@akon-labs/nexus-cli 0.1.9 → 0.1.11-rc.2

package/dist/extensions/mcp/mcp-oauth-provider.js

@@ -0,0 +1,491 @@
+/**
+ * MCP OAuth Provider
+ *
+ * Implementation of the MCP SDK's OAuthClientProvider interface.
+ * Handles OAuth client registration, token storage, and authorization redirection.
+ */
+import { UnauthorizedError, } from "@modelcontextprotocol/client";
+import { getAppClientUri, getAppName } from "./agent-dir.js";
+import { clearAllCredentials, clearClientInfo, clearCodeVerifier, clearTokens, getAuthForUrl, updateClientInfo, updateTokens, } from "./mcp-auth.js";
+import { resolveCommandSecret } from "./utils.js";
+/**
+ * Client name advertised during Dynamic Client Registration.
+ *
+ * OAuth consent screens must identify the application users are running.
+ */
+function defaultClientName() {
+    return getAppName();
+}
+/**
+ * Client homepage advertised during Dynamic Client Registration.
+ *
+ * RFC 7591 defines client_uri as the home page of the client.
+ */
+function defaultClientUri() {
+    const declared = getAppClientUri();
+    if (declared)
+        return declared;
+    return getAppName() === "Nexus" ? "https://github.com/Akon-Labs/nexus-cli" : undefined;
+}
+function issuersMatch(first, second) {
+    return (first === second ||
+        (first.endsWith("/") && first.slice(0, -1) === second) ||
+        (second.endsWith("/") && second.slice(0, -1) === first));
+}
+// Callback server configuration
+const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
+const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
+let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+    const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+    if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {
+        configuredOAuthCallbackPort = parsedPort;
+    }
+}
+let oauthCallbackPort = configuredOAuthCallbackPort;
+let oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+export function getConfiguredOAuthCallbackPort() {
+    return configuredOAuthCallbackPort;
+}
+export function getOAuthCallbackPort() {
+    return oauthCallbackPort;
+}
+export function setOAuthCallbackPort(port) {
+    oauthCallbackPort = port;
+}
+export function getOAuthCallbackPath() {
+    return oauthCallbackPath;
+}
+export function setOAuthCallbackPath(path) {
+    oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+const reservedAuthorizationParams = new Set([
+    "client_id",
+    "code_challenge",
+    "code_challenge_method",
+    "redirect_uri",
+    "resource",
+    "response_type",
+    "scope",
+    "state",
+]);
+function addAuthorizationParams(authorizationUrl, params) {
+    if (!params)
+        return authorizationUrl;
+    const nextUrl = new URL(authorizationUrl.toString());
+    for (const [key, value] of Object.entries(params)) {
+        if (reservedAuthorizationParams.has(key) || nextUrl.searchParams.has(key)) {
+            throw new Error(`OAuth authorizationParams.${key} cannot override an authorization flow parameter`);
+        }
+        nextUrl.searchParams.set(key, value);
+    }
+    return nextUrl;
+}
+/**
+ * OAuth provider implementation for MCP servers.
+ * Implements the OAuthClientProvider interface from the MCP SDK.
+ */
+export class McpOAuthProvider {
+    redirectUrlSnapshot;
+    active = true;
+    flowClientInfo;
+    flowCodeVerifier;
+    flowDiscoveryState;
+    flowIssuerMismatch = false;
+    flowState;
+    serverName;
+    serverUrl;
+    config;
+    callbacks;
+    storageOptions;
+    runtimeSignal;
+    constructor(serverName, serverUrl, config, callbacks, storageOptions = {}, runtimeSignal, initialState) {
+        this.serverName = serverName;
+        this.serverUrl = serverUrl;
+        this.config = config;
+        this.callbacks = callbacks;
+        this.storageOptions = storageOptions;
+        this.runtimeSignal = runtimeSignal;
+        this.flowState = initialState;
+        this.redirectUrlSnapshot =
+            config.grantType === "client_credentials"
+                ? undefined
+                : (config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`);
+    }
+    get usesClientCredentials() {
+        return this.config.grantType === "client_credentials";
+    }
+    get discoveredIssuer() {
+        return (this.flowDiscoveryState?.authorizationServerMetadata?.issuer ?? this.flowDiscoveryState?.authorizationServerUrl);
+    }
+    deactivate() {
+        this.active = false;
+    }
+    assertStoredIssuerBindings(entry, issuer) {
+        if (this.flowIssuerMismatch) {
+            throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
+        }
+        if (!entry || !issuer)
+            return;
+        const storedIssuers = [entry.clientInfo?.issuer, entry.tokens?.issuer].filter((storedIssuer) => storedIssuer !== undefined);
+        if (storedIssuers.some((storedIssuer) => !issuersMatch(storedIssuer, issuer))) {
+            this.flowIssuerMismatch = true;
+            throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
+        }
+    }
+    throwIfInactive() {
+        if (!this.active)
+            throw new Error("OAuth flow is no longer active");
+        this.runtimeSignal?.throwIfAborted();
+    }
+    /**
+     * The redirect URL for OAuth callbacks.
+     * This must match the redirect_uri in client metadata.
+     */
+    get redirectUrl() {
+        return this.redirectUrlSnapshot;
+    }
+    /** Configured homepage, otherwise the Nexus repository. */
+    get clientUri() {
+        return this.config.clientUri ?? defaultClientUri();
+    }
+    /**
+     * Client metadata for dynamic registration.
+     * Describes this client to the OAuth authorization server.
+     */
+    get clientMetadata() {
+        if (this.usesClientCredentials) {
+            return {
+                client_name: this.config.clientName ?? defaultClientName(),
+                ...(this.clientUri !== undefined ? { client_uri: this.clientUri } : {}),
+                ...(this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {}),
+                redirect_uris: [],
+                grant_types: ["client_credentials"],
+                token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+            };
+        }
+        const redirectUrl = this.redirectUrl;
+        if (!redirectUrl) {
+            throw new Error("redirectUrl is required for authorization_code flow");
+        }
+        return {
+            redirect_uris: [redirectUrl],
+            client_name: this.config.clientName ?? defaultClientName(),
+            ...(this.clientUri !== undefined ? { client_uri: this.clientUri } : {}),
+            ...(this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {}),
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+            ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),
+        };
+    }
+    /**
+     * Get client information (for pre-registered or dynamically registered clients).
+     * Returns undefined if no client info exists or if the server URL has changed.
+     */
+    async clientInformation() {
+        const issuer = this.discoveredIssuer;
+        const stored = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
+        this.assertStoredIssuerBindings(stored, issuer);
+        // Check config first (pre-registered client). Store only its issuer binding.
+        // The configured secret stays in config and never enters the credential store.
+        if (this.config.clientId) {
+            const storedClient = stored?.clientInfo?.clientId === this.config.clientId ? stored.clientInfo : undefined;
+            if (issuer && (storedClient?.issuer !== issuer || storedClient.configPreRegistered !== true)) {
+                updateClientInfo(this.serverName, { clientId: this.config.clientId, issuer, configPreRegistered: true }, this.serverUrl, this.storageOptions);
+            }
+            const clientSecret = this.config.clientSecret?.startsWith("!")
+                ? resolveCommandSecret(this.config.clientSecret, `MCP server "${this.serverName}" OAuth clientSecret`)
+                : this.config.clientSecret;
+            return {
+                client_id: this.config.clientId,
+                client_secret: clientSecret,
+                ...(issuer !== undefined ? { issuer } : {}),
+            };
+        }
+        // Keep client registration associated with this in-flight flow even if
+        // another runtime writes the shared persistent entry for the same name.
+        const clientInfo = this.flowClientInfo ?? stored?.clientInfo;
+        if (clientInfo) {
+            // A stored SEP-2352 issuer stub for a config-pre-registered client
+            // (identified by its explicit marker) is only meaningful
+            // when the config supplies the matching client secret. Since we reach
+            // this branch only when config.clientId is absent, serving the stub
+            // would let a token refresh go out with a client_id but no secret,
+            // causing invalid_client and credential invalidation. Return undefined
+            // so callers treat this as "no client info".
+            const isConfigStub = clientInfo.configPreRegistered === true;
+            if (isConfigStub) {
+                return undefined;
+            }
+            // Check if client secret has expired
+            if (clientInfo.clientSecretExpiresAt && clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
+                return undefined;
+            }
+            if (issuer && clientInfo.issuer && !issuersMatch(clientInfo.issuer, issuer)) {
+                return undefined;
+            }
+            if (issuer && clientInfo.issuer === undefined) {
+                clientInfo.issuer = issuer;
+                this.flowClientInfo = clientInfo;
+                updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);
+            }
+            // Return all registration metadata and the local issuer extension.
+            // This keeps the SDK OAuth view and the stored issuer binding consistent.
+            return {
+                client_id: clientInfo.clientId,
+                client_secret: clientInfo.clientSecret,
+                ...(clientInfo.clientIdIssuedAt !== undefined ? { client_id_issued_at: clientInfo.clientIdIssuedAt } : {}),
+                ...(clientInfo.clientSecretExpiresAt !== undefined
+                    ? { client_secret_expires_at: clientInfo.clientSecretExpiresAt }
+                    : {}),
+                ...(clientInfo.redirectUris !== undefined ? { redirect_uris: clientInfo.redirectUris } : {}),
+                ...(clientInfo.issuer !== undefined ? { issuer: clientInfo.issuer } : {}),
+            };
+        }
+        // No client info or URL changed - will trigger dynamic registration
+        return undefined;
+    }
+    /**
+     * Save client information from dynamic registration.
+     */
+    async saveClientInformation(info) {
+        this.throwIfInactive();
+        const issuer = this.discoveredIssuer ?? info.issuer;
+        if (this.config.clientId && info.client_id === this.config.clientId) {
+            updateClientInfo(this.serverName, {
+                clientId: info.client_id,
+                ...(issuer !== undefined ? { issuer } : {}),
+                configPreRegistered: true,
+            }, this.serverUrl, this.storageOptions);
+            return;
+        }
+        const redirectUris = ("redirect_uris" in info ? info.redirect_uris : undefined) ??
+            (this.redirectUrl ? [this.redirectUrl] : undefined);
+        const clientInfo = {
+            clientId: info.client_id,
+            ...(info.client_secret !== undefined ? { clientSecret: info.client_secret } : {}),
+            ...(info.client_id_issued_at !== undefined ? { clientIdIssuedAt: info.client_id_issued_at } : {}),
+            ...(info.client_secret_expires_at !== undefined
+                ? { clientSecretExpiresAt: info.client_secret_expires_at }
+                : {}),
+            ...(redirectUris !== undefined ? { redirectUris } : {}),
+            ...(issuer !== undefined ? { issuer } : {}),
+        };
+        this.flowClientInfo = clientInfo;
+        updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);
+    }
+    /**
+     * Get stored OAuth tokens.
+     * Returns undefined if no tokens exist or if the server URL has changed.
+     */
+    async tokens() {
+        // Use getAuthForUrl to validate tokens are for the current server URL.
+        const entry = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
+        if (!entry?.tokens)
+            return undefined;
+        const issuer = this.discoveredIssuer;
+        this.assertStoredIssuerBindings(entry, issuer);
+        if (issuer && entry.tokens.issuer === undefined) {
+            entry.tokens.issuer = issuer;
+            updateTokens(this.serverName, entry.tokens, this.serverUrl, this.storageOptions);
+        }
+        return {
+            access_token: entry.tokens.accessToken,
+            token_type: "Bearer",
+            refresh_token: entry.tokens.refreshToken,
+            expires_in: entry.tokens.expiresAt !== undefined
+                ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))
+                : undefined,
+            scope: entry.tokens.scope,
+            ...(entry.tokens.issuer !== undefined ? { issuer: entry.tokens.issuer } : {}),
+        };
+    }
+    /**
+     * Save OAuth tokens.
+     */
+    async saveTokens(tokens) {
+        const issuer = this.discoveredIssuer ?? tokens.issuer;
+        const storedTokens = {
+            accessToken: tokens.access_token,
+            ...(tokens.refresh_token !== undefined ? { refreshToken: tokens.refresh_token } : {}),
+            // Preserve expiry even when expires_in is 0 (e.g. the SDK re-saving an
+            // already-expired token) so expired tokens stay expired instead of
+            // being persisted as never-expiring.
+            ...(tokens.expires_in !== undefined ? { expiresAt: Date.now() / 1000 + tokens.expires_in } : {}),
+            ...(tokens.scope !== undefined ? { scope: tokens.scope } : {}),
+            ...(issuer !== undefined ? { issuer } : {}),
+        };
+        this.throwIfInactive();
+        updateTokens(this.serverName, storedTokens, this.serverUrl, this.storageOptions);
+        // Discovery must survive the browser redirect so the callback can verify
+        // the authorization server that minted the code. Once token issuance
+        // succeeds, clear it so a later 401 re-reads PRM and can observe an
+        // authorization-server migration.
+        this.flowDiscoveryState = undefined;
+    }
+    /**
+     * Redirect the user to the authorization URL.
+     * This opens the browser for the user to authenticate.
+     *
+     * Throws UnauthorizedError when called outside of a user-initiated flow
+     * (no oauthState saved by startAuth). That path is reached when the SDK
+     * falls through from a failed refresh into a fresh authorization_code
+     * flow, which library hosts cannot complete in-process.
+     */
+    async redirectToAuthorization(authorizationUrl) {
+        if (this.usesClientCredentials) {
+            throw new Error("redirectToAuthorization is not used for client_credentials flow");
+        }
+        // No flow-local state means we're on the post-refresh authorize fallback.
+        this.throwIfInactive();
+        if (!this.flowState) {
+            throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+        }
+        // URL is passed to callback, not logged (may contain sensitive params)
+        await this.callbacks.onRedirect(addAuthorizationParams(authorizationUrl, this.config.authorizationParams));
+    }
+    /**
+     * Save the PKCE code verifier.
