@ashx-j/lunr 0.1.0

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js

@@ -0,0 +1,482 @@
+// @ts-nocheck
+/**
+ * MCP Auth Flow
+ *
+ * High-level OAuth flow management using the MCP SDK's built-in auth functions.
+ */
+import { auth as runSdkAuth, UnauthorizedError, } from "@modelcontextprotocol/sdk/client/auth.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import open from "open";
+import { McpOAuthProvider } from "./mcp-oauth-provider.js";
+import { ensureCallbackServer, waitForCallback, cancelPendingCallback, stopCallbackServer, releaseCallbackServer, } from "./mcp-callback-server.js";
+import { getAuthForUrl, isTokenExpired, hasStoredTokens, clearAllCredentials, clearClientInfo, clearTokens, clearCodeVerifier, updateOAuthState, getOAuthState, clearOAuthState, } from "./mcp-auth.js";
+// Track pending transports for auth completion
+const pendingTransports = new Map();
+const pendingAuthStates = new Map();
+const pendingAuthCleanupTimers = new Map();
+// Deduplicate concurrent authenticate() calls per server.
+const pendingAuthentications = new Map();
+/** Timeout for manual auth completion (5 minutes) */
+const MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Generate a cryptographically secure random state parameter.
+ */
+function generateState() {
+    return Array.from(crypto.getRandomValues(new Uint8Array(32)))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+/**
+ * Extract OAuth configuration from a ServerEntry.
+ */
+export function extractOAuthConfig(definition) {
+    if (definition.oauth === false) {
+        return {};
+    }
+    const config = {};
+    if (definition.oauth?.grantType !== undefined)
+        config.grantType = definition.oauth.grantType;
+    if (definition.oauth?.clientId !== undefined)
+        config.clientId = definition.oauth.clientId;
+    if (definition.oauth?.clientSecret !== undefined)
+        config.clientSecret = definition.oauth.clientSecret;
+    if (definition.oauth?.scope !== undefined)
+        config.scope = definition.oauth.scope;
+    if (definition.oauth?.redirectUri !== undefined) {
+        if (typeof definition.oauth.redirectUri !== "string") {
+            throw new Error("OAuth redirectUri must be a string");
+        }
+        const redirectUri = definition.oauth.redirectUri.trim();
+        if (!redirectUri) {
+            throw new Error("OAuth redirectUri must not be empty");
+        }
+        config.redirectUri = redirectUri;
+    }
+    if (definition.oauth?.clientName !== undefined) {
+        if (typeof definition.oauth.clientName !== "string") {
+            throw new Error("OAuth clientName must be a string");
+        }
+        const clientName = definition.oauth.clientName.trim();
+        if (!clientName) {
+            throw new Error("OAuth clientName must not be empty");
+        }
+        config.clientName = clientName;
+    }
+    if (definition.oauth?.clientUri !== undefined) {
+        if (typeof definition.oauth.clientUri !== "string") {
+            throw new Error("OAuth clientUri must be a string");
+        }
+        const clientUri = definition.oauth.clientUri.trim();
+        if (!clientUri) {
+            throw new Error("OAuth clientUri must not be empty");
+        }
+        config.clientUri = clientUri;
+    }
+    return config;
+}
+function parseOAuthRedirectUri(redirectUri) {
+    let url;
+    try {
+        url = new URL(redirectUri);
+    }
+    catch (error) {
+        throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
+    }
+    const hostname = url.hostname.toLowerCase();
+    const isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+    if (url.protocol !== "http:" || !isLocalhost) {
+        throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI");
+    }
+    if (url.username || url.password) {
+        throw new Error("OAuth redirectUri must not include username or password");
+    }
+    if (url.hash) {
+        throw new Error("OAuth redirectUri must not include a fragment");
+    }
+    if (!url.port) {
+        throw new Error("OAuth redirectUri must include an explicit numeric port");
+    }
+    const port = Number.parseInt(url.port, 10);
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+        throw new Error("OAuth redirectUri must include an explicit numeric port");
+    }
+    const callbackHost = hostname === "[::1]" ? "::1" : hostname;
+    return { port, callbackHost, callbackPath: url.pathname };
+}
+/**
+ * Start OAuth authentication flow for a server.
+ * Returns the authorization URL when browser authorization is required.
+ */
+export async function startAuth(serverName, serverUrl, definition) {
+    const config = definition ? extractOAuthConfig(definition) : {};
+    if (config.grantType === "client_credentials") {
+        const storedAuth = await getAuthForUrl(serverName, serverUrl);
+        if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {
+            clearClientInfo(serverName);
+            clearCodeVerifier(serverName);
+            await clearOAuthState(serverName);
+        }
+        const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+            onRedirect: async () => {
+                throw new Error("Browser redirect is not used for client_credentials flow");
+            },
+        });
+        const result = await runSdkAuth(authProvider, { serverUrl });
+        if (result !== "AUTHORIZED") {
+            throw new UnauthorizedError("Failed to authorize");
+        }
+        return { authorizationUrl: "" };
+    }
+    const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined;
+    const oauthState = generateState();
+    try {
+        await ensureCallbackServer({
+            strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,
+            oauthState,
+            reserveState: true,
+            ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),
+        });
+    }
+    catch (error) {
+        await clearOAuthState(serverName);
+        throw error;
+    }
+    let capturedUrl;
+    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+        onRedirect: async (url) => {
+            capturedUrl = url;
+        },
+    });
+    try {
+        const storedAuth = await getAuthForUrl(serverName, serverUrl);
+        if (storedAuth?.clientInfo && !config.clientId) {
+            if (!storedAuth.tokens) {
+                clearClientInfo(serverName);
+                clearCodeVerifier(serverName);
+                await clearOAuthState(serverName);
+            }
+            else {
+                const redirectUris = storedAuth.clientInfo.redirectUris;
+                if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? "")) {
+                    clearClientInfo(serverName);
+                    clearTokens(serverName);
+                    clearCodeVerifier(serverName);
+                    await clearOAuthState(serverName);
+                }
+            }
+        }
+        await updateOAuthState(serverName, oauthState, serverUrl);
+        const result = await runSdkAuth(authProvider, { serverUrl });
+        if (result === "AUTHORIZED") {
+            releaseCallbackServer(oauthState);
+            await clearOAuthState(serverName);
+            return { authorizationUrl: "" };
+        }
+        if (!capturedUrl) {
+            throw new UnauthorizedError("OAuth authorization URL was not provided");
+        }
+        const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider });
+        await setPendingTransport(serverName, pendingTransport, oauthState);
+        return { authorizationUrl: capturedUrl.toString() };
+    }
+    catch (error) {
+        await clearPendingAuth(serverName, oauthState);
+        throw error;
+    }
+}
+async function setPendingTransport(serverName, transport, oauthState) {
+    await clearPendingAuth(serverName);
+    pendingTransports.set(serverName, transport);
+    pendingAuthStates.set(serverName, oauthState);
+    const cleanupTimer = setTimeout(() => {
+        void clearPendingAuth(serverName, oauthState);
+    }, MANUAL_AUTH_TIMEOUT_MS);
+    cleanupTimer.unref?.();
+    pendingAuthCleanupTimers.set(serverName, cleanupTimer);
+}
+async function clearPendingAuth(serverName, oauthState) {
+    const pendingState = pendingAuthStates.get(serverName);
+    if (oauthState && pendingState && pendingState !== oauthState)
+        return;
+    const timer = pendingAuthCleanupTimers.get(serverName);
+    if (timer) {
+        clearTimeout(timer);
+        pendingAuthCleanupTimers.delete(serverName);
+    }
+    const transport = pendingTransports.get(serverName);
+    pendingTransports.delete(serverName);
+    pendingAuthStates.delete(serverName);
+    const stateToRelease = pendingState ?? oauthState;
+    if (stateToRelease) {
+        releaseCallbackServer(stateToRelease);
+        const storedState = await getOAuthState(serverName);
+        if (storedState === stateToRelease) {
+            await clearOAuthState(serverName);
+        }
+    }
+    if (transport) {
+        await transport.close().catch(() => { });
+    }
+}
+function getSearchParamsFromInput(input) {
+    try {
+        const url = new URL(input);
+        const params = new URLSearchParams(url.search);
+        if (url.hash) {
+            const hash = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash;
+            const hashParams = new URLSearchParams(hash);
+            for (const [key, value] of hashParams) {
+                if (!params.has(key))
+                    params.set(key, value);
+            }
+        }
+        return params;
+    }
+    catch {
+        const query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input;
+        const params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query);
+        return params.has("code") || params.has("state") || params.has("error") ? params : undefined;
+    }
+}
+/**
+ * Extract an OAuth authorization code from either a raw code, a query string,
+ * or the full localhost redirect URL copied from the browser address bar.
+ */
+export function parseAuthorizationCodeInput(input, expectedState) {
+    const trimmed = input.trim();
+    if (!trimmed) {
+        throw new Error("Authorization code or redirect URL is required");
+    }
+    const params = getSearchParamsFromInput(trimmed);
+    if (params) {
+        const error = params.get("error");
+        if (error) {
+            const description = params.get("error_description");
+            throw new Error(description ? `${error}: ${description}` : error);
+        }
+        const state = params.get("state");
+        if (expectedState && !state) {
+            throw new Error("OAuth state missing from redirect URL");
+        }
+        if (expectedState && state !== expectedState) {
+            throw new Error("OAuth state mismatch - potential CSRF attack");
+        }
+        const code = params.get("code");
+        if (code)
+            return code;
+    }
+    if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {
+        return trimmed;
+    }
+    throw new Error("Could not find an OAuth authorization code in the provided input");
+}
+/**
+ * Complete OAuth authentication from manual user input.
+ */
+export async function completeAuthFromInput(serverName, input) {
+    const oauthState = await getOAuthState(serverName);
+    const code = parseAuthorizationCodeInput(input, oauthState);
+    return completeAuth(serverName, code);
+}
+/**
+ * Complete OAuth authentication with the authorization code.
+ */
+export async function completeAuth(serverName, authorizationCode) {
+    const transport = pendingTransports.get(serverName);
+    if (!transport) {
+        throw new Error(`No pending OAuth flow for server: ${serverName}`);
+    }
+    const oauthState = await getOAuthState(serverName);
+    try {
+        // Complete the auth using the transport's finishAuth method
+        await transport.finishAuth(authorizationCode);
+        return "authenticated";
+    }
+    finally {
+        await clearPendingAuth(serverName, oauthState);
+    }
+}
+/**
+ * Perform the complete OAuth authentication flow for a server.
+ *
+ * @param serverName - The name of the MCP server
+ * @param serverUrl - The URL of the MCP server
+ * @param definition - The server definition (optional)
+ * @returns The final auth status
+ */
+export async function authenticate(serverName, serverUrl, definition, options = {}) {
+    const inFlight = pendingAuthentications.get(serverName);
+    if (inFlight) {
+        return inFlight;
+    }
+    const operation = (async () => {
+        // Start auth flow
+        const { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
+        // If no auth URL needed, already authenticated
+        if (!authorizationUrl) {
+            return "authenticated";
+        }
+        // Get the state that was already generated and stored in startAuth()
+        const oauthState = await getOAuthState(serverName);
+        if (!oauthState) {
+            throw new Error("OAuth state not found - this should not happen");
+        }
+        // Register the callback BEFORE opening the browser
+        const callbackPromise = waitForCallback(oauthState);
+        try {
+            // Open browser. Always surface the URL first so remote/headless users can copy it
+            // even when the OS browser handoff is unavailable or invisible.
+            if (options.onAuthorizationUrl) {
+                await options.onAuthorizationUrl(authorizationUrl);
+            }
+            else {
+                console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\n${authorizationUrl}`);
+            }
+            try {
+                await open(authorizationUrl);
+            }
+            catch (error) {
+                console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
+            }
+            // Wait for callback
+            const code = await callbackPromise;
+            // Validate state
+            const storedState = await getOAuthState(serverName);
+            if (storedState !== oauthState) {
+                await clearOAuthState(serverName);
+                throw new Error("OAuth state mismatch - potential CSRF attack");
+            }
+            await clearOAuthState(serverName);
+            // Complete the auth
+            return await completeAuth(serverName, code);
+        }
+        catch (error) {
+            cancelPendingCallback(oauthState);
+            await clearPendingAuth(serverName, oauthState);
+            throw error;
+        }
+    })();
+    pendingAuthentications.set(serverName, operation);
+    try {
+        return await operation;
+    }
+    finally {
+        if (pendingAuthentications.get(serverName) === operation) {
+            pendingAuthentications.delete(serverName);
+        }
+    }
+}
+/**
+ * Get a valid access token for a server, refreshing if necessary.
+ *
+ * @param serverName - The name of the MCP server
+ * @param serverUrl - The URL of the MCP server
+ * @returns The valid tokens or null if not authenticated
+ */
+export async function getValidToken(serverName, serverUrl) {
+    // Check if we have valid tokens
+    const entry = await getAuthForUrl(serverName, serverUrl);
+    if (!entry?.tokens) {
+        return null;
+    }
+    // Check expiration
+    const expired = await isTokenExpired(serverName);
+    if (expired === false) {
+        return entry.tokens;
+    }
+    if (expired === true && entry.tokens.refreshToken) {
+        // Token is expired, try to refresh
+        console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`);
+        try {
+            // Create auth provider for token refresh
+            const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {
+                onRedirect: async () => { },
+            });
+            const clientInfo = await authProvider.clientInformation();
+            if (!clientInfo) {
+                console.log(`MCP Auth: No client info for refresh for ${serverName}`);
+                return null;
+            }
+            const result = await runSdkAuth(authProvider, { serverUrl });
+            if (result !== "AUTHORIZED") {
+                return null;
+            }
+            const refreshed = await getAuthForUrl(serverName, serverUrl);
+            return refreshed?.tokens ?? null;
+        }
+        catch (error) {
+            console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error });
+            return null;
+        }
+    }
+    // No expiration info or no refresh token, assume valid
+    return entry.tokens;
+}
+/**
+ * Check the authentication status for a server.
+ *
+ * @param serverName - The name of the MCP server
+ * @returns The current auth status
+ */
+export async function getAuthStatus(serverName) {
+    const hasTokens = await hasStoredTokens(serverName);
+    if (!hasTokens)
+        return "not_authenticated";
+    const expired = await isTokenExpired(serverName);
+    return expired ? "expired" : "authenticated";
+}
+/**
+ * Remove all OAuth credentials for a server.
+ *
+ * @param serverName - The name of the MCP server
+ */
+export async function removeAuth(serverName) {
+    const oauthState = await getOAuthState(serverName);
+    if (oauthState) {
+        cancelPendingCallback(oauthState);
+    }
+    await clearPendingAuth(serverName, oauthState);
+    clearAllCredentials(serverName);
+    await clearOAuthState(serverName);
+    console.log(`MCP Auth: Removed credentials for ${serverName}`);
+}
+/**
+ * Check if OAuth is supported for a server configuration.
+ * OAuth is supported for HTTP servers unless explicitly disabled.
+ *
+ * @param definition - The server definition
+ * @returns True if OAuth is supported
+ */
+export function supportsOAuth(definition) {
+    // OAuth requires a URL
+    if (!definition.url)
+        return false;
+    // Explicitly disabled via auth: false or oauth: false
+    if (definition.auth === false)
+        return false;
+    if (definition.oauth === false)
+        return false;
+    if (definition.auth === "oauth")
+        return true;
+    // Configured custom headers take precedence over implicit OAuth auto-detection.
+    if (definition.headers && Object.keys(definition.headers).length > 0)
+        return false;
+    // OAuth is enabled when auth is not specified (auto-detect)
+    return definition.auth === undefined;
+}
+/**
+ * Initialize the OAuth system on startup.
+ * OAuth callback binding is lazy and starts from startAuth() only.
+ */
+export async function initializeOAuth() { }
+/**
+ * Shutdown the OAuth system.
+ * Stops the callback server and cancels pending auths.
+ */
+export async function shutdownOAuth() {
+    for (const serverName of Array.from(pendingTransports.keys())) {
+        await clearPendingAuth(serverName);
+    }
+    await stopCallbackServer();
+}
+//# sourceMappingURL=mcp-auth-flow.js.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-flow.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;GAIG;AAEH,OAAO,EACL,IAAI,IAAI,UAAU,EAClB,iBAAiB,GAClB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,eAAe,GAEhB,MAAM,eAAe,CAAA;AAUtB,+CAA+C;AAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;AACnD,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAyC,CAAA;AAEjF,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA+B,CAAA;AAErE,qDAAqD;AACrD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5C;;GAEG;AACH,SAAS,aAAa,GAAW;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AAAA,CACZ;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAuB,EAAkB;IAC1E,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAA;IAC5F,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAA;IACzF,IAAI,UAAU,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAA;IACrG,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAA;IAChF,IAAI,UAAU,CAAC,KAAK,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAChD,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;IAClC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;IAChC,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;IAC9B,CAAC;IACD,OAAO,MAAM,CAAA;AAAA,CACd;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAgE;IAChH,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC3C,MAAM,WAAW,GAAG,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAA;IACtH,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;AAAA,CAC1D;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkB,EAClB,SAAiB,EACjB,UAAwB,EACe;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAE/D,IAAI,MAAM,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,UAAU,EAAE,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrE,eAAe,CAAC,UAAU,CAAC,CAAA;YAC3B,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC7B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YACvE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;YAAA,CAC5E;SACF,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAElC,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC;YACzB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YACxE,UAAU;YACV,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvJ,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;IAED,IAAI,WAA4B,CAAA;IAChC,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;QACvE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACzB,WAAW,GAAG,GAAG,CAAA;QAAA,CAClB;KACF,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,UAAU,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,eAAe,CAAC,UAAU,CAAC,CAAA;gBAC3B,iBAAiB,CAAC,UAAU,CAAC,CAAA;gBAC7B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAA;gBACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3F,eAAe,CAAC,UAAU,CAAC,CAAA;oBAC3B,WAAW,CAAC,UAAU,CAAC,CAAA;oBACvB,iBAAiB,CAAC,UAAU,CAAC,CAAA;oBAC7B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;QAEzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,qBAAqB,CAAC,UAAU,CAAC,CAAA;YACjC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;YACjC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAA;QACjC,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QAChG,MAAM,mBAAmB,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAA;QACnE,OAAO,EAAE,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAA;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;AAAA,CACF;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,SAAwC,EACxC,UAAkB,EACH;IACf,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAClC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAC5C,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QACpC,KAAK,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAAA,CAC9C,EAAE,sBAAsB,CAAC,CAAA;IAC1B,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,wBAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;AAAA,CACvD;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,UAAmB,EAAiB;IACtF,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACtD,IAAI,UAAU,IAAI,YAAY,IAAI,YAAY,KAAK,UAAU;QAAE,OAAM;IAErE,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACnD,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,YAAY,IAAI,UAAU,CAAA;IACjD,IAAI,cAAc,EAAE,CAAC;QACnB,qBAAqB,CAAC,cAAc,CAAC,CAAA;QACrC,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAA;IACzC,CAAC;AAAA,CACF;AAED,SAAS,wBAAwB,CAAC,KAAa,EAA+B;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;YACpE,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,aAAsB,EAAU;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,aAAa,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;IACvB,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;AAAA,CACpF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,KAAa,EACQ;IACrB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC3D,OAAO,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;AAAA,CACtC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,iBAAyB,EACJ;IACrB,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;IAElD,IAAI,CAAC;QACH,4DAA4D;QAC5D,MAAM,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;QAC7C,OAAO,eAAe,CAAA;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAChD,CAAC;AAAA,CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,UAAwB,EACxB,OAAO,GAAwB,EAAE,EACZ;IACrB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,KAAK,IAAyB,EAAE,CAAC;QAClD,kBAAkB;QAClB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QAE/E,+CAA+C;QAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QAED,mDAAmD;QACnD,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;QAEnD,IAAI,CAAC;YACH,kFAAkF;YAClF,gEAAgE;YAChE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;YACpD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,2CAA2C,UAAU,MAAM,gBAAgB,EAAE,CAAC,CAAA;YAC5F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,wCAAwC,UAAU,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5G,CAAC;YAED,oBAAoB;YACpB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAA;YAElC,iBAAiB;YACjB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;YACnD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;gBAC/B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;gBACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;YAEjC,oBAAoB;YACpB,OAAO,MAAM,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qBAAqB,CAAC,UAAU,CAAC,CAAA;YACjC,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YAC9C,MAAM,KAAK,CAAA;QACb,CAAC;IAAA,CACF,CAAC,EAAE,CAAA;IAEJ,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAA;IACxB,CAAC;YAAS,CAAC;QACT,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;AAAA,CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,SAAiB,EACa;IAC9B,gCAAgC;IAChC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAA;IACrB,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAClD,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,UAAU,sBAAsB,CAAC,CAAA;QAE5E,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;gBACnE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,EAAC,CAAC;aAC3B,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAA;YACzD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,4CAA4C,UAAU,EAAE,CAAC,CAAA;gBACrE,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YAC5D,OAAO,SAAS,EAAE,MAAM,IAAI,IAAI,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5E,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,OAAO,KAAK,CAAC,MAAM,CAAA;AAAA,CACpB;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAuB;IAC3E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO,mBAAmB,CAAA;IAE1C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAA;AAAA,CAC7C;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB,EAAiB;IAClE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAC9C,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC/B,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;AAAA,CAC/D;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAuB,EAAW;IAC9D,uBAAuB;IACvB,IAAI,CAAC,UAAU,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEjC,sDAAsD;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAE5C,gFAAgF;IAChF,IAAI,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAElF,4DAA4D;IAC5D,OAAO,UAAU,CAAC,IAAI,KAAK,SAAS,CAAA;AAAA,CACrC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,GAAkB,EAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,GAAkB;IACnD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,kBAAkB,EAAE,CAAA;AAAA,CAC3B","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Flow\n * \n * High-level OAuth flow management using the MCP SDK's built-in auth functions.\n */\n\nimport {\n  auth as runSdkAuth,\n  UnauthorizedError,\n} from \"@modelcontextprotocol/sdk/client/auth.js\"\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\"\nimport open from \"open\"\nimport { McpOAuthProvider, type McpOAuthConfig } from \"./mcp-oauth-provider.ts\"\nimport {\n  ensureCallbackServer,\n  waitForCallback,\n  cancelPendingCallback,\n  stopCallbackServer,\n  releaseCallbackServer,\n} from \"./mcp-callback-server.ts\"\nimport {\n  getAuthForUrl,\n  isTokenExpired,\n  hasStoredTokens,\n  clearAllCredentials,\n  clearClientInfo,\n  clearTokens,\n  clearCodeVerifier,\n  updateOAuthState,\n  getOAuthState,\n  clearOAuthState,\n  type StoredTokens,\n} from \"./mcp-auth.ts\"\nimport type { ServerEntry } from \"./types.ts\"\n\n/** Auth status for a server */\nexport type AuthStatus = \"authenticated\" | \"expired\" | \"not_authenticated\"\n\nexport interface AuthenticateOptions {\n  onAuthorizationUrl?: (authorizationUrl: string) => void | Promise<void>\n}\n\n// Track pending transports for auth completion\nconst pendingTransports = new Map<string, StreamableHTTPClientTransport>()\nconst pendingAuthStates = new Map<string, string>()\nconst pendingAuthCleanupTimers = new Map<string, ReturnType<typeof setTimeout>>()\n\n// Deduplicate concurrent authenticate() calls per server.\nconst pendingAuthentications = new Map<string, Promise<AuthStatus>>()\n\n/** Timeout for manual auth completion (5 minutes) */\nconst MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000\n\n/**\n * Generate a cryptographically secure random state parameter.\n */\nfunction generateState(): string {\n  return Array.from(crypto.getRandomValues(new Uint8Array(32)))\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\n/**\n * Extract OAuth configuration from a ServerEntry.\n */\nexport function extractOAuthConfig(definition: ServerEntry): McpOAuthConfig {\n  if (definition.oauth === false) {\n    return {}\n  }\n\n  const config: McpOAuthConfig = {}\n  if (definition.oauth?.grantType !== undefined) config.grantType = definition.oauth.grantType\n  if (definition.oauth?.clientId !== undefined) config.clientId = definition.oauth.clientId\n  if (definition.oauth?.clientSecret !== undefined) config.clientSecret = definition.oauth.clientSecret\n  if (definition.oauth?.scope !== undefined) config.scope = definition.oauth.scope\n  if (definition.oauth?.redirectUri !== undefined) {\n    if (typeof definition.oauth.redirectUri !== \"string\") {\n      throw new Error(\"OAuth redirectUri must be a string\")\n    }\n    const redirectUri = definition.oauth.redirectUri.trim()\n    if (!redirectUri) {\n      throw new Error(\"OAuth redirectUri must not be empty\")\n    }\n    config.redirectUri = redirectUri\n  }\n  if (definition.oauth?.clientName !== undefined) {\n    if (typeof definition.oauth.clientName !== \"string\") {\n      throw new Error(\"OAuth clientName must be a string\")\n    }\n    const clientName = definition.oauth.clientName.trim()\n    if (!clientName) {\n      throw new Error(\"OAuth clientName must not be empty\")\n    }\n    config.clientName = clientName\n  }\n  if (definition.oauth?.clientUri !== undefined) {\n    if (typeof definition.oauth.clientUri !== \"string\") {\n      throw new Error(\"OAuth clientUri must be a string\")\n    }\n    const clientUri = definition.oauth.clientUri.trim()\n    if (!clientUri) {\n      throw new Error(\"OAuth clientUri must not be empty\")\n    }\n    config.clientUri = clientUri\n  }\n  return config\n}\n\nfunction parseOAuthRedirectUri(redirectUri: string): { port: number; callbackHost: string; callbackPath: string } {\n  let url: URL\n  try {\n    url = new URL(redirectUri)\n  } catch (error) {\n    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error })\n  }\n\n  const hostname = url.hostname.toLowerCase()\n  const isLocalhost = hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\"\n  if (url.protocol !== \"http:\" || !isLocalhost) {\n    throw new Error(\"OAuth redirectUri must be an http:// localhost or loopback URI\")\n  }\n\n  if (url.username || url.password) {\n    throw new Error(\"OAuth redirectUri must not include username or password\")\n  }\n\n  if (url.hash) {\n    throw new Error(\"OAuth redirectUri must not include a fragment\")\n  }\n\n  if (!url.port) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const port = Number.parseInt(url.port, 10)\n  if (!Number.isInteger(port) || port <= 0 || port > 65535) {\n    throw new Error(\"OAuth redirectUri must include an explicit numeric port\")\n  }\n\n  const callbackHost = hostname === \"[::1]\" ? \"::1\" : hostname\n  return { port, callbackHost, callbackPath: url.pathname }\n}\n\n/**\n * Start OAuth authentication flow for a server.\n * Returns the authorization URL when browser authorization is required.\n */\nexport async function startAuth(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry\n): Promise<{ authorizationUrl: string }> {\n  const config = definition ? extractOAuthConfig(definition) : {}\n\n  if (config.grantType === \"client_credentials\") {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId) {\n      clearClientInfo(serverName)\n      clearCodeVerifier(serverName)\n      await clearOAuthState(serverName)\n    }\n\n    const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n      onRedirect: async () => {\n        throw new Error(\"Browser redirect is not used for client_credentials flow\")\n      },\n    })\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result !== \"AUTHORIZED\") {\n      throw new UnauthorizedError(\"Failed to authorize\")\n    }\n    return { authorizationUrl: \"\" }\n  }\n\n  const redirectCallback = config.redirectUri !== undefined ? parseOAuthRedirectUri(config.redirectUri) : undefined\n  const oauthState = generateState()\n\n  try {\n    await ensureCallbackServer({\n      strictPort: Boolean(config.clientId) || config.redirectUri !== undefined,\n      oauthState,\n      reserveState: true,\n      ...(redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}),\n    })\n  } catch (error) {\n    await clearOAuthState(serverName)\n    throw error\n  }\n\n  let capturedUrl: URL | undefined\n  const authProvider = new McpOAuthProvider(serverName, serverUrl, config, {\n    onRedirect: async (url) => {\n      capturedUrl = url\n    },\n  })\n\n  try {\n    const storedAuth = await getAuthForUrl(serverName, serverUrl)\n    if (storedAuth?.clientInfo && !config.clientId) {\n      if (!storedAuth.tokens) {\n        clearClientInfo(serverName)\n        clearCodeVerifier(serverName)\n        await clearOAuthState(serverName)\n      } else {\n        const redirectUris = storedAuth.clientInfo.redirectUris\n        if (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? \"\")) {\n          clearClientInfo(serverName)\n          clearTokens(serverName)\n          clearCodeVerifier(serverName)\n          await clearOAuthState(serverName)\n        }\n      }\n    }\n\n    await updateOAuthState(serverName, oauthState, serverUrl)\n\n    const result = await runSdkAuth(authProvider, { serverUrl })\n    if (result === \"AUTHORIZED\") {\n      releaseCallbackServer(oauthState)\n      await clearOAuthState(serverName)\n      return { authorizationUrl: \"\" }\n    }\n    if (!capturedUrl) {\n      throw new UnauthorizedError(\"OAuth authorization URL was not provided\")\n    }\n    const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider })\n    await setPendingTransport(serverName, pendingTransport, oauthState)\n    return { authorizationUrl: capturedUrl.toString() }\n  } catch (error) {\n    await clearPendingAuth(serverName, oauthState)\n    throw error\n  }\n}\n\nasync function setPendingTransport(\n  serverName: string,\n  transport: StreamableHTTPClientTransport,\n  oauthState: string,\n): Promise<void> {\n  await clearPendingAuth(serverName)\n  pendingTransports.set(serverName, transport)\n  pendingAuthStates.set(serverName, oauthState)\n  const cleanupTimer = setTimeout(() => {\n    void clearPendingAuth(serverName, oauthState)\n  }, MANUAL_AUTH_TIMEOUT_MS)\n  cleanupTimer.unref?.()\n  pendingAuthCleanupTimers.set(serverName, cleanupTimer)\n}\n\nasync function clearPendingAuth(serverName: string, oauthState?: string): Promise<void> {\n  const pendingState = pendingAuthStates.get(serverName)\n  if (oauthState && pendingState && pendingState !== oauthState) return\n\n  const timer = pendingAuthCleanupTimers.get(serverName)\n  if (timer) {\n    clearTimeout(timer)\n    pendingAuthCleanupTimers.delete(serverName)\n  }\n\n  const transport = pendingTransports.get(serverName)\n  pendingTransports.delete(serverName)\n  pendingAuthStates.delete(serverName)\n  const stateToRelease = pendingState ?? oauthState\n  if (stateToRelease) {\n    releaseCallbackServer(stateToRelease)\n    const storedState = await getOAuthState(serverName)\n    if (storedState === stateToRelease) {\n      await clearOAuthState(serverName)\n    }\n  }\n  if (transport) {\n    await transport.close().catch(() => {})\n  }\n}\n\nfunction getSearchParamsFromInput(input: string): URLSearchParams | undefined {\n  try {\n    const url = new URL(input)\n    const params = new URLSearchParams(url.search)\n    if (url.hash) {\n      const hash = url.hash.startsWith(\"#\") ? url.hash.slice(1) : url.hash\n      const hashParams = new URLSearchParams(hash)\n      for (const [key, value] of hashParams) {\n        if (!params.has(key)) params.set(key, value)\n      }\n    }\n    return params\n  } catch {\n    const query = input.includes(\"?\") ? input.slice(input.indexOf(\"?\") + 1) : input\n    const params = new URLSearchParams(query.startsWith(\"#\") ? query.slice(1) : query)\n    return params.has(\"code\") || params.has(\"state\") || params.has(\"error\") ? params : undefined\n  }\n}\n\n/**\n * Extract an OAuth authorization code from either a raw code, a query string,\n * or the full localhost redirect URL copied from the browser address bar.\n */\nexport function parseAuthorizationCodeInput(input: string, expectedState?: string): string {\n  const trimmed = input.trim()\n  if (!trimmed) {\n    throw new Error(\"Authorization code or redirect URL is required\")\n  }\n\n  const params = getSearchParamsFromInput(trimmed)\n  if (params) {\n    const error = params.get(\"error\")\n    if (error) {\n      const description = params.get(\"error_description\")\n      throw new Error(description ? `${error}: ${description}` : error)\n    }\n\n    const state = params.get(\"state\")\n    if (expectedState && !state) {\n      throw new Error(\"OAuth state missing from redirect URL\")\n    }\n    if (expectedState && state !== expectedState) {\n      throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n    }\n\n    const code = params.get(\"code\")\n    if (code) return code\n  }\n\n  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {\n    return trimmed\n  }\n\n  throw new Error(\"Could not find an OAuth authorization code in the provided input\")\n}\n\n/**\n * Complete OAuth authentication from manual user input.\n */\nexport async function completeAuthFromInput(\n  serverName: string,\n  input: string,\n): Promise<AuthStatus> {\n  const oauthState = await getOAuthState(serverName)\n  const code = parseAuthorizationCodeInput(input, oauthState)\n  return completeAuth(serverName, code)\n}\n\n/**\n * Complete OAuth authentication with the authorization code.\n */\nexport async function completeAuth(\n  serverName: string,\n  authorizationCode: string\n): Promise<AuthStatus> {\n  const transport = pendingTransports.get(serverName)\n  if (!transport) {\n    throw new Error(`No pending OAuth flow for server: ${serverName}`)\n  }\n\n  const oauthState = await getOAuthState(serverName)\n\n  try {\n    // Complete the auth using the transport's finishAuth method\n    await transport.finishAuth(authorizationCode)\n    return \"authenticated\"\n  } finally {\n    await clearPendingAuth(serverName, oauthState)\n  }\n}\n\n/**\n * Perform the complete OAuth authentication flow for a server.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server  \n * @param definition - The server definition (optional)\n * @returns The final auth status\n */\nexport async function authenticate(\n  serverName: string,\n  serverUrl: string,\n  definition?: ServerEntry,\n  options: AuthenticateOptions = {},\n): Promise<AuthStatus> {\n  const inFlight = pendingAuthentications.get(serverName)\n  if (inFlight) {\n    return inFlight\n  }\n\n  const operation = (async (): Promise<AuthStatus> => {\n    // Start auth flow\n    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)\n\n    // If no auth URL needed, already authenticated\n    if (!authorizationUrl) {\n      return \"authenticated\"\n    }\n\n    // Get the state that was already generated and stored in startAuth()\n    const oauthState = await getOAuthState(serverName)\n    if (!oauthState) {\n      throw new Error(\"OAuth state not found - this should not happen\")\n    }\n\n    // Register the callback BEFORE opening the browser\n    const callbackPromise = waitForCallback(oauthState)\n\n    try {\n      // Open browser. Always surface the URL first so remote/headless users can copy it\n      // even when the OS browser handoff is unavailable or invisible.\n      if (options.onAuthorizationUrl) {\n        await options.onAuthorizationUrl(authorizationUrl)\n      } else {\n        console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\\n${authorizationUrl}`)\n      }\n      try {\n        await open(authorizationUrl)\n      } catch (error) {\n        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })\n      }\n\n      // Wait for callback\n      const code = await callbackPromise\n\n      // Validate state\n      const storedState = await getOAuthState(serverName)\n      if (storedState !== oauthState) {\n        await clearOAuthState(serverName)\n        throw new Error(\"OAuth state mismatch - potential CSRF attack\")\n      }\n      await clearOAuthState(serverName)\n\n      // Complete the auth\n      return await completeAuth(serverName, code)\n    } catch (error) {\n      cancelPendingCallback(oauthState)\n      await clearPendingAuth(serverName, oauthState)\n      throw error\n    }\n  })()\n\n  pendingAuthentications.set(serverName, operation)\n\n  try {\n    return await operation\n  } finally {\n    if (pendingAuthentications.get(serverName) === operation) {\n      pendingAuthentications.delete(serverName)\n    }\n  }\n}\n\n/**\n * Get a valid access token for a server, refreshing if necessary.\n * \n * @param serverName - The name of the MCP server\n * @param serverUrl - The URL of the MCP server\n * @returns The valid tokens or null if not authenticated\n */\nexport async function getValidToken(\n  serverName: string,\n  serverUrl: string,\n): Promise<StoredTokens | null> {\n  // Check if we have valid tokens\n  const entry = await getAuthForUrl(serverName, serverUrl)\n  if (!entry?.tokens) {\n    return null\n  }\n\n  // Check expiration\n  const expired = await isTokenExpired(serverName)\n  if (expired === false) {\n    return entry.tokens\n  }\n\n  if (expired === true && entry.tokens.refreshToken) {\n    // Token is expired, try to refresh\n    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`)\n\n    try {\n      // Create auth provider for token refresh\n      const authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {\n        onRedirect: async () => {},\n      })\n\n      const clientInfo = await authProvider.clientInformation()\n      if (!clientInfo) {\n        console.log(`MCP Auth: No client info for refresh for ${serverName}`)\n        return null\n      }\n\n      const result = await runSdkAuth(authProvider, { serverUrl })\n      if (result !