@ai-ecoverse/slicc-agent 3.35.0 → 3.36.1

package/dist/mcp/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/index.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type {\n  Agent,\n  Registry,\n  ToolExecutionApi,\n  ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport type { CodemodeExtra } from './allow.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport { parseMcpConfig } from './config.ts';\nimport type { McpAttach, McpRuntime } from './runtime.ts';\n\nexport { allows, type CodemodeExtra, McpAllowDoc, mcpEntries, serverAllowed } from './allow.ts';\nexport type { McpAccounts, McpAttach, McpRuntime, ServerStatus } from './runtime.ts';\n\nexport type McpLoader = () => Promise<typeof import('./runtime.ts')>;\n\nexport const loadRuntime: McpLoader = () => import('./runtime.ts');\n\nexport interface McpSetup {\n  catalog(): McpCatalog | undefined;\n  direct(names: readonly string[]): ToolRegistration[];\n  codemode(api: ToolExecutionApi, agent: Agent, context: Context): Promise<CodemodeExtra>;\n  attach(options: McpAttach, context: Context): Promise<McpRuntime>;\n}\n\nconst idle: McpRuntime = {\n  accounts: async () => [],\n  connect: async (id) => {\n    throw new Error(`${id} is not an MCP server that takes a token`);\n  },\n  disconnect: async () => undefined,\n  onChange: () => () => undefined,\n  status: () => [],\n  reload: async () => undefined,\n  close: async () => undefined,\n};\n\nasync function unavailable(options: McpAttach, error: unknown, context: Context) {\n  const file = `${options.home}/.pi/agent/mcp.json`;\n  const read = await options.env.readTextFile(file, context);\n  if (!parseMcpConfig(read.ok ? read.value : undefined).servers.length) return;\n  await options.licks\n    .deliver(\n      {\n        channel: 'fswatch',\n        source: 'mcp:~/.pi/agent/mcp.json',\n        title: \"MCP servers can't start in this SLICC\",\n        text: error instanceof Error ? error.message : String(error),\n        body: \"The MCP client didn't load, so the servers in ~/.pi/agent/mcp.json stay off until SLICC is updated.\",\n        target: 'cone',\n        severity: 'warn',\n        eventId: 'mcp\\nunavailable',\n      },\n      context\n    )\n    .catch(() => undefined);\n}\n\nexport function setupMcp(registry: Registry, load: McpLoader = loadRuntime): McpSetup {\n  let catalog: McpCatalog | undefined;\n  return {\n    catalog: () => catalog,\n    direct: (names) => catalog?.direct(names) ?? [],\n    codemode: async (api, agent, context) =>\n      catalog ? catalog.codemode(api, agent, context) : { tools: [], globals: [] },\n    async attach(options, context) {\n      let started: Awaited<ReturnType<Awaited<ReturnType<McpLoader>>['startMcp']>>;\n      try {\n        started = await (await load()).startMcp(registry, options, context);\n      } catch (error) {\n        await unavailable(options, error, context);\n        return idle;\n      }\n      catalog = started.catalog;\n      return started.runtime;\n    },\n  };\n}\n"],
-  "mappings": "AASA,SAAS,sBAAsB;AAG/B,SAAS,QAA4B,aAAa,YAAY,qBAAqB;AAK5E,MAAM,cAAyB,MAAM,OAAO,cAAc;AASjE,MAAM,OAAmB;AAAA,EACvB,UAAU,YAAY,CAAC;AAAA,EACvB,SAAS,OAAO,OAAO;AACrB,UAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AAAA,EACjE;AAAA,EACA,YAAY,YAAY;AAAA,EACxB,UAAU,MAAM,MAAM;AAAA,EACtB,QAAQ,MAAM,CAAC;AAAA,EACf,QAAQ,YAAY;AAAA,EACpB,OAAO,YAAY;AACrB;AAEA,eAAe,YAAY,SAAoB,OAAgB,SAAkB;AAC/E,QAAM,OAAO,GAAG,QAAQ,IAAI;AAC5B,QAAM,OAAO,MAAM,QAAQ,IAAI,aAAa,MAAM,OAAO;AACzD,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS,EAAE,QAAQ,OAAQ;AACtE,QAAM,QAAQ,MACX;AAAA,IACC;AAAA,MACE,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC3D,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA;AAAA,EACF,EACC,MAAM,MAAM,MAAS;AAC1B;AAEO,SAAS,SAAS,UAAoB,OAAkB,aAAuB;AACpF,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC;AAAA,IAC9C,UAAU,OAAO,KAAK,OAAO,YAC3B,UAAU,QAAQ,SAAS,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC7E,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AACJ,UAAI;AACF,kBAAU,OAAO,MAAM,KAAK,GAAG,SAAS,UAAU,SAAS,OAAO;AAAA,MACpE,SAAS,OAAO;AACd,cAAM,YAAY,SAAS,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,gBAAU,QAAQ;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type {\n  Agent,\n  Registry,\n  ToolExecutionApi,\n  ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport type { CodemodeExtra } from './allow.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport { parseMcpConfig } from './config.ts';\nimport type { McpAttach, McpRuntime } from './runtime.ts';\n\nexport { allows, type CodemodeExtra, McpAllowDoc, mcpEntries, serverAllowed } from './allow.ts';\nexport type { McpAccounts, McpAttach, McpRuntime, ServerStatus } from './runtime.ts';\n\nexport type McpLoader = () => Promise<typeof import('./runtime.ts')>;\n\nexport const loadRuntime: McpLoader = () => import('./runtime.ts');\n\nexport interface McpSetup {\n  catalog(): McpCatalog | undefined;\n  direct(names: readonly string[]): ToolRegistration[];\n  codemode(api: ToolExecutionApi, agent: Agent, context: Context): Promise<CodemodeExtra>;\n  attach(options: McpAttach, context: Context): Promise<McpRuntime>;\n}\n\nconst idle: McpRuntime = {\n  accounts: async () => [],\n  signIn: async (id) => {\n    throw new Error(`${id} is not an MCP server that signs in`);\n  },\n  connect: async (id) => {\n    throw new Error(`${id} is not an MCP server that takes a token`);\n  },\n  disconnect: async () => undefined,\n  onChange: () => () => undefined,\n  status: () => [],\n  reload: async () => undefined,\n  close: async () => undefined,\n};\n\nasync function unavailable(options: McpAttach, error: unknown, context: Context) {\n  const file = `${options.home}/.pi/agent/mcp.json`;\n  const read = await options.env.readTextFile(file, context);\n  if (!parseMcpConfig(read.ok ? read.value : undefined).servers.length) return;\n  await options.licks\n    .deliver(\n      {\n        channel: 'fswatch',\n        source: 'mcp:~/.pi/agent/mcp.json',\n        title: \"MCP servers can't start in this SLICC\",\n        text: error instanceof Error ? error.message : String(error),\n        body: \"The MCP client didn't load, so the servers in ~/.pi/agent/mcp.json stay off until SLICC is updated.\",\n        target: 'cone',\n        severity: 'warn',\n        eventId: 'mcp\\nunavailable',\n      },\n      context\n    )\n    .catch(() => undefined);\n}\n\nexport function setupMcp(registry: Registry, load: McpLoader = loadRuntime): McpSetup {\n  let catalog: McpCatalog | undefined;\n  return {\n    catalog: () => catalog,\n    direct: (names) => catalog?.direct(names) ?? [],\n    codemode: async (api, agent, context) =>\n      catalog ? catalog.codemode(api, agent, context) : { tools: [], globals: [] },\n    async attach(options, context) {\n      let started: Awaited<ReturnType<Awaited<ReturnType<McpLoader>>['startMcp']>>;\n      try {\n        started = await (await load()).startMcp(registry, options, context);\n      } catch (error) {\n        await unavailable(options, error, context);\n        return idle;\n      }\n      catalog = started.catalog;\n      return started.runtime;\n    },\n  };\n}\n"],
+  "mappings": "AASA,SAAS,sBAAsB;AAG/B,SAAS,QAA4B,aAAa,YAAY,qBAAqB;AAK5E,MAAM,cAAyB,MAAM,OAAO,cAAc;AASjE,MAAM,OAAmB;AAAA,EACvB,UAAU,YAAY,CAAC;AAAA,EACvB,QAAQ,OAAO,OAAO;AACpB,UAAM,IAAI,MAAM,GAAG,EAAE,qCAAqC;AAAA,EAC5D;AAAA,EACA,SAAS,OAAO,OAAO;AACrB,UAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AAAA,EACjE;AAAA,EACA,YAAY,YAAY;AAAA,EACxB,UAAU,MAAM,MAAM;AAAA,EACtB,QAAQ,MAAM,CAAC;AAAA,EACf,QAAQ,YAAY;AAAA,EACpB,OAAO,YAAY;AACrB;AAEA,eAAe,YAAY,SAAoB,OAAgB,SAAkB;AAC/E,QAAM,OAAO,GAAG,QAAQ,IAAI;AAC5B,QAAM,OAAO,MAAM,QAAQ,IAAI,aAAa,MAAM,OAAO;AACzD,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS,EAAE,QAAQ,OAAQ;AACtE,QAAM,QAAQ,MACX;AAAA,IACC;AAAA,MACE,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC3D,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA;AAAA,EACF,EACC,MAAM,MAAM,MAAS;AAC1B;AAEO,SAAS,SAAS,UAAoB,OAAkB,aAAuB;AACpF,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC;AAAA,IAC9C,UAAU,OAAO,KAAK,OAAO,YAC3B,UAAU,QAAQ,SAAS,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC7E,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AACJ,UAAI;AACF,kBAAU,OAAO,MAAM,KAAK,GAAG,SAAS,UAAU,SAAS,OAAO;AAAA,MACpE,SAAS,OAAO;AACd,cAAM,YAAY,SAAS,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,gBAAU,QAAQ;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/mcp/oauth.js

@@ -0,0 +1,268 @@
+import {
+  authorizeMcp,
+  discoverOAuthServerInfo,
+  McpOAuthAuthorizationRequiredError,
+  parseWwwAuthenticate,
+  registerClient,
+  selectResource,
+  stepUpScope
+} from "@earendil-works/pi-mcp/oauth";
+import { credentialKey } from "./credentials.js";
+const CLIENT_NAME = "SLICC";
+function sentence(text) {
+  const trimmed = text.trim();
+  const lowered = /^[A-Z][a-z]/.test(trimmed) ? `${trimmed[0]?.toLowerCase()}${trimmed.slice(1)}` : trimmed;
+  return /[.!?]$/.test(lowered) ? lowered : `${lowered}.`;
+}
+const LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function secureUrl(url) {
+  return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK.has(url.hostname);
+}
+function signInRequired(cause) {
+  const error = new McpOAuthAuthorizationRequiredError();
+  if (cause !== void 0) error.cause = cause;
+  return error;
+}
+function authProvider(provider, server) {
+  const configured = server.config.oauth?.authServerMetadataUrl;
+  let inFlight;
+  const authorize = async (context, step, challenge) => {
+    const granted = step ? await provider.tokens() : void 0;
+    try {
+      await authorizeMcp(provider, {
+        serverUrl: context.serverUrl,
+        ...challenge.resourceMetadataUrl ? { resourceMetadataUrl: challenge.resourceMetadataUrl } : {},
+        ...step ? { scope: stepUpScope(granted?.scope, challenge.scope), skipRefresh: true } : challenge.scope ? { scope: challenge.scope } : {},
