@axtary/cli 0.1.0 → 0.2.0

package/dist/mcp-fs-normalize.d.ts

@@ -0,0 +1,18 @@
+/** Read-only filesystem tools → the input field holding the path. */
+export declare const MCP_FS_READ_TOOLS: Record<string, string>;
+/** Mutating filesystem tools → the input field holding the path. */
+export declare const MCP_FS_WRITE_TOOLS: Record<string, string>;
+/**
+ * An MCP tool may be presented bare (`read_text_file`) or namespaced by the
+ * server (`filesystem.read_text_file`, `mcp__fs__read_text_file`); match on the
+ * trailing segment so a recognized tool is governed either way.
+ */
+export declare function baseMcpToolName(toolName: string): string;
+export type McpFilesystemToolClass = {
+    kind: "read" | "write";
+    /** Input field holding the path argument. */
+    pathField: string;
+};
+/** Classify an MCP tool name as a filesystem read/write, or null if unknown. */
+export declare function classifyMcpFilesystemTool(toolName: string): McpFilesystemToolClass | null;
+//# sourceMappingURL=mcp-fs-normalize.d.ts.map

package/dist/mcp-fs-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-fs-normalize.d.ts","sourceRoot":"","sources":["../src/mcp-fs-normalize.ts"],"names":[],"mappings":"AAMA,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKpD,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIrD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gFAAgF;AAChF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,GACf,sBAAsB,GAAG,IAAI,CAS/B"}

package/dist/mcp-fs-normalize.js

@@ -0,0 +1,39 @@
+// Shared classification of MCP filesystem-server tool calls, used by the Cursor
+// and Codex runtime-hook adapters so the recognized (security-relevant) tool
+// list lives in exactly one place. Tool names verified against the official
+// @modelcontextprotocol/server-filesystem README (2026-06-26): the old
+// `read_file` was renamed to `read_text_file`; the path argument is `"path"`.
+/** Read-only filesystem tools → the input field holding the path. */
+export const MCP_FS_READ_TOOLS = {
+    read_text_file: "path",
+    read_media_file: "path",
+    read_file: "path",
+    get_file_info: "path",
+};
+/** Mutating filesystem tools → the input field holding the path. */
+export const MCP_FS_WRITE_TOOLS = {
+    write_file: "path",
+    edit_file: "path",
+    create_directory: "path",
+};
+/**
+ * An MCP tool may be presented bare (`read_text_file`) or namespaced by the
+ * server (`filesystem.read_text_file`, `mcp__fs__read_text_file`); match on the
+ * trailing segment so a recognized tool is governed either way.
+ */
+export function baseMcpToolName(toolName) {
+    const segments = toolName.split(/__|[./]/);
+    return segments[segments.length - 1] ?? toolName;
+}
+/** Classify an MCP tool name as a filesystem read/write, or null if unknown. */
+export function classifyMcpFilesystemTool(toolName) {
+    const base = baseMcpToolName(toolName);
+    if (MCP_FS_READ_TOOLS[base]) {
+        return { kind: "read", pathField: MCP_FS_READ_TOOLS[base] };
+    }
+    if (MCP_FS_WRITE_TOOLS[base]) {
+        return { kind: "write", pathField: MCP_FS_WRITE_TOOLS[base] };
+    }
+    return null;
+}
+//# sourceMappingURL=mcp-fs-normalize.js.map

package/dist/mcp-fs-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-fs-normalize.js","sourceRoot":"","sources":["../src/mcp-fs-normalize.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,8EAA8E;AAE9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,cAAc,EAAE,MAAM;IACtB,eAAe,EAAE,MAAM;IACvB,SAAS,EAAE,MAAM;IACjB,aAAa,EAAE,MAAM;CACtB,CAAC;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC;AACnD,CAAC;AAQD,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CACvC,QAAgB;IAEhB,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAE,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp-oauth.d.ts

