@bevel-software/platform-core-backend 0.1.0

package/dist/modules/mcp/mcp-auth.middleware.js

@@ -0,0 +1,116 @@
+import { InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import '../tool-auth/external-api-key.interface.js'; // Express Request augmentation (req.externalApiKeyId)
+/**
+ * Auth middleware for the MCP endpoint. Accepts any of:
+ *
+ *   1. A connection key (Bearer `bevel_…`) — minted from the settings UI,
+ *      resolved via ExternalApiKeyService.
+ *   2. An MCP OAuth access token (Bearer `bevel-mcp_…`) — issued by our own
+ *      authorization server after the /connect consent flow, resolved via
+ *      BevelOAuthProvider.
+ *   3. A regular JWT — same shape the web app uses. Lets a logged-in user
+ *      hit the MCP endpoint from their browser if we ever need it
+ *      (e.g. an in-app debugger). Keeps the surface from forking.
+ *
+ * The middleware **must** run before the MCP transport handler — the
+ * transport pulls `req.userId` to populate the session row at `initialize`.
+ *
+ * Failures return 401 with a `WWW-Authenticate` challenge carrying
+ * `resource_metadata` (RFC 9728) so an OAuth-capable MCP client discovers our
+ * authorization server and starts the flow, while clients configured with a
+ * key simply prompt for it.
+ */
+export function createMcpAuthMiddleware(authService, externalApiKeyService, oauthProvider, resourceMetadataUrl) {
+    const wwwAuthenticate = `Bearer realm="bevel-mcp", resource_metadata="${resourceMetadataUrl}"`;
+    const unauthorized = (res, error) => {
+        res.setHeader('WWW-Authenticate', wwwAuthenticate);
+        res.status(401).json({ error });
+    };
+    return async (req, res, next) => {
+        const header = req.headers.authorization;
+        // RFC 7235 §2.1: auth scheme matching is case-insensitive ("bearer",
+        // "BEARER", "BeArEr" are all valid). Match on the lowercased prefix and
+        // then take the token as whatever follows the first whitespace, so the
+        // extraction stays correct regardless of the caller's casing.
+        if (!header || !header.toLowerCase().startsWith('bearer ')) {
+            unauthorized(res, 'Missing or invalid Authorization header');
+            return;
+        }
+        const firstSpace = header.indexOf(' ');
+        const token = header.slice(firstSpace + 1).trim();
+        // Route on the tenant key prefixes so we never accidentally pass a JWT
+        // through hash lookup or an external API key through jsonwebtoken — both
+        // would 500 instead of cleanly 401-ing. Order matters only for clarity:
+        // the connection-key (`bevel_`), OAuth (`bevel-mcp_`), and JWT (`eyJ…`)
+        // shapes are mutually non-overlapping.
+        if (externalApiKeyService.looksLikeExternalApiKey(token)) {
+            try {
+                // Resolve the token *id* alongside the user so the tool handler can
+                // meter the internal model against this key's daily cap — the same
+                // per-key guardrail the LLM proxy enforces. OAuth and JWT callers
+                // have no connection key, so those paths below leave
+                // `externalApiKeyId` unset and are not metered.
+                const resolved = await externalApiKeyService.verifyAndLoadToken(token);
+                if (!resolved) {
+                    unauthorized(res, 'Invalid or revoked connection key');
+                    return;
+                }
+                req.userId = resolved.user.id;
+                req.userEmail = resolved.user.email;
+                req.externalApiKeyId = resolved.tokenId;
+                next();
+                return;
+            }
+            catch (err) {
+                // A DB error during verification is a 500, not a 401 — the caller's
+                // credentials may be valid; we just can't check them right now.
+                console.error('[mcp-auth] connection-key verification failed:', err);
+                res.status(500).json({ error: 'Authentication backend unavailable' });
+                return;
+            }
+        }
+        // MCP OAuth access token — issued by our own authorization server. An
+        // invalid/expired/revoked token is a clean 401 (re-challenging with
+        // resource_metadata so the client can re-authorize); a DB failure is a
+        // 500, same split as the connection-key branch above.
+        if (oauthProvider.looksLikeAccessToken(token)) {
+            try {
+                const info = await oauthProvider.verifyAccessToken(token);
+                req.userId = String(info.extra?.userId ?? '');
+                req.userEmail = String(info.extra?.userEmail ?? '');
+                if (!req.userId) {
+                    unauthorized(res, 'Invalid access token');
+                    return;
+                }
+            }
+            catch (err) {
+                if (err instanceof InvalidTokenError) {
+                    unauthorized(res, 'Invalid, expired, or revoked access token');
+                }
+                else {
+                    console.error('[mcp-auth] OAuth token verification failed:', err);
+                    res.status(500).json({ error: 'Authentication backend unavailable' });
+                }
+                return;
+            }
+            // Outside the try so a synchronous throw from a downstream handler isn't
+            // misclassified as a token-verification failure (and doesn't try to write
+            // a second response).
+            next();
+            return;
+        }
+        // JWT path — same logic as `createAuthMiddleware` in modules/auth, kept
+        // duplicated rather than imported because that one writes its own 401
+        // body shape and we want the WWW-Authenticate header set.
+        try {
+            const { userId, email } = authService.verifyToken(token);
+            req.userId = userId;
+            req.userEmail = email;
+            next();
+        }
+        catch {
+            unauthorized(res, 'Invalid or expired token');
+        }
+    };
+}
+//# sourceMappingURL=mcp-auth.middleware.js.map