+        ...configured ? { authorizationServerMetadataUrl: new URL(configured) } : {},
+        fetch: context.fetch
+      });
+    } catch (error) {
+      throw error instanceof McpOAuthAuthorizationRequiredError ? error : signInRequired(error);
+    }
+  };
+  return {
+    token: async () => (await provider.tokens())?.access_token,
+    async onUnauthorized(context) {
+      const challenge = parseWwwAuthenticate(context.response.headers.get("www-authenticate"));
+      const step = challenge.error === "insufficient_scope";
+      if (!step && !inFlight && context.token !== void 0) {
+        const current = (await provider.tokens())?.access_token;
+        if (current !== void 0 && current !== context.token) return;
+      }
+      inFlight ??= authorize(context, step, challenge).finally(() => {
+        inFlight = void 0;
+      });
+      await inFlight;
+    }
+  };
+}
+const bytesToBase64Url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const random = (length) => crypto.getRandomValues(new Uint8Array(length));
+async function pkce() {
+  const verifier = bytesToBase64Url(random(32));
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };
+}
+function randomState() {
+  return [...random(32)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+class StoredOAuth {
+  redirectUrl;
+  clientMetadata;
+  #credentials;
+  #server;
+  #writes = Promise.resolve();
+  constructor(server, credentials, redirectUrl) {
+    this.#server = server;
+    this.#credentials = credentials;
+    this.redirectUrl = redirectUrl;
+    this.clientMetadata = {
+      client_name: server.config.oauth?.clientName ?? CLIENT_NAME,
+      redirect_uris: [redirectUrl],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      ...server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}
+    };
+  }
+  get serverUrl() {
+    return String(new URL(this.#server.config.url));
+  }
+  async #key() {
+    return credentialKey(this.#server.name, this.#server.config.url);
+  }
+  async load() {
+    await this.#writes;
+    const stored = await this.#credentials.read(await this.#key());
+    const state = stored?.type === "oauth" ? stored.state : void 0;
+    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };
+  }
+  async update(change) {
+    const write = this.#writes.then(async () => {
+      const key = await this.#key();
+      await this.#credentials.modify(key, async (current) => {
+        const before = current?.type === "oauth" ? current.state : void 0;
+        const next = change(
+          before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl }
+        );
+        return {
+          type: "oauth",
+          access: next.tokens?.access_token ?? "",
+          refresh: next.tokens?.refresh_token ?? "",
+          expires: next.tokensExpireAt ?? 0,
+          state: next
+        };
+      });
+    });
+    this.#writes = write.catch(() => void 0);
+    await write;
+  }
+  async signedIn() {
+    return (await this.load()).tokens !== void 0;
+  }
+  state() {
+    throw new McpOAuthAuthorizationRequiredError();
+  }
+  async clientInformation() {
+    const configured = this.#server.config.oauth?.clientId;
+    return configured ? { client_id: configured } : (await this.load()).clientInformation;
+  }
+  async saveClientInformation(information) {
+    if (this.#server.config.oauth?.clientId) return;
+    await this.update((state) => ({ ...state, clientInformation: information }));
+  }
+  async tokens() {
+    return (await this.load()).tokens;
+  }
+  async saveTokens(tokens) {
+    const expires = tokens.expires_in === void 0 ? void 0 : Date.now() + tokens.expires_in * 1e3;
+    await this.update((state) => {
+      const next = { ...state, tokens };
+      if (expires === void 0) delete next.tokensExpireAt;
+      else next.tokensExpireAt = expires;
+      return next;
+    });
+  }
+  redirectToAuthorization() {
+    throw new McpOAuthAuthorizationRequiredError();
+  }
+  async saveCodeVerifier(verifier) {
+    await this.update((state) => ({ ...state, codeVerifier: verifier }));
+  }
+  async codeVerifier() {
+    const verifier = (await this.load()).codeVerifier;
+    if (!verifier) throw new Error("No OAuth PKCE code verifier is stored");
+    return verifier;
+  }
+  async invalidateCredentials(kind) {
+    await this.update((state) => {
+      const next = { ...state };
+      if (kind === "all" || kind === "client") delete next.clientInformation;
+      if (kind === "all" || kind === "tokens") {
+        delete next.tokens;
+        delete next.tokensExpireAt;
+      }
+      if (kind === "all" || kind === "verifier") delete next.codeVerifier;
+      if (kind === "all" || kind === "discovery") delete next.discovery;
+      if (kind === "all") delete next.oauthState;
+      return next;
+    });
+  }
+  async saveDiscoveryState(discovery) {
+    await this.update((state) => ({ ...state, discovery }));
+  }
+  async discoveryState() {
+    return (await this.load()).discovery;
+  }
+  async forget() {
+    await this.#writes;
+    await this.#credentials.delete(await this.#key());
+  }
+}
+async function beginSignIn(provider, server, options) {
+  const configured = server.config.oauth?.authServerMetadataUrl;
+  const info = await discoverOAuthServerInfo(server.config.url, {
+    fetch: options.fetch,
+    ...options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {},
+    ...configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}
+  });
+  if (!configured) await provider.saveDiscoveryState(info);
+  const metadata = info.authorizationServerMetadata;
+  if (metadata && !metadata.response_types_supported.includes("code"))
+    throw new Error("The authorization server doesn't support authorization codes.");
+  if (metadata?.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256"))
+    throw new Error("The authorization server doesn't support PKCE S256.");
+  const scope = server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(" ") || void 0;
+  let client = await provider.clientInformation();
+  if (!client) {
+    client = await registerClient(info.authorizationServerUrl, {
+      ...metadata ? { metadata } : {},
+      clientMetadata: provider.clientMetadata,
+      ...scope ? { scope } : {},
+      fetch: options.fetch
+    });
+    await provider.saveClientInformation(client);
+  }
+  const { verifier, challenge } = await pkce();
+  const state = randomState();
+  await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));
+  const url = new URL(
+    metadata?.authorization_endpoint ?? new URL("/authorize", info.authorizationServerUrl)
+  );
+  if (!secureUrl(url)) throw new Error("The authorization server's sign-in address isn't https.");
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", client.client_id);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("redirect_uri", provider.redirectUrl);
+  url.searchParams.set("state", state);
+  if (scope) url.searchParams.set("scope", scope);
+  if (scope?.split(/\s+/).includes("offline_access")) url.searchParams.set("prompt", "consent");
+  const resource = selectResource(server.config.url, info.resourceMetadata);
+  if (resource) url.searchParams.set("resource", resource);
+  return { url: url.href, state };
+}
+async function finishSignIn(provider, server, answer, fetch) {
+  let callback;
+  try {
+    callback = JSON.parse(answer);
+  } catch {
+    throw new Error("The sign-in answer isn't a callback.");
+  }
+  const expected = (await provider.load()).oauthState;
+  if (!expected || callback.state !== expected)
+    throw new Error("The sign-in answer doesn't match this sign-in. Try again.");
+  if (callback.error)
+    throw new Error(
+      `Sign-in failed: ${sentence(callback.error_description?.trim() || callback.error)}`
+    );
+  if (!callback.code) throw new Error("The sign-in answer has no authorization code.");
+  const configured = server.config.oauth?.authServerMetadataUrl;
+  await authorizeMcp(provider, {
+    serverUrl: server.config.url,
+    authorizationCode: callback.code,
+    ...callback.iss ? { iss: callback.iss } : {},
+    ...server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {},
+    ...configured ? { authorizationServerMetadataUrl: new URL(configured) } : {},
+    fetch
+  });
+  await provider.update((state) => {
+    const next = { ...state };
+    delete next.oauthState;
+    delete next.codeVerifier;
+    return next;
+  });
+}
+export {
+  CLIENT_NAME,
+  StoredOAuth,
+  authProvider,
+  beginSignIn,
+  finishSignIn,
+  pkce,
+  randomState,
+  secureUrl,
+  sentence,
+  signInRequired
+};
+//# sourceMappingURL=oauth.js.map

package/dist/mcp/oauth.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/mcp/oauth.ts"],
+  "sourcesContent": ["import type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { AuthProvider, McpFetch, UnauthorizedContext } from '@earendil-works/pi-mcp';\nimport {\n  authorizeMcp,\n  discoverOAuthServerInfo,\n  McpOAuthAuthorizationRequiredError,\n  type McpOAuthState,\n  type OAuthChallenge,\n  parseWwwAuthenticate,\n  registerClient,\n  selectResource,\n  stepUpScope,\n} from '@earendil-works/pi-mcp/oauth';\nimport type { McpSignIn } from '../services.ts';\nimport type { McpServerConfig } from './config.ts';\nimport { credentialKey } from './credentials.ts';\n\ntype Provider = Parameters<typeof authorizeMcp>[0];\ntype Tokens = Awaited<ReturnType<Provider['tokens']>>;\ntype Client = Awaited<ReturnType<Provider['clientInformation']>>;\ntype Discovery = NonNullable<McpOAuthState['discovery']>;\n\nexport const CLIENT_NAME = 'SLICC';\n\nexport function sentence(text: string): string {\n  const trimmed = text.trim();\n  const lowered = /^[A-Z][a-z]/.test(trimmed)\n    ? `${trimmed[0]?.toLowerCase()}${trimmed.slice(1)}`\n    : trimmed;\n  return /[.!?]$/.test(lowered) ? lowered : `${lowered}.`;\n}\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function secureUrl(url: URL): boolean {\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nexport function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError {\n  const error = new McpOAuthAuthorizationRequiredError();\n  if (cause !== undefined) error.cause = cause;\n  return error;\n}\n\nexport function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  let inFlight: Promise<void> | undefined;\n  const authorize = async (\n    context: UnauthorizedContext,\n    step: boolean,\n    challenge: OAuthChallenge\n  ) => {\n    const granted = step ? await provider.tokens() : undefined;\n    try {\n      await authorizeMcp(provider, {\n        serverUrl: context.serverUrl,\n        ...(challenge.resourceMetadataUrl\n          ? { resourceMetadataUrl: challenge.resourceMetadataUrl }\n          : {}),\n        ...(step\n          ? { scope: stepUpScope(granted?.scope, challenge.scope), skipRefresh: true }\n          : challenge.scope\n            ? { scope: challenge.scope }\n            : {}),\n        ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n        fetch: context.fetch,\n      });\n    } catch (error) {\n      throw error instanceof McpOAuthAuthorizationRequiredError ? error : signInRequired(error);\n    }\n  };\n  return {\n    token: async () => (await provider.tokens())?.access_token,\n    async onUnauthorized(context) {\n      const challenge = parseWwwAuthenticate(context.response.headers.get('www-authenticate'));\n      const step = challenge.error === 'insufficient_scope';\n      if (!step && !inFlight && context.token !== undefined) {\n        const current = (await provider.tokens())?.access_token;\n        if (current !== undefined && current !== context.token) return;\n      }\n      inFlight ??= authorize(context, step, challenge).finally(() => {\n        inFlight = undefined;\n      });\n      await inFlight;\n    },\n  };\n}\n\nconst bytesToBase64Url = (bytes: Uint8Array) =>\n  btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst random = (length: number) => crypto.getRandomValues(new Uint8Array(length));\n\nexport async function pkce(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = bytesToBase64Url(random(32));\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };\n}\n\nexport function randomState(): string {\n  return [...random(32)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nexport interface OAuthServer {\n  name: string;\n  config: McpServerConfig;\n}\n\nexport class StoredOAuth implements Provider {\n  readonly redirectUrl: string;\n  readonly clientMetadata: Provider['clientMetadata'];\n  readonly #credentials: CredentialStore;\n  readonly #server: OAuthServer;\n  #writes: Promise<unknown> = Promise.resolve();\n\n  constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string) {\n    this.#server = server;\n    this.#credentials = credentials;\n    this.redirectUrl = redirectUrl;\n    this.clientMetadata = {\n      client_name: server.config.oauth?.clientName ?? CLIENT_NAME,\n      redirect_uris: [redirectUrl],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'none',\n      ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    };\n  }\n\n  get serverUrl(): string {\n    return String(new URL(this.#server.config.url));\n  }\n\n  async #key(): Promise<string> {\n    return credentialKey(this.#server.name, this.#server.config.url);\n  }\n\n  async load(): Promise<McpOAuthState> {\n    await this.#writes;\n    const stored = await this.#credentials.read(await this.#key());\n    const state =\n      stored?.type === 'oauth' ? (stored.state as McpOAuthState | undefined) : undefined;\n    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };\n  }\n\n  async update(change: (state: McpOAuthState) => McpOAuthState): Promise<void> {\n    const write = this.#writes.then(async () => {\n      const key = await this.#key();\n      await this.#credentials.modify(key, async (current) => {\n        const before =\n          current?.type === 'oauth' ? (current.state as McpOAuthState | undefined) : undefined;\n        const next = change(\n          before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl }\n        );\n        return {\n          type: 'oauth',\n          access: next.tokens?.access_token ?? '',\n          refresh: next.tokens?.refresh_token ?? '',\n          expires: next.tokensExpireAt ?? 0,\n          state: next,\n        };\n      });\n    });\n    this.#writes = write.catch(() => undefined);\n    await write;\n  }\n\n  async signedIn(): Promise<boolean> {\n    return (await this.load()).tokens !== undefined;\n  }\n\n  state(): string {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async clientInformation(): Promise<Client> {\n    const configured = this.#server.config.oauth?.clientId;\n    return configured ? { client_id: configured } : (await this.load()).clientInformation;\n  }\n\n  async saveClientInformation(information: NonNullable<Client>): Promise<void> {\n    if (this.#server.config.oauth?.clientId) return;\n    await this.update((state) => ({ ...state, clientInformation: information }));\n  }\n\n  async tokens(): Promise<Tokens> {\n    return (await this.load()).tokens;\n  }\n\n  async saveTokens(tokens: NonNullable<Tokens>): Promise<void> {\n    const expires =\n      tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;\n    await this.update((state) => {\n      const next: McpOAuthState = { ...state, tokens };\n      if (expires === undefined) delete next.tokensExpireAt;\n      else next.tokensExpireAt = expires;\n      return next;\n    });\n  }\n\n  redirectToAuthorization(): void {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.update((state) => ({ ...state, codeVerifier: verifier }));\n  }\n\n  async codeVerifier(): Promise<string> {\n    const verifier = (await this.load()).codeVerifier;\n    if (!verifier) throw new Error('No OAuth PKCE code verifier is stored');\n    return verifier;\n  }\n\n  async invalidateCredentials(\n    kind: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'\n  ): Promise<void> {\n    await this.update((state) => {\n      const next = { ...state };\n      if (kind === 'all' || kind === 'client') delete next.clientInformation;\n      if (kind === 'all' || kind === 'tokens') {\n        delete next.tokens;\n        delete next.tokensExpireAt;\n      }\n      if (kind === 'all' || kind === 'verifier') delete next.codeVerifier;\n      if (kind === 'all' || kind === 'discovery') delete next.discovery;\n      if (kind === 'all') delete next.oauthState;\n      return next;\n    });\n  }\n\n  async saveDiscoveryState(discovery: Discovery): Promise<void> {\n    await this.update((state) => ({ ...state, discovery }));\n  }\n\n  async discoveryState(): Promise<Discovery | undefined> {\n    return (await this.load()).discovery;\n  }\n\n  async forget(): Promise<void> {\n    await this.#writes;\n    await this.#credentials.delete(await this.#key());\n  }\n}\n\nexport type { McpSignIn } from '../services.ts';\n\nexport async function beginSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  options: { fetch: McpFetch; resourceMetadataUrl?: URL }\n): Promise<McpSignIn> {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  const info = await discoverOAuthServerInfo(server.config.url, {\n    fetch: options.fetch,\n    ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n  });\n  if (!configured) await provider.saveDiscoveryState(info);\n  const metadata = info.authorizationServerMetadata;\n  if (metadata && !metadata.response_types_supported.includes('code'))\n    throw new Error(\"The authorization server doesn't support authorization codes.\");\n  if (\n    metadata?.code_challenge_methods_supported &&\n    !metadata.code_challenge_methods_supported.includes('S256')\n  )\n    throw new Error(\"The authorization server doesn't support PKCE S256.\");\n  const scope =\n    server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(' ') || undefined;\n  let client = await provider.clientInformation();\n  if (!client) {\n    client = await registerClient(info.authorizationServerUrl, {\n      ...(metadata ? { metadata } : {}),\n      clientMetadata: provider.clientMetadata,\n      ...(scope ? { scope } : {}),\n      fetch: options.fetch,\n    });\n    await provider.saveClientInformation(client);\n  }\n  const { verifier, challenge } = await pkce();\n  const state = randomState();\n  await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));\n  const url = new URL(\n    metadata?.authorization_endpoint ?? new URL('/authorize', info.authorizationServerUrl)\n  );\n  if (!secureUrl(url)) throw new Error(\"The authorization server's sign-in address isn't https.\");\n  url.searchParams.set('response_type', 'code');\n  url.searchParams.set('client_id', client.client_id);\n  url.searchParams.set('code_challenge', challenge);\n  url.searchParams.set('code_challenge_method', 'S256');\n  url.searchParams.set('redirect_uri', provider.redirectUrl);\n  url.searchParams.set('state', state);\n  if (scope) url.searchParams.set('scope', scope);\n  if (scope?.split(/\\s+/).includes('offline_access')) url.searchParams.set('prompt', 'consent');\n  const resource = selectResource(server.config.url, info.resourceMetadata);\n  if (resource) url.searchParams.set('resource', resource);\n  return { url: url.href, state };\n}\n\nexport interface Callback {\n  code?: string;\n  state?: string;\n  iss?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport async function finishSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  answer: string,\n  fetch: McpFetch\n): Promise<void> {\n  let callback: Callback;\n  try {\n    callback = JSON.parse(answer) as Callback;\n  } catch {\n    throw new Error(\"The sign-in answer isn't a callback.\");\n  }\n  const expected = (await provider.load()).oauthState;\n  if (!expected || callback.state !== expected)\n    throw new Error(\"The sign-in answer doesn't match this sign-in. Try again.\");\n  if (callback.error)\n    throw new Error(\n      `Sign-in failed: ${sentence(callback.error_description?.trim() || callback.error)}`\n    );\n  if (!callback.code) throw new Error('The sign-in answer has no authorization code.');\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  await authorizeMcp(provider, {\n    serverUrl: server.config.url,\n    authorizationCode: callback.code,\n    ...(callback.iss ? { iss: callback.iss } : {}),\n    ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n    fetch,\n  });\n  await provider.update((state) => {\n    const next = { ...state };\n    delete next.oauthState;\n    delete next.codeVerifier;\n    return next;\n  });\n}\n"],
+  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,qBAAqB;AAOvB,MAAM,cAAc;AAEpB,SAAS,SAAS,MAAsB;AAC7C,QAAM,UAAU,KAAK,KAAK;AAC1B,QAAM,UAAU,cAAc,KAAK,OAAO,IACtC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAC/C;AACJ,SAAO,SAAS,KAAK,OAAO,IAAI,UAAU,GAAG,OAAO;AACtD;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,UAAU,KAAmB;AAC3C,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEO,SAAS,eAAe,OAAqD;AAClF,QAAM,QAAQ,IAAI,mCAAmC;AACrD,MAAI,UAAU,OAAW,OAAM,QAAQ;AACvC,SAAO;AACT;AAEO,SAAS,aAAa,UAAuB,QAAmC;AACrF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,MAAI;AACJ,QAAM,YAAY,OAChB,SACA,MACA,cACG;AACH,UAAM,UAAU,OAAO,MAAM,SAAS,OAAO,IAAI;AACjD,QAAI;AACF,YAAM,aAAa,UAAU;AAAA,QAC3B,WAAW,QAAQ;AAAA,QACnB,GAAI,UAAU,sBACV,EAAE,qBAAqB,UAAU,oBAAoB,IACrD,CAAC;AAAA,QACL,GAAI,OACA,EAAE,OAAO,YAAY,SAAS,OAAO,UAAU,KAAK,GAAG,aAAa,KAAK,IACzE,UAAU,QACR,EAAE,OAAO,UAAU,MAAM,IACzB,CAAC;AAAA,QACP,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,QAC5E,OAAO,QAAQ;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,iBAAiB,qCAAqC,QAAQ,eAAe,KAAK;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,aAAa,MAAM,SAAS,OAAO,IAAI;AAAA,IAC9C,MAAM,eAAe,SAAS;AAC5B,YAAM,YAAY,qBAAqB,QAAQ,SAAS,QAAQ,IAAI,kBAAkB,CAAC;AACvF,YAAM,OAAO,UAAU,UAAU;AACjC,UAAI,CAAC,QAAQ,CAAC,YAAY,QAAQ,UAAU,QAAW;AACrD,cAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,YAAI,YAAY,UAAa,YAAY,QAAQ,MAAO;AAAA,MAC1D;AACA,mBAAa,UAAU,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM;AAC7D,mBAAW;AAAA,MACb,CAAC;AACD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB,CAAC,UACxB,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAC/B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEtB,MAAM,SAAS,CAAC,WAAmB,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAEhF,eAAsB,OAAyD;AAC7E,QAAM,WAAW,iBAAiB,OAAO,EAAE,CAAC;AAC5C,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AACvF,SAAO,EAAE,UAAU,WAAW,iBAAiB,IAAI,WAAW,MAAM,CAAC,EAAE;AACzE;AAEO,SAAS,cAAsB;AACpC,SAAO,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAClF;AAOO,MAAM,YAAgC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,UAA4B,QAAQ,QAAQ;AAAA,EAE5C,YAAY,QAAqB,aAA8B,aAAqB;AAClF,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAAO,OAAO,OAAO,cAAc;AAAA,MAChD,eAAe,CAAC,WAAW;AAAA,MAC3B,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,cAAc,KAAK,QAAQ,MAAM,KAAK,QAAQ,OAAO,GAAG;AAAA,EACjE;AAAA,EAEA,MAAM,OAA+B;AACnC,UAAM,KAAK;AACX,UAAM,SAAS,MAAM,KAAK,aAAa,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7D,UAAM,QACJ,QAAQ,SAAS,UAAW,OAAO,QAAsC;AAC3E,WAAO,OAAO,cAAc,KAAK,YAAY,QAAQ,EAAE,WAAW,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,OAAO,QAAgE;AAC3E,UAAM,QAAQ,KAAK,QAAQ,KAAK,YAAY;AAC1C,YAAM,MAAM,MAAM,KAAK,KAAK;AAC5B,YAAM,KAAK,aAAa,OAAO,KAAK,OAAO,YAAY;AACrD,cAAM,SACJ,SAAS,SAAS,UAAW,QAAQ,QAAsC;AAC7E,cAAM,OAAO;AAAA,UACX,QAAQ,cAAc,KAAK,YAAY,SAAS,EAAE,WAAW,KAAK,UAAU;AAAA,QAC9E;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,KAAK,QAAQ,gBAAgB;AAAA,UACrC,SAAS,KAAK,QAAQ,iBAAiB;AAAA,UACvC,SAAS,KAAK,kBAAkB;AAAA,UAChC,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,SAAK,UAAU,MAAM,MAAM,MAAM,MAAS;AAC1C,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,WAA6B;AACjC,YAAQ,MAAM,KAAK,KAAK,GAAG,WAAW;AAAA,EACxC;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,oBAAqC;AACzC,UAAM,aAAa,KAAK,QAAQ,OAAO,OAAO;AAC9C,WAAO,aAAa,EAAE,WAAW,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG;AAAA,EACtE;AAAA,EAEA,MAAM,sBAAsB,aAAiD;AAC3E,QAAI,KAAK,QAAQ,OAAO,OAAO,SAAU;AACzC,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,mBAAmB,YAAY,EAAE;AAAA,EAC7E;AAAA,EAEA,MAAM,SAA0B;AAC9B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAA4C;AAC3D,UAAM,UACJ,OAAO,eAAe,SAAY,SAAY,KAAK,IAAI,IAAI,OAAO,aAAa;AACjF,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAsB,EAAE,GAAG,OAAO,OAAO;AAC/C,UAAI,YAAY,OAAW,QAAO,KAAK;AAAA,UAClC,MAAK,iBAAiB;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,0BAAgC;AAC9B,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,iBAAiB,UAAiC;AACtD,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,cAAc,SAAS,EAAE;AAAA,EACrE;AAAA,EAEA,MAAM,eAAgC;AACpC,UAAM,YAAY,MAAM,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uCAAuC;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBACJ,MACe;AACf,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAO,EAAE,GAAG,MAAM;AACxB,UAAI,SAAS,SAAS,SAAS,SAAU,QAAO,KAAK;AACrD,UAAI,SAAS,SAAS,SAAS,UAAU;AACvC,eAAO,KAAK;AACZ,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,SAAS,SAAS,WAAY,QAAO,KAAK;AACvD,UAAI,SAAS,SAAS,SAAS,YAAa,QAAO,KAAK;AACxD,UAAI,SAAS,MAAO,QAAO,KAAK;AAChC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,mBAAmB,WAAqC;AAC5D,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,EACxD;AAAA,EAEA,MAAM,iBAAiD;AACrD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,KAAK;AACX,UAAM,KAAK,aAAa,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAClD;AACF;AAIA,eAAsB,YACpB,UACA,QACA,SACoB;AACpB,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,OAAO,MAAM,wBAAwB,OAAO,OAAO,KAAK;AAAA,IAC5D,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,IAC1F,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,EAC9E,CAAC;AACD,MAAI,CAAC,WAAY,OAAM,SAAS,mBAAmB,IAAI;AACvD,QAAM,WAAW,KAAK;AACtB,MAAI,YAAY,CAAC,SAAS,yBAAyB,SAAS,MAAM;AAChE,UAAM,IAAI,MAAM,+DAA+D;AACjF,MACE,UAAU,oCACV,CAAC,SAAS,iCAAiC,SAAS,MAAM;AAE1D,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,QACJ,OAAO,OAAO,OAAO,SAAS,KAAK,kBAAkB,kBAAkB,KAAK,GAAG,KAAK;AACtF,MAAI,SAAS,MAAM,SAAS,kBAAkB;AAC9C,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,eAAe,KAAK,wBAAwB;AAAA,MACzD,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,gBAAgB,SAAS;AAAA,MACzB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MACzB,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,UAAM,SAAS,sBAAsB,MAAM;AAAA,EAC7C;AACA,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,KAAK;AAC3C,QAAM,QAAQ,YAAY;AAC1B,QAAM,SAAS,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,cAAc,UAAU,YAAY,MAAM,EAAE;AAC9F,QAAM,MAAM,IAAI;AAAA,IACd,UAAU,0BAA0B,IAAI,IAAI,cAAc,KAAK,sBAAsB;AAAA,EACvF;AACA,MAAI,CAAC,UAAU,GAAG,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAC9F,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,aAAa,OAAO,SAAS;AAClD,MAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,gBAAgB,SAAS,WAAW;AACzD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,MAAI,OAAO,MAAM,KAAK,EAAE,SAAS,gBAAgB,EAAG,KAAI,aAAa,IAAI,UAAU,SAAS;AAC5F,QAAM,WAAW,eAAe,OAAO,OAAO,KAAK,KAAK,gBAAgB;AACxE,MAAI,SAAU,KAAI,aAAa,IAAI,YAAY,QAAQ;AACvD,SAAO,EAAE,KAAK,IAAI,MAAM,MAAM;AAChC;AAUA,eAAsB,aACpB,UACA,QACA,QACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,MAAM;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,YAAY,MAAM,SAAS,KAAK,GAAG;AACzC,MAAI,CAAC,YAAY,SAAS,UAAU;AAClC,UAAM,IAAI,MAAM,2DAA2D;AAC7E,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR,mBAAmB,SAAS,SAAS,mBAAmB,KAAK,KAAK,SAAS,KAAK,CAAC;AAAA,IACnF;AACF,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,+CAA+C;AACnF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,aAAa,UAAU;AAAA,IAC3B,WAAW,OAAO,OAAO;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,GAAI,SAAS,MAAM,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IACzE,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,CAAC,UAAU;AAC/B,UAAM,OAAO,EAAE,GAAG,MAAM;AACxB,WAAO,KAAK;AACZ,WAAO,KAAK;AACZ,WAAO;AAAA,EACT,CAAC;AACH;",
+  "names": []
+}

package/dist/mcp/runtime.js

@@ -1,12 +1,14 @@
 import { StreamableHttpTransport } from "@earendil-works/pi-mcp";
+import { mcpAccounts } from "./accounts.js";
 import { McpCatalog } from "./catalog.js";
 import {
   parseMcpConfig,
-  sameConfig
+  sameConfig,
+  usesOAuth
 } from "./config.js";
 import { McpServerConnection } from "./connection.js";
-import { credentialKey, resolveHeaders, scrub, secretNames } from "./credentials.js";
-import { MCP_ACCOUNT } from "./label.js";
+import { resolveHeaders, scrub, secretNames } from "./credentials.js";
+import { authProvider as oauthAuth, StoredOAuth } from "./oauth.js";
 import { patchSse } from "./sse.js";
 const MCP_LOG_MAX_BYTES = 5 * 1024 * 1024;
 function configPath(home) {
@@ -49,7 +51,7 @@ ${connection.missing.join(",")}`
   if (connection.state === "needs-auth")
     return {
       ...base,
-      title: `MCP server "${name}" rejected its token`,
+      title: secretNames(connection.entry.config).length ? `MCP server "${name}" rejected its token` : `MCP server "${name}" needs sign-in`,
       text: connection.signInMessage(),
       severity: "warn",
       eventId: `${name}
@@ -104,52 +106,6 @@ function serverLog(options, context) {
     settled: () => logging
   };
 }
-function mcpAccounts(catalog, credentials, restart, listeners) {
-  const find = (id) => {
-    const connection = catalog.connections.get(id.slice(MCP_ACCOUNT.length));
-    if (!id.startsWith(MCP_ACCOUNT) || !connection || !secretNames(connection.entry.config).length)
-      throw new Error(`${id} is not an MCP server that takes a token`);
-    return connection;
-  };
-  const keyOf = (connection) => credentialKey(connection.name, connection.entry.config.url);
-  return {
-    async accounts() {
-      const rows = [];
-      for (const connection of catalog.connections.values()) {