== \"AUTHORIZED\") {\n        return null\n      }\n      const refreshed = await getAuthForUrl(serverName, serverUrl)\n      return refreshed?.tokens ?? null\n    } catch (error) {\n      console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error })\n      return null\n    }\n  }\n\n  // No expiration info or no refresh token, assume valid\n  return entry.tokens\n}\n\n/**\n * Check the authentication status for a server.\n * \n * @param serverName - The name of the MCP server\n * @returns The current auth status\n */\nexport async function getAuthStatus(serverName: string): Promise<AuthStatus> {\n  const hasTokens = await hasStoredTokens(serverName)\n  if (!hasTokens) return \"not_authenticated\"\n\n  const expired = await isTokenExpired(serverName)\n  return expired ? \"expired\" : \"authenticated\"\n}\n\n/**\n * Remove all OAuth credentials for a server.\n * \n * @param serverName - The name of the MCP server\n */\nexport async function removeAuth(serverName: string): Promise<void> {\n  const oauthState = await getOAuthState(serverName)\n  if (oauthState) {\n    cancelPendingCallback(oauthState)\n  }\n  await clearPendingAuth(serverName, oauthState)\n  clearAllCredentials(serverName)\n  await clearOAuthState(serverName)\n  console.log(`MCP Auth: Removed credentials for ${serverName}`)\n}\n\n/**\n * Check if OAuth is supported for a server configuration.\n * OAuth is supported for HTTP servers unless explicitly disabled.\n * \n * @param definition - The server definition\n * @returns True if OAuth is supported\n */\nexport function supportsOAuth(definition: ServerEntry): boolean {\n  // OAuth requires a URL\n  if (!definition.url) return false\n  \n  // Explicitly disabled via auth: false or oauth: false\n  if (definition.auth === false) return false\n  if (definition.oauth === false) return false\n  if (definition.auth === \"oauth\") return true\n  \n  // Configured custom headers take precedence over implicit OAuth auto-detection.\n  if (definition.headers && Object.keys(definition.headers).length > 0) return false\n\n  // OAuth is enabled when auth is not specified (auto-detect)\n  return definition.auth === undefined\n}\n\n/**\n * Initialize the OAuth system on startup.\n * OAuth callback binding is lazy and starts from startAuth() only.\n */\nexport async function initializeOAuth(): Promise<void> {}\n\n/**\n * Shutdown the OAuth system.\n * Stops the callback server and cancels pending auths.\n */\nexport async function shutdownOAuth(): Promise<void> {\n  for (const serverName of Array.from(pendingTransports.keys())) {\n    await clearPendingAuth(serverName)\n  }\n  await stopCallbackServer()\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.d.ts

@@ -0,0 +1,104 @@
+/**
+ * MCP Auth Storage Module
+ *
+ * Handles secure storage of OAuth credentials, tokens, client information,
+ * and PKCE state for MCP servers.
+ *
+ * Token storage location: $MCP_OAUTH_DIR/sha256-<server-hash>/tokens.json when set,
+ * otherwise <Pi agent dir>/mcp-oauth/sha256-<server-hash>/tokens.json
+ */
+/** OAuth token storage format */
+export interface StoredTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    scope?: string;
+}
+/** OAuth client information from dynamic or static registration */
+export interface StoredClientInfo {
+    clientId: string;
+    clientSecret?: string;
+    clientIdIssuedAt?: number;
+    clientSecretExpiresAt?: number;
+    redirectUris?: string[];
+}
+/** Complete auth entry for a server */
+export interface AuthEntry {
+    tokens?: StoredTokens;
+    clientInfo?: StoredClientInfo;
+    codeVerifier?: string;
+    oauthState?: string;
+    serverUrl?: string;
+}
+/**
+ * Get the tokens file path for a server.
+ */
+export declare function getAuthEntryFilePath(serverName: string): string;
+/**
+ * Get auth entry for a server.
+ */
+export declare function getAuthEntry(serverName: string): AuthEntry | undefined;
+/**
+ * Get auth entry and validate it's for the correct URL.
+ * Returns undefined if URL has changed (credentials are invalid).
+ */
+export declare function getAuthForUrl(serverName: string, serverUrl: string): AuthEntry | undefined;
+/**
+ * Save auth entry for a server.
+ */
+export declare function saveAuthEntry(serverName: string, entry: AuthEntry, serverUrl?: string): void;
+/**
+ * Remove auth entry for a server.
+ * Also removes the server directory if empty.
+ */
+export declare function removeAuthEntry(serverName: string): void;
+/**
+ * Update tokens for a server.
+ */
+export declare function updateTokens(serverName: string, tokens: StoredTokens, serverUrl?: string): void;
+/**
+ * Update client info for a server.
+ */
+export declare function updateClientInfo(serverName: string, clientInfo: StoredClientInfo, serverUrl?: string): void;
+/**
+ * Update code verifier for a server.
+ */
+export declare function updateCodeVerifier(serverName: string, codeVerifier: string, serverUrl?: string): void;
+/**
+ * Clear code verifier for a server.
+ */
+export declare function clearCodeVerifier(serverName: string): void;
+/**
+ * Update OAuth state for a server.
+ */
+export declare function updateOAuthState(serverName: string, state: string, serverUrl?: string): void;
+/**
+ * Get OAuth state for a server.
+ */
+export declare function getOAuthState(serverName: string): string | undefined;
+/**
+ * Clear OAuth state for a server.
+ */
+export declare function clearOAuthState(serverName: string): void;
+/**
+ * Check if stored tokens are expired.
+ * Returns null if no tokens exist, false if no expiry or not expired, true if expired.
+ */
+export declare function isTokenExpired(serverName: string): boolean | null;
+/**
+ * Check if a server has stored tokens.
+ */
+export declare function hasStoredTokens(serverName: string): boolean;
+/**
+ * Clear all credentials for a server.
+ */
+export declare function clearAllCredentials(serverName: string): void;
+/**
+ * Clear only client info for a server.
+ */
+export declare function clearClientInfo(serverName: string): void;
+/**
+ * Clear only tokens for a server.
+ */
+export declare function clearTokens(serverName: string): void;
+//# sourceMappingURL=mcp-auth.d.ts.map