package/dist/modules/mcp/mcp-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAIpF,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAE3G;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwB,EACxB,qBAA6C,EAC7C,aAAiC,EACjC,mBAA2B;IAE3B,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;IAC/F,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,KAAa,EAAE,EAAE;QACpD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,qDAAqD;gBACrD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,gEAAgE;gBAChE,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBAChB,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,YAAY,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/mcp/mcp-session-store.d.ts

@@ -0,0 +1,74 @@
+/**
+ * In-memory mapping from MCP session id → { userId, tokenId }. Each entry
+ * represents one MCP client connection's worth of state: the Bevel user the
+ * Bearer token resolved to at `initialize`, and the connection-key id for
+ * metering. Conversation continuity is the caller's own (a continuity-aware
+ * tool like `ask` returns its `sessionId` in the result and the caller echoes
+ * it back); thread/workspace bookkeeping lives on the REST tool surface.
+ *
+ * Eviction is lazy: each `get` / `touch` sweeps idle entries before the
+ * lookup, and `put` enforces the size cap before insert. No background
+ * timer — keeps the store cheap to construct and avoids leaking a setInterval
+ * handle in tests.
+ *
+ * Single-replica only. If we add a second backend instance later, sessions
+ * need to be persisted (see docs/mcp-remote-access.md → "Out of scope"). The
+ * MCP protocol tolerates this — a 404 on an unknown session id is a defined
+ * response, and clients re-initialize.
+ */
+export interface McpSession {
+    sessionId: string;
+    userId: string;
+    /**
+     * The connection-key id this session authenticated with, or null when the
+     * session was opened with a browser JWT (no connection key). Captured at
+     * `initialize` so every `ask_bevel_agent` call in the session can be metered
+     * against that key's daily token cap.
+     */
+    tokenId: string | null;
+    createdAt: number;
+    lastTouchedAt: number;
+}
+export interface McpSessionStoreOptions {
+    /** Drop sessions idle for longer than this. Default: 4 hours. */
+    idleTtlMs?: number;
+    /** Hard cap on simultaneous live sessions. Oldest-touched evicted first. */
+    maxSessions?: number;
+    /** Override `Date.now` — injected only by tests. */
+    now?: () => number;
+}
+export declare class McpSessionStore {
+    private readonly sessions;
+    private readonly idleTtlMs;
+    private readonly maxSessions;
+    private readonly now;
+    private readonly evictListeners;
+    constructor(opts?: McpSessionStoreOptions);
+    /**
+     * Subscribe to eviction events. Returns an unsubscribe function so callers
+     * can clean up in test teardown. The route layer uses this to drop the
+     * transport-state entry in its `active` map and close the underlying SDK
+     * transport when the store decides a session has aged out.
+     */
+    onEvict(listener: (sessionId: string) => void): () => void;
+    /**
+     * Register a fresh MCP session. Caller supplies the id (generated by the
+     * SDK's transport). Evicts the oldest-touched session if the cap is hit
+     * — better than refusing the connection, since a wedged old session is
+     * the most likely cause of a full table.
+     */
+    create(sessionId: string, userId: string, tokenId?: string | null): McpSession;
+    /**
+     * Look up a session and bump its `lastTouchedAt`. Returns null when the
+     * session is unknown or has aged out. Sweep runs first so an aged entry
+     * is collected, not silently revived.
+     */
+    get(sessionId: string): McpSession | null;
+    delete(sessionId: string): void;
+    /** Visible size; useful for diagnostics. Does not sweep. */
+    size(): number;
+    private sweep;
+    private evictOldest;
+    private emitEviction;
+}
+//# sourceMappingURL=mcp-session-store.d.ts.map