-        if (!secretNames(connection.entry.config).length) continue;
-        const stored = await credentials.read(await keyOf(connection)) !== void 0;
-        rows.push({
-          id: `${MCP_ACCOUNT}${connection.name}`,
-          provider: connection.name,
-          identity: new URL(connection.entry.config.url).host,
-          status: connection.state === "needs-auth" ? "expired" : stored ? "connected" : "disconnected",
-          auth: "api-key",
-          needs: null,
-          group: "mcp",
-          secret: "token"
-        });
-      }
-      return rows;
-    },
-    async connect(id, secret) {
-      const connection = find(id);
-      await credentials.modify(await keyOf(connection), async () => ({
-        type: "api_key",
-        key: secret
-      }));
-      restart(connection);
-    },
-    async disconnect(id) {
-      const connection = find(id);
-      await credentials.delete(await keyOf(connection));
-      restart(connection);
-    },
-    onChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    }
-  };
-}
 async function attachMcp(catalog, options, context) {
   const { env, home } = options;
   catalog.codemodeOn = options.codemode;
@@ -166,15 +122,21 @@ async function attachMcp(catalog, options, context) {
   let initial = /* @__PURE__ */ new Set();
   let first = true;
   const log = serverLog(options, context);
-  const make = (url, headers) => new StreamableHttpTransport({
-    url,
-    headers,
-    fetch: (input, init) => options.fetch(input, init)
-  });
+  const fetcher = (input, init) => options.fetch(input, init);
+  const oauth = (entry) => new StoredOAuth(entry, options.credentials, options.redirect);
   const transport = async (entry) => {
     const resolved = await resolveHeaders(entry.name, entry.config, options.credentials);
     if (!resolved.ok) return { missing: resolved.missing };
-    return { transport: make(entry.config.url, resolved.headers), secrets: resolved.secrets };
+    const authProvider = usesOAuth(entry.config) ? oauthAuth(oauth(entry), entry) : void 0;
+    return {
+      transport: new StreamableHttpTransport({
+        url: entry.config.url,
+        headers: resolved.headers,
+        fetch: fetcher,
+        ...authProvider ? { authProvider } : {}
+      }),
+      secrets: resolved.secrets
+    };
   };
   const open = (entry) => {
     const connection = new McpServerConnection({
@@ -225,13 +187,17 @@ async function attachMcp(catalog, options, context) {
   const watched = await env.watch([{ path: configPath(home) }], schedule, context);
   const watcher = watched.ok ? watched.value : void 0;
   const restart = (connection) => {
-    catalog.connections.delete(connection.name);
-    void connection.close();
     open(connection.entry);
+    void connection.close();
     catalog.rebuild();
   };
   return {
-    ...mcpAccounts(catalog, options.credentials, restart, listeners),
+    ...mcpAccounts(
+      catalog,
+      { credentials: options.credentials, oauth, fetch: fetcher },
+      restart,
+      listeners
+    ),
     status: () => [...catalog.connections.values()].map((connection) => ({
       name: connection.name,
       state: connection.state,
@@ -262,7 +228,6 @@ export {
   connectedLick,
   logLine,
   logPath,
-  mcpAccounts,
   problemLick,
   startMcp,
   stateLick

package/dist/mcp/runtime.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/runtime.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { Registry } from '@earendil-works/pi-durable';\nimport type { ExecutionEnv, FileWatcher } from '@earendil-works/pi-durable/env';\nimport { StreamableHttpTransport } from '@earendil-works/pi-mcp';\nimport type { LickEvent, Licks } from '../licks/licks.ts';\nimport type { AccountState } from '../services.ts';\nimport { McpCatalog } from './catalog.ts';\nimport {\n  type McpConfigProblem,\n  type McpServerEntry,\n  parseMcpConfig,\n  sameConfig,\n} from './config.ts';\nimport { McpServerConnection } from './connection.ts';\nimport { credentialKey, resolveHeaders, scrub, secretNames } from './credentials.ts';\nimport { MCP_ACCOUNT } from './label.ts';\nimport { patchSse } from './sse.ts';\n\nexport const MCP_LOG_MAX_BYTES = 5 * 1024 * 1024;\n\nexport function configPath(home: string): string {\n  return `${home}/.pi/agent/mcp.json`;\n}\n\nexport function logPath(home: string): string {\n  return `${home}/.pi/agent/mcp.log`;\n}\n\nexport interface McpAttach {\n  licks: Licks;\n  env: ExecutionEnv;\n  home: string;\n  credentials: CredentialStore;\n  fetch: typeof fetch;\n  version: string;\n  reloadMs: number;\n  codemode: boolean;\n  cors: boolean;\n}\n\nexport interface ServerStatus {\n  name: string;\n  state: string;\n  tools: number;\n  error?: string;\n}\n\nexport interface McpAccounts {\n  accounts(): Promise<AccountState[]>;\n  connect(id: string, secret: string): Promise<void>;\n  disconnect(id: string): Promise<void>;\n  onChange(listener: () => void): () => void;\n}\n\nexport interface McpRuntime extends McpAccounts {\n  status(): ServerStatus[];\n  reload(context: Context): Promise<void>;\n  close(context: Context): Promise<void>;\n}\n\nexport function problemLick(problem: McpConfigProblem, home: string): LickEvent {\n  const file = `~${configPath(home).slice(home.length)}`;\n  const where = problem.server ? `server \"${problem.server}\"` : file;\n  const field = problem.field ? `, field ${problem.field}` : '';\n  return {\n    channel: 'fswatch',\n    source: `mcp:${file}`,\n    title: `MCP config problem: ${where}${field}`,\n    text: problem.message,\n    body: `${file}: the entry is skipped until it is fixed. The format is in the slicc-agent README.`,\n    target: 'cone',\n    severity: 'warn',\n    eventId: `${problem.server ?? ''}\\n${problem.field ?? ''}\\n${problem.message}`,\n  };\n}\n\nconst CORS_ERROR = /failed to fetch|networkerror|load failed|cors/i;\n\nexport function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined {\n  const name = connection.name;\n  const base = { channel: 'fswatch' as const, source: `mcp:${name}`, target: 'cone' as const };\n  if (connection.state === 'needs-secret')\n    return {\n      ...base,\n      title: `MCP server \"${name}\" needs a token`,\n      text: `Its headers use ${connection.missing.map((item) => `\\${${item}}`).join(', ')}. Add the value in Settings \u203A MCP servers.`,\n      severity: 'warn',\n      eventId: `${name}\\nsecret\\n${connection.missing.join(',')}`,\n    };\n  if (connection.state === 'needs-auth')\n    return {\n      ...base,\n      title: `MCP server \"${name}\" rejected its token`,\n      text: connection.signInMessage(),\n      severity: 'warn',\n      eventId: `${name}\\nauth`,\n    };\n  if (connection.state !== 'failed') return undefined;\n  const error = scrub(connection.error ?? 'unknown error', connection.secrets);\n  const blocked = cors && CORS_ERROR.test(error);\n  return {\n    ...base,\n    title: `MCP server \"${name}\" can't connect`,\n    text: blocked\n      ? \"Seven reaches it with the page's own fetch, and the server sends no CORS headers. Run slicc-node, slicc-swift or the SLICC extension, which fetch without CORS.\"\n      : error,\n    severity: 'warn',\n    eventId: `${name}\\nfailed\\n${blocked ? 'cors' : error}`,\n  };\n}\n\nexport function connectedLick(connection: McpServerConnection): LickEvent {\n  const count = connection.tools.length;\n  return {\n    channel: 'fswatch',\n    source: `mcp:${connection.name}`,\n    title: `MCP server \"${connection.name}\" connected`,\n    text: `${connection.entry.config.url} offers ${count} tool${count === 1 ? '' : 's'}.`,\n    target: 'cone',\n    eventId: `${connection.name}\\nconnected\\n${connection.entry.config.url}`,\n  };\n}\n\nexport function logLine(\n  server: string,\n  params: unknown,\n  secrets: readonly string[],\n  at: Date\n): string {\n  const { level, logger, data } = (params ?? {}) as {\n    level?: string;\n    logger?: string;\n    data?: unknown;\n  };\n  const text = scrub(typeof data === 'string' ? data : (JSON.stringify(data) ?? ''), secrets);\n  return `${at.toISOString()} [${server}] ${level ?? 'info'}${logger ? ` ${logger}` : ''}: ${text}\\n`;\n}\n\nfunction serverLog(options: McpAttach, context: Context) {\n  let logging = Promise.resolve();\n  const path = logPath(options.home);\n  const { env } = options;\n  return {\n    write(connection: McpServerConnection, params: unknown) {\n      const line = logLine(connection.name, params, connection.secrets, new Date());\n      logging = logging.then(async () => {\n        const info = await env.fileInfo(path, context);\n        if (info.ok && info.value.size > MCP_LOG_MAX_BYTES)\n          await env.renameFile(path, `${path}.1`, context);\n        await env.appendFile(path, line, context);\n      });\n    },\n    settled: () => logging,\n  };\n}\n\nexport function mcpAccounts(\n  catalog: McpCatalog,\n  credentials: CredentialStore,\n  restart: (connection: McpServerConnection) => void,\n  listeners: Set<() => void>\n): McpAccounts {\n  const find = (id: string) => {\n    const connection = catalog.connections.get(id.slice(MCP_ACCOUNT.length));\n    if (!id.startsWith(MCP_ACCOUNT) || !connection || !secretNames(connection.entry.config).length)\n      throw new Error(`${id} is not an MCP server that takes a token`);\n    return connection;\n  };\n  const keyOf = (connection: McpServerConnection) =>\n    credentialKey(connection.name, connection.entry.config.url);\n  return {\n    async accounts() {\n      const rows: AccountState[] = [];\n      for (const connection of catalog.connections.values()) {\n        if (!secretNames(connection.entry.config).length) continue;\n        const stored = (await credentials.read(await keyOf(connection))) !== undefined;\n        rows.push({\n          id: `${MCP_ACCOUNT}${connection.name}`,\n          provider: connection.name,\n          identity: new URL(connection.entry.config.url).host,\n          status:\n            connection.state === 'needs-auth' ? 'expired' : stored ? 'connected' : 'disconnected',\n          auth: 'api-key',\n          needs: null,\n          group: 'mcp',\n          secret: 'token',\n        });\n      }\n      return rows;\n    },\n    async connect(id, secret) {\n      const connection = find(id);\n      await credentials.modify(await keyOf(connection), async () => ({\n        type: 'api_key',\n        key: secret,\n      }));\n      restart(connection);\n    },\n    async disconnect(id) {\n      const connection = find(id);\n      await credentials.delete(await keyOf(connection));\n      restart(connection);\n    },\n    onChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n  };\n}\n\nexport async function attachMcp(\n  catalog: McpCatalog,\n  options: McpAttach,\n  context: Context\n): Promise<McpRuntime> {\n  const { env, home } = options;\n  catalog.codemodeOn = options.codemode;\n  const reported = new Set<string>();\n  const report = async (lick: LickEvent | undefined, using: Context) => {\n    if (!lick?.eventId || reported.has(lick.eventId)) return;\n    reported.add(lick.eventId);\n    await options.licks.deliver(lick, using).catch(() => undefined);\n  };\n  const listeners = new Set<() => void>();\n  const notify = () => {\n    for (const listener of listeners) listener();\n  };\n  let initial: Set<string> = new Set();\n  let first = true;\n  const log = serverLog(options, context);\n  const make = (url: string, headers: Record<string, string>) =>\n    new StreamableHttpTransport({\n      url,\n      headers,\n      fetch: (input, init) => options.fetch(input, init),\n    });\n  const transport = async (entry: McpServerEntry) => {\n    const resolved = await resolveHeaders(entry.name, entry.config, options.credentials);\n    if (!resolved.ok) return { missing: resolved.missing };\n    return { transport: make(entry.config.url, resolved.headers), secrets: resolved.secrets };\n  };\n  const open = (entry: McpServerEntry) => {\n    const connection = new McpServerConnection({\n      entry,\n      version: options.version,\n      transport,\n      onTools: () => catalog.rebuild(),\n      onLog: log.write,\n      onChange: (changed) => {\n        if (catalog.connections.get(changed.name) !== changed) return;\n        if (changed.state === 'connected' && !initial.has(changed.name))\n          void report(connectedLick(changed), context);\n        void report(stateLick(changed, options.cors), context);\n        if (changed.state !== 'connected') catalog.rebuild();\n        notify();\n      },\n    });\n    catalog.connections.set(entry.name, connection);\n    void connection.getClient().catch(() => undefined);\n  };\n  const reload = async (using: Context) => {\n    const read = await env.readTextFile(configPath(home), using);\n    const parsed = parseMcpConfig(read.ok ? read.value : undefined);\n    for (const problem of parsed.problems) await report(problemLick(problem, home), using);\n    const wanted = new Map(\n      parsed.servers\n        .filter((entry) => entry.config.enabled !== false)\n        .map((entry) => [entry.name, entry])\n    );\n    const closing: Promise<void>[] = [];\n    for (const [name, connection] of [...catalog.connections]) {\n      const next = wanted.get(name);\n      if (next && sameConfig(next.config, connection.entry.config)) continue;\n      catalog.connections.delete(name);\n      closing.push(connection.close());\n    }\n    if (first) initial = new Set(wanted.keys());\n    first = false;\n    for (const [name, entry] of wanted) if (!catalog.connections.has(name)) open(entry);\n    catalog.rebuild();\n    notify();\n    await Promise.all(closing);\n  };\n  await reload(context);\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const schedule = () => {\n    clearTimeout(timer);\n    timer = setTimeout(() => void reload(context).catch(() => undefined), options.reloadMs);\n  };\n  const watched = await env.watch([{ path: configPath(home) }], schedule, context);\n  const watcher: FileWatcher | undefined = watched.ok ? watched.value : undefined;\n  const restart = (connection: McpServerConnection) => {\n    catalog.connections.delete(connection.name);\n    void connection.close();\n    open(connection.entry);\n    catalog.rebuild();\n  };\n  return {\n    ...mcpAccounts(catalog, options.credentials, restart, listeners),\n    status: () =>\n      [...catalog.connections.values()].map((connection) => ({\n        name: connection.name,\n        state: connection.state,\n        tools: connection.tools.length,\n        ...(connection.error ? { error: scrub(connection.error, connection.secrets) } : {}),\n      })),\n    reload,\n    async close(using) {\n      clearTimeout(timer);\n      await watcher?.close(using);\n      const all = [...catalog.connections.values()];\n      catalog.connections.clear();\n      await Promise.all(all.map((connection) => connection.close()));\n      catalog.rebuild();\n      await log.settled();\n    },\n  };\n}\n\nexport async function startMcp(\n  registry: Registry,\n  options: McpAttach,\n  context: Context\n): Promise<{ catalog: McpCatalog; runtime: McpRuntime }> {\n  patchSse();\n  const catalog = new McpCatalog(registry);\n  return { catalog, runtime: await attachMcp(catalog, options, context) };\n}\n"],
-  "mappings": "AAIA,SAAS,+BAA+B;AAGxC,SAAS,kBAAkB;AAC3B;AAAA,EAGE;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,eAAe,gBAAgB,OAAO,mBAAmB;AAClE,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AAElB,MAAM,oBAAoB,IAAI,OAAO;AAErC,SAAS,WAAW,MAAsB;AAC/C,SAAO,GAAG,IAAI;AAChB;AAEO,SAAS,QAAQ,MAAsB;AAC5C,SAAO,GAAG,IAAI;AAChB;AAkCO,SAAS,YAAY,SAA2B,MAAyB;AAC9E,QAAM,OAAO,IAAI,WAAW,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;AACpD,QAAM,QAAQ,QAAQ,SAAS,WAAW,QAAQ,MAAM,MAAM;AAC9D,QAAM,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,KAAK,KAAK;AAC3D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,IAAI;AAAA,IACnB,OAAO,uBAAuB,KAAK,GAAG,KAAK;AAAA,IAC3C,MAAM,QAAQ;AAAA,IACd,MAAM,GAAG,IAAI;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS,GAAG,QAAQ,UAAU,EAAE;AAAA,EAAK,QAAQ,SAAS,EAAE;AAAA,EAAK,QAAQ,OAAO;AAAA,EAC9E;AACF;AAEA,MAAM,aAAa;AAEZ,SAAS,UAAU,YAAiC,MAAsC;AAC/F,QAAM,OAAO,WAAW;AACxB,QAAM,OAAO,EAAE,SAAS,WAAoB,QAAQ,OAAO,IAAI,IAAI,QAAQ,OAAgB;AAC3F,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,eAAe,IAAI;AAAA,MAC1B,MAAM,mBAAmB,WAAW,QAAQ,IAAI,CAAC,SAAS,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MACnF,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,WAAW,QAAQ,KAAK,GAAG,CAAC;AAAA,IAC3D;AACF,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,eAAe,IAAI;AAAA,MAC1B,MAAM,WAAW,cAAc;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,IAClB;AACF,MAAI,WAAW,UAAU,SAAU,QAAO;AAC1C,QAAM,QAAQ,MAAM,WAAW,SAAS,iBAAiB,WAAW,OAAO;AAC3E,QAAM,UAAU,QAAQ,WAAW,KAAK,KAAK;AAC7C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,eAAe,IAAI;AAAA,IAC1B,MAAM,UACF,oKACA;AAAA,IACJ,UAAU;AAAA,IACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,UAAU,SAAS,KAAK;AAAA,EACvD;AACF;AAEO,SAAS,cAAc,YAA4C;AACxE,QAAM,QAAQ,WAAW,MAAM;AAC/B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,WAAW,IAAI;AAAA,IAC9B,OAAO,eAAe,WAAW,IAAI;AAAA,IACrC,MAAM,GAAG,WAAW,MAAM,OAAO,GAAG,WAAW,KAAK,QAAQ,UAAU,IAAI,KAAK,GAAG;AAAA,IAClF,QAAQ;AAAA,IACR,SAAS,GAAG,WAAW,IAAI;AAAA;AAAA,EAAgB,WAAW,MAAM,OAAO,GAAG;AAAA,EACxE;AACF;AAEO,SAAS,QACd,QACA,QACA,SACA,IACQ;AACR,QAAM,EAAE,OAAO,QAAQ,KAAK,IAAK,UAAU,CAAC;AAK5C,QAAM,OAAO,MAAM,OAAO,SAAS,WAAW,OAAQ,KAAK,UAAU,IAAI,KAAK,IAAK,OAAO;AAC1F,SAAO,GAAG,GAAG,YAAY,CAAC,KAAK,MAAM,KAAK,SAAS,MAAM,GAAG,SAAS,IAAI,MAAM,KAAK,EAAE,KAAK,IAAI;AAAA;AACjG;AAEA,SAAS,UAAU,SAAoB,SAAkB;AACvD,MAAI,UAAU,QAAQ,QAAQ;AAC9B,QAAM,OAAO,QAAQ,QAAQ,IAAI;AACjC,QAAM,EAAE,IAAI,IAAI;AAChB,SAAO;AAAA,IACL,MAAM,YAAiC,QAAiB;AACtD,YAAM,OAAO,QAAQ,WAAW,MAAM,QAAQ,WAAW,SAAS,oBAAI,KAAK,CAAC;AAC5E,gBAAU,QAAQ,KAAK,YAAY;AACjC,cAAM,OAAO,MAAM,IAAI,SAAS,MAAM,OAAO;AAC7C,YAAI,KAAK,MAAM,KAAK,MAAM,OAAO;AAC/B,gBAAM,IAAI,WAAW,MAAM,GAAG,IAAI,MAAM,OAAO;AACjD,cAAM,IAAI,WAAW,MAAM,MAAM,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,IACA,SAAS,MAAM;AAAA,EACjB;AACF;AAEO,SAAS,YACd,SACA,aACA,SACA,WACa;AACb,QAAM,OAAO,CAAC,OAAe;AAC3B,UAAM,aAAa,QAAQ,YAAY,IAAI,GAAG,MAAM,YAAY,MAAM,CAAC;AACvE,QAAI,CAAC,GAAG,WAAW,WAAW,KAAK,CAAC,cAAc,CAAC,YAAY,WAAW,MAAM,MAAM,EAAE;AACtF,YAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AACjE,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,CAAC,eACb,cAAc,WAAW,MAAM,WAAW,MAAM,OAAO,GAAG;AAC5D,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,OAAuB,CAAC;AAC9B,iBAAW,cAAc,QAAQ,YAAY,OAAO,GAAG;AACrD,YAAI,CAAC,YAAY,WAAW,MAAM,MAAM,EAAE,OAAQ;AAClD,cAAM,SAAU,MAAM,YAAY,KAAK,MAAM,MAAM,UAAU,CAAC,MAAO;AACrE,aAAK,KAAK;AAAA,UACR,IAAI,GAAG,WAAW,GAAG,WAAW,IAAI;AAAA,UACpC,UAAU,WAAW;AAAA,UACrB,UAAU,IAAI,IAAI,WAAW,MAAM,OAAO,GAAG,EAAE;AAAA,UAC/C,QACE,WAAW,UAAU,eAAe,YAAY,SAAS,cAAc;AAAA,UACzE,MAAM;AAAA,UACN,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,IAAI,QAAQ;AACxB,YAAM,aAAa,KAAK,EAAE;AAC1B,YAAM,YAAY,OAAO,MAAM,MAAM,UAAU,GAAG,aAAa;AAAA,QAC7D,MAAM;AAAA,QACN,KAAK;AAAA,MACP,EAAE;AACF,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,aAAa,KAAK,EAAE;AAC1B,YAAM,YAAY,OAAO,MAAM,MAAM,UAAU,CAAC;AAChD,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,SAAS,UAAU;AACjB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM,UAAU,OAAO,QAAQ;AAAA,IACxC;AAAA,EACF;AACF;AAEA,eAAsB,UACpB,SACA,SACA,SACqB;AACrB,QAAM,EAAE,KAAK,KAAK,IAAI;AACtB,UAAQ,aAAa,QAAQ;AAC7B,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,SAAS,OAAO,MAA6B,UAAmB;AACpE,QAAI,CAAC,MAAM,WAAW,SAAS,IAAI,KAAK,OAAO,EAAG;AAClD,aAAS,IAAI,KAAK,OAAO;AACzB,UAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,EAChE;AACA,QAAM,YAAY,oBAAI,IAAgB;AACtC,QAAM,SAAS,MAAM;AACnB,eAAW,YAAY,UAAW,UAAS;AAAA,EAC7C;AACA,MAAI,UAAuB,oBAAI,IAAI;AACnC,MAAI,QAAQ;AACZ,QAAM,MAAM,UAAU,SAAS,OAAO;AACtC,QAAM,OAAO,CAAC,KAAa,YACzB,IAAI,wBAAwB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,OAAO,CAAC,OAAO,SAAS,QAAQ,MAAM,OAAO,IAAI;AAAA,EACnD,CAAC;AACH,QAAM,YAAY,OAAO,UAA0B;AACjD,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW;AACnF,QAAI,CAAC,SAAS,GAAI,QAAO,EAAE,SAAS,SAAS,QAAQ;AACrD,WAAO,EAAE,WAAW,KAAK,MAAM,OAAO,KAAK,SAAS,OAAO,GAAG,SAAS,SAAS,QAAQ;AAAA,EAC1F;AACA,QAAM,OAAO,CAAC,UAA0B;AACtC,UAAM,aAAa,IAAI,oBAAoB;AAAA,MACzC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,SAAS,MAAM,QAAQ,QAAQ;AAAA,MAC/B,OAAO,IAAI;AAAA,MACX,UAAU,CAAC,YAAY;AACrB,YAAI,QAAQ,YAAY,IAAI,QAAQ,IAAI,MAAM,QAAS;AACvD,YAAI,QAAQ,UAAU,eAAe,CAAC,QAAQ,IAAI,QAAQ,IAAI;AAC5D,eAAK,OAAO,cAAc,OAAO,GAAG,OAAO;AAC7C,aAAK,OAAO,UAAU,SAAS,QAAQ,IAAI,GAAG,OAAO;AACrD,YAAI,QAAQ,UAAU,YAAa,SAAQ,QAAQ;AACnD,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,YAAQ,YAAY,IAAI,MAAM,MAAM,UAAU;AAC9C,SAAK,WAAW,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD;AACA,QAAM,SAAS,OAAO,UAAmB;AACvC,UAAM,OAAO,MAAM,IAAI,aAAa,WAAW,IAAI,GAAG,KAAK;AAC3D,UAAM,SAAS,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS;AAC9D,eAAW,WAAW,OAAO,SAAU,OAAM,OAAO,YAAY,SAAS,IAAI,GAAG,KAAK;AACrF,UAAM,SAAS,IAAI;AAAA,MACjB,OAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,YAAY,KAAK,EAChD,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC;AAAA,IACvC;AACA,UAAM,UAA2B,CAAC;AAClC,eAAW,CAAC,MAAM,UAAU,KAAK,CAAC,GAAG,QAAQ,WAAW,GAAG;AACzD,YAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,UAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,MAAM,EAAG;AAC9D,cAAQ,YAAY,OAAO,IAAI;AAC/B,cAAQ,KAAK,WAAW,MAAM,CAAC;AAAA,IACjC;AACA,QAAI,MAAO,WAAU,IAAI,IAAI,OAAO,KAAK,CAAC;AAC1C,YAAQ;AACR,eAAW,CAAC,MAAM,KAAK,KAAK,OAAQ,KAAI,CAAC,QAAQ,YAAY,IAAI,IAAI,EAAG,MAAK,KAAK;AAClF,YAAQ,QAAQ;AAChB,WAAO;AACP,UAAM,QAAQ,IAAI,OAAO;AAAA,EAC3B;AACA,QAAM,OAAO,OAAO;AACpB,MAAI;AACJ,QAAM,WAAW,MAAM;AACrB,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS,GAAG,QAAQ,QAAQ;AAAA,EACxF;AACA,QAAM,UAAU,MAAM,IAAI,MAAM,CAAC,EAAE,MAAM,WAAW,IAAI,EAAE,CAAC,GAAG,UAAU,OAAO;AAC/E,QAAM,UAAmC,QAAQ,KAAK,QAAQ,QAAQ;AACtE,QAAM,UAAU,CAAC,eAAoC;AACnD,YAAQ,YAAY,OAAO,WAAW,IAAI;AAC1C,SAAK,WAAW,MAAM;AACtB,SAAK,WAAW,KAAK;AACrB,YAAQ,QAAQ;AAAA,EAClB;AACA,SAAO;AAAA,IACL,GAAG,YAAY,SAAS,QAAQ,aAAa,SAAS,SAAS;AAAA,IAC/D,QAAQ,MACN,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACrD,MAAM,WAAW;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,WAAW,MAAM;AAAA,MACxB,GAAI,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,OAAO,WAAW,OAAO,EAAE,IAAI,CAAC;AAAA,IACnF,EAAE;AAAA,IACJ;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,mBAAa,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,MAAM,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC;AAC5C,cAAQ,YAAY,MAAM;AAC1B,YAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,eAAe,WAAW,MAAM,CAAC,CAAC;AAC7D,cAAQ,QAAQ;AAChB,YAAM,IAAI,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,UACA,SACA,SACuD;AACvD,WAAS;AACT,QAAM,UAAU,IAAI,WAAW,QAAQ;AACvC,SAAO,EAAE,SAAS,SAAS,MAAM,UAAU,SAAS,SAAS,OAAO,EAAE;AACxE;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { Registry } from '@earendil-works/pi-durable';\nimport type { ExecutionEnv, FileWatcher } from '@earendil-works/pi-durable/env';\nimport { StreamableHttpTransport } from '@earendil-works/pi-mcp';\nimport type { LickEvent, Licks } from '../licks/licks.ts';\nimport { type McpAccounts, mcpAccounts } from './accounts.ts';\nimport { McpCatalog } from './catalog.ts';\nimport {\n  type McpConfigProblem,\n  type McpServerEntry,\n  parseMcpConfig,\n  sameConfig,\n  usesOAuth,\n} from './config.ts';\nimport { McpServerConnection } from './connection.ts';\nimport { resolveHeaders, scrub, secretNames } from './credentials.ts';\nimport { authProvider as oauthAuth, StoredOAuth } from './oauth.ts';\nimport { patchSse } from './sse.ts';\n\nexport const MCP_LOG_MAX_BYTES = 5 * 1024 * 1024;\n\nexport function configPath(home: string): string {\n  return `${home}/.pi/agent/mcp.json`;\n}\n\nexport function logPath(home: string): string {\n  return `${home}/.pi/agent/mcp.log`;\n}\n\nexport interface McpAttach {\n  licks: Licks;\n  env: ExecutionEnv;\n  home: string;\n  credentials: CredentialStore;\n  fetch: typeof fetch;\n  version: string;\n  reloadMs: number;\n  codemode: boolean;\n  cors: boolean;\n  redirect: string;\n}\n\nexport interface ServerStatus {\n  name: string;\n  state: string;\n  tools: number;\n  error?: string;\n}\n\nexport type { McpAccounts } from './accounts.ts';\n\nexport interface McpRuntime extends McpAccounts {\n  status(): ServerStatus[];\n  reload(context: Context): Promise<void>;\n  close(context: Context): Promise<void>;\n}\n\nexport function problemLick(problem: McpConfigProblem, home: string): LickEvent {\n  const file = `~${configPath(home).slice(home.length)}`;\n  const where = problem.server ? `server \"${problem.server}\"` : file;\n  const field = problem.field ? `, field ${problem.field}` : '';\n  return {\n    channel: 'fswatch',\n    source: `mcp:${file}`,\n    title: `MCP config problem: ${where}${field}`,\n    text: problem.message,\n    body: `${file}: the entry is skipped until it is fixed. The format is in the slicc-agent README.`,\n    target: 'cone',\n    severity: 'warn',\n    eventId: `${problem.server ?? ''}\\n${problem.field ?? ''}\\n${problem.message}`,\n  };\n}\n\nconst CORS_ERROR = /failed to fetch|networkerror|load failed|cors/i;\n\nexport function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined {\n  const name = connection.name;\n  const base = { channel: 'fswatch' as const, source: `mcp:${name}`, target: 'cone' as const };\n  if (connection.state === 'needs-secret')\n    return {\n      ...base,\n      title: `MCP server \"${name}\" needs a token`,\n      text: `Its headers use ${connection.missing.map((item) => `\\${${item}}`).join(', ')}. Add the value in Settings \u203A MCP servers.`,\n      severity: 'warn',\n      eventId: `${name}\\nsecret\\n${connection.missing.join(',')}`,\n    };\n  if (connection.state === 'needs-auth')\n    return {\n      ...base,\n      title: secretNames(connection.entry.config).length\n        ? `MCP server \"${name}\" rejected its token`\n        : `MCP server \"${name}\" needs sign-in`,\n      text: connection.signInMessage(),\n      severity: 'warn',\n      eventId: `${name}\\nauth`,\n    };\n  if (connection.state !== 'failed') return undefined;\n  const error = scrub(connection.error ?? 'unknown error', connection.secrets);\n  const blocked = cors && CORS_ERROR.test(error);\n  return {\n    ...base,\n    title: `MCP server \"${name}\" can't connect`,\n    text: blocked\n      ? \"Seven reaches it with the page's own fetch, and the server sends no CORS headers. Run slicc-node, slicc-swift or the SLICC extension, which fetch without CORS.\"\n      : error,\n    severity: 'warn',\n    eventId: `${name}\\nfailed\\n${blocked ? 'cors' : error}`,\n  };\n}\n\nexport function connectedLick(connection: McpServerConnection): LickEvent {\n  const count = connection.tools.length;\n  return {\n    channel: 'fswatch',\n    source: `mcp:${connection.name}`,\n    title: `MCP server \"${connection.name}\" connected`,\n    text: `${connection.entry.config.url} offers ${count} tool${count === 1 ? '' : 's'}.`,\n    target: 'cone',\n    eventId: `${connection.name}\\nconnected\\n${connection.entry.config.url}`,\n  };\n}\n\nexport function logLine(\n  server: string,\n  params: unknown,\n  secrets: readonly string[],\n  at: Date\n): string {\n  const { level, logger, data } = (params ?? {}) as {\n    level?: string;\n    logger?: string;\n    data?: unknown;\n  };\n  const text = scrub(typeof data === 'string' ? data : (JSON.stringify(data) ?? ''), secrets);\n  return `${at.toISOString()} [${server}] ${level ?? 'info'}${logger ? ` ${logger}` : ''}: ${text}\\n`;\n}\n\nfunction serverLog(options: McpAttach, context: Context) {\n  let logging = Promise.resolve();\n  const path = logPath(options.home);\n  const { env } = options;\n  return {\n    write(connection: McpServerConnection, params: unknown) {\n      const line = logLine(connection.name, params, connection.secrets, new Date());\n      logging = logging.then(async () => {\n        const info = await env.fileInfo(path, context);\n        if (info.ok && info.value.size > MCP_LOG_MAX_BYTES)\n          await env.renameFile(path, `${path}.1`, context);\n        await env.appendFile(path, line, context);\n      });\n    },\n    settled: () => logging,\n  };\n}\n\nexport async function attachMcp(\n  catalog: McpCatalog,\n  options: McpAttach,\n  context: Context\n): Promise<McpRuntime> {\n  const { env, home } = options;\n  catalog.codemodeOn = options.codemode;\n  const reported = new Set<string>();\n  const report = async (lick: LickEvent | undefined, using: Context) => {\n    if (!lick?.eventId || reported.has(lick.eventId)) return;\n    reported.add(lick.eventId);\n    await options.licks.deliver(lick, using).catch(() => undefined);\n  };\n  const listeners = new Set<() => void>();\n  const notify = () => {\n    for (const listener of listeners) listener();\n  };\n  let initial: Set<string> = new Set();\n  let first = true;\n  const log = serverLog(options, context);\n  const fetcher = (input: string | URL, init?: RequestInit) => options.fetch(input, init);\n  const oauth = (entry: McpServerEntry) =>\n    new StoredOAuth(entry, options.credentials, options.redirect);\n  const transport = async (entry: McpServerEntry) => {\n    const resolved = await resolveHeaders(entry.name, entry.config, options.credentials);\n    if (!resolved.ok) return { missing: resolved.missing };\n    const authProvider = usesOAuth(entry.config) ? oauthAuth(oauth(entry), entry) : undefined;\n    return {\n      transport: new StreamableHttpTransport({\n        url: entry.config.url,\n        headers: resolved.headers,\n        fetch: fetcher,\n        ...(authProvider ? { authProvider } : {}),\n      }),\n      secrets: resolved.secrets,\n    };\n  };\n  const open = (entry: McpServerEntry) => {\n    const connection = new McpServerConnection({\n      entry,\n      version: options.version,\n      transport,\n      onTools: () => catalog.rebuild(),\n      onLog: log.write,\n      onChange: (changed) => {\n        if (catalog.connections.get(changed.name) !== changed) return;\n        if (changed.state === 'connected' && !initial.has(changed.name))\n          void report(connectedLick(changed), context);\n        void report(stateLick(changed, options.cors), context);\n        if (changed.state !== 'connected') catalog.rebuild();\n        notify();\n      },\n    });\n    catalog.connections.set(entry.name, connection);\n    void connection.getClient().catch(() => undefined);\n  };\n  const reload = async (using: Context) => {\n    const read = await env.readTextFile(configPath(home), using);\n    const parsed = parseMcpConfig(read.ok ? read.value : undefined);\n    for (const problem of parsed.problems) await report(problemLick(problem, home), using);\n    const wanted = new Map(\n      parsed.servers\n        .filter((entry) => entry.config.enabled !== false)\n        .map((entry) => [entry.name, entry])\n    );\n    const closing: Promise<void>[] = [];\n    for (const [name, connection] of [...catalog.connections]) {\n      const next = wanted.get(name);\n      if (next && sameConfig(next.config, connection.entry.config)) continue;\n      catalog.connections.delete(name);\n      closing.push(connection.close());\n    }\n    if (first) initial = new Set(wanted.keys());\n    first = false;\n    for (const [name, entry] of wanted) if (!catalog.connections.has(name)) open(entry);\n    catalog.rebuild();\n    notify();\n    await Promise.all(closing);\n  };\n  await reload(context);\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const schedule = () => {\n    clearTimeout(timer);\n    timer = setTimeout(() => void reload(context).catch(() => undefined), options.reloadMs);\n  };\n  const watched = await env.watch([{ path: configPath(home) }], schedule, context);\n  const watcher: FileWatcher | undefined = watched.ok ? watched.value : undefined;\n  const restart = (connection: McpServerConnection) => {\n    open(connection.entry);\n    void connection.close();\n    catalog.rebuild();\n  };\n  return {\n    ...mcpAccounts(\n      catalog,\n      { credentials: options.credentials, oauth, fetch: fetcher },\n      restart,\n      listeners\n    ),\n    status: () =>\n      [...catalog.connections.values()].map((connection) => ({\n        name: connection.name,\n        state: connection.state,\n        tools: connection.tools.length,\n        ...(connection.error ? { error: scrub(connection.error, connection.secrets) } : {}),\n      })),\n    reload,\n    async close(using) {\n      clearTimeout(timer);\n      await watcher?.close(using);\n      const all = [...catalog.connections.values()];\n      catalog.connections.clear();\n      await Promise.all(all.map((connection) => connection.close()));\n      catalog.rebuild();\n      await log.settled();\n    },\n  };\n}\n\nexport async function startMcp(\n  registry: Registry,\n  options: McpAttach,\n  context: Context\n): Promise<{ catalog: McpCatalog; runtime: McpRuntime }> {\n  patchSse();\n  const catalog = new McpCatalog(registry);\n  return { catalog, runtime: await attachMcp(catalog, options, context) };\n}\n"],
+  "mappings": "AAIA,SAAS,+BAA+B;AAExC,SAA2B,mBAAmB;AAC9C,SAAS,kBAAkB;AAC3B;AAAA,EAGE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,gBAAgB,OAAO,mBAAmB;AACnD,SAAS,gBAAgB,WAAW,mBAAmB;AACvD,SAAS,gBAAgB;AAElB,MAAM,oBAAoB,IAAI,OAAO;AAErC,SAAS,WAAW,MAAsB;AAC/C,SAAO,GAAG,IAAI;AAChB;AAEO,SAAS,QAAQ,MAAsB;AAC5C,SAAO,GAAG,IAAI;AAChB;AA8BO,SAAS,YAAY,SAA2B,MAAyB;AAC9E,QAAM,OAAO,IAAI,WAAW,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;AACpD,QAAM,QAAQ,QAAQ,SAAS,WAAW,QAAQ,MAAM,MAAM;AAC9D,QAAM,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,KAAK,KAAK;AAC3D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,IAAI;AAAA,IACnB,OAAO,uBAAuB,KAAK,GAAG,KAAK;AAAA,IAC3C,MAAM,QAAQ;AAAA,IACd,MAAM,GAAG,IAAI;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS,GAAG,QAAQ,UAAU,EAAE;AAAA,EAAK,QAAQ,SAAS,EAAE;AAAA,EAAK,QAAQ,OAAO;AAAA,EAC9E;AACF;AAEA,MAAM,aAAa;AAEZ,SAAS,UAAU,YAAiC,MAAsC;AAC/F,QAAM,OAAO,WAAW;AACxB,QAAM,OAAO,EAAE,SAAS,WAAoB,QAAQ,OAAO,IAAI,IAAI,QAAQ,OAAgB;AAC3F,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,eAAe,IAAI;AAAA,MAC1B,MAAM,mBAAmB,WAAW,QAAQ,IAAI,CAAC,SAAS,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MACnF,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,WAAW,QAAQ,KAAK,GAAG,CAAC;AAAA,IAC3D;AACF,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SACxC,eAAe,IAAI,yBACnB,eAAe,IAAI;AAAA,MACvB,MAAM,WAAW,cAAc;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,IAClB;AACF,MAAI,WAAW,UAAU,SAAU,QAAO;AAC1C,QAAM,QAAQ,MAAM,WAAW,SAAS,iBAAiB,WAAW,OAAO;AAC3E,QAAM,UAAU,QAAQ,WAAW,KAAK,KAAK;AAC7C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,eAAe,IAAI;AAAA,IAC1B,MAAM,UACF,oKACA;AAAA,IACJ,UAAU;AAAA,IACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,UAAU,SAAS,KAAK;AAAA,EACvD;AACF;AAEO,SAAS,cAAc,YAA4C;AACxE,QAAM,QAAQ,WAAW,MAAM;AAC/B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,WAAW,IAAI;AAAA,IAC9B,OAAO,eAAe,WAAW,IAAI;AAAA,IACrC,MAAM,GAAG,WAAW,MAAM,OAAO,GAAG,WAAW,KAAK,QAAQ,UAAU,IAAI,KAAK,GAAG;AAAA,IAClF,QAAQ;AAAA,IACR,SAAS,GAAG,WAAW,IAAI;AAAA;AAAA,EAAgB,WAAW,MAAM,OAAO,GAAG;AAAA,EACxE;AACF;AAEO,SAAS,QACd,QACA,QACA,SACA,IACQ;AACR,QAAM,EAAE,OAAO,QAAQ,KAAK,IAAK,UAAU,CAAC;AAK5C,QAAM,OAAO,MAAM,OAAO,SAAS,WAAW,OAAQ,KAAK,UAAU,IAAI,KAAK,IAAK,OAAO;AAC1F,SAAO,GAAG,GAAG,YAAY,CAAC,KAAK,MAAM,KAAK,SAAS,MAAM,GAAG,SAAS,IAAI,MAAM,KAAK,EAAE,KAAK,IAAI;AAAA;AACjG;AAEA,SAAS,UAAU,SAAoB,SAAkB;AACvD,MAAI,UAAU,QAAQ,QAAQ;AAC9B,QAAM,OAAO,QAAQ,QAAQ,IAAI;AACjC,QAAM,EAAE,IAAI,IAAI;AAChB,SAAO;AAAA,IACL,MAAM,YAAiC,QAAiB;AACtD,YAAM,OAAO,QAAQ,WAAW,MAAM,QAAQ,WAAW,SAAS,oBAAI,KAAK,CAAC;AAC5E,gBAAU,QAAQ,KAAK,YAAY;AACjC,cAAM,OAAO,MAAM,IAAI,SAAS,MAAM,OAAO;AAC7C,YAAI,KAAK,MAAM,KAAK,MAAM,OAAO;AAC/B,gBAAM,IAAI,WAAW,MAAM,GAAG,IAAI,MAAM,OAAO;AACjD,cAAM,IAAI,WAAW,MAAM,MAAM,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,IACA,SAAS,MAAM;AAAA,EACjB;AACF;AAEA,eAAsB,UACpB,SACA,SACA,SACqB;AACrB,QAAM,EAAE,KAAK,KAAK,IAAI;AACtB,UAAQ,aAAa,QAAQ;AAC7B,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,SAAS,OAAO,MAA6B,UAAmB;AACpE,QAAI,CAAC,MAAM,WAAW,SAAS,IAAI,KAAK,OAAO,EAAG;AAClD,aAAS,IAAI,KAAK,OAAO;AACzB,UAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,EAChE;AACA,QAAM,YAAY,oBAAI,IAAgB;AACtC,QAAM,SAAS,MAAM;AACnB,eAAW,YAAY,UAAW,UAAS;AAAA,EAC7C;AACA,MAAI,UAAuB,oBAAI,IAAI;AACnC,MAAI,QAAQ;AACZ,QAAM,MAAM,UAAU,SAAS,OAAO;AACtC,QAAM,UAAU,CAAC,OAAqB,SAAuB,QAAQ,MAAM,OAAO,IAAI;AACtF,QAAM,QAAQ,CAAC,UACb,IAAI,YAAY,OAAO,QAAQ,aAAa,QAAQ,QAAQ;AAC9D,QAAM,YAAY,OAAO,UAA0B;AACjD,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW;AACnF,QAAI,CAAC,SAAS,GAAI,QAAO,EAAE,SAAS,SAAS,QAAQ;AACrD,UAAM,eAAe,UAAU,MAAM,MAAM,IAAI,UAAU,MAAM,KAAK,GAAG,KAAK,IAAI;AAChF,WAAO;AAAA,MACL,WAAW,IAAI,wBAAwB;AAAA,QACrC,KAAK,MAAM,OAAO;AAAA,QAClB,SAAS,SAAS;AAAA,QAClB,OAAO;AAAA,QACP,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,MACzC,CAAC;AAAA,MACD,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AACA,QAAM,OAAO,CAAC,UAA0B;AACtC,UAAM,aAAa,IAAI,oBAAoB;AAAA,MACzC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,SAAS,MAAM,QAAQ,QAAQ;AAAA,MAC/B,OAAO,IAAI;AAAA,MACX,UAAU,CAAC,YAAY;AACrB,YAAI,QAAQ,YAAY,IAAI,QAAQ,IAAI,MAAM,QAAS;AACvD,YAAI,QAAQ,UAAU,eAAe,CAAC,QAAQ,IAAI,QAAQ,IAAI;AAC5D,eAAK,OAAO,cAAc,OAAO,GAAG,OAAO;AAC7C,aAAK,OAAO,UAAU,SAAS,QAAQ,IAAI,GAAG,OAAO;AACrD,YAAI,QAAQ,UAAU,YAAa,SAAQ,QAAQ;AACnD,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,YAAQ,YAAY,IAAI,MAAM,MAAM,UAAU;AAC9C,SAAK,WAAW,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD;AACA,QAAM,SAAS,OAAO,UAAmB;AACvC,UAAM,OAAO,MAAM,IAAI,aAAa,WAAW,IAAI,GAAG,KAAK;AAC3D,UAAM,SAAS,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS;AAC9D,eAAW,WAAW,OAAO,SAAU,OAAM,OAAO,YAAY,SAAS,IAAI,GAAG,KAAK;AACrF,UAAM,SAAS,IAAI;AAAA,MACjB,OAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,YAAY,KAAK,EAChD,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC;AAAA,IACvC;AACA,UAAM,UAA2B,CAAC;AAClC,eAAW,CAAC,MAAM,UAAU,KAAK,CAAC,GAAG,QAAQ,WAAW,GAAG;AACzD,YAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,UAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,MAAM,EAAG;AAC9D,cAAQ,YAAY,OAAO,IAAI;AAC/B,cAAQ,KAAK,WAAW,MAAM,CAAC;AAAA,IACjC;AACA,QAAI,MAAO,WAAU,IAAI,IAAI,OAAO,KAAK,CAAC;AAC1C,YAAQ;AACR,eAAW,CAAC,MAAM,KAAK,KAAK,OAAQ,KAAI,CAAC,QAAQ,YAAY,IAAI,IAAI,EAAG,MAAK,KAAK;AAClF,YAAQ,QAAQ;AAChB,WAAO;AACP,UAAM,QAAQ,IAAI,OAAO;AAAA,EAC3B;AACA,QAAM,OAAO,OAAO;AACpB,MAAI;AACJ,QAAM,WAAW,MAAM;AACrB,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS,GAAG,QAAQ,QAAQ;AAAA,EACxF;AACA,QAAM,UAAU,MAAM,IAAI,MAAM,CAAC,EAAE,MAAM,WAAW,IAAI,EAAE,CAAC,GAAG,UAAU,OAAO;AAC/E,QAAM,UAAmC,QAAQ,KAAK,QAAQ,QAAQ;AACtE,QAAM,UAAU,CAAC,eAAoC;AACnD,SAAK,WAAW,KAAK;AACrB,SAAK,WAAW,MAAM;AACtB,YAAQ,QAAQ;AAAA,EAClB;AACA,SAAO;AAAA,IACL,GAAG;AAAA,MACD;AAAA,MACA,EAAE,aAAa,QAAQ,aAAa,OAAO,OAAO,QAAQ;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ,MACN,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACrD,MAAM,WAAW;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,WAAW,MAAM;AAAA,MACxB,GAAI,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,OAAO,WAAW,OAAO,EAAE,IAAI,CAAC;AAAA,IACnF,EAAE;AAAA,IACJ;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,mBAAa,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,MAAM,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC;AAC5C,cAAQ,YAAY,MAAM;AAC1B,YAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,eAAe,WAAW,MAAM,CAAC,CAAC;AAC7D,cAAQ,QAAQ;AAChB,YAAM,IAAI,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,UACA,SACA,SACuD;AACvD,WAAS;AACT,QAAM,UAAU,IAAI,WAAW,QAAQ;AACvC,SAAO,EAAE,SAAS,SAAS,MAAM,UAAU,SAAS,SAAS,OAAO,EAAE;AACxE;",
   "names": []
 }