@@ -0,0 +1,67 @@
+import { type CredentialStore, type StoredCredential } from "./credentials.js";
+export declare const MCP_OAUTH_CLIENT_NAME = "axtary-mcp-wrapper";
+/** Stable credential-broker key for a remote MCP server, by canonical resource URI. */
+export declare function mcpOAuthProviderKey(wrapUrl: string): string;
+export type McpOAuthLoginInput = {
+    wrapUrl: string;
+    scopes?: string[];
+    /** A pre-registered client id; skips Dynamic Client Registration. */
+    clientId?: string;
+    clientSecret?: string;
+    redirectPort?: number;
+    store?: CredentialStore;
+    fetch?: typeof fetch;
+    openBrowser?: (url: string) => void | Promise<void>;
+    stdout?: (text: string) => void;
+    now?: () => number;
+    randomState?: () => string;
+    pkceVerifier?: () => string;
+    timeoutMs?: number;
+    onListening?: (port: number) => void;
+};
+export type McpOAuthLoginResult = {
+    resource: string;
+    issuer: string;
+    authMethod: "dynamic_registration" | "preregistered_client";
+    scopes: string[];
+    expiresAt: string | null;
+    account: string | null;
+    secretBackend: StoredCredential["secretBackend"];
+};
+export declare function runMcpLogin(input: McpOAuthLoginInput): Promise<McpOAuthLoginResult>;
+export declare function runMcpLogout(input: {
+    wrapUrl: string;
+    store?: CredentialStore;
+}): Promise<{
+    resource: string;
+    removed: boolean;
+}>;
+export type McpOAuthSession = {
+    resource: string;
+    issuer: string | null;
+    scopes: string[];
+    expiresAt: string | null;
+    status: "live" | "stale";
+    account: string | null;
+};
+/** List remote-MCP OAuth sessions from the broker — metadata only, never tokens. */
+export declare function runMcpSessions(input?: {
+    store?: CredentialStore;
+    now?: number;
+}): Promise<McpOAuthSession[]>;
+/**
+ * Resolve the `Authorization: Bearer` header for a remote MCP server from the
+ * broker, refreshing a lapsed token when a refresh token and token endpoint are
+ * available. Fails closed with an actionable error when no session exists or a
+ * stale session cannot be refreshed — the bearer is never invented.
+ */
+export declare function resolveMcpOAuthAuthorization(input: {
+    wrapUrl: string;
+    store?: CredentialStore;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): Promise<{
+    authorization: string;
+    resource: string;
+}>;
+//# sourceMappingURL=mcp-oauth.d.ts.map

package/dist/mcp-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../src/mcp-oauth.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAoB1B,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAE1D,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;IAC5D,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;CAClD,CAAC;AAgCF,wBAAsB,WAAW,CAC/B,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAgJ9B;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAIlD;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,oFAAoF;AACpF,wBAAsB,cAAc,CAAC,KAAK,GAAE;IAC1C,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACT,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAiBlC;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuDvD"}