+     */
+    async saveCodeVerifier(codeVerifier) {
+        this.throwIfInactive();
+        this.flowCodeVerifier = codeVerifier;
+    }
+    /**
+     * Get the stored PKCE code verifier.
+     * @throws Error if no code verifier is stored
+     */
+    async codeVerifier() {
+        if (this.usesClientCredentials) {
+            throw new Error("codeVerifier is not used for client_credentials flow");
+        }
+        this.throwIfInactive();
+        if (!this.flowCodeVerifier) {
+            throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+        }
+        return this.flowCodeVerifier;
+    }
+    /**
+     * Keep discovery with the in-flight PKCE verifier. The callback leg uses it
+     * to validate the authorization response issuer before token exchange.
+     */
+    async saveDiscoveryState(state) {
+        this.throwIfInactive();
+        this.flowDiscoveryState = structuredClone(state);
+    }
+    async discoveryState() {
+        this.throwIfInactive();
+        return this.flowDiscoveryState ? structuredClone(this.flowDiscoveryState) : undefined;
+    }
+    /**
+     * Save the OAuth state parameter for CSRF protection.
+     */
+    async saveState(state) {
+        this.throwIfInactive();
+        this.flowState = state;
+    }
+    /**
+     * Get the stored OAuth state parameter.
+     * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
+     */
+    async state() {
+        if (this.usesClientCredentials) {
+            throw new Error("state is not used for client_credentials flow");
+        }
+        this.throwIfInactive();
+        if (!this.flowState) {
+            throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+        }
+        return this.flowState;
+    }
+    /**
+     * Invalidate credentials when authentication fails.
+     * Clears tokens, client info, or all credentials based on the type.
+     */
+    async invalidateCredentials(type) {
+        this.throwIfInactive();
+        switch (type) {
+            case "all":
+                this.flowClientInfo = undefined;
+                this.flowCodeVerifier = undefined;
+                this.flowDiscoveryState = undefined;
+                this.flowIssuerMismatch = false;
+                this.flowState = undefined;
+                clearAllCredentials(this.serverName, this.storageOptions);
+                break;
+            case "client":
+                this.flowClientInfo = undefined;
+                clearClientInfo(this.serverName, this.storageOptions);
+                break;
+            case "tokens":
+                clearTokens(this.serverName, this.storageOptions);
+                break;
+            case "verifier":
+                clearCodeVerifier(this.serverName, this.storageOptions);
+                break;
+            case "discovery":
+                this.flowDiscoveryState = undefined;
+                break;
+        }
+    }
+    /**
+     * Adds configured authorization-code scope without replacing the SDK's
+     * default token endpoint authentication behavior.
+     */
+    addClientAuthentication = async (headers, params, _url, metadata) => {
+        this.throwIfInactive();
+        if (params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope) {
+            params.set("scope", this.config.scope);
+        }
+        const clientInfo = await this.clientInformation();
+        this.throwIfInactive();
+        if (!clientInfo) {
+            return;
+        }
+        const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
+        const hasClientSecret = clientInfo.client_secret !== undefined;
+        let authMethod;
+        if (supportedMethods.length === 0) {
+            authMethod = hasClientSecret ? "client_secret_post" : "none";
+        }
+        else if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
+            authMethod = "client_secret_basic";
+        }
+        else if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
+            authMethod = "client_secret_post";
+        }
+        else if (supportedMethods.includes("none")) {
+            authMethod = "none";
+        }
+        else {
+            authMethod = hasClientSecret ? "client_secret_post" : "none";
+        }
+        if (authMethod === "client_secret_basic") {
+            if (!clientInfo.client_secret) {
+                throw new Error("client_secret_basic authentication requires a client_secret");
+            }
+            headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+            return;
+        }
+        if (!params.has("client_id")) {
+            params.set("client_id", clientInfo.client_id);
+        }
+        if (authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret")) {
+            params.set("client_secret", clientInfo.client_secret);
+        }
+    };
+    prepareTokenRequest(scope) {
+        if (!this.usesClientCredentials) {
+            return undefined;
+        }
+        const params = new URLSearchParams({ grant_type: "client_credentials" });
+        const requestedScope = scope ?? this.config.scope;
+        if (requestedScope) {
+            params.set("scope", requestedScope);
+        }
+        return params;
+    }
+}
+export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };
+//# sourceMappingURL=mcp-oauth-provider.js.map

package/dist/extensions/mcp/mcp-oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-provider.js","sourceRoot":"","sources":["../../../src/extensions/mcp/mcp-oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAIN,iBAAiB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAGN,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EAGb,gBAAgB,EAChB,YAAY,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AACH,SAAS,iBAAiB,GAAW;IACpC,OAAO,UAAU,EAAE,CAAC;AAAA,CACpB;AAED;;;;GAIG;AACH,SAAS,gBAAgB,GAAuB;IAC/C,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,UAAU,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACvF;AAKD,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc,EAAW;IAC7D,OAAO,CACN,KAAK,KAAK,MAAM;QAChB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACtD,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CACvD,CAAC;AAAA,CACF;AAED,gCAAgC;AAChC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEhD,IAAI,2BAA2B,GAAG,2BAA2B,CAAC;AAE9D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC3E,2BAA2B,GAAG,UAAU,CAAC;IAC1C,CAAC;AACF,CAAC;AAED,IAAI,iBAAiB,GAAG,2BAA2B,CAAC;AACpD,IAAI,iBAAiB,GAAG,2BAA2B,CAAC;AAEpD,MAAM,UAAU,8BAA8B,GAAW;IACxD,OAAO,2BAA2B,CAAC;AAAA,CACnC;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC9C,OAAO,iBAAiB,CAAC;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACxD,iBAAiB,GAAG,IAAI,CAAC;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,GAAW;IAC9C,OAAO,iBAAiB,CAAC;AAAA,CACzB;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAQ;IACxD,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAAA,CAC7D;AAgBD,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC3C,WAAW;IACX,gBAAgB;IAChB,uBAAuB;IACvB,cAAc;IACd,UAAU;IACV,eAAe;IACf,OAAO;IACP,OAAO;CACP,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAAC,gBAAqB,EAAE,MAA0C,EAAO;IACvG,IAAI,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,kDAAkD,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAOD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACX,mBAAmB,CAAqB;IACjD,MAAM,GAAG,IAAI,CAAC;IACd,cAAc,CAA+B;IAC7C,gBAAgB,CAAqB;IACrC,kBAAkB,CAAkC;IACpD,kBAAkB,GAAG,KAAK,CAAC;IAC3B,SAAS,CAAqB;IAC9B,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,MAAM,CAAiB;IACvB,SAAS,CAAoB;IAC7B,cAAc,CAAqB;IACnC,aAAa,CAA0B;IAE/C,YACC,UAAkB,EAClB,SAAiB,EACjB,MAAsB,EACtB,SAA4B,EAC5B,cAAc,GAAuB,EAAE,EACvC,aAA2B,EAC3B,YAAqB,EACpB;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC;QAC9B,IAAI,CAAC,mBAAmB;YACvB,MAAM,CAAC,SAAS,KAAK,oBAAoB;gBACxC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,oBAAoB,EAAE,GAAG,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAAA,CAClG;IAED,IAAY,qBAAqB,GAAY;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC;IAAA,CACtD;IAED,IAAY,gBAAgB,GAAuB;QAClD,OAAO,CACN,IAAI,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAC/G,CAAC;IAAA,CACF;IAED,UAAU,GAAS;QAClB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IAAA,CACpB;IAEO,0BAA0B,CAAC,KAA4B,EAAE,MAA0B,EAAQ;QAClG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACd,iDAAiD,IAAI,CAAC,UAAU,iDAAiD,CACjH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QAE9B,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAC5E,CAAC,YAAY,EAA0B,EAAE,CAAC,YAAY,KAAK,SAAS,CACpE,CAAC;QACF,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CACd,iDAAiD,IAAI,CAAC,UAAU,iDAAiD,CACjH,CAAC;QACH,CAAC;IAAA,CACD;IAEO,eAAe,GAAS;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC;IAAA,CACrC;IAED;;;OAGG;IACH,IAAI,WAAW,GAAuB;QACrC,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAAA,CAChC;IAED,2DAA2D;IAC3D,IAAY,SAAS,GAAuB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IAAA,CACnD;IAED;;;OAGG;IACH,IAAI,cAAc,GAAwB;QACzC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,OAAO;gBACN,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,iBAAiB,EAAE;gBAC1D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;gBACnC,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;aACpF,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACN,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,iBAAiB,EAAE;YAC1D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YACpF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IAAA,CACF;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,GAAqD;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACzF,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEhD,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3G,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,IAAI,YAAY,CAAC,mBAAmB,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC9F,gBAAgB,CACf,IAAI,CAAC,UAAU,EACf,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,EACrE,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,cAAc,CACnB,CAAC;YACH,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC;gBAC7D,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,CAAC,UAAU,sBAAsB,CAAC;gBACtG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5B,OAAO;gBACN,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,YAAY;gBAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACX,CAAC;QACnC,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,UAAU,CAAC;QAC7D,IAAI,UAAU,EAAE,CAAC;YAChB,mEAAmE;YACnE,yDAAyD;YACzD,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,6CAA6C;YAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,mBAAmB,KAAK,IAAI,CAAC;YAC7D,IAAI,YAAY,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,qCAAqC;YACrC,IAAI,UAAU,CAAC,qBAAqB,IAAI,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC9F,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC7E,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/C,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC;gBACjC,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACpF,CAAC;YACD,mEAAmE;YACnE,0EAA0E;YAC1E,OAAO;gBACN,SAAS,EAAE,UAAU,CAAC,QAAQ;gBAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;gBACtC,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1G,GAAG,CAAC,UAAU,CAAC,qBAAqB,KAAK,SAAS;oBACjD,CAAC,CAAC,EAAE,wBAAwB,EAAE,UAAU,CAAC,qBAAqB,EAAE;oBAChE,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC;QACnC,CAAC;QAED,oEAAoE;QACpE,OAAO,SAAS,CAAC;IAAA,CACjB;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAiC,EAAiB;QAC7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAK,IAAqC,CAAC,MAAM,CAAC;QACtF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrE,gBAAgB,CACf,IAAI,CAAC,UAAU,EACf;gBACC,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,mBAAmB,EAAE,IAAI;aACzB,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,cAAc,CACnB,CAAC;YACF,OAAO;QACR,CAAC;QAED,MAAM,YAAY,GACjB,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,UAAU,GAAqB;YACpC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAAA,CACnF;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,GAAqC;QAChD,uEAAuE;QACvE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,SAAS,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACrC,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAED,OAAO;YACN,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACtC,UAAU,EAAE,QAAQ;YACpB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACxC,UAAU,EACT,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;IAAA,CACvB;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB,EAAiB;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAK,MAA4B,CAAC,MAAM,CAAC;QAC7E,MAAM,YAAY,GAAiB;YAClC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,uEAAuE;YACvE,mEAAmE;YACnE,qCAAqC;YACrC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACjF,yEAAyE;QACzE,qEAAqE;QACrE,oEAAoE;QACpE,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAAA,CACpC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB,CAAC,gBAAqB,EAAiB;QACnE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACpF,CAAC;QACD,0EAA0E;QAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,uEAAuE;QACvE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAAA,CAC3G;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB,EAAiB;QAC3D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC;IAAA,CACrC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,GAAoB;QACrC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAAA,CAC7B;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAA0B,EAAiB;QACnE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAAA,CACjD;IAED,KAAK,CAAC,cAAc,GAA6C;QAChE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CACtF;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAiB;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IAAA,CACvB;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,GAAoB;QAC9B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IAAA,CACtB;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAA4D,EAAiB;QACxG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,KAAK;gBACT,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;gBAChC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;gBAClC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;gBACpC,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;gBAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC3B,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC1D,MAAM;YACP,KAAK,QAAQ;gBACZ,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;gBAChC,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBACtD,MAAM;YACP,KAAK,QAAQ;gBACZ,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBAClD,MAAM;YACP,KAAK,UAAU;gBACd,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBACxD,MAAM;YACP,KAAK,WAAW;gBACf,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;gBACpC,MAAM;QACR,CAAC;IAAA,CACD;IAED;;;OAGG;IACH,uBAAuB,GAA4B,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7F,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,EAAE,qCAAqC,IAAI,EAAE,CAAC;QAC/E,MAAM,eAAe,GAAG,UAAU,CAAC,aAAa,KAAK,SAAS,CAAC;QAC/D,IAAI,UAAiE,CAAC;QAEtE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9D,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAChF,UAAU,GAAG,qBAAqB,CAAC;QACpC,CAAC;aAAM,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/E,UAAU,GAAG,oBAAoB,CAAC;QACnC,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,UAAU,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9D,CAAC;QAED,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,CAAC,GAAG,CACV,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAChG,CAAC;YACF,OAAO;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,UAAU,KAAK,oBAAoB,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC;IAAA,CACD,CAAC;IAEF,mBAAmB,CAAC,KAAc,EAA+B;QAChE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAClD,IAAI,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;CACD;AAED,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,CAAC","sourcesContent":["/**\n * MCP OAuth Provider\n *\n * Implementation of the MCP SDK's OAuthClientProvider interface.\n * Handles OAuth client registration, token storage, and authorization redirection.\n */\n\nimport type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from \"@modelcontextprotocol/client\";\nimport {\n\ttype AddClientAuthentication,\n\ttype OAuthClientProvider,\n\ttype OAuthDiscoveryState,\n\tUnauthorizedError,\n} from \"@modelcontextprotocol/client\";\nimport { getAppClientUri, getAppName } from \"./agent-dir.ts\";\nimport {\n\ttype AuthEntry,\n\ttype AuthStorageOptions,\n\tclearAllCredentials,\n\tclearClientInfo,\n\tclearCodeVerifier,\n\tclearTokens,\n\tgetAuthForUrl,\n\ttype StoredClientInfo,\n\ttype StoredTokens,\n\tupdateClientInfo,\n\tupdateTokens,\n} from \"./mcp-auth.ts\";\nimport { resolveCommandSecret } from \"./utils.ts\";\n\n/**\n * Client name advertised during Dynamic Client Registration.\n *\n * OAuth consent screens must identify the application users are running.\n */\nfunction defaultClientName(): string {\n\treturn getAppName();\n}\n\n/**\n * Client homepage advertised during Dynamic Client Registration.\n *\n * RFC 7591 defines client_uri as the home page of the client.\n */\nfunction defaultClientUri(): string | undefined {\n\tconst declared = getAppClientUri();\n\tif (declared) return declared;\n\treturn getAppName() === \"Nexus\" ? \"https://github.com/Akon-Labs/nexus-cli\" : undefined;\n}\n\ntype IssuerBoundClientInformation = OAuthClientInformationMixed & { issuer?: string };\ntype IssuerBoundTokens = OAuthTokens & { issuer?: string };\n\nfunction issuersMatch(first: string, second: string): boolean {\n\treturn (\n\t\tfirst === second ||\n\t\t(first.endsWith(\"/\") && first.slice(0, -1) === second) ||\n\t\t(second.endsWith(\"/\") && second.slice(0, -1) === first)\n\t);\n}\n\n// Callback server configuration\nconst DEFAULT_OAUTH_CALLBACK_PORT = 19876;\nconst DEFAULT_OAUTH_CALLBACK_PATH = \"/callback\";\n\nlet configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;\n\nif (process.env.MCP_OAUTH_CALLBACK_PORT) {\n\tconst parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);\n\tif (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {\n\t\tconfiguredOAuthCallbackPort = parsedPort;\n\t}\n}\n\nlet oauthCallbackPort = configuredOAuthCallbackPort;\nlet oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;\n\nexport function getConfiguredOAuthCallbackPort(): number {\n\treturn configuredOAuthCallbackPort;\n}\n\nexport function getOAuthCallbackPort(): number {\n\treturn oauthCallbackPort;\n}\n\nexport function setOAuthCallbackPort(port: number): void {\n\toauthCallbackPort = port;\n}\n\nexport function getOAuthCallbackPath(): string {\n\treturn oauthCallbackPath;\n}\n\nexport function setOAuthCallbackPath(path: string): void {\n\toauthCallbackPath = path.startsWith(\"/\") ? path : `/${path}`;\n}\n\n/** Configuration options for OAuth */\nexport interface McpOAuthConfig {\n\tgrantType?: \"authorization_code\" | \"client_credentials\";\n\tclientId?: string;\n\tclientSecret?: string;\n\tscope?: string;\n\tauthorizationParams?: Record<string, string>;\n\tredirectUri?: string;\n\tclientName?: string;\n\tclientUri?: string;\n\tlogoUri?: string;\n\tskipIssuerMetadataValidation?: boolean;\n}\n\nconst reservedAuthorizationParams = new Set([\n\t\"client_id\",\n\t\"code_challenge\",\n\t\"code_challenge_method\",\n\t\"redirect_uri\",\n\t\"resource\",\n\t\"response_type\",\n\t\"scope\",\n\t\"state\",\n]);\n\nfunction addAuthorizationParams(authorizationUrl: URL, params: Record<string, string> | undefined): URL {\n\tif (!params) return authorizationUrl;\n\tconst nextUrl = new URL(authorizationUrl.toString());\n\tfor (const [key, value] of Object.entries(params)) {\n\t\tif (reservedAuthorizationParams.has(key) || nextUrl.searchParams.has(key)) {\n\t\t\tthrow new Error(`OAuth authorizationParams.${key} cannot override an authorization flow parameter`);\n\t\t}\n\t\tnextUrl.searchParams.set(key, value);\n\t}\n\treturn nextUrl;\n}\n\n/** Callbacks for OAuth flow interactions */\nexport interface McpOAuthCallbacks {\n\tonRedirect: (url: URL) => void | Promise<void>;\n}\n\n/**\n * OAuth provider implementation for MCP servers.\n * Implements the OAuthClientProvider interface from the MCP SDK.