@bevel-software/platform-core-backend 0.1.0

package/dist/modules/mcp/mcp.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.service.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,QAAQ,EACR,SAAS,GAKV,MAAM,oCAAoC,CAAC;AAC5C,OAAO,YAAY,CAAC,CAAC,gEAAgE;AACrF,OAAO,WAAW,CAAC,CAAC,gFAAgF;AACpG,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,aAAa,EAA6B,MAAM,4CAA4C,CAAC;AACtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAGnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAmB3E,qFAAqF;AACrF,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAE3C;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAG;IAClC,8UAA8U;IAC9U,iWAAiW;IACjW,kXAAkX;CACnX,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAEf,MAAM,oBAAoB,GAAc;IACtC;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,8IAA8I;QAChJ,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAA4B;KACvG;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,iJAAiJ;QACnJ,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE;aAC9G;YACD,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,oBAAoB,EAAE,KAAK;SACF;KAC5B;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE;gBAC1G,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,gCAAgC,EAAE;gBAC3G,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,8EAA8E,EAAE;aACnK;YACD,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,oBAAoB,EAAE,KAAK;SACF;KAC5B;CACF,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAazE,sGAAsG;AACtG,SAAS,eAAe,CAAC,KAAkB;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM;QACvB,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,iEAAiE,KAAK,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAIA;IACA;IAIA;IAKA;IAhBnB,YACmB,YAA6B,EAC7B,IAAqB;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC3D,YAAmC,EACnC,WAAgC;IACjD,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IAClD,cAAqC;IACtD,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACtD