now;
+	const codeTtl = options.authorizationCodeTtlMs ?? AUTHORIZATION_CODE_TTL_MS;
+	const accessTtl = options.accessTokenTtlMs ?? ACCESS_TOKEN_TTL_MS;
+	const refreshTtl = options.refreshTokenTtlMs ?? REFRESH_TOKEN_TTL_MS;
+	const maxRecords = options.maxRecords ?? DEFAULT_MAX_RECORDS;
+	if (!Number.isSafeInteger(maxRecords) || maxRecords < 3) throw new Error("Session MCP authorization maxRecords must be a safe integer of at least 3.");
+	const clients = /* @__PURE__ */ new Map();
+	const bindings = /* @__PURE__ */ new Map();
+	const grants = /* @__PURE__ */ new Map();
+	const codes = /* @__PURE__ */ new Map();
+	const accessTokens = /* @__PURE__ */ new Map();
+	const refreshTokens = /* @__PURE__ */ new Map();
+	const consumedRefreshTokens = /* @__PURE__ */ new Map();
+	const publicClient = ({ secretHash: _secretHash, ...client }) => client;
+	const recordCount = () => grants.size + codes.size + accessTokens.size + refreshTokens.size + consumedRefreshTokens.size;
+	const sweep = () => {
+		const currentTime = now();
+		for (const [key, value] of codes) if (value.expiresAt <= currentTime) codes.delete(key);
+		for (const [key, value] of accessTokens) if (value.expiresAt <= currentTime) accessTokens.delete(key);
+		for (const [key, value] of refreshTokens) if (value.expiresAt <= currentTime) refreshTokens.delete(key);
+		for (const [key, value] of consumedRefreshTokens) if (value.expiresAt <= currentTime) consumedRefreshTokens.delete(key);
+		const referencedGrants = /* @__PURE__ */ new Set();
+		for (const value of codes.values()) referencedGrants.add(value.grant.id);
+		for (const value of accessTokens.values()) referencedGrants.add(value.grant.id);
+		for (const value of refreshTokens.values()) referencedGrants.add(value.grant.id);
+		for (const value of consumedRefreshTokens.values()) referencedGrants.add(value.grantId);
+		for (const grantId of grants.keys()) if (!referencedGrants.has(grantId)) grants.delete(grantId);
+	};
+	const requireCapacity = (additionalRecords) => {
+		sweep();
+		if (recordCount() + additionalRecords > maxRecords) throw new SessionMcpOAuthError("invalid_request", "The authorization service is at capacity.");
+	};
+	const authenticateClient = (clientId, clientSecret) => {
+		const client = clients.get(clientId);
+		if (client === void 0 || !exactSecret(clientSecret, client.secretHash)) throw new SessionMcpOAuthError("invalid_client", "Client authentication failed.");
+		return client;
+	};
+	const revokeGrant = (grantId) => {
+		if (!grants.delete(grantId)) return false;
+		for (const [key, value] of codes) if (value.grant.id === grantId) codes.delete(key);
+		for (const [key, value] of accessTokens) if (value.grant.id === grantId) accessTokens.delete(key);
+		for (const [key, value] of refreshTokens) if (value.grant.id === grantId) refreshTokens.delete(key);
+		return true;
+	};
+	const revokeFamily = (familyId, grantId) => {
+		revokeGrant(grantId);
+		for (const [key, value] of accessTokens) if (value.familyId === familyId) accessTokens.delete(key);
+		for (const [key, value] of refreshTokens) if (value.familyId === familyId) refreshTokens.delete(key);
+	};
+	const mintTokens = (grant, familyId = opaque(GRANT_ID_BYTES), familyExpiresAt = now() + refreshTtl) => {
+		const issuedAt = now();
+		const accessExpiresAt = Math.min(issuedAt + accessTtl, familyExpiresAt);
+		const accessToken = opaque();
+		const refreshToken = opaque();
+		accessTokens.set(tokenKey(accessToken), {
+			grant,
+			familyId,
+			expiresAt: accessExpiresAt
+		});
+		refreshTokens.set(tokenKey(refreshToken), {
+			grant,
+			familyId,
+			expiresAt: familyExpiresAt,
+			familyExpiresAt
+		});
+		return {
+			accessToken,
+			refreshToken,
+			tokenType: "Bearer",
+			expiresIn: Math.max(0, Math.floor((accessExpiresAt - issuedAt) / 1e3)),
+			grant
+		};
+	};
+	return {
+		createClient(input) {
+			const createdAt = now();
+			const clientId = opaque(CLIENT_ID_BYTES);
+			const clientSecret = opaque(CLIENT_SECRET_BYTES);
+			const urlCredential = input.authMethod === "url_token";
+			const headerCredential = input.authMethod === "api_key";
+			let redirectUri = "";
+			if (!urlCredential && !headerCredential) {
+				if (typeof input.redirectUri !== "string") throw new SessionMcpOAuthError("invalid_request", "Redirect URI must be an absolute HTTPS URL.");
+				redirectUri = requireHttpsUrl(input.redirectUri, "Redirect URI", true);
+			}
+			const client = {
+				clientId,
+				name: requireName(input.name, "Client name"),
+				redirectUri,
+				tokenEndpointAuthMethod: urlCredential ? "url_token" : headerCredential ? "api_key" : "client_secret_post",
+				createdAt,
+				secretHash: digest(clientSecret)
+			};
+			clients.set(clientId, client);
+			return {
+				...publicClient(client),
+				clientSecret
+			};
+		},
+		readClient(clientId) {
+			const client = clients.get(clientId);
+			return client === void 0 ? void 0 : publicClient(client);
+		},
+		listClients() {
+			return [...clients.values()].map(publicClient);
+		},
+		revokeClient(clientId) {
+			if (!clients.delete(clientId)) return false;
+			bindings.delete(clientId);
+			for (const grant of grants.values()) if (grant.clientId === clientId) revokeGrant(grant.id);
+			return true;
+		},
+		createAuthorizationBinding(input) {
+			if (!clients.has(input.clientId)) throw new SessionMcpOAuthError("invalid_client", "Unknown local client.");
+			if (bindings.has(input.clientId)) throw new SessionMcpOAuthError("invalid_request", "Client authorization is already bound.");
+			if (!Number.isSafeInteger(input.sessionGeneration) || input.sessionGeneration < 0) throw new SessionMcpOAuthError("invalid_request", "Session generation must be a non-negative safe integer.");
+			const routing = sessionMcpRouting(input.routing);
+			const scope = input.scope ?? "restricted";
+			if (scope !== "session" && scope !== "restricted") throw new SessionMcpOAuthError("invalid_request", "Authorization scope is not supported.");
+			let tools;
+			let skills;
+			if (scope === "session") {
+				if (input.tools !== void 0 || input.skills !== void 0) throw new SessionMcpOAuthError("invalid_request", "Session scope cannot include capability grants.");
+				tools = Object.freeze([]);
+				skills = Object.freeze([]);
+			} else {
+				if (!Array.isArray(input.tools) || !Array.isArray(input.skills)) throw new SessionMcpOAuthError("invalid_request", "Restricted scope requires tool and skill grants.");
+				tools = exactUniqueGrants(input.tools, "Tool");
+				skills = exactUniqueGrants(input.skills, "Skill");
+			}
+			const binding = Object.freeze({
+				clientId: input.clientId,
+				sessionId: requireName(input.sessionId, "Session ID"),
+				sessionGeneration: input.sessionGeneration,
+				audience: requireHttpsUrl(input.audience, "Audience", false),
+				scope,
+				routing,
+				tools,
+				skills
+			});
+			bindings.set(input.clientId, binding);
+			return binding;
+		},
+		readAuthorizationBinding(clientId) {
+			return bindings.get(clientId);
+		},
+		persistentRegistration(clientId, workspaceId, verifiedAt) {
+			const client = clients.get(clientId);
+			const binding = bindings.get(clientId);
+			if (client === void 0 || binding === void 0 || !Number.isSafeInteger(verifiedAt)) return void 0;
+			const { sessionGeneration: _sessionGeneration, ...persistentBinding } = binding;
+			return {
+				client: publicClient(client),
+				secretHash: client.secretHash.toString("hex"),
+				workspaceId: requireName(workspaceId, "Workspace ID"),
+				binding: persistentBinding,
+				verifiedAt
+			};
+		},
+		restorePersistentRegistration(registration, sessionGeneration) {
+			if (bindings.has(registration.client.clientId) || !/^[a-f0-9]{64}$/u.test(registration.secretHash) || !Number.isSafeInteger(sessionGeneration) || sessionGeneration < 0 || registration.client.clientId !== registration.binding.clientId) return false;
+			try {
+				const held = clients.get(registration.client.clientId);
+				if (held && (held.redirectUri !== registration.client.redirectUri || held.tokenEndpointAuthMethod !== registration.client.tokenEndpointAuthMethod || !timingSafeEqual(held.secretHash, Buffer.from(registration.secretHash, "hex")))) return false;
+				if (registration.client.tokenEndpointAuthMethod !== "client_secret_post" && registration.client.tokenEndpointAuthMethod !== "api_key" && registration.client.tokenEndpointAuthMethod !== "url_token" || registration.client.tokenEndpointAuthMethod !== "client_secret_post" && (registration.client.redirectUri !== "" || registration.binding.scope !== "session")) return false;
+				const client = {
+					clientId: requireName(registration.client.clientId, "Client ID"),
+					name: requireName(registration.client.name, "Client name"),
+					redirectUri: registration.client.tokenEndpointAuthMethod === "client_secret_post" ? requireHttpsUrl(registration.client.redirectUri, "Redirect URI", true) : registration.client.redirectUri,
+					tokenEndpointAuthMethod: registration.client.tokenEndpointAuthMethod,
+					createdAt: registration.client.createdAt,
+					secretHash: Buffer.from(registration.secretHash, "hex")
+				};
+				const routing = sessionMcpRouting(registration.binding.routing);
+				const scope = registration.binding.scope;
+				const tools = scope === "session" ? Object.freeze([]) : exactUniqueGrants(registration.binding.tools, "Tool");
+				const skills = scope === "session" ? Object.freeze([]) : exactUniqueGrants(registration.binding.skills, "Skill");
+				if (scope !== "session" && scope !== "restricted" || scope === "session" && (registration.binding.tools.length !== 0 || registration.binding.skills.length !== 0)) throw new SessionMcpOAuthError("invalid_request", "Stored Session MCP authorization is invalid.");
+				clients.set(client.clientId, client);
+				bindings.set(client.clientId, Object.freeze({
+					clientId: client.clientId,
+					sessionId: requireName(registration.binding.sessionId, "Session ID"),
+					sessionGeneration,
+					audience: requireHttpsUrl(registration.binding.audience, "Audience", false),
+					scope,
+					routing,
+					tools,
+					skills
+				}));
+				return true;
+			} catch {
+				clients.delete(registration.client.clientId);
+				return false;
+			}
+		},
+		issueAuthorizationCode(input) {
+			const client = clients.get(input.clientId);
+			if (client === void 0) throw new SessionMcpOAuthError("invalid_client", "Unknown local client.");
+			const binding = bindings.get(input.clientId);
+			if (binding === void 0) throw new SessionMcpOAuthError("invalid_request", "Client authorization has not been preauthorized.");
+			if (client.tokenEndpointAuthMethod !== "client_secret_post") throw new SessionMcpOAuthError("invalid_client", "This client does not support OAuth authorization.");
+			if (input.redirectUri !== client.redirectUri) throw new SessionMcpOAuthError("invalid_request", "Redirect URI does not exactly match the registered callback.");
+			if (input.codeChallengeMethod !== "S256" || !/^[A-Za-z0-9_-]{43}$/u.test(input.codeChallenge)) throw new SessionMcpOAuthError("invalid_request", "A valid S256 PKCE challenge is required.");
+			requireCapacity(2);
+			const issuedAt = now();
+			const grant = Object.freeze({
+				id: opaque(GRANT_ID_BYTES),
+				...binding,
+				createdAt: issuedAt
+			});
+			const code = opaque();
+			const expiresAt = issuedAt + codeTtl;
+			grants.set(grant.id, grant);
+			codes.set(tokenKey(code), {
+				clientId: client.clientId,
+				redirectUri: client.redirectUri,
+				challenge: input.codeChallenge,
+				grant,
+				expiresAt
+			});
+			return {
+				code,
+				grant,
+				expiresAt
+			};
+		},
+		exchangeToken(request) {
+			if (authenticateClient(request.clientId, request.clientSecret).tokenEndpointAuthMethod !== "client_secret_post") throw new SessionMcpOAuthError("invalid_client", "This client does not support OAuth tokens.");
+			sweep();
+			if (request.grantType === "authorization_code") {
+				const codeKey = tokenKey(request.code);
+				const stored = codes.get(codeKey);
+				if (stored === void 0 || stored.expiresAt <= now() || stored.clientId !== request.clientId || stored.redirectUri !== request.redirectUri || !/^[A-Za-z0-9\-._~]{43,128}$/u.test(request.codeVerifier) || createHash("sha256").update(request.codeVerifier).digest("base64url") !== stored.challenge || !grants.has(stored.grant.id)) {
+					codes.delete(codeKey);
+					if (stored !== void 0) revokeGrant(stored.grant.id);
+					throw new SessionMcpOAuthError("invalid_grant", "Authorization code is invalid or expired.");
+				}
+				requireCapacity(1);
+				codes.delete(codeKey);
+				return mintTokens(stored.grant);
+			}
+			if (request.grantType === "refresh_token") {
+				const refreshKey = tokenKey(request.refreshToken);
+				const replayed = consumedRefreshTokens.get(refreshKey);
+				if (replayed !== void 0) {
+					if (replayed.clientId === request.clientId && replayed.expiresAt > now()) revokeFamily(replayed.familyId, replayed.grantId);
+					throw new SessionMcpOAuthError("invalid_grant", "Refresh token is invalid or expired.");
+				}
+				const stored = refreshTokens.get(refreshKey);
+				if (stored === void 0 || stored.expiresAt <= now() || stored.grant.clientId !== request.clientId || !grants.has(stored.grant.id)) {
+					refreshTokens.delete(refreshKey);
+					throw new SessionMcpOAuthError("invalid_grant", "Refresh token is invalid or expired.");
+				}
+				requireCapacity(2);
+				refreshTokens.delete(refreshKey);
+				consumedRefreshTokens.set(refreshKey, {
+					clientId: stored.grant.clientId,
+					grantId: stored.grant.id,
+					familyId: stored.familyId,
+					expiresAt: stored.familyExpiresAt
+				});
+				return mintTokens(stored.grant, stored.familyId, stored.familyExpiresAt);
+			}
+			throw new SessionMcpOAuthError("unsupported_grant_type", "Only authorization_code and refresh_token are supported.");
+		},
+		issueUrlToken(clientId) {
+			const client = clients.get(clientId);
+			if (client === void 0 || client.tokenEndpointAuthMethod !== "url_token") throw new SessionMcpOAuthError("invalid_client", "This client does not support signed MCP URLs.");
+			const binding = bindings.get(clientId);
+			if (binding === void 0) throw new SessionMcpOAuthError("invalid_request", "Client authorization has not been preauthorized.");
+			const payload = Buffer.from(JSON.stringify({
+				aud: binding.audience,
+				iat: Math.floor(client.createdAt / 1e3),
+				iss: URL_TOKEN_ISSUER,
+				sid: binding.sessionId,
+				sub: client.clientId
+			})).toString("base64url");
+			const input = `${URL_TOKEN_HEADER}.${payload}`;
+			return `${input}.${urlTokenSignature(input, client.secretHash).toString("base64url")}`;
+		},
+		authenticateUrlToken(token, audience) {
+			const parsed = parseUrlToken(token);
+			if (parsed === void 0) return void 0;
+			const client = clients.get(parsed.claims.sub);
+			if (client === void 0 || client.tokenEndpointAuthMethod !== "url_token") return void 0;
+			const binding = bindings.get(client.clientId);
+			if (binding === void 0 || binding.audience !== audience || parsed.claims.aud !== audience || parsed.claims.sid !== binding.sessionId || parsed.claims.iat !== Math.floor(client.createdAt / 1e3)) return void 0;
+			const expected = urlTokenSignature(parsed.input, client.secretHash);