\n */\nexport class McpOAuthProvider implements OAuthClientProvider {\n\tprivate readonly redirectUrlSnapshot: string | undefined;\n\tprivate active = true;\n\tprivate flowClientInfo: StoredClientInfo | undefined;\n\tprivate flowCodeVerifier: string | undefined;\n\tprivate flowDiscoveryState: OAuthDiscoveryState | undefined;\n\tprivate flowIssuerMismatch = false;\n\tprivate flowState: string | undefined;\n\tprivate serverName: string;\n\tprivate serverUrl: string;\n\tprivate config: McpOAuthConfig;\n\tprivate callbacks: McpOAuthCallbacks;\n\tprivate storageOptions: AuthStorageOptions;\n\tprivate runtimeSignal: AbortSignal | undefined;\n\n\tconstructor(\n\t\tserverName: string,\n\t\tserverUrl: string,\n\t\tconfig: McpOAuthConfig,\n\t\tcallbacks: McpOAuthCallbacks,\n\t\tstorageOptions: AuthStorageOptions = {},\n\t\truntimeSignal?: AbortSignal,\n\t\tinitialState?: string,\n\t) {\n\t\tthis.serverName = serverName;\n\t\tthis.serverUrl = serverUrl;\n\t\tthis.config = config;\n\t\tthis.callbacks = callbacks;\n\t\tthis.storageOptions = storageOptions;\n\t\tthis.runtimeSignal = runtimeSignal;\n\t\tthis.flowState = initialState;\n\t\tthis.redirectUrlSnapshot =\n\t\t\tconfig.grantType === \"client_credentials\"\n\t\t\t\t? undefined\n\t\t\t\t: (config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`);\n\t}\n\n\tprivate get usesClientCredentials(): boolean {\n\t\treturn this.config.grantType === \"client_credentials\";\n\t}\n\n\tprivate get discoveredIssuer(): string | undefined {\n\t\treturn (\n\t\t\tthis.flowDiscoveryState?.authorizationServerMetadata?.issuer ?? this.flowDiscoveryState?.authorizationServerUrl\n\t\t);\n\t}\n\n\tdeactivate(): void {\n\t\tthis.active = false;\n\t}\n\n\tprivate assertStoredIssuerBindings(entry: AuthEntry | undefined, issuer: string | undefined): void {\n\t\tif (this.flowIssuerMismatch) {\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`,\n\t\t\t);\n\t\t}\n\t\tif (!entry || !issuer) return;\n\n\t\tconst storedIssuers = [entry.clientInfo?.issuer, entry.tokens?.issuer].filter(\n\t\t\t(storedIssuer): storedIssuer is string => storedIssuer !== undefined,\n\t\t);\n\t\tif (storedIssuers.some((storedIssuer) => !issuersMatch(storedIssuer, issuer))) {\n\t\t\tthis.flowIssuerMismatch = true;\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`,\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate throwIfInactive(): void {\n\t\tif (!this.active) throw new Error(\"OAuth flow is no longer active\");\n\t\tthis.runtimeSignal?.throwIfAborted();\n\t}\n\n\t/**\n\t * The redirect URL for OAuth callbacks.\n\t * This must match the redirect_uri in client metadata.\n\t */\n\tget redirectUrl(): string | undefined {\n\t\treturn this.redirectUrlSnapshot;\n\t}\n\n\t/** Configured homepage, otherwise the Nexus repository. */\n\tprivate get clientUri(): string | undefined {\n\t\treturn this.config.clientUri ?? defaultClientUri();\n\t}\n\n\t/**\n\t * Client metadata for dynamic registration.\n\t * Describes this client to the OAuth authorization server.\n\t */\n\tget clientMetadata(): OAuthClientMetadata {\n\t\tif (this.usesClientCredentials) {\n\t\t\treturn {\n\t\t\t\tclient_name: this.config.clientName ?? defaultClientName(),\n\t\t\t\t...(this.clientUri !== undefined ? { client_uri: this.clientUri } : {}),\n\t\t\t\t...(this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {}),\n\t\t\t\tredirect_uris: [],\n\t\t\t\tgrant_types: [\"client_credentials\"],\n\t\t\t\ttoken_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n\t\t\t};\n\t\t}\n\n\t\tconst redirectUrl = this.redirectUrl;\n\t\tif (!redirectUrl) {\n\t\t\tthrow new Error(\"redirectUrl is required for authorization_code flow\");\n\t\t}\n\n\t\treturn {\n\t\t\tredirect_uris: [redirectUrl],\n\t\t\tclient_name: this.config.clientName ?? defaultClientName(),\n\t\t\t...(this.clientUri !== undefined ? { client_uri: this.clientUri } : {}),\n\t\t\t...(this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {}),\n\t\t\tgrant_types: [\"authorization_code\", \"refresh_token\"],\n\t\t\tresponse_types: [\"code\"],\n\t\t\ttoken_endpoint_auth_method: this.config.clientSecret ? \"client_secret_post\" : \"none\",\n\t\t\t...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),\n\t\t};\n\t}\n\n\t/**\n\t * Get client information (for pre-registered or dynamically registered clients).\n\t * Returns undefined if no client info exists or if the server URL has changed.\n\t */\n\tasync clientInformation(): Promise<OAuthClientInformationMixed | undefined> {\n\t\tconst issuer = this.discoveredIssuer;\n\t\tconst stored = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);\n\t\tthis.assertStoredIssuerBindings(stored, issuer);\n\n\t\t// Check config first (pre-registered client). Store only its issuer binding.\n\t\t// The configured secret stays in config and never enters the credential store.\n\t\tif (this.config.clientId) {\n\t\t\tconst storedClient = stored?.clientInfo?.clientId === this.config.clientId ? stored.clientInfo : undefined;\n\t\t\tif (issuer && (storedClient?.issuer !== issuer || storedClient.configPreRegistered !== true)) {\n\t\t\t\tupdateClientInfo(\n\t\t\t\t\tthis.serverName,\n\t\t\t\t\t{ clientId: this.config.clientId, issuer, configPreRegistered: true },\n\t\t\t\t\tthis.serverUrl,\n\t\t\t\t\tthis.storageOptions,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst clientSecret = this.config.clientSecret?.startsWith(\"!\")\n\t\t\t\t? resolveCommandSecret(this.config.clientSecret, `MCP server \"${this.serverName}\" OAuth clientSecret`)\n\t\t\t\t: this.config.clientSecret;\n\t\t\treturn {\n\t\t\t\tclient_id: this.config.clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\t...(issuer !== undefined ? { issuer } : {}),\n\t\t\t} as IssuerBoundClientInformation;\n\t\t}\n\n\t\t// Keep client registration associated with this in-flight flow even if\n\t\t// another runtime writes the shared persistent entry for the same name.\n\t\tconst clientInfo = this.flowClientInfo ?? stored?.clientInfo;\n\t\tif (clientInfo) {\n\t\t\t// A stored SEP-2352 issuer stub for a config-pre-registered client\n\t\t\t// (identified by its explicit marker) is only meaningful\n\t\t\t// when the config supplies the matching client secret. Since we reach\n\t\t\t// this branch only when config.clientId is absent, serving the stub\n\t\t\t// would let a token refresh go out with a client_id but no secret,\n\t\t\t// causing invalid_client and credential invalidation. Return undefined\n\t\t\t// so callers treat this as \"no client info\".\n\t\t\tconst isConfigStub = clientInfo.configPreRegistered === true;\n\t\t\tif (isConfigStub) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Check if client secret has expired\n\t\t\tif (clientInfo.clientSecretExpiresAt && clientInfo.clientSecretExpiresAt < Date.now() / 1000) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (issuer && clientInfo.issuer && !issuersMatch(clientInfo.issuer, issuer)) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (issuer && clientInfo.issuer === undefined) {\n\t\t\t\tclientInfo.issuer = issuer;\n\t\t\t\tthis.flowClientInfo = clientInfo;\n\t\t\t\tupdateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);\n\t\t\t}\n\t\t\t// Return all registration metadata and the local issuer extension.\n\t\t\t// This keeps the SDK OAuth view and the stored issuer binding consistent.\n\t\t\treturn {\n\t\t\t\tclient_id: clientInfo.clientId,\n\t\t\t\tclient_secret: clientInfo.clientSecret,\n\t\t\t\t...(clientInfo.clientIdIssuedAt !== undefined ? { client_id_issued_at: clientInfo.clientIdIssuedAt } : {}),\n\t\t\t\t...(clientInfo.clientSecretExpiresAt !== undefined\n\t\t\t\t\t? { client_secret_expires_at: clientInfo.clientSecretExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\t...(clientInfo.redirectUris !== undefined ? { redirect_uris: clientInfo.redirectUris } : {}),\n\t\t\t\t...(clientInfo.issuer !== undefined ? { issuer: clientInfo.issuer } : {}),\n\t\t\t} as IssuerBoundClientInformation;\n\t\t}\n\n\t\t// No client info or URL changed - will trigger dynamic registration\n\t\treturn undefined;\n\t}\n\n\t/**\n\t * Save client information from dynamic registration.\n\t */\n\tasync saveClientInformation(info: OAuthClientInformationMixed): Promise<void> {\n\t\tthis.throwIfInactive();\n\t\tconst issuer = this.discoveredIssuer ?? (info as IssuerBoundClientInformation).issuer;\n\t\tif (this.config.clientId && info.client_id === this.config.clientId) {\n\t\t\tupdateClientInfo(\n\t\t\t\tthis.serverName,\n\t\t\t\t{\n\t\t\t\t\tclientId: info.client_id,\n\t\t\t\t\t...(issuer !== undefined ? { issuer } : {}),\n\t\t\t\t\tconfigPreRegistered: true,\n\t\t\t\t},\n\t\t\t\tthis.serverUrl,\n\t\t\t\tthis.storageOptions,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\tconst redirectUris =\n\t\t\t(\"redirect_uris\" in info ? info.redirect_uris : undefined) ??\n\t\t\t(this.redirectUrl ? [this.redirectUrl] : undefined);\n\t\tconst clientInfo: StoredClientInfo = {\n\t\t\tclientId: info.client_id,\n\t\t\t...(info.client_secret !== undefined ? { clientSecret: info.client_secret } : {}),\n\t\t\t...(info.client_id_issued_at !== undefined ? { clientIdIssuedAt: info.client_id_issued_at } : {}),\n\t\t\t...(info.client_secret_expires_at !== undefined\n\t\t\t\t? { clientSecretExpiresAt: info.client_secret_expires_at }\n\t\t\t\t: {}),\n\t\t\t...(redirectUris !== undefined ? { redirectUris } : {}),\n\t\t\t...(issuer !== undefined ? { issuer } : {}),\n\t\t};\n\t\tthis.flowClientInfo = clientInfo;\n\t\tupdateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);\n\t}\n\n\t/**\n\t * Get stored OAuth tokens.\n\t * Returns undefined if no tokens exist or if the server URL has changed.\n\t */\n\tasync tokens(): Promise<OAuthTokens | undefined> {\n\t\t// Use getAuthForUrl to validate tokens are for the current server URL.\n\t\tconst entry = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);\n\t\tif (!entry?.tokens) return undefined;\n\t\tconst issuer = this.discoveredIssuer;\n\t\tthis.assertStoredIssuerBindings(entry, issuer);\n\t\tif (issuer && entry.tokens.issuer === undefined) {\n\t\t\tentry.tokens.issuer = issuer;\n\t\t\tupdateTokens(this.serverName, entry.tokens, this.serverUrl, this.storageOptions);\n\t\t}\n\n\t\treturn {\n\t\t\taccess_token: entry.tokens.accessToken,\n\t\t\ttoken_type: \"Bearer\",\n\t\t\trefresh_token: entry.tokens.refreshToken,\n\t\t\texpires_in:\n\t\t\t\tentry.tokens.expiresAt !== undefined\n\t\t\t\t\t? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1000))\n\t\t\t\t\t: undefined,\n\t\t\tscope: entry.tokens.scope,\n\t\t\t...(entry.tokens.issuer !== undefined ? { issuer: entry.tokens.issuer } : {}),\n\t\t} as IssuerBoundTokens;\n\t}\n\n\t/**\n\t * Save OAuth tokens.\n\t */\n\tasync saveTokens(tokens: OAuthTokens): Promise<void> {\n\t\tconst issuer = this.discoveredIssuer ?? (tokens as IssuerBoundTokens).issuer;\n\t\tconst storedTokens: StoredTokens = {\n\t\t\taccessToken: tokens.access_token,\n\t\t\t...(tokens.refresh_token !== undefined ? { refreshToken: tokens.refresh_token } : {}),\n\t\t\t// Preserve expiry even when expires_in is 0 (e.g. the SDK re-saving an\n\t\t\t// already-expired token) so expired tokens stay expired instead of\n\t\t\t// being persisted as never-expiring.\n\t\t\t...(tokens.expires_in !== undefined ? { expiresAt: Date.now() / 1000 + tokens.expires_in } : {}),\n\t\t\t...(tokens.scope !== undefined ? { scope: tokens.scope } : {}),\n\t\t\t...(issuer !== undefined ? { issuer } : {}),\n\t\t};\n\t\tthis.throwIfInactive();\n\t\tupdateTokens(this.serverName, storedTokens, this.serverUrl, this.storageOptions);\n\t\t// Discovery must survive the browser redirect so the callback can verify\n\t\t// the authorization server that minted the code. Once token issuance\n\t\t// succeeds, clear it so a later 401 re-reads PRM and can observe an\n\t\t// authorization-server migration.\n\t\tthis.flowDiscoveryState = undefined;\n\t}\n\n\t/**\n\t * Redirect the user to the authorization URL.\n\t * This opens the browser for the user to authenticate.\n\t *\n\t * Throws UnauthorizedError when called outside of a user-initiated flow\n\t * (no oauthState saved by startAuth). That path is reached when the SDK\n\t * falls through from a failed refresh into a fresh authorization_code\n\t * flow, which library hosts cannot complete in-process.\n\t */\n\tasync redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n\t\tif (this.usesClientCredentials) {\n\t\t\tthrow new Error(\"redirectToAuthorization is not used for client_credentials flow\");\n\t\t}\n\t\t// No flow-local state means we're on the post-refresh authorize fallback.\n\t\tthis.throwIfInactive();\n\t\tif (!this.flowState) {\n\t\t\tthrow new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);\n\t\t}\n\t\t// URL is passed to callback, not logged (may contain sensitive params)\n\t\tawait this.callbacks.onRedirect(addAuthorizationParams(authorizationUrl, this.config.authorizationParams));\n\t}\n\n\t/**\n\t * Save the PKCE code verifier.\n\t */\n\tasync saveCodeVerifier(codeVerifier: string): Promise<void> {\n\t\tthis.throwIfInactive();\n\t\tthis.flowCodeVerifier = codeVerifier;\n\t}\n\n\t/**\n\t * Get the stored PKCE code verifier.\n\t * @throws Error if no code verifier is stored\n\t */\n\tasync codeVerifier(): Promise<string> {\n\t\tif (this.usesClientCredentials) {\n\t\t\tthrow new Error(\"codeVerifier is not used for client_credentials flow\");\n\t\t}\n\t\tthis.throwIfInactive();\n\t\tif (!this.flowCodeVerifier) {\n\t\t\tthrow new Error(`No code verifier saved for MCP server: ${this.serverName}`);\n\t\t}\n\t\treturn this.flowCodeVerifier;\n\t}\n\n\t/**\n\t * Keep discovery with the in-flight PKCE verifier. The callback leg uses it\n\t * to validate the authorization response issuer before token exchange.\n\t */\n\tasync saveDiscoveryState(state: OAuthDiscoveryState): Promise<void> {\n\t\tthis.throwIfInactive();\n\t\tthis.flowDiscoveryState = structuredClone(state);\n\t}\n\n\tasync discoveryState(): Promise<OAuthDiscoveryState | undefined> {\n\t\tthis.throwIfInactive();\n\t\treturn this.flowDiscoveryState ? structuredClone(this.flowDiscoveryState) : undefined;\n\t}\n\n\t/**\n\t * Save the OAuth state parameter for CSRF protection.\n\t */\n\tasync saveState(state: string): Promise<void> {\n\t\tthis.throwIfInactive();\n\t\tthis.flowState = state;\n\t}\n\n\t/**\n\t * Get the stored OAuth state parameter.\n\t * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)\n\t */\n\tasync state(): Promise<string> {\n\t\tif (this.usesClientCredentials) {\n\t\t\tthrow new Error(\"state is not used for client_credentials flow\");\n\t\t}\n\t\tthis.throwIfInactive();\n\t\tif (!this.flowState) {\n\t\t\tthrow new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);\n\t\t}\n\t\treturn this.flowState;\n\t}\n\n\t/**\n\t * Invalidate credentials when authentication fails.\n\t * Clears tokens, client info, or all credentials based on the type.\n\t */\n\tasync invalidateCredentials(type: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\"): Promise<void> {\n\t\tthis.throwIfInactive();\n\t\tswitch (type) {\n\t\t\tcase \"all\":\n\t\t\t\tthis.flowClientInfo = undefined;\n\t\t\t\tthis.flowCodeVerifier = undefined;\n\t\t\t\tthis.flowDiscoveryState = undefined;\n\t\t\t\tthis.flowIssuerMismatch = false;\n\t\t\t\tthis.flowState = undefined;\n\t\t\t\tclearAllCredentials(this.serverName, this.storageOptions);\n\t\t\t\tbreak;\n\t\t\tcase \"client\":\n\t\t\t\tthis.flowClientInfo = undefined;\n\t\t\t\tclearClientInfo(this.serverName, this.storageOptions);\n\t\t\t\tbreak;\n\t\t\tcase \"tokens\":\n\t\t\t\tclearTokens(this.serverName, this.storageOptions);\n\t\t\t\tbreak;\n\t\t\tcase \"verifier\":\n\t\t\t\tclearCodeVerifier(this.serverName, this.storageOptions);\n\t\t\t\tbreak;\n\t\t\tcase \"discovery\":\n\t\t\t\tthis.flowDiscoveryState = undefined;\n\t\t\t\tbreak;\n\t\t}\n\t}\n\n\t/**\n\t * Adds configured authorization-code scope without replacing the SDK's\n\t * default token endpoint authentication behavior.\n\t */\n\taddClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {\n\t\tthis.throwIfInactive();\n\t\tif (params.get(\"grant_type\") === \"authorization_code\" && !params.has(\"scope\") && this.config.scope) {\n\t\t\tparams.set(\"scope\", this.config.scope);\n\t\t}\n\n\t\tconst clientInfo = await this.clientInformation();\n\t\tthis.throwIfInactive();\n\t\tif (!clientInfo) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];\n\t\tconst hasClientSecret = clientInfo.client_secret !== undefined;\n\t\tlet authMethod: \"client_secret_basic\" | \"client_secret_post\" | \"none\";\n\n\t\tif (supportedMethods.length === 0) {\n\t\t\tauthMethod = hasClientSecret ? \"client_secret_post\" : \"none\";\n\t\t} else if (hasClientSecret && supportedMethods.includes(\"client_secret_basic\")) {\n\t\t\tauthMethod = \"client_secret_basic\";\n\t\t} else if (hasClientSecret && supportedMethods.includes(\"client_secret_post\")) {\n\t\t\tauthMethod = \"client_secret_post\";\n\t\t} else if (supportedMethods.includes(\"none\")) {\n\t\t\tauthMethod = \"none\";\n\t\t} else {\n\t\t\tauthMethod = hasClientSecret ? \"client_secret_post\" : \"none\";\n\t\t}\n\n\t\tif (authMethod === \"client_secret_basic\") {\n\t\t\tif (!clientInfo.client_secret) {\n\t\t\t\tthrow new Error(\"client_secret_basic authentication requires a client_secret\");\n\t\t\t}\n\t\t\theaders.set(\n\t\t\t\t\"Authorization\",\n\t\t\t\t`Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString(\"base64\")}`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\tif (!params.has(\"client_id\")) {\n\t\t\tparams.set(\"client_id\", clientInfo.client_id);\n\t\t}\n\t\tif (authMethod === \"client_secret_post\" && clientInfo.client_secret && !params.has(\"client_secret\")) {\n\t\t\tparams.set(\"client_secret\", clientInfo.client_secret);\n\t\t}\n\t};\n\n\tprepareTokenRequest(scope?: string): URLSearchParams | undefined {\n\t\tif (!this.usesClientCredentials) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst params = new URLSearchParams({ grant_type: \"client_credentials\" });\n\t\tconst requestedScope = scope ?? this.config.scope;\n\t\tif (requestedScope) {\n\t\t\tparams.set(\"scope\", requestedScope);\n\t\t}\n\t\treturn params;\n\t}\n}\n\nexport { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };\n"]}

package/dist/extensions/mcp/mcp-output-guard.d.ts

@@ -0,0 +1,59 @@
+import type { ContentBlock, McpSettings } from "./types.ts";
+export declare const DEFAULT_MCP_OUTPUT_MAX_BYTES: number;
+export declare const DEFAULT_MCP_OUTPUT_MAX_LINES = 2000;
+export declare const DEFAULT_MCP_DETAILS_MAX_BYTES: number;
+export interface McpOutputGuardDetails {
+    truncated: true;
+    originalBytes: number;
+    returnedBytes: number;
+    originalLines: number;
+    returnedLines: number;
+    /** Number of image content blocks returned untouched alongside the truncated text. */
+    imageBlocksPassedThrough?: number;
+    fullOutputPath?: string;
+    writeError?: string;
+}
+export interface McpResultSummary {
+    omitted: true;
+    reason: string;
+    isError: boolean;
+    contentBlocks: number;
+    contentSummary: Array<Record<string, unknown>>;
+    structuredContent?: Record<string, unknown>;
+    meta?: Record<string, unknown>;
+    extraFields?: Array<Record<string, unknown>>;
+    rawResultBytes: number;
+    fullResultPath?: string;
+    resultWriteError?: string;
+}
+export interface McpOutputGuardOptions {
+    enabled?: boolean;
+    prefix?: string;
+    suffix?: string;
+    emptyTextFallback?: string;
+    maxBytes?: number;
+    maxLines?: number;
+    detailsMaxBytes?: number;
+    /**
+     * Raw MCP result to expose as details.mcpResult. Kept raw when its JSON
+     * fits detailsMaxBytes (or when the guard is disabled); otherwise replaced
+     * with a compact summary and spilled to a temp file. Omit for call sites
+     * whose details never carried the raw result (e.g. direct tools).
+     */
+    rawMcpResult?: unknown;
+}
+export interface GuardedMcpOutput {
+    content: ContentBlock[];
+    outputGuard?: McpOutputGuardDetails;
+    mcpResult?: unknown;
+}
+export declare function resolveMcpOutputGuardOptions(settings?: McpSettings): Pick<McpOutputGuardOptions, "enabled" | "maxBytes" | "maxLines" | "detailsMaxBytes">;
+/** Spread helper for tool-result details: includes mcpResult/outputGuard only when present. */
+export declare function guardedMcpDetails(guarded: GuardedMcpOutput): Record<string, unknown>;
+/**
+ * Bound model-facing MCP output. Text output is capped at maxBytes/maxLines and
+ * spilled to a temp file when oversized. Image blocks pass through untouched —
+ * they are delivered to the provider as native image content, not text context.
+ */
+export declare function guardMcpOutput(content: ContentBlock[], options?: McpOutputGuardOptions): Promise<GuardedMcpOutput>;
+//# sourceMappingURL=mcp-output-guard.d.ts.map