package/dist/modules/mcp/mcp-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-session-store.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAKD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IASnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0C;gBAE7D,IAAI,GAAE,sBAA2B;IAM7C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAO1D;;;;;OAKG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,GAAG,IAAW,GAAG,UAAU;IAiBpF;;;;OAIG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAQzC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI/B,4DAA4D;IAC5D,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,KAAK;IAUb,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,YAAY;CAYrB"}

package/dist/modules/mcp/mcp-session-store.js

@@ -0,0 +1,131 @@
+/**
+ * In-memory mapping from MCP session id → { userId, tokenId }. Each entry
+ * represents one MCP client connection's worth of state: the Bevel user the
+ * Bearer token resolved to at `initialize`, and the connection-key id for
+ * metering. Conversation continuity is the caller's own (a continuity-aware
+ * tool like `ask` returns its `sessionId` in the result and the caller echoes
+ * it back); thread/workspace bookkeeping lives on the REST tool surface.
+ *
+ * Eviction is lazy: each `get` / `touch` sweeps idle entries before the
+ * lookup, and `put` enforces the size cap before insert. No background
+ * timer — keeps the store cheap to construct and avoids leaking a setInterval
+ * handle in tests.
+ *
+ * Single-replica only. If we add a second backend instance later, sessions
+ * need to be persisted (see docs/mcp-remote-access.md → "Out of scope"). The
+ * MCP protocol tolerates this — a 404 on an unknown session id is a defined
+ * response, and clients re-initialize.
+ */
+const DEFAULT_IDLE_TTL_MS = 4 * 60 * 60 * 1000;
+const DEFAULT_MAX_SESSIONS = 5000;
+export class McpSessionStore {
+    sessions = new Map();
+    idleTtlMs;
+    maxSessions;
+    now;
+    // Subscribers notified whenever a session is dropped by the store itself
+    // (idle TTL sweep or size-cap eviction). NOT fired by explicit `delete()` —
+    // the caller of `delete` already knows the session is gone, and the route
+    // layer uses `delete` *because* it's already cleaning up.
+    //
+    // Callbacks are invoked synchronously; long-running cleanup (e.g.
+    // `transport.close()`) should be fire-and-forget so a slow listener can't
+    // block the next eviction.
+    evictListeners = new Set();
+    constructor(opts = {}) {
+        this.idleTtlMs = opts.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;
+        this.maxSessions = opts.maxSessions ?? DEFAULT_MAX_SESSIONS;
+        this.now = opts.now ?? Date.now;
+    }
+    /**
+     * Subscribe to eviction events. Returns an unsubscribe function so callers
+     * can clean up in test teardown. The route layer uses this to drop the
+     * transport-state entry in its `active` map and close the underlying SDK
+     * transport when the store decides a session has aged out.
+     */
+    onEvict(listener) {
+        this.evictListeners.add(listener);
+        return () => {
+            this.evictListeners.delete(listener);
+        };
+    }
+    /**
+     * Register a fresh MCP session. Caller supplies the id (generated by the
+     * SDK's transport). Evicts the oldest-touched session if the cap is hit
+     * — better than refusing the connection, since a wedged old session is
+     * the most likely cause of a full table.
+     */
+    create(sessionId, userId, tokenId = null) {
+        this.sweep();
+        if (this.sessions.size >= this.maxSessions) {
+            this.evictOldest();
+        }
+        const now = this.now();
+        const session = {
+            sessionId,
+            userId,
+            tokenId,
+            createdAt: now,
+            lastTouchedAt: now,
+        };
+        this.sessions.set(sessionId, session);
+        return session;
+    }
+    /**
+     * Look up a session and bump its `lastTouchedAt`. Returns null when the
+     * session is unknown or has aged out. Sweep runs first so an aged entry
+     * is collected, not silently revived.
+     */
+    get(sessionId) {
+        this.sweep();
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return null;
+        session.lastTouchedAt = this.now();
+        return session;
+    }
+    delete(sessionId) {
+        this.sessions.delete(sessionId);
+    }
+    /** Visible size; useful for diagnostics. Does not sweep. */
+    size() {
+        return this.sessions.size;
+    }
+    sweep() {
+        const cutoff = this.now() - this.idleTtlMs;
+        for (const [id, s] of this.sessions) {
+            if (s.lastTouchedAt < cutoff) {
+                this.sessions.delete(id);
+                this.emitEviction(id);
+            }
+        }
+    }
+    evictOldest() {
+        let oldestId = null;
+        let oldestTouched = Infinity;
+        for (const [id, s] of this.sessions) {
+            if (s.lastTouchedAt < oldestTouched) {
+                oldestTouched = s.lastTouchedAt;
+                oldestId = id;
+            }
+        }
+        if (oldestId) {
+            this.sessions.delete(oldestId);
+            this.emitEviction(oldestId);
+        }
+    }
+    emitEviction(sessionId) {
+        for (const listener of this.evictListeners) {
+            try {
+                listener(sessionId);
+            }
+            catch (err) {
+                // A misbehaving listener must not stop the sweep from finishing —
+                // otherwise one bad subscriber would block the rest of the eviction
+                // pass and leak more sessions.
+                console.warn('[mcp-session-store] eviction listener threw:', err);
+            }
+        }
+    }
+}
+//# sourceMappingURL=mcp-session-store.js.map

package/dist/modules/mcp/mcp-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-session-store.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAyBH,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,MAAM,OAAO,eAAe;IACT,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzC,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,GAAG,CAAe;IACnC,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,0DAA0D;IAC1D,EAAE;IACF,kEAAkE;IAClE,0EAA0E;IAC1E,2BAA2B;IACV,cAAc,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEzE,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC;QACvD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAqC;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,SAAiB,EAAE,MAAc,EAAE,UAAyB,IAAI;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAe;YAC1B,SAAS;YACT,MAAM;YACN,OAAO;YACP,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,GAAG;SACnB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,SAAiB;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,4DAA4D;IAC5D,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAEO,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,aAAa,GAAG,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,aAAa,GAAG,QAAQ,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,aAAa,GAAG,aAAa,EAAE,CAAC;gBACpC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;gBAChC,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,SAAiB;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,oEAAoE;gBACpE,+BAA+B;gBAC/B,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/modules/mcp/mcp.routes.d.ts

@@ -0,0 +1,24 @@
+import express, { type RequestHandler } from 'express';
+import type { IExternalApiKeyService } from '../tool-auth/external-api-key.interface.js';
+import type { McpService } from './mcp.service.js';
+import type { ILlmUsageMeter } from '../tool-auth/llm-usage-meter.js';
+import '../tool-auth/external-api-key.interface.js';
+/**
+ * Routes for the remote MCP server + the connection-key management endpoints.
+ *
+ * Layout:
+ *   POST   /mcp           — client→server MCP messages (initialize + tool calls)
+ *   GET    /mcp           — server→client SSE channel (session-bound)
+ *   DELETE /mcp           — terminate a session
+ *
+ *   GET    /mcp/external-api-keys         — list this user's connection keys
+ *   POST   /mcp/external-api-keys         — mint a new key (returns plaintext ONCE)
+ *   DELETE /mcp/external-api-keys/:id     — revoke
+ *
+ * The `/mcp` endpoints accept either a connection key or a JWT (see
+ * McpAuthMiddleware). The `/mcp/external-api-keys/*` endpoints accept only the JWT —
+ * minting/revoking via a connection key would let a leaked key roll itself
+ * over and stay alive forever.
+ */
+export declare function createMcpRoutes(mcpService: McpService, externalApiKeyService: IExternalApiKeyService, mcpAuthMiddleware: RequestHandler, jwtAuthMiddleware: RequestHandler, llmUsageService: ILlmUsageMeter): express.Router;
+//# sourceMappingURL=mcp.routes.d.ts.map

package/dist/modules/mcp/mcp.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAgB,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AASrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,4CAA4C,CAAC;AAepD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,qBAAqB,EAAE,sBAAsB,EAC7C,iBAAiB,EAAE,cAAc,EACjC,iBAAiB,EAAE,cAAc,EACjC,eAAe,EAAE,cAAc,GAC9B,OAAO,CAAC,MAAM,CAoNhB"}

package/dist/modules/mcp/mcp.routes.js

@@ -0,0 +1,229 @@
+import express from 'express';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { InvalidTokenLabelError, TokenNotFoundError, TokenStillActiveError, } from '../tool-auth/external-api-key.errors.js';
+import '../tool-auth/external-api-key.interface.js'; // req.externalApiKeyId augmentation
+/** Pull the raw bearer token off an already-authenticated request. */
+function extractBearer(req) {
+    const header = req.headers.authorization ?? '';
+    const firstSpace = header.indexOf(' ');
+    return firstSpace >= 0 ? header.slice(firstSpace + 1).trim() : '';
+}
+/**
+ * Routes for the remote MCP server + the connection-key management endpoints.
+ *
+ * Layout:
+ *   POST   /mcp           — client→server MCP messages (initialize + tool calls)
+ *   GET    /mcp           — server→client SSE channel (session-bound)
+ *   DELETE /mcp           — terminate a session
+ *
+ *   GET    /mcp/external-api-keys         — list this user's connection keys
+ *   POST   /mcp/external-api-keys         — mint a new key (returns plaintext ONCE)
+ *   DELETE /mcp/external-api-keys/:id     — revoke
+ *
+ * The `/mcp` endpoints accept either a connection key or a JWT (see
+ * McpAuthMiddleware). The `/mcp/external-api-keys/*` endpoints accept only the JWT —
+ * minting/revoking via a connection key would let a leaked key roll itself
+ * over and stay alive forever.
+ */
+export function createMcpRoutes(mcpService, externalApiKeyService, mcpAuthMiddleware, jwtAuthMiddleware, llmUsageService) {
+    const router = express.Router();
+    // Per-process map of live MCP sessions. In-memory mirror of McpSessionStore
+    // — McpSessionStore holds the *domain* state (userId, threadId, idle TTL),
+    // this map holds the *transport* state (the SDK objects we need to route
+    // a subsequent HTTP request to the correct session). Both are cleared on
+    // restart; clients re-initialize.
+    const active = new Map();
+    // When McpSessionStore drops a session on its own (idle-TTL sweep or
+    // size-cap eviction), the matching transport pair would otherwise leak
+    // here — `active.has(id)` would still return true and route requests to a
+    // McpServer whose backing domain state is gone. Subscribe to the store and
+    // tear down the transport so the resources free immediately and the next
+    // request with that id correctly 404s.
+    mcpService.onSessionEvicted((sessionId) => {
+        const entry = active.get(sessionId);
+        if (!entry)
+            return;
+        active.delete(sessionId);
+        // close() is async; fire-and-forget so a slow socket teardown can't
+        // block the store's eviction loop. transport.onclose still fires but
+        // its `active.delete` is now a no-op.
+        void entry.transport.close().catch((err) => {
+            console.warn('[mcp] transport close on eviction failed:', err);
+        });
+    });
+    // ── MCP transport ──────────────────────────────────────────────────────
+    router.post('/mcp', mcpAuthMiddleware, async (req, res) => {
+        try {
+            const sessionIdHeader = req.headers['mcp-session-id'];
+            const body = req.body;
+            // Three valid request shapes on POST /mcp:
+            //  1. No session id + body is initialize → spin up a new transport.
+            //  2. Session id + matching active session → forward.
+            //  3. Anything else → 400 / 404.
+            if (sessionIdHeader && active.has(sessionIdHeader)) {
+                const session = active.get(sessionIdHeader);
+                // Defense in depth: the auth middleware bound a userId for this
+                // request; refuse if it doesn't match the session's owner. Stops
+                // a leaked session id from being used cross-user even if the
+                // attacker has their own valid connection key.
+                if (session.userId !== req.userId) {
+                    res.status(403).json({ error: 'Session does not belong to this user' });
+                    return;
+                }
+                await session.transport.handleRequest(req, res, body);
+                return;
+            }
+            if (!sessionIdHeader && isInitializeRequest(body)) {
+                // The proxy authenticates its loopback calls with the SAME bearer the
+                // client used here, so it acts on the request exactly as the caller
+                // would. Captured at initialize and seeded into the session's UtcpClient.
+                const { transport, server } = await mcpService.createSession(req.userId, 
+                // Connection-key id (set by mcpAuthMiddleware for `bevel_…` bearers;
+                // undefined for browser JWT) — kept for audit/diagnostics.
+                req.externalApiKeyId ?? null, extractBearer(req), (sessionId) => {
+                    active.set(sessionId, { transport, server, userId: req.userId });
+                });
+                // Closing the transport (DELETE /mcp, or client disconnect during
+                // close) should drop both the active map and the McpSessionStore
+                // entry. McpService wired onsessionclosed → sessionStore.delete; we
+                // mirror it here.
+                transport.onclose = () => {