+			if (!timingSafeEqual(expected, parsed.signature)) return void 0;
+			return {
+				id: client.clientId,
+				...binding,
+				createdAt: client.createdAt,
+				expiresAt: Number.MAX_SAFE_INTEGER
+			};
+		},
+		authenticateAccessToken(token, audience) {
+			sweep();
+			const key = tokenKey(token);
+			const presentedHash = digest(token);
+			for (const client of clients.values()) {
+				if (client.tokenEndpointAuthMethod !== "api_key" || !timingSafeEqual(presentedHash, client.secretHash)) continue;
+				const binding = bindings.get(client.clientId);
+				if (binding === void 0 || binding.audience !== audience) return void 0;
+				return {
+					id: client.clientId,
+					...binding,
+					createdAt: client.createdAt,
+					expiresAt: Number.MAX_SAFE_INTEGER
+				};
+			}
+			const stored = accessTokens.get(key);
+			if (stored === void 0) return void 0;
+			if (stored.expiresAt <= now() || !grants.has(stored.grant.id)) {
+				accessTokens.delete(key);
+				return;
+			}
+			if (stored.grant.audience !== audience) return void 0;
+			return {
+				...stored.grant,
+				expiresAt: stored.expiresAt
+			};
+		},
+		revokeGrant,
+		revokeSessionGeneration(sessionId, sessionGeneration) {
+			let revoked = 0;
+			for (const grant of grants.values()) if (grant.sessionId === sessionId && grant.sessionGeneration === sessionGeneration && revokeGrant(grant.id)) revoked += 1;
+			for (const [clientId, binding] of bindings) if (binding.sessionId === sessionId && binding.sessionGeneration === sessionGeneration) bindings.delete(clientId);
+			return revoked;
+		},
+		revokeSession(sessionId) {
+			let revoked = 0;
+			for (const grant of grants.values()) if (grant.sessionId === sessionId && revokeGrant(grant.id)) revoked += 1;
+			for (const [clientId, binding] of bindings) if (binding.sessionId === sessionId) bindings.delete(clientId);
+			return revoked;
+		}
+	};
+}
+//#endregion
+export { SessionMcpOAuthError, createSessionMcpAuthorizationService, sessionMcpRouting };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/sessionMcpAuthorization/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/sessionMcpAuthorization/index.ts"],"sourcesContent":["import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\n\nconst ACCESS_TOKEN_TTL_MS = 15 * 60_000;\nconst AUTHORIZATION_CODE_TTL_MS = 5 * 60_000;\nconst CLIENT_ID_BYTES = 18;\nconst CLIENT_SECRET_BYTES = 32;\nconst DEFAULT_MAX_RECORDS = 10_000;\nconst GRANT_ID_BYTES = 18;\nconst REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60_000;\nconst TOKEN_BYTES = 32;\nconst URL_TOKEN_HEADER = Buffer.from('{\"alg\":\"HS256\",\"typ\":\"JWT\"}').toString('base64url');\nconst URL_TOKEN_ISSUER = 'doompi-session-mcp';\nconst URL_TOKEN_MAX_LENGTH = 4096;\n\nexport type SessionMcpOAuthErrorCode =\n  | 'invalid_client'\n  | 'invalid_grant'\n  | 'invalid_request'\n  | 'unsupported_grant_type';\n\nexport class SessionMcpOAuthError extends Error {\n  readonly code: SessionMcpOAuthErrorCode;\n\n  constructor(code: SessionMcpOAuthErrorCode, message: string) {\n    super(message);\n    this.name = 'SessionMcpOAuthError';\n    this.code = code;\n  }\n}\n\nexport type SessionMcpScope = 'restricted' | 'session';\nexport type SessionMcpRouting = 'conversation';\n\n/**\n * Conversation routing is mandatory. Legacy registrations are migrated at read time\n * so they cannot continue to share their parent runtime.\n */\nexport function sessionMcpRouting(value: unknown): SessionMcpRouting {\n  if (value === undefined || value === 'session' || value === 'conversation') return 'conversation';\n  throw new SessionMcpOAuthError('invalid_request', 'Session MCP routing is not supported.');\n}\n\nexport interface SessionMcpClient {\n  readonly clientId: string;\n  readonly name: string;\n  readonly redirectUri: string;\n  readonly tokenEndpointAuthMethod: 'client_secret_post' | 'api_key' | 'url_token';\n  readonly createdAt: number;\n}\n\nexport interface CreatedSessionMcpClient extends SessionMcpClient {\n  /** Returned once. Only a SHA-256 digest is retained by the service. */\n  readonly clientSecret: string;\n}\n\nexport interface SessionMcpAuthorizationBinding {\n  readonly clientId: string;\n  readonly sessionId: string;\n  readonly sessionGeneration: number;\n  readonly audience: string;\n  readonly scope: SessionMcpScope;\n  /** Always conversation. Legacy persisted values are normalized at read time. */\n  readonly routing?: SessionMcpRouting;\n  readonly tools: readonly string[];\n  readonly skills: readonly string[];\n}\n\nexport type CreateSessionMcpAuthorizationBindingInput = Omit<\n  SessionMcpAuthorizationBinding,\n  'scope' | 'tools' | 'skills'\n> &\n  (\n    | { readonly scope: 'session'; readonly tools?: never; readonly skills?: never }\n    | { readonly scope?: 'restricted'; readonly tools: readonly string[]; readonly skills: readonly string[] }\n  );\n\nexport interface SessionMcpGrant extends SessionMcpAuthorizationBinding {\n  readonly id: string;\n  readonly createdAt: number;\n}\n\nexport interface SessionMcpAccessGrant extends SessionMcpGrant {\n  readonly expiresAt: number;\n}\n\nexport interface SessionMcpTokenResponse {\n  readonly accessToken: string;\n  readonly refreshToken: string;\n  readonly tokenType: 'Bearer';\n  readonly expiresIn: number;\n  readonly grant: SessionMcpGrant;\n}\n\nexport interface SessionMcpAuthorizationServiceOptions {\n  readonly now?: () => number;\n  readonly authorizationCodeTtlMs?: number;\n  readonly accessTokenTtlMs?: number;\n  readonly refreshTokenTtlMs?: number;\n  /** Maximum combined authorization codes, grants, tokens, and refresh-token tombstones. */\n  readonly maxRecords?: number;\n}\n\nexport type CreateSessionMcpClientInput =\n  | { readonly name: string; readonly redirectUri: string; readonly authMethod?: 'oauth' }\n  | { readonly name: string; readonly authMethod: 'api_key' | 'url_token'; readonly redirectUri?: never };\n\nexport interface IssueSessionMcpAuthorizationCodeInput {\n  readonly clientId: string;\n  readonly redirectUri: string;\n  readonly codeChallenge: string;\n  readonly codeChallengeMethod: 'S256';\n}\n\nexport type SessionMcpTokenRequest =\n  | {\n      readonly grantType: 'authorization_code';\n      readonly clientId: string;\n      readonly clientSecret: string;\n      readonly code: string;\n      readonly redirectUri: string;\n      readonly codeVerifier: string;\n    }\n  | {\n      readonly grantType: 'refresh_token';\n      readonly clientId: string;\n      readonly clientSecret: string;\n      readonly refreshToken: string;\n    };\n\nexport interface SessionMcpAuthorizationCode {\n  readonly code: string;\n  readonly grant: SessionMcpGrant;\n  readonly expiresAt: number;\n}\n\nexport interface SessionMcpPersistentRegistration {\n  readonly client: SessionMcpClient;\n  readonly secretHash: string;\n  readonly workspaceId: string;\n  readonly binding: Omit<SessionMcpAuthorizationBinding, 'sessionGeneration'>;\n  readonly verifiedAt: number;\n}\n\nexport interface SessionMcpAuthorizationService {\n  createClient(input: CreateSessionMcpClientInput): CreatedSessionMcpClient;\n  readClient(clientId: string): SessionMcpClient | undefined;\n  listClients(): readonly SessionMcpClient[];\n  revokeClient(clientId: string): boolean;\n  createAuthorizationBinding(input: CreateSessionMcpAuthorizationBindingInput): SessionMcpAuthorizationBinding;\n  readAuthorizationBinding(clientId: string): SessionMcpAuthorizationBinding | undefined;\n  persistentRegistration(\n    clientId: string,\n    workspaceId: string,\n    verifiedAt: number,\n  ): SessionMcpPersistentRegistration | undefined;\n  