package/dist/mcp-oauth.js

@@ -0,0 +1,242 @@
+import { buildAuthorizationUrl, canonicalResourceUri, createOAuthState, createPkcePair, discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata, exchangeAuthorizationCode, refreshAccessToken, registerOAuthClient, } from "@axtary/mcp";
+import { credentialExpired, loadCredentialStore, } from "./credentials.js";
+import { captureAuthorizationCode, defaultOpenBrowser, listen, DEFAULT_OAUTH_REDIRECT_PATH, DEFAULT_OAUTH_REDIRECT_PORT, } from "./oauth.js";
+// Remote-MCP OAuth, wired to the local credential broker.
+//
+// `axtary mcp login --wrap-url <https url>` discovers the server's authorization
+// server (RFC 9728 → RFC 8414), registers a public PKCE client when the server
+// supports Dynamic Client Registration (RFC 7591), runs the loopback consent
+// flow, and stores the resulting bearer + refresh token in the same 0600/keychain
+// broker as native connectors. The token never leaves the enforcement plane: it
+// lives only in the broker and the upstream request header — never in pins, the
+// ledger, status output, or the dashboard. `axtary mcp serve --oauth` then
+// resolves (and refreshes) that bearer when connecting upstream.
+export const MCP_OAUTH_CLIENT_NAME = "axtary-mcp-wrapper";
+/** Stable credential-broker key for a remote MCP server, by canonical resource URI. */
+export function mcpOAuthProviderKey(wrapUrl) {
+    return `mcp-remote:${canonicalResourceUri(wrapUrl)}`;
+}
+/**
+ * Probe the MCP endpoint to recover the `WWW-Authenticate` header from a 401, so
+ * discovery can prefer the advertised `resource_metadata` URL. Best-effort: a
+ * server that does not 401 (or any transport error) simply yields no header and
+ * discovery falls back to the well-known path.
+ */
+async function probeWwwAuthenticate(wrapUrl, fetchImpl, timeoutMs) {
+    try {
+        const response = await fetchImpl(wrapUrl, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: "axtary_oauth_probe",
+                method: "ping",
+                params: {},
+            }),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        void response.body?.cancel();
+        return response.headers.get("www-authenticate") ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function runMcpLogin(input) {
+    const fetchImpl = input.fetch ?? globalThis.fetch;
+    const stdout = input.stdout ?? ((text) => process.stdout.write(text));
+    const now = input.now ?? (() => Date.now());
+    const timeoutMs = input.timeoutMs ?? 300_000;
+    const discoveryTimeoutMs = 15_000;
+    const resource = canonicalResourceUri(input.wrapUrl);
+    const wwwAuthenticate = await probeWwwAuthenticate(input.wrapUrl, fetchImpl, discoveryTimeoutMs);
+    const prm = await discoverProtectedResourceMetadata({
+        mcpUrl: input.wrapUrl,
+        fetch: fetchImpl,
+        wwwAuthenticate,
+        timeoutMs: discoveryTimeoutMs,
+    });
+    const asMeta = await discoverAuthorizationServerMetadata({
+        issuer: prm.authorizationServers[0],
+        fetch: fetchImpl,
+        timeoutMs: discoveryTimeoutMs,
+    });
+    const scopes = input.scopes && input.scopes.length > 0
+        ? input.scopes
+        : prm.scopesSupported.length > 0
+            ? prm.scopesSupported
+            : asMeta.scopesSupported;
+    // Dynamic Client Registration registers whatever redirect we bound, so default
+    // to an ephemeral port (0) for the DCR path — there is no fixed, predictable
+    // port for another local process to pre-bind and race for the callback. A
+    // pre-registered client (explicit --client-id) keeps the conventional 7878,
+    // since its redirect URI was registered out of band.
+    const redirectPort = input.redirectPort ?? (input.clientId ? DEFAULT_OAUTH_REDIRECT_PORT : 0);
+    const { server, port } = await listen(redirectPort);
+    input.onListening?.(port);
+    const redirectUri = `http://127.0.0.1:${port}${DEFAULT_OAUTH_REDIRECT_PATH}`;
+    let authMethod = "preregistered_client";
+    let clientId = input.clientId;
+    let clientSecret = input.clientSecret;
+    try {
+        if (!clientId) {
+            if (!asMeta.registrationEndpoint) {
+                throw new Error(`mcp_oauth_no_client_id:${asMeta.issuer} does not support dynamic registration — pass --client-id`);
+            }
+            const registered = await registerOAuthClient({
+                registrationEndpoint: asMeta.registrationEndpoint,
+                redirectUris: [redirectUri],
+                clientName: MCP_OAUTH_CLIENT_NAME,
+                scopes,
+                fetch: fetchImpl,
+                timeoutMs: discoveryTimeoutMs,
+            });
+            clientId = registered.clientId;
+            clientSecret = registered.clientSecret ?? undefined;
+            authMethod = "dynamic_registration";
+        }
+        const pkce = createPkcePair(input.pkceVerifier);
+        const state = createOAuthState(input.randomState);
+        const authorization = await captureAuthorizationCode({
+            server,
+            redirectPath: DEFAULT_OAUTH_REDIRECT_PATH,
+            state,
+            timeoutMs,
+            start: async () => {
+                const authorizeUrl = buildAuthorizationUrl({
+                    authorizationEndpoint: asMeta.authorizationEndpoint,
+                    clientId: clientId,
+                    redirectUri,
+                    resource,