+                    if (transport.sessionId)
+                        active.delete(transport.sessionId);
+                };
+                await server.connect(transport);
+                await transport.handleRequest(req, res, body);
+                return;
+            }
+            res.status(400).json({
+                error: 'Bad request: missing session id, or session id does not match any active session.',
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            console.error('[mcp] POST /mcp failed:', msg);
+            if (!res.headersSent) {
+                res.status(500).json({ error: msg });
+            }
+            else {
+                res.end();
+            }
+        }
+    });
+    const sessionRequest = async (req, res) => {
+        const sessionIdHeader = req.headers['mcp-session-id'];
+        if (!sessionIdHeader || !active.has(sessionIdHeader)) {
+            res.status(404).json({ error: 'Unknown MCP session' });
+            return;
+        }
+        const session = active.get(sessionIdHeader);
+        if (session.userId !== req.userId) {
+            res.status(403).json({ error: 'Session does not belong to this user' });
+            return;
+        }
+        try {
+            await session.transport.handleRequest(req, res);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            console.error('[mcp] session request failed:', msg);
+            if (!res.headersSent)
+                res.status(500).json({ error: msg });
+            else
+                res.end();
+        }
+    };
+    // GET is the server→client SSE channel for session-scoped notifications.
+    router.get('/mcp', mcpAuthMiddleware, sessionRequest);
+    // DELETE terminates the session — SDK closes the transport, our
+    // onclose handler cleans up the active map, and McpService's
+    // onsessionclosed clears the McpSessionStore entry.
+    router.delete('/mcp', mcpAuthMiddleware, sessionRequest);
+    // ── Connection-key management (JWT-only) ───────────────────────────────
+    router.get('/mcp/external-api-keys', jwtAuthMiddleware, async (req, res) => {
+        try {
+            const tokens = await externalApiKeyService.listForUser(req.userId);
+            // Enrich each key with its LLM-proxy usage today + the daily cap, so the
+            // settings UI can show how much of the model budget the key has spent.
+            const usage = await llmUsageService.usageForTokens(tokens.map((t) => t.id));
+            res.json(tokens.map((t) => ({
+                ...t,
+                llmUsage: {
+                    usedTodayTokens: usage[t.id] ?? 0,
+                    dailyTokenCap: llmUsageService.dailyCap,
+                },
+            })));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            res.status(500).json({ error: msg });
+        }
+    });
+    router.post('/mcp/external-api-keys', jwtAuthMiddleware, async (req, res) => {
+        try {
+            // `express.json()` leaves req.body undefined when the client posts
+            // without `Content-Type: application/json` (or with another type
+            // entirely). Destructuring undefined throws a TypeError that the outer
+            // catch would 500 — guard with a clean 400 instead.
+            if (!req.body || typeof req.body !== 'object') {
+                res.status(400).json({ error: 'JSON body required' });
+                return;
+            }
+            const { label } = req.body;
+            if (!label) {
+                res.status(400).json({ error: 'label is required' });
+                return;
+            }
+            const minted = await externalApiKeyService.mint(req.userId, label);
+            // The plaintext field is the *only* read path for the raw key. The
+            // frontend must store it nowhere — it shows the dialog once and then
+            // discards. Subsequent fetches return only `summary`-shaped rows.
+            res.json(minted);
+        }
+        catch (err) {
+            if (err instanceof InvalidTokenLabelError) {
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            res.status(500).json({ error: msg });
+        }
+    });
+    router.delete('/mcp/external-api-keys/:id', jwtAuthMiddleware, async (req, res) => {
+        try {
+            await externalApiKeyService.revoke(String(req.params.id), req.userId);
+            res.json({ status: 'revoked' });
+        }
+        catch (err) {
+            if (err instanceof TokenNotFoundError) {
+                res.status(404).json({ error: err.message });
+                return;
+            }
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            res.status(500).json({ error: msg });
+        }
+    });
+    // Hard-delete: permanently remove a *disconnected* key and its audit row.
+    // Separate path from revoke so the two lifecycle steps can't be conflated;
+    // the service refuses to delete a still-active key (409).
+    router.delete('/mcp/external-api-keys/:id/permanent', jwtAuthMiddleware, async (req, res) => {
+        try {
+            await externalApiKeyService.remove(String(req.params.id), req.userId);
+            res.json({ status: 'deleted' });
+        }
+        catch (err) {
+            if (err instanceof TokenNotFoundError) {
+                res.status(404).json({ error: err.message });
+                return;
+            }
+            if (err instanceof TokenStillActiveError) {
+                res.status(409).json({ error: err.message });
+                return;
+            }
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            res.status(500).json({ error: msg });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=mcp.routes.js.map

package/dist/modules/mcp/mcp.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.routes.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8C,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAIjD,OAAO,4CAA4C,CAAC,CAAC,oCAAoC;AAQzF,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAsB,EACtB,qBAA6C,EAC7C,iBAAiC,EACjC,iBAAiC,EACjC,eAA+B;IAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEhD,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uCAAuC;IACvC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,oEAAoE;QACpE,qEAAqE;QACrE,sCAAsC;QACtC,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzC,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAEtB,2CAA2C;YAC3C,oEAAoE;YACpE,sDAAsD;YACtD,iCAAiC;YACjC,IAAI,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;gBAC7C,gEAAgE;gBAChE,iEAAiE;gBACjE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;oBAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,eAAe,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,sEAAsE;gBACtE,oEAAoE;gBACpE,0EAA0E;gBAC1E,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,aAAa,CAC1D,GAAG,CAAC,MAAO;gBACX,qEAAqE;gBACrE,2DAA2D;gBAC3D,GAAG,CAAC,gBAAgB,IAAI,IAAI,EAC5B,aAAa,CAAC,GAAG,CAAC,EAClB,CAAC,SAAS,EAAE,EAAE;oBACZ,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAO,EAAE,CAAC,CAAC;gBACpE,CAAC,CACF,CAAC;gBACF,kEAAkE;gBAClE,iEAAiE;gBACjE,oEAAoE;gBACpE,kBAAkB;gBAClB,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,IAAI,SAAS,CAAC,SAAS;wBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC9D,CAAC,CAAC;gBACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EACH,mFAAmF;aACtF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAC5E,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACtD,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAEtD,gEAAgE;IAChE,6DAA6D;IAC7D,oDAAoD;IACpD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAEzD,0EAA0E;IAE1E,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACpE,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjB,GAAG,CAAC;gBACJ,QAAQ,EAAE;oBACR,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;oBACjC,aAAa,EAAE,eAAe,CAAC,QAAQ;iBACxC;aACF,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1E,IAAI,CAAC;YACH,mEAAmE;YACnE,iEAAiE;YACjE,uEAAuE;YACvE,oDAAoD;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAA0B,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAO,EAAE,KAAK,CAAC,CAAC;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAO,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,CAAC,MAAM,CAAC,sCAAsC,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAO,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}