restorePersistentRegistration(registration: SessionMcpPersistentRegistration, sessionGeneration: number): boolean;\n  issueAuthorizationCode(input: IssueSessionMcpAuthorizationCodeInput): SessionMcpAuthorizationCode;\n  exchangeToken(request: SessionMcpTokenRequest): SessionMcpTokenResponse;\n  issueUrlToken(clientId: string): string;\n  authenticateUrlToken(token: string, audience: string): SessionMcpAccessGrant | undefined;\n  authenticateAccessToken(token: string, audience: string): SessionMcpAccessGrant | undefined;\n  revokeGrant(grantId: string): boolean;\n  revokeSessionGeneration(sessionId: string, sessionGeneration: number): number;\n  revokeSession(sessionId: string): number;\n}\n\ninterface StoredClient extends SessionMcpClient {\n  readonly secretHash: Buffer;\n}\n\ninterface StoredCode {\n  readonly clientId: string;\n  readonly redirectUri: string;\n  readonly challenge: string;\n  readonly grant: SessionMcpGrant;\n  readonly expiresAt: number;\n}\n\ninterface StoredAccessToken {\n  readonly grant: SessionMcpGrant;\n  readonly familyId: string;\n  readonly expiresAt: number;\n}\n\ninterface StoredRefreshToken extends StoredAccessToken {\n  readonly familyExpiresAt: number;\n}\n\ninterface ConsumedRefreshToken {\n  readonly clientId: string;\n  readonly grantId: string;\n  readonly familyId: string;\n  readonly expiresAt: number;\n}\n\nfunction digest(value: string): Buffer {\n  return createHash('sha256').update(value).digest();\n}\n\nfunction tokenKey(value: string): string {\n  return digest(value).toString('hex');\n}\n\nfunction opaque(bytes = TOKEN_BYTES): string {\n  return randomBytes(bytes).toString('base64url');\n}\n\nfunction exactSecret(actual: string, expectedHash: Buffer): boolean {\n  return timingSafeEqual(digest(actual), expectedHash);\n}\n\ninterface SessionMcpUrlTokenClaims {\n  readonly aud: string;\n  readonly iat: number;\n  readonly iss: typeof URL_TOKEN_ISSUER;\n  readonly sid: string;\n  readonly sub: string;\n}\n\nfunction urlTokenSignature(input: string, key: Buffer): Buffer {\n  return createHmac('sha256', key).update(input).digest();\n}\n\nfunction parseUrlToken(\n  token: string,\n): { readonly claims: SessionMcpUrlTokenClaims; readonly input: string; readonly signature: Buffer } | undefined {\n  if (token.length > URL_TOKEN_MAX_LENGTH) return undefined;\n  const parts = token.split('.');\n  if (parts.length !== 3) return undefined;\n  const [header, payload, encodedSignature] = parts;\n  if (\n    header !== URL_TOKEN_HEADER ||\n    !/^[A-Za-z0-9_-]{1,2048}$/u.test(payload!) ||\n    !/^[A-Za-z0-9_-]{43}$/u.test(encodedSignature!)\n  )\n    return undefined;\n  try {\n    const payloadBytes = Buffer.from(payload!, 'base64url');\n    const signature = Buffer.from(encodedSignature!, 'base64url');\n    if (\n      payloadBytes.toString('base64url') !== payload ||\n      signature.length !== 32 ||\n      signature.toString('base64url') !== encodedSignature\n    )\n      return undefined;\n    const value: unknown = JSON.parse(payloadBytes.toString('utf8'));\n    if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;\n    const claims = value as Partial<SessionMcpUrlTokenClaims>;\n    if (\n      Object.keys(value).sort().join(',') !== 'aud,iat,iss,sid,sub' ||\n      claims.iss !== URL_TOKEN_ISSUER ||\n      typeof claims.sub !== 'string' ||\n      claims.sub === '' ||\n      typeof claims.sid !== 'string' ||\n      claims.sid === '' ||\n      typeof claims.aud !== 'string' ||\n      claims.aud === '' ||\n      typeof claims.iat !== 'number' ||\n      !Number.isSafeInteger(claims.iat)\n    )\n      return undefined;\n    return { claims: claims as SessionMcpUrlTokenClaims, input: `${header}.${payload}`, signature };\n  } catch {\n    return undefined;\n  }\n}\n\nfunction requireHttpsUrl(value: string, label: string, allowQuery: boolean): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    throw new SessionMcpOAuthError('invalid_request', `${label} must be an absolute HTTPS URL.`);\n  }\n  if (\n    parsed.protocol !== 'https:' ||\n    parsed.username !== '' ||\n    parsed.password !== '' ||\n    parsed.hash !== '' ||\n    (!allowQuery && parsed.search !== '')\n  ) {\n    throw new SessionMcpOAuthError(\n      'invalid_request',\n      `${label} must be an absolute HTTPS URL without credentials, a query, or a fragment.`,\n    );\n  }\n  return parsed.href;\n}\n\nfunction requireName(value: string, label: string): string {\n  const normalized = value.trim();\n  if (normalized === '') throw new SessionMcpOAuthError('invalid_request', `${label} must not be empty.`);\n  return normalized;\n}\n\nfunction exactUniqueGrants(values: readonly string[], label: string): readonly string[] {\n  if (values.some((value) => value === '' || value !== value.trim())) {\n    throw new SessionMcpOAuthError('invalid_request', `${label} grants must contain exact non-empty names.`);\n  }\n  return Object.freeze([...new Set(values)]);\n}\n\n/** In-memory restricted OAuth authority. It intentionally has no discovery or client registration surface. */\nexport function createSessionMcpAuthorizationService(\n  options: SessionMcpAuthorizationServiceOptions = {},\n): SessionMcpAuthorizationService {\n  const now = options.now ?? Date.now;\n  const codeTtl = options.authorizationCodeTtlMs ?? AUTHORIZATION_CODE_TTL_MS;\n  const accessTtl = options.accessTokenTtlMs ?? ACCESS_TOKEN_TTL_MS;\n  const refreshTtl = options.refreshTokenTtlMs ?? REFRESH_TOKEN_TTL_MS;\n  const maxRecords = options.maxRecords ?? DEFAULT_MAX_RECORDS;\n  if (!Number.isSafeInteger(maxRecords) || maxRecords < 3) {\n    throw new Error('Session MCP authorization maxRecords must be a safe integer of at least 3.');\n  }\n\n  const clients = new Map<string, StoredClient>();\n  const bindings = new Map<string, SessionMcpAuthorizationBinding>();\n  const grants = new Map<string, SessionMcpGrant>();\n  const codes = new Map<string, StoredCode>();\n  const accessTokens = new Map<string, StoredAccessToken>();\n  const refreshTokens = new Map<string, StoredRefreshToken>();\n  const consumedRefreshTokens = new Map<string, ConsumedRefreshToken>();\n\n  const publicClient = ({ secretHash: _secretHash, ...client }: StoredClient): SessionMcpClient => client;\n\n  const recordCount = (): number =>\n    grants.size + codes.size + accessTokens.size + refreshTokens.size + consumedRefreshTokens.size;\n\n  const sweep = (): void => {\n    const currentTime = now();\n    for (const [key, value] of codes) if (value.expiresAt <= currentTime) codes.delete(key);\n    for (const [key, value] of accessTokens) if (value.expiresAt <= currentTime) accessTokens.delete(key);\n    for (const [key, value] of refreshTokens) if (value.expiresAt <= currentTime) refreshTokens.delete(key);\n    for (const [key, value] of consumedRefreshTokens) {\n      if (value.expiresAt <= currentTime) consumedRefreshTokens.delete(key);\n    }\n\n    const referencedGrants = new Set<string>();\n    for (const value of codes.values()) referencedGrants.add(value.grant.id);\n    for (const value of accessTokens.values()) referencedGrants.add(value.grant.id);\n    for (const value of refreshTokens.values()) referencedGrants.add(value.grant.id);\n    for (const value of consumedRefreshTokens.values()) referencedGrants.add(value.grantId);\n    for (const grantId of grants.keys()) if (!referencedGrants.has(grantId)) grants.delete(grantId);\n  };\n\n  const requireCapacity = (additionalRecords: number): void => {\n    sweep();\n    if (recordCount() + additionalRecords > maxRecords) {\n      throw new SessionMcpOAuthError('invalid_request', 'The authorization service is at capacity.');\n    }\n  };\n\n  const authenticateClient = (clientId: string, clientSecret: string): StoredClient => {\n    const client = clients.get(clientId);\n    if (client === undefined || !exactSecret(clientSecret, client.secretHash)) {\n      throw new SessionMcpOAuthError('invalid_client', 'Client authentication failed.');\n    }\n    return client;\n  };\n\n  const revokeGrant = (grantId: string): boolean => {\n    if (!grants.delete(grantId)) return false;\n    for (const [key, value] of codes) if (value.grant.id === grantId) codes.delete(key);\n    for (const [key, value] of accessTokens) if (value.grant.id === grantId) accessTokens.delete(key);\n    for (const [key, value] of refreshTokens) if (value.grant.id === grantId) refreshTokens.delete(key);\n    return true;\n  };\n\n  const revokeFamily = (familyId: string, grantId: string): void => {\n    revokeGrant(grantId);\n    for (const [key, value] of accessTokens) if (value.familyId === familyId) accessTokens.delete(key);\n    for (const [key, value] of refreshTokens) if (value.familyId === familyId) refreshTokens.delete(key);\n  };\n\n  const mintTokens = (\n    grant: SessionMcpGrant,\n    familyId = opaque(GRANT_ID_BYTES),\n    familyExpiresAt = now() + refreshTtl,\n  ): SessionMcpTokenResponse => {\n    const issuedAt = now();\n    const accessExpiresAt = Math.min(issuedAt + accessTtl, familyExpiresAt);\n    const accessToken = opaque();\n    const refreshToken = opaque();\n    accessTokens.set(tokenKey(accessToken), { grant, familyId, expiresAt: accessExpiresAt });\n    refreshTokens.set(tokenKey(refreshToken), {\n      grant,\n      familyId,\n      expiresAt: familyExpiresAt,\n      familyExpiresAt,\n    });\n    return {\n      accessToken,\n      refreshToken,\n      tokenType: 'Bearer',\n      expiresIn: Math.max(0, Math.floor((accessExpiresAt - issuedAt) / 1000)),\n      grant,\n    };\n  };\n\n  return {\n    createClient(input) {\n      const createdAt = now();\n      const clientId = opaque(CLIENT_ID_BYTES);\n      const clientSecret = opaque(CLIENT_SECRET_BYTES);\n      const urlCredential = input.authMethod === 'url_token';\n      const headerCredential = input.authMethod === 'api_key';\n      let redirectUri = '';\n      if (!urlCredential && !headerCredential) {\n        if (typeof input.redirectUri !== 'string') {\n          throw new SessionMcpOAuthError('invalid_request', 'Redirect URI must be an absolute HTTPS URL.');\n        }\n        redirectUri = requireHttpsUrl(input.redirectUri, 'Redirect URI', true);\n      }\n      const client: StoredClient = {\n        clientId,\n        name: requireName(input.name, 'Client name'),\n        redirectUri,\n        tokenEndpointAuthMethod: urlCredential ? 'url_token' : headerCredential ? 'api_key' : 'client_secret_post',\n        createdAt,\n        secretHash: digest(clientSecret),\n      };\n      clients.set(clientId, client);\n      return { ...publicClient(client), clientSecret };\n    },\n    readClient(clientId) {\n      const client = clients.get(clientId);\n      return client === undefined ? undefined : publicClient(client);\n    },\n    listClients() {\n      return [...clients.values()].map(publicClient);\n    },\n    revokeClient(clientId) {\n      if (!clients.delete(clientId)) return false;\n      bindings.delete(clientId);\n      for (const grant of grants.values()) if (grant.clientId === clientId) revokeGrant(grant.id);\n      return true;\n    },\n    createAuthorizationBinding(input) {\n      if (!clients.has(input.clientId)) throw new SessionMcpOAuthError('invalid_client', 'Unknown local client.');\n      if (bindings.has(input.clientId)) {\n        throw new SessionMcpOAuthError('invalid_request', 'Client authorization is already bound.');\n      }\n      if (!Number.isSafeInteger(input.sessionGeneration) || input.sessionGeneration < 0) {\n        throw new SessionMcpOAuthError('invalid_request', 'Session generation must be a non-negative safe integer.');\n      }\n      const routing = sessionMcpRouting(input.routing);\n      const scope = input.scope ?? 'restricted';\n      if (scope !== 'session' && scope !== 'restricted') {\n        throw new SessionMcpOAuthError('invalid_request', 'Authorization scope is not supported.');\n      }\n      let tools: readonly string[];\n      let skills: readonly string[];\n      if (scope === 'session') {\n        if (input.tools !== undefined || input.skills !== undefined) {\n          throw new SessionMcpOAuthError('invalid_request', 'Session scope cannot include capability grants.');\n        }\n        tools = Object.freeze([] as string[]);\n        skills = Object.freeze([] as string[]);\n      } else {\n        if (!Array.isArray(input.tools) || !Array.isArray(input.skills)) {\n          throw new SessionMcpOAuthError('invalid_request', 'Restricted scope requires tool and skill grants.');\n        }\n        tools = exactUniqueGrants(input.tools, 'Tool');\n        skills = exactUniqueGrants(input.skills, 'Skill');\n      }\n      const binding: SessionMcpAuthorizationBinding = Object.freeze({\n        clientId: input.clientId,\n        sessionId: requireName(input.sessionId, 'Session ID'),\n        sessionGeneration: input.sessionGeneration,\n        audience: requireHttpsUrl(input.audience, 'Audience', false),\n        scope,\n        routing,\n        tools,\n        skills,\n      });\n      bindings.set(input.clientId, binding);\n      return binding;\n    },\n    readAuthorizationBinding(clientId) {\n      return bindings.get(clientId);\n    },\n    persistentRegistration(clientId, workspaceId, verifiedAt) {\n      const client = clients.get(clientId);\n      const binding = bindings.get(clientId);\n      if (client === undefined || binding === undefined || !Number.isSafeInteger(verifiedAt)) return undefined;\n      const { sessionGeneration: _sessionGeneration, ...persistentBinding } = binding;\n      return {\n        client: publicClient(client),\n        secretHash: client.secretHash.toString('hex'),\n        workspaceId: requireName(workspaceId, 'Workspace ID'),\n        binding: persistentBinding,\n        verifiedAt,\n      };\n    },\n    restorePersistentRegistration(registration, sessionGeneration) {\n      if (\n        bindings.has(registration.client.clientId) ||\n        !/^[a-f0-9]{64}$/u.test(registration.secretHash) ||\n        !Number.isSafeInteger(sessionGeneration) ||\n        sessionGeneration < 0 ||\n        registration.client.clientId !== registration.binding.clientId\n      )\n        return false;\n      try {\n        // Restarting a runtime revokes its binding, not its durable client registration.\n        const held = clients.get(registration.client.clientId);\n        if (\n          held &&\n          (held.redirectUri !== registration.client.redirectUri ||\n            held.tokenEndpointAuthMethod !== registration.client.tokenEndpointAuthMethod ||\n            !timingSafeEqual(held.secretHash, Buffer.from(registration.secretHash, 'hex')))\n        )\n          return false;\n        if (\n          (registration.client.tokenEndpointAuthMethod !== 'client_secret_post' &&\n            registration.client.tokenEndpointAuthMethod !== 'api_key' &&\n            registration.client.tokenEndpointAuthMethod !== 'url_token') ||\n          (registration.client.tokenEndpointAuthMethod !== 'client_secret_post' &&\n            (registration.client.redirectUri !== '' || registration.binding.scope !== 'session'))\n        )\n          return false;\n        const client: StoredClient = {\n          clientId: requireName(registration.client.clientId, 'Client ID'),\n          name: requireName(registration.client.name, 'Client name'),\n          redirectUri:\n            registration.client.tokenEndpointAuthMethod === 'client_secret_post'\n              ? requireHttpsUrl(registration.client.redirectUri, 'Redirect URI', true)\n              : registration.client.redirectUri,\n          tokenEndpointAuthMethod: registration.client.tokenEndpointAuthMethod,\n          createdAt: registration.client.createdAt,\n          secretHash: Buffer.from(registration.secretHash, 'hex'),\n        };\n        const routing = sessionMcpRouting(registration.binding.routing);\n        const scope = registration.binding.scope;\n        const tools =\n          scope === 'session' ? Object.freeze([] as string[]) : exactUniqueGrants(registration.binding.tools, 'Tool');\n        const skills =\n          scope === 'session' ? Object.freeze([] as string[]) : exactUniqueGrants(registration.binding.skills, 'Skill');\n        if (\n          (scope !== 'session' && scope !== 'restricted') ||\n          (scope === 'session' && (registration.binding.tools.length !== 0 || registration.binding.skills.length !== 0))\n        ) {\n          throw new SessionMcpOAuthError('invalid_request', 'Stored Session MCP authorization is invalid.');\n        }\n        clients.set(client.clientId, client);\n        bindings.set(\n          client.clientId,\n          Object.freeze({\n            clientId: client.clientId,\n            sessionId: requireName(registration.binding.sessionId, 'Session ID'),\n            sessionGeneration,\n            audience: requireHttpsUrl(registration.binding.audience, 'Audience', false),\n            scope,\n            routing,\n            tools,\n            skills,\n          }),\n        );\n        return true;\n      } catch {\n        clients.delete(registration.client.clientId);\n        return false;\n      }\n    },\n    issueAuthorizationCode(input) {\n      const client = clients.get(input.clientId);\n      if (client === undefined) throw new SessionMcpOAuthError('invalid_client', 'Unknown local client.');\n      const binding = bindings.get(input.clientId);\n      if (binding === undefined) {\n        throw new SessionMcpOAuthError('invalid_request', 'Client authorization has not been preauthorized.');\n      }\n      if (client.tokenEndpointAuthMethod !== 'client_secret_post') {\n        throw new SessionMcpOAuthError('invalid_client', 'This client does not support OAuth authorization.');\n      }\n      if (input.redirectUri !== client.redirectUri) {\n        throw new SessionMcpOAuthError(\n          'invalid_request',\n          'Redirect URI does not exactly match the registered callback.',\n        );\n      }\n      if (input.codeChallengeMethod !== 'S256' || !/^[A-Za-z0-9_-]{43}$/u.test(input.codeChallenge)) {\n        throw new SessionMcpOAuthError('invalid_request', 'A valid S256 PKCE challenge is required.');\n      }\n      requireCapacity(2);\n      const issuedAt = now();\n      const grant: SessionMcpGrant = Object.freeze({\n        id: opaque(GRANT_ID_BYTES),\n        ...binding,\n        createdAt: issuedAt,\n      });\n      const code = opaque();\n      const expiresAt = issuedAt + codeTtl;\n      grants.set(grant.id, grant);\n      codes.set(tokenKey(code), {\n        clientId: client.clientId,\n        redirectUri: client.redirectUri,\n        challenge: input.codeChallenge,\n        grant,\n        expiresAt,\n      });\n      return { code, grant, expiresAt };\n    },\n    exchangeToken(request) {\n      const client = authenticateClient(request.clientId, request.clientSecret);\n      if (client.tokenEndpointAuthMethod !== 'client_secret_post') {\n        throw new SessionMcpOAuthError('invalid_client', 'This client does not support OAuth tokens.');\n      }\n      sweep();\n      if (request.grantType === 'authorization_code') {\n        const codeKey = tokenKey(request.code);\n        const stored = codes.get(codeKey);\n        if (\n          stored === undefined ||\n          stored.expiresAt <= now() ||\n          stored.clientId !== request.clientId ||\n          stored.redirectUri !== request.redirectUri ||\n          !/^[A-Za-z0-9\\-._~]{43,128}$/u.test(request.codeVerifier) ||\n          createHash('sha256').update(request.codeVerifier).digest('base64url') !== stored.challenge ||\n          !grants.has(stored.grant.id)\n        ) {\n          codes.delete(codeKey);\n          if (stored !== undefined) revokeGrant(stored.grant.id);\n          throw new SessionMcpOAuthError('invalid_grant', 'Authorization code is invalid or expired.');\n        }\n        requireCapacity(1);\n        codes.delete(codeKey);\n        return mintTokens(stored.grant);\n      }\n      if (request.grantType === 'refresh_token') {\n        const refreshKey = tokenKey(request.refreshToken);\n        const replayed = consumedRefreshTokens.get(refreshKey);\n        if (replayed !== undefined) {\n          if (replayed.clientId === request.clientId && replayed.expiresAt > now()) {\n            revokeFamily(replayed.familyId, replayed.grantId);\n          }\n          throw new SessionMcpOAuthError('invalid_grant', 'Refresh token is invalid or expired.');\n        }\n        const stored = refreshTokens.get(refreshKey);\n        if (\n          stored === undefined ||\n          stored.expiresAt <= now() ||\n          stored.grant.clientId !== request.clientId ||\n          !grants.has(stored.grant.id)\n        ) {\n          refreshTokens.delete(refreshKey);\n          throw new SessionMcpOAuthError('invalid_grant', 'Refresh token is invalid or expired.');\n        }\n        requireCapacity(2);\n        refreshTokens.delete(refreshKey);\n        consumedRefreshTokens.set(refreshKey, {\n          clientId: stored.grant.clientId,\n          grantId: stored.grant.id,\n          familyId: stored.familyId,\n          expiresAt: stored.familyExpiresAt,\n        });\n        return mintTokens(stored.grant, stored.familyId, stored.familyExpiresAt);\n      }\n      throw new SessionMcpOAuthError(\n        'unsupported_grant_type',\n        'Only authorization_code and refresh_token are supported.',\n      );\n    },\n    issueUrlToken(clientId) {\n      const client = clients.get(clientId);\n      if (client === undefined || client.tokenEndpointAuthMethod !== 'url_token') {\n        throw new SessionMcpOAuthError('invalid_client', 'This client does not support signed MCP URLs.');\n      }\n      const binding = bindings.get(clientId);\n      if (binding === undefined) {\n        throw new SessionMcpOAuthError('invalid_request', 'Client authorization has not been preauthorized.');\n      }\n      const payload = Buffer.from(\n        JSON.stringify({\n          aud: binding.audience,\n          iat: Math.floor(client.createdAt / 1000),\n          iss: URL_TOKEN_ISSUER,\n          sid: binding.sessionId,\n          sub: client.clientId,\n        } satisfies SessionMcpUrlTokenClaims),\n      ).toString('base64url');\n      const input = `${URL_TOKEN_HEADER}.${payload}`;\n      return `${input}.${urlTokenSignature(input, client.secretHash).toString('base64url')}`;\n    },\n    authenticateUrlToken(token, audience) {\n      const parsed = parseUrlToken(token);\n      if (parsed === undefined) return undefined;\n      const client = clients.get(parsed.claims.sub);\n      if (client === undefined || client.tokenEndpointAuthMethod !== 'url_token') return undefined;\n      const binding = bindings.get(client.clientId);\n      if (\n        binding === undefined ||\n        binding.audience !== audience ||\n        parsed.claims.aud !== audience ||\n        parsed.claims.sid !== binding.sessionId ||\n        parsed.claims.iat !== Math.floor(client.createdAt / 1000)\n      )\n        return undefined;\n      const expected = urlTokenSignature(parsed.input, client.secretHash);\n      if (!timingSafeEqual(expected, parsed.signature)) return undefined;\n      return { id: client.clientId, ...binding, createdAt: client.createdAt, expiresAt: Number.MAX_SAFE_INTEGER };\n    },\n    authenticateAccessToken(token, audience) {\n      sweep();\n      const key = tokenKey(token);\n      // API keys are long-lived credentials, but remain tied to the current binding and audience.\n      const presentedHash = digest(token);\n      for (const client of clients.values()) {\n        if (client.tokenEndpointAuthMethod !== 'api_key' || !timingSafeEqual(presentedHash, client.secretHash))\n          continue;\n        const binding = bindings.get(client.clientId);\n        if (binding === undefined || binding.audience !== audience) return undefined;\n        return { id: client.clientId, ...binding, createdAt: client.createdAt, expiresAt: Number.MAX_SAFE_INTEGER };\n      }\n      const stored = accessTokens.get(key);\n      if (stored === undefined) return undefined;\n      if (stored.expiresAt <= now() || !grants.has(stored.grant.id)) {\n        accessTokens.delete(key);\n        return undefined;\n      }\n      if (stored.grant.audience !== audience) return undefined;\n      return { ...stored.grant, expiresAt: stored.expiresAt };\n    },\n    revokeGrant,\n    revokeSessionGeneration(sessionId, sessionGeneration) {\n      let revoked = 0;\n      for (const grant of grants.values()) {\n        if (grant.sessionId === sessionId && grant.sessionGeneration === sessionGeneration && revokeGrant(grant.id)) {\n          revoked += 1;\n        }\n      }\n      for (const [clientId, binding] of bindings) {\n        if (binding.sessionId === sessionId && binding.sessionGeneration === sessionGeneration)\n          bindings.delete(clientId);\n      }\n      return revoked;\n    },\n    revokeSession(sessionId) {\n      let revoked = 0;\n      for (const grant of grants.values()) {\n        if (grant.sessionId === sessionId && revokeGrant(grant.id)) revoked += 1;\n      }\n      for (const [clientId, binding] of bindings) if (binding.sessionId === sessionId) bindings.delete(clientId);\n      return revoked;\n    },\n  };\n}\n"],"mappings":";;AAEA,MAAM,sBAAsB;AAC5B,MAAM,4BAA4B;AAClC,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB;AAC5B,MAAM,iBAAiB;AACvB,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AACpB,MAAM,mBAAmB,OAAO,KAAK,qCAA6B,CAAC,CAAC,SAAS,WAAW;AACxF,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAQ7B,IAAa,uBAAb,cAA0C,MAAM;CAC9C;CAEA,YAAY,MAAgC,SAAiB;EAC3D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;AASA,SAAgB,kBAAkB,OAAmC;CACnE,IAAI,UAAU,KAAA,KAAa,UAAU,aAAa,UAAU,gBAAgB,OAAO;CACnF,MAAM,IAAI,qBAAqB,mBAAmB,uCAAuC;AAC3F;AA2JA,SAAS,OAAO,OAAuB;CACrC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;AACnD;AAEA,SAAS,SAAS,OAAuB;CACvC,OAAO,OAAO,KAAK,CAAC,CAAC,SAAS,KAAK;AACrC;AAEA,SAAS,OAAO,QAAQ,aAAqB;CAC3C,OAAO,YAAY,KAAK,CAAC,CAAC,SAAS,WAAW;AAChD;AAEA,SAAS,YAAY,QAAgB,cAA+B;CAClE,OAAO,gBAAgB,OAAO,MAAM,GAAG,YAAY;AACrD;AAUA,SAAS,kBAAkB,OAAe,KAAqB;CAC7D,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;AACxD;AAEA,SAAS,cACP,OAC+G;CAC/G,IAAI,MAAM,SAAS,sBAAsB,OAAO,KAAA;CAChD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;CAC/B,MAAM,CAAC,QAAQ,SAAS,oBAAoB;CAC5C,IACE,WAAW,oBACX,CAAC,2BAA2B,KAAK,OAAQ,KACzC,CAAC,uBAAuB,KAAK,gBAAiB,GAE9C,OAAO,KAAA;CACT,IAAI;EACF,MAAM,eAAe,OAAO,KAAK,SAAU,WAAW;EACtD,MAAM,YAAY,OAAO,KAAK,kBAAmB,WAAW;EAC5D,IACE,aAAa,SAAS,WAAW,MAAM,WACvC,UAAU,WAAW,MACrB,UAAU,SAAS,WAAW,MAAM,kBAEpC,OAAO,KAAA;EACT,MAAM,QAAiB,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;EAC/D,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;EAChF,MAAM,SAAS;EACf,IACE,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,yBACxC,OAAO,QAAQ,oBACf,OAAO,OAAO,QAAQ,YACtB,OAAO,QAAQ,MACf,OAAO,OAAO,QAAQ,YACtB,OAAO,QAAQ,MACf,OAAO,OAAO,QAAQ,YACtB,OAAO,QAAQ,MACf,OAAO,OAAO,QAAQ,YACtB,CAAC,OAAO,cAAc,OAAO,GAAG,GAEhC,OAAO,KAAA;EACT,OAAO;GAAU;GAAoC,OAAO,GAAG,OAAO,GAAG;GAAW;EAAU;CAChG,QAAQ;EACN;CACF;AACF;AAEA,SAAS,gBAAgB,OAAe,OAAe,YAA6B;CAClF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,MAAM,IAAI,qBAAqB,mBAAmB,GAAG,MAAM,gCAAgC;CAC7F;CACA,IACE,OAAO,aAAa,YACpB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,SAAS,MACf,CAAC,cAAc,OAAO,WAAW,IAElC,MAAM,IAAI,qBACR,mBACA,GAAG,MAAM,4EACX;CAEF,OAAO,OAAO;AAChB;AAEA,SAAS,YAAY,OAAe,OAAuB;CACzD,MAAM,aAAa,MAAM,KAAK;CAC9B,IAAI,eAAe,IAAI,MAAM,IAAI,qBAAqB,mBAAmB,GAAG,MAAM,oBAAoB;CACtG,OAAO;AACT;AAEA,SAAS,kBAAkB,QAA2B,OAAkC;CACtF,IAAI,OAAO,MAAM,UAAU,UAAU,MAAM,UAAU,MAAM,KAAK,CAAC,GAC/D,MAAM,IAAI,qBAAqB,mBAAmB,GAAG,MAAM,4CAA4C;CAEzG,OAAO,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC;AAC3C;;AAGA,SAAgB,qCACd,UAAiD,CAAC,GAClB;CAChC,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,UAAU,QAAQ,0BAA0B;CAClD,MAAM,YAAY,QAAQ,oBAAoB;CAC9C,MAAM,aAAa,QAAQ,qBAAqB;CAChD,MAAM,aAAa,QAAQ,cAAc;CACzC,IAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,GACpD,MAAM,IAAI,MAAM,4EAA4E;CAG9F,MAAM,0BAAU,IAAI,IAA0B;CAC9C,MAAM,2BAAW,IAAI,IAA4C;CACjE,MAAM,yBAAS,IAAI,IAA6B;CAChD,MAAM,wBAAQ,IAAI,IAAwB;CAC1C,MAAM,+BAAe,IAAI,IAA+B;CACxD,MAAM,gCAAgB,IAAI,IAAgC;CAC1D,MAAM,wCAAwB,IAAI,IAAkC;CAEpE,MAAM,gBAAgB,EAAE,YAAY,aAAa,GAAG,aAA6C;CAEjG,MAAM,oBACJ,OAAO,OAAO,MAAM,OAAO,aAAa,OAAO,cAAc,OAAO,sBAAsB;CAE5F,MAAM,cAAoB;EACxB,MAAM,cAAc,IAAI;EACxB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,IAAI,MAAM,aAAa,aAAa,MAAM,OAAO,GAAG;EACtF,KAAK,MAAM,CAAC,KAAK,UAAU,cAAc,IAAI,MAAM,aAAa,aAAa,aAAa,OAAO,GAAG;EACpG,KAAK,MAAM,CAAC,KAAK,UAAU,eAAe,IAAI,MAAM,aAAa,aAAa,cAAc,OAAO,GAAG;EACtG,KAAK,MAAM,CAAC,KAAK,UAAU,uBACzB,IAAI,MAAM,aAAa,aAAa,sBAAsB,OAAO,GAAG;EAGtE,MAAM,mCAAmB,IAAI,IAAY;EACzC,KAAK,MAAM,SAAS,MAAM,OAAO,GAAG,iBAAiB,IAAI,MAAM,MAAM,EAAE;EACvE,KAAK,MAAM,SAAS,aAAa,OAAO,GAAG,iBAAiB,IAAI,MAAM,MAAM,EAAE;EAC9E,KAAK,MAAM,SAAS,cAAc,OAAO,GAAG,iBAAiB,IAAI,MAAM,MAAM,EAAE;EAC/E,KAAK,MAAM,SAAS,sBAAsB,OAAO,GAAG,iBAAiB,IAAI,MAAM,OAAO;EACtF,KAAK,MAAM,WAAW,OAAO,KAAK,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,GAAG,OAAO,OAAO,OAAO;CAChG;CAEA,MAAM,mBAAmB,sBAAoC;EAC3D,MAAM;EACN,IAAI,YAAY,IAAI,oBAAoB,YACtC,MAAM,IAAI,qBAAqB,mBAAmB,2CAA2C;CAEjG;CAEA,MAAM,sBAAsB,UAAkB,iBAAuC;EACnF,MAAM,SAAS,QAAQ,IAAI,QAAQ;EACnC,IAAI,WAAW,KAAA,KAAa,CAAC,YAAY,cAAc,OAAO,UAAU,GACtE,MAAM,IAAI,qBAAqB,kBAAkB,+BAA+B;EAElF,OAAO;CACT;CAEA,MAAM,eAAe,YAA6B;EAChD,IAAI,CAAC,OAAO,OAAO,OAAO,GAAG,OAAO;EACpC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,IAAI,MAAM,MAAM,OAAO,SAAS,MAAM,OAAO,GAAG;EAClF,KAAK,MAAM,CAAC,KAAK,UAAU,cAAc,IAAI,MAAM,MAAM,OAAO,SAAS,aAAa,OAAO,GAAG;EAChG,KAAK,MAAM,CAAC,KAAK,UAAU,eAAe,IAAI,MAAM,MAAM,OAAO,SAAS,cAAc,OAAO,GAAG;EAClG,OAAO;CACT;CAEA,MAAM,gBAAgB,UAAkB,YAA0B;EAChE,YAAY,OAAO;EACnB,KAAK,MAAM,CAAC,KAAK,UAAU,cAAc,IAAI,MAAM,aAAa,UAAU,aAAa,OAAO,GAAG;EACjG,KAAK,MAAM,CAAC,KAAK,UAAU,eAAe,IAAI,MAAM,aAAa,UAAU,cAAc,OAAO,GAAG;CACrG;CAEA,MAAM,cACJ,OACA,WAAW,OAAO,cAAc,GAChC,kBAAkB,IAAI,IAAI,eACE;EAC5B,MAAM,WAAW,IAAI;EACrB,MAAM,kBAAkB,KAAK,IAAI,WAAW,WAAW,eAAe;EACtE,MAAM,cAAc,OAAO;EAC3B,MAAM,eAAe,OAAO;EAC5B,aAAa,IAAI,SAAS,WAAW,GAAG;GAAE;GAAO;GAAU,WAAW;EAAgB,CAAC;EACvF,cAAc,IAAI,SAAS,YAAY,GAAG;GACxC;GACA;GACA,WAAW;GACX;EACF,CAAC;EACD,OAAO;GACL;GACA;GACA,WAAW;GACX,WAAW,KAAK,IAAI,GAAG,KAAK,OAAO,kBAAkB,YAAY,GAAI,CAAC;GACtE;EACF;CACF;CAEA,OAAO;EACL,aAAa,OAAO;GAClB,MAAM,YAAY,IAAI;GACtB,MAAM,WAAW,OAAO,eAAe;GACvC,MAAM,eAAe,OAAO,mBAAmB;GAC/C,MAAM,gBAAgB,MAAM,eAAe;GAC3C,MAAM,mBAAmB,MAAM,eAAe;GAC9C,IAAI,cAAc;GAClB,IAAI,CAAC,iBAAiB,CAAC,kBAAkB;IACvC,IAAI,OAAO,MAAM,gBAAgB,UAC/B,MAAM,IAAI,qBAAqB,mBAAmB,6CAA6C;IAEjG,cAAc,gBAAgB,MAAM,aAAa,gBAAgB,IAAI;GACvE;GACA,MAAM,SAAuB;IAC3B;IACA,MAAM,YAAY,MAAM,MAAM,aAAa;IAC3C;IACA,yBAAyB,gBAAgB,cAAc,mBAAmB,YAAY;IACtF;IACA,YAAY,OAAO,YAAY;GACjC;GACA,QAAQ,IAAI,UAAU,MAAM;GAC5B,OAAO;IAAE,GAAG,aAAa,MAAM;IAAG;GAAa;EACjD;EACA,WAAW,UAAU;GACnB,MAAM,SAAS,QAAQ,IAAI,QAAQ;GACnC,OAAO,WAAW,KAAA,IAAY,KAAA,IAAY,aAAa,MAAM;EAC/D;EACA,cAAc;GACZ,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,IAAI,YAAY;EAC/C;EACA,aAAa,UAAU;GACrB,IAAI,CAAC,QAAQ,OAAO,QAAQ,GAAG,OAAO;GACtC,SAAS,OAAO,QAAQ;GACxB,KAAK,MAAM,SAAS,OAAO,OAAO,GAAG,IAAI,MAAM,aAAa,UAAU,YAAY,MAAM,EAAE;GAC1F,OAAO;EACT;EACA,2BAA2B,OAAO;GAChC,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG,MAAM,IAAI,qBAAqB,kBAAkB,uBAAuB;GAC1G,IAAI,SAAS,IAAI,MAAM,QAAQ,GAC7B,MAAM,IAAI,qBAAqB,mBAAmB,wCAAwC;GAE5F,IAAI,CAAC,OAAO,cAAc,MAAM,iBAAiB,KAAK,MAAM,oBAAoB,GAC9E,MAAM,IAAI,qBAAqB,mBAAmB,yDAAyD;GAE7G,MAAM,UAAU,kBAAkB,MAAM,OAAO;GAC/C,MAAM,QAAQ,MAAM,SAAS;GAC7B,IAAI,UAAU,aAAa,UAAU,cACnC,MAAM,IAAI,qBAAqB,mBAAmB,uCAAuC;GAE3F,IAAI;GACJ,IAAI;GACJ,IAAI,UAAU,WAAW;IACvB,IAAI,MAAM,UAAU,KAAA,KAAa,MAAM,WAAW,KAAA,GAChD,MAAM,IAAI,qBAAqB,mBAAmB,iDAAiD;IAErG,QAAQ,OAAO,OAAO,CAAC,CAAa;IACpC,SAAS,OAAO,OAAO,CAAC,CAAa;GACvC,OAAO;IACL,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC,MAAM,QAAQ,MAAM,MAAM,GAC5D,MAAM,IAAI,qBAAqB,mBAAmB,kDAAkD;IAEtG,QAAQ,kBAAkB,MAAM,OAAO,MAAM;IAC7C,SAAS,kBAAkB,MAAM,QAAQ,OAAO;GAClD;GACA,MAAM,UAA0C,OAAO,OAAO;IAC5D,UAAU,MAAM;IAChB,WAAW,YAAY,MAAM,WAAW,YAAY;IACpD,mBAAmB,MAAM;IACzB,UAAU,gBAAgB,MAAM,UAAU,YAAY,KAAK;IAC3D;IACA;IACA;IACA;GACF,CAAC;GACD,SAAS,IAAI,MAAM,UAAU,OAAO;GACpC,OAAO;EACT;EACA,yBAAyB,UAAU;GACjC,OAAO,SAAS,IAAI,QAAQ;EAC9B;EACA,uBAAuB,UAAU,aAAa,YAAY;GACxD,MAAM,SAAS,QAAQ,IAAI,QAAQ;GACnC,MAAM,UAAU,SAAS,IAAI,QAAQ;GACrC,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,KAAa,CAAC,OAAO,cAAc,UAAU,GAAG,OAAO,KAAA;GAC/F,MAAM,EAAE,mBAAmB,oBAAoB,GAAG,sBAAsB;GACxE,OAAO;IACL,QAAQ,aAAa,MAAM;IAC3B,YAAY,OAAO,WAAW,SAAS,KAAK;IAC5C,aAAa,YAAY,aAAa,cAAc;IACpD,SAAS;IACT;GACF;EACF;EACA,8BAA8B,cAAc,mBAAmB;GAC7D,IACE,SAAS,IAAI,aAAa,OAAO,QAAQ,KACzC,CAAC,kBAAkB,KAAK,aAAa,UAAU,KAC/C,CAAC,OAAO,cAAc,iBAAiB,KACvC,oBAAoB,KACpB,aAAa,OAAO,aAAa,aAAa,QAAQ,UAEtD,OAAO;GACT,IAAI;IAEF,MAAM,OAAO,QAAQ,IAAI,aAAa,OAAO,QAAQ;IACrD,IACE,SACC,KAAK,gBAAgB,aAAa,OAAO,eACxC,KAAK,4BAA4B,aAAa,OAAO,2BACrD,CAAC,gBAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,KAAK,CAAC,IAE/E,OAAO;IACT,IACG,aAAa,OAAO,4BAA4B,wBAC/C,aAAa,OAAO,4BAA4B,aAChD,aAAa,OAAO,4BAA4B,eACjD,aAAa,OAAO,4BAA4B,yBAC9C,aAAa,OAAO,gBAAgB,MAAM,aAAa,QAAQ,UAAU,YAE5E,OAAO;IACT,MAAM,SAAuB;KAC3B,UAAU,YAAY,aAAa,OAAO,UAAU,WAAW;KAC/D,MAAM,YAAY,aAAa,OAAO,MAAM,aAAa;KACzD,aACE,aAAa,OAAO,4BAA4B,uBAC5C,gBAAgB,aAAa,OAAO,aAAa,gBAAgB,IAAI,IACrE,aAAa,OAAO;KAC1B,yBAAyB,aAAa,OAAO;KAC7C,WAAW,aAAa,OAAO;KAC/B,YAAY,OAAO,KAAK,aAAa,YAAY,KAAK;IACxD;IACA,MAAM,UAAU,kBAAkB,aAAa,QAAQ,OAAO;IAC9D,MAAM,QAAQ,aAAa,QAAQ;IACnC,MAAM,QACJ,UAAU,YAAY,OAAO,OAAO,CAAC,CAAa,IAAI,kBAAkB,aAAa,QAAQ,OAAO,MAAM;IAC5G,MAAM,SACJ,UAAU,YAAY,OAAO,OAAO,CAAC,CAAa,IAAI,kBAAkB,aAAa,QAAQ,QAAQ,OAAO;IAC9G,IACG,UAAU,aAAa,UAAU,gBACjC,UAAU,cAAc,aAAa,QAAQ,MAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,WAAW,IAE3G,MAAM,IAAI,qBAAqB,mBAAmB,8CAA8C;IAElG,QAAQ,IAAI,OAAO,UAAU,MAAM;IACnC,SAAS,IACP,OAAO,UACP,OAAO,OAAO;KACZ,UAAU,OAAO;KACjB,WAAW,YAAY,aAAa,QAAQ,WAAW,YAAY;KACnE;KACA,UAAU,gBAAgB,aAAa,QAAQ,UAAU,YAAY,KAAK;KAC1E;KACA;KACA;KACA;IACF,CAAC,CACH;IACA,OAAO;GACT,QAAQ;IACN,QAAQ,OAAO,aAAa,OAAO,QAAQ;IAC3C,OAAO;GACT;EACF;EACA,uBAAuB,OAAO;GAC5B,MAAM,SAAS,QAAQ,IAAI,MAAM,QAAQ;GACzC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,qBAAqB,kBAAkB,uBAAuB;GAClG,MAAM,UAAU,SAAS,IAAI,MAAM,QAAQ;GAC3C,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,qBAAqB,mBAAmB,kDAAkD;GAEtG,IAAI,OAAO,4BAA4B,sBACrC,MAAM,IAAI,qBAAqB,kBAAkB,mDAAmD;GAEtG,IAAI,MAAM,gBAAgB,OAAO,aAC/B,MAAM,IAAI,qBACR,mBACA,8DACF;GAEF,IAAI,MAAM,wBAAwB,UAAU,CAAC,uBAAuB,KAAK,MAAM,aAAa,GAC1F,MAAM,IAAI,qBAAqB,mBAAmB,0CAA0C;GAE9F,gBAAgB,CAAC;GACjB,MAAM,WAAW,IAAI;GACrB,MAAM,QAAyB,OAAO,OAAO;IAC3C,IAAI,OAAO,cAAc;IACzB,GAAG;IACH,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO;GACpB,MAAM,YAAY,WAAW;GAC7B,OAAO,IAAI,MAAM,IAAI,KAAK;GAC1B,MAAM,IAAI,SAAS,IAAI,GAAG;IACxB,UAAU,OAAO;IACjB,aAAa,OAAO;IACpB,WAAW,MAAM;IACjB;IACA;GACF,CAAC;GACD,OAAO;IAAE;IAAM;IAAO;GAAU;EAClC;EACA,cAAc,SAAS;GAErB,IADe,mBAAmB,QAAQ,UAAU,QAAQ,YACnD,CAAC,CAAC,4BAA4B,sBACrC,MAAM,IAAI,qBAAqB,kBAAkB,4CAA4C;GAE/F,MAAM;GACN,IAAI,QAAQ,cAAc,sBAAsB;IAC9C,MAAM,UAAU,SAAS,QAAQ,IAAI;IACrC,MAAM,SAAS,MAAM,IAAI,OAAO;IAChC,IACE,WAAW,KAAA,KACX,OAAO,aAAa,IAAI,KACxB,OAAO,aAAa,QAAQ,YAC5B,OAAO,gBAAgB,QAAQ,eAC/B,CAAC,8BAA8B,KAAK,QAAQ,YAAY,KACxD,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,YAAY,CAAC,CAAC,OAAO,WAAW,MAAM,OAAO,aACjF,CAAC,OAAO,IAAI,OAAO,MAAM,EAAE,GAC3B;KACA,MAAM,OAAO,OAAO;KACpB,IAAI,WAAW,KAAA,GAAW,YAAY,OAAO,MAAM,EAAE;KACrD,MAAM,IAAI,qBAAqB,iBAAiB,2CAA2C;IAC7F;IACA,gBAAgB,CAAC;IACjB,MAAM,OAAO,OAAO;IACpB,OAAO,WAAW,OAAO,KAAK;GAChC;GACA,IAAI,QAAQ,cAAc,iBAAiB;IACzC,MAAM,aAAa,SAAS,QAAQ,YAAY;IAChD,MAAM,WAAW,sBAAsB,IAAI,UAAU;IACrD,IAAI,aAAa,KAAA,GAAW;KAC1B,IAAI,SAAS,aAAa,QAAQ,YAAY,SAAS,YAAY,IAAI,GACrE,aAAa,SAAS,UAAU,SAAS,OAAO;KAElD,MAAM,IAAI,qBAAqB,iBAAiB,sCAAsC;IACxF;IACA,MAAM,SAAS,cAAc,IAAI,UAAU;IAC3C,IACE,WAAW,KAAA,KACX,OAAO,aAAa,IAAI,KACxB,OAAO,MAAM,aAAa,QAAQ,YAClC,CAAC,OAAO,IAAI,OAAO,MAAM,EAAE,GAC3B;KACA,cAAc,OAAO,UAAU;KAC/B,MAAM,IAAI,qBAAqB,iBAAiB,sCAAsC;IACxF;IACA,gBAAgB,CAAC;IACjB,cAAc,OAAO,UAAU;IAC/B,sBAAsB,IAAI,YAAY;KACpC,UAAU,OAAO,MAAM;KACvB,SAAS,OAAO,MAAM;KACtB,UAAU,OAAO;KACjB,WAAW,OAAO;IACpB,CAAC;IACD,OAAO,WAAW,OAAO,OAAO,OAAO,UAAU,OAAO,eAAe;GACzE;GACA,MAAM,IAAI,qBACR,0BACA,0DACF;EACF;EACA,cAAc,UAAU;GACtB,MAAM,SAAS,QAAQ,IAAI,QAAQ;GACnC,IAAI,WAAW,KAAA,KAAa,OAAO,4BAA4B,aAC7D,MAAM,IAAI,qBAAqB,kBAAkB,+CAA+C;GAElG,MAAM,UAAU,SAAS,IAAI,QAAQ;GACrC,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,qBAAqB,mBAAmB,kDAAkD;GAEtG,MAAM,UAAU,OAAO,KACrB,KAAK,UAAU;IACb,KAAK,QAAQ;IACb,KAAK,KAAK,MAAM,OAAO,YAAY,GAAI;IACvC,KAAK;IACL,KAAK,QAAQ;IACb,KAAK,OAAO;GACd,CAAoC,CACtC,CAAC,CAAC,SAAS,WAAW;GACtB,MAAM,QAAQ,GAAG,iBAAiB,GAAG;GACrC,OAAO,GAAG,MAAM,GAAG,kBAAkB,OAAO,OAAO,UAAU,CAAC,CAAC,SAAS,WAAW;EACrF;EACA,qBAAqB,OAAO,UAAU;GACpC,MAAM,SAAS,cAAc,KAAK;GAClC,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;GACjC,MAAM,SAAS,QAAQ,IAAI,OAAO,OAAO,GAAG;GAC5C,IAAI,WAAW,KAAA,KAAa,OAAO,4BAA4B,aAAa,OAAO,KAAA;GACnF,MAAM,UAAU,SAAS,IAAI,OAAO,QAAQ;GAC5C,IACE,YAAY,KAAA,KACZ,QAAQ,aAAa,YACrB,OAAO,OAAO,QAAQ,YACtB,OAAO,OAAO,QAAQ,QAAQ,aAC9B,OAAO,OAAO,QAAQ,KAAK,MAAM,OAAO,YAAY,GAAI,GAExD,OAAO,KAAA;GACT,MAAM,WAAW,kBAAkB,OAAO,OAAO,OAAO,UAAU;GAClE,IAAI,CAAC,gBAAgB,UAAU,OAAO,SAAS,GAAG,OAAO,KAAA;GACzD,OAAO;IAAE,IAAI,OAAO;IAAU,GAAG;IAAS,WAAW,OAAO;IAAW,WAAW,OAAO;GAAiB;EAC5G;EACA,wBAAwB,OAAO,UAAU;GACvC,MAAM;GACN,MAAM,MAAM,SAAS,KAAK;GAE1B,MAAM,gBAAgB,OAAO,KAAK;GAClC,KAAK,MAAM,UAAU,QAAQ,OAAO,GAAG;IACrC,IAAI,OAAO,4BAA4B,aAAa,CAAC,gBAAgB,eAAe,OAAO,UAAU,GACnG;IACF,MAAM,UAAU,SAAS,IAAI,OAAO,QAAQ;IAC5C,IAAI,YAAY,KAAA,KAAa,QAAQ,aAAa,UAAU,OAAO,KAAA;IACnE,OAAO;KAAE,IAAI,OAAO;KAAU,GAAG;KAAS,WAAW,OAAO;KAAW,WAAW,OAAO;IAAiB;GAC5G;GACA,MAAM,SAAS,aAAa,IAAI,GAAG;GACnC,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;GACjC,IAAI,OAAO,aAAa,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,MAAM,EAAE,GAAG;IAC7D,aAAa,OAAO,GAAG;IACvB;GACF;GACA,IAAI,OAAO,MAAM,aAAa,UAAU,OAAO,KAAA;GAC/C,OAAO;IAAE,GAAG,OAAO;IAAO,WAAW,OAAO;GAAU;EACxD;EACA;EACA,wBAAwB,WAAW,mBAAmB;GACpD,IAAI,UAAU;GACd,KAAK,MAAM,SAAS,OAAO,OAAO,GAChC,IAAI,MAAM,cAAc,aAAa,MAAM,sBAAsB,qBAAqB,YAAY,MAAM,EAAE,GACxG,WAAW;GAGf,KAAK,MAAM,CAAC,UAAU,YAAY,UAChC,IAAI,QAAQ,cAAc,aAAa,QAAQ,sBAAsB,mBACnE,SAAS,OAAO,QAAQ;GAE5B,OAAO;EACT;EACA,cAAc,WAAW;GACvB,IAAI,UAAU;GACd,KAAK,MAAM,SAAS,OAAO,OAAO,GAChC,IAAI,MAAM,cAAc,aAAa,YAAY,MAAM,EAAE,GAAG,WAAW;GAEzE,KAAK,MAAM,CAAC,UAAU,YAAY,UAAU,IAAI,QAAQ,cAAc,WAAW,SAAS,OAAO,QAAQ;GACzG,OAAO;EACT;CACF;AACF"}