+                    scopes,
+                    state,
+                    codeChallenge: pkce.challenge,
+                });
+                stdout(`Opening your browser to authorize ${resource}.\n`);
+                stdout(`If it does not open, visit:\n  ${authorizeUrl}\n`);
+                await (input.openBrowser ?? defaultOpenBrowser)(authorizeUrl);
+            },
+        });
+        const tokens = await exchangeAuthorizationCode({
+            tokenEndpoint: asMeta.tokenEndpoint,
+            clientId: clientId,
+            clientSecret,
+            code: authorization.code,
+            redirectUri,
+            codeVerifier: pkce.verifier,
+            resource,
+            fetch: fetchImpl,
+            timeoutMs: discoveryTimeoutMs,
+        });
+        const grantedScopes = tokens.scope.length > 0 ? tokens.scope : scopes;
+        const expiresAt = tokens.expiresIn
+            ? new Date(now() + tokens.expiresIn * 1000).toISOString()
+            : null;
+        const store = input.store ?? loadCredentialStore();
+        const metadata = await store.set({
+            provider: mcpOAuthProviderKey(input.wrapUrl),
+            type: "oauth",
+            source: "oauth",
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            scopes: grantedScopes,
+            expiresAt,
+            account: prm.resourceName,
+            context: {
+                resource,
+                issuer: asMeta.issuer,
+                tokenEndpoint: asMeta.tokenEndpoint,
+                authorizationEndpoint: asMeta.authorizationEndpoint,
+                clientId: clientId,
+                transport: "streamable-http",
+                authMethod,
+            },
+        });
+        return {
+            resource,
+            issuer: asMeta.issuer,
+            authMethod,
+            scopes: metadata.scopes,
+            expiresAt: metadata.expiresAt,
+            account: metadata.account,
+            secretBackend: metadata.secretBackend,
+        };
+    }
+    finally {
+        server.close();
+    }
+}
+export async function runMcpLogout(input) {
+    const store = input.store ?? loadCredentialStore();
+    const removed = await store.delete(mcpOAuthProviderKey(input.wrapUrl));
+    return { resource: canonicalResourceUri(input.wrapUrl), removed };
+}
+/** List remote-MCP OAuth sessions from the broker — metadata only, never tokens. */
+export async function runMcpSessions(input = {}) {
+    const store = input.store ?? loadCredentialStore();
+    const metadata = await store.list();
+    return metadata
+        .filter((entry) => entry.provider.startsWith("mcp-remote:"))
+        .map((entry) => ({
+        resource: entry.context?.resource ?? entry.provider.slice("mcp-remote:".length),
+        issuer: entry.context?.issuer ?? null,
+        scopes: entry.scopes,
+        expiresAt: entry.expiresAt,
+        status: credentialExpired({ expiresAt: entry.expiresAt }, input.now)
+            ? "stale"
+            : "live",
+        account: entry.account,
+    }))
+        .sort((a, b) => a.resource.localeCompare(b.resource));
+}
+/**
+ * Resolve the `Authorization: Bearer` header for a remote MCP server from the
+ * broker, refreshing a lapsed token when a refresh token and token endpoint are
+ * available. Fails closed with an actionable error when no session exists or a
+ * stale session cannot be refreshed — the bearer is never invented.
+ */
+export async function resolveMcpOAuthAuthorization(input) {
+    const store = input.store ?? loadCredentialStore();
+    const now = input.now ?? (() => Date.now());
+    const resource = canonicalResourceUri(input.wrapUrl);
+    const key = mcpOAuthProviderKey(input.wrapUrl);
+    const credential = await store.get(key);
+    if (!credential) {
+        throw new Error(`mcp_oauth_not_authorized:${resource} — run 'axtary mcp login --wrap-url ${input.wrapUrl}'`);
+    }
+    if (!credentialExpired(credential, now())) {
+        return { authorization: `Bearer ${credential.accessToken}`, resource };
+    }
+    const tokenEndpoint = credential.context?.tokenEndpoint;
+    const clientId = credential.context?.clientId;
+    if (!credential.refreshToken || !tokenEndpoint || !clientId) {
+        throw new Error(`mcp_oauth_session_expired:${resource} — run 'axtary mcp login --wrap-url ${input.wrapUrl}'`);
+    }
+    const refreshed = await refreshAccessToken({
+        tokenEndpoint,
+        clientId,
+        refreshToken: credential.refreshToken,
+        resource,
+        scopes: credential.scopes,
+        fetch: input.fetch ?? globalThis.fetch,
+    });
+    const grantedScopes = refreshed.scope.length > 0 ? refreshed.scope : credential.scopes;
+    const expiresAt = refreshed.expiresIn
+        ? new Date(now() + refreshed.expiresIn * 1000).toISOString()
+        : null;
+    await store.set({
+        provider: key,
+        type: "oauth",
+        source: "oauth",
+        accessToken: refreshed.accessToken,
+        // OAuth 2.1 rotates public-client refresh tokens; keep the prior one if the
+        // server did not return a new one.
+        refreshToken: refreshed.refreshToken ?? credential.refreshToken,
+        scopes: grantedScopes,
+        expiresAt,
+        account: credential.account,
+        context: credential.context,
+    });
+    return { authorization: `Bearer ${refreshed.accessToken}`, resource };
+}
+//# sourceMappingURL=mcp-oauth.js.map

package/dist/mcp-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../src/mcp-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,mCAAmC,EACnC,iCAAiC,EACjC,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,MAAM,EACN,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAEpB,0DAA0D;AAC1D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,iEAAiE;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAE1D,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,cAAc,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;AACvD,CAAC;AA8BD;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,SAAuB,EACvB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,oBAAoB;gBACxB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,EAAE;aACX,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAyB;IAEzB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC;IAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;IAElC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAChD,KAAK,CAAC,OAAO,EACb,SAAS,EACT,kBAAkB,CACnB,CAAC;IAEF,MAAM,GAAG,GAA8B,MAAM,iCAAiC,CAAC;QAC7E,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,KAAK,EAAE,SAAS;QAChB,eAAe;QACf,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC;IAEH,MAAM,MAAM,GACV,MAAM,mCAAmC,CAAC;QACxC,MAAM,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnC,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC;IAEL,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,KAAK,CAAC,MAAM;QACd,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,eAAe;YACrB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAE/B,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,WAAW,GAAG,oBAAoB,IAAI,GAAG,2BAA2B,EAAE,CAAC;IAE7E,IAAI,UAAU,GAAsC,sBAAsB,CAAC;IAC3E,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAEtC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,MAAM,2DAA2D,CACnG,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBAC3C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,MAAM;gBACN,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,kBAAkB;aAC9B,CAAC,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YAC/B,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,SAAS,CAAC;YACpD,UAAU,GAAG,sBAAsB,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;YACnD,MAAM;YACN,YAAY,EAAE,2BAA2B;YACzC,KAAK;YACL,SAAS;YACT,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,YAAY,GAAG,qBAAqB,CAAC;oBACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,QAAQ,EAAE,QAAS;oBACnB,WAAW;oBACX,QAAQ;oBACR,MAAM;oBACN,KAAK;oBACL,aAAa,EAAE,IAAI,CAAC,SAAS;iBAC9B,CAAC,CAAC;gBACH,MAAM,CAAC,qCAAqC,QAAQ,KAAK,CAAC,CAAC;gBAC3D,MAAM,CAAC,kCAAkC,YAAY,IAAI,CAAC,CAAC;gBAC3D,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC,YAAY,CAAC,CAAC;YAChE,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,QAAS;YACnB,YAAY;YACZ,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,WAAW;YACX,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,QAAQ;YACR,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,kBAAkB;SAC9B,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC;YAC/B,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;YAC5C,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,aAAa;YACrB,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,OAAO,EAAE;gBACP,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;gBACnD,QAAQ,EAAE,QAAS;gBACnB,SAAS,EAAE,iBAAiB;gBAC5B,UAAU;aACX;SACF,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU;YACV,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;SACtC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAGlC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC;AAWD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAGjC,EAAE;IACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAEpC,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;QAC/E,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC;YAClE,CAAC,CAAE,OAAiB;YACpB,CAAC,CAAE,MAAgB;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,uCAAuC,KAAK,CAAC,OAAO,GAAG,CAC5F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;IAE9C,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,uCAAuC,KAAK,CAAC,OAAO,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,aAAa;QACb,QAAQ;QACR,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;KACvC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IACvF,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS;QACnC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC5D,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,KAAK,CAAC,GAAG,CAAC;QACd,QAAQ,EAAE,GAAG;QACb,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,4EAA4E;QAC5E,mCAAmC;QACnC,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY;QAC/D,MAAM,EAAE,aAAa;QACrB,SAAS;QACT,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;IAEH,OAAO,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,90 @@
+import { type Server } from "node:http";
+export declare const DEFAULT_OAUTH_REDIRECT_PORT = 7878;
+export declare const DEFAULT_OAUTH_REDIRECT_PATH = "/callback";
+export type OAuthProviderDescriptor = {
+    provider: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    /** Separator used in the `scope` param. Slack uses ",", most use " ". */
+    scopeSeparator: string;
+    /** Whether to use PKCE (S256). Slack/Linear v2 require a client secret instead. */
+    pkce: boolean;
+    /** Whether the token exchange needs the client secret. */
+    requiresClientSecret: boolean;
+    tokenRequestFormat?: "form" | "json";
+    /**
+     * Whether the provider rejects a plain-http loopback redirect and requires an
+     * HTTPS redirect URI. Slack does (verified: Slack OAuth rejects http://
+     * redirects), so a bare `127.0.0.1` loopback cannot be used — the caller must
+     * supply an HTTPS redirect (e.g. a tunnel) or use a different credential path.
+     * Linear accepts http://localhost.
+     */
+    requiresHttpsRedirect: boolean;
+    extraAuthParams?: Record<string, string>;
+};
+export declare const OAUTH_PROVIDERS: Record<string, OAuthProviderDescriptor>;
+export type OAuthTokenResult = {
+    accessToken: string;
+    refreshToken: string | null;
+    tokenType: string | null;
+    scope: string[];
+    expiresAt: string | null;
+    account: string | null;
+    selectedResourceIds: string[];
+};
+export type LoopbackOAuthInput = {
+    descriptor: OAuthProviderDescriptor;
+    clientId: string;
+    clientSecret?: string;
+    redirectPort?: number;
+    redirectPath?: string;
+    /**
+     * The redirect URI advertised to the provider. Defaults to the local loopback
+     * (`http://127.0.0.1:<port><path>`). Override with a tunnel's HTTPS URL when a
+     * provider requires HTTPS (e.g. Slack); the local server still listens on
+     * redirectPort and the tunnel forwards to it.
+     */
+    redirectUri?: string;
+    openBrowser: (url: string) => void | Promise<void>;
+    fetch?: typeof fetch;
+    now?: () => number;
+    randomState?: () => string;
+    pkceVerifier?: () => string;
+    timeoutMs?: number;
+    /** Called with the bound local port once listening (useful for tunnels/tests). */
+    onListening?: (port: number) => void;
+};
+export declare function runLoopbackOAuth(input: LoopbackOAuthInput): Promise<OAuthTokenResult>;
+export type AtlassianAccessibleResource = {
+    id: string;
+    url: string;
+    name: string;
+    scopes: string[];
+    avatarUrl?: string;
+};
+export declare function discoverAtlassianAccessibleResources(accessToken: string, fetchImpl?: typeof fetch): Promise<AtlassianAccessibleResource[]>;
+export declare function refreshOAuthAccessToken(input: {
+    descriptor: OAuthProviderDescriptor;
+    clientId: string;
+    clientSecret?: string;
+    refreshToken: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): Promise<OAuthTokenResult>;
+export declare function listen(port: number): Promise<{
+    server: Server;
+    port: number;
+}>;
+export declare function captureAuthorizationCode(input: {
+    server: Server;
+    redirectPath: string;
+    state: string;
+    timeoutMs: number;
+    start: () => Promise<void>;
+}): Promise<{
+    code: string;
+    selectedResourceIds: string[];
+}>;
+export declare function defaultOpenBrowser(url: string): void;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,MAAM,EAEZ,MAAM,WAAW,CAAC;AAYnB,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC;;;;;;OAMG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CA4DnE,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,uBAAuB,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,CAAC;AAMF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsD3F;AAiED,MAAM,MAAM,2BAA2B,GAAG;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAsBxC;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,uBAAuB,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6B5B;AAqCD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAS9E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoE3D;AA8BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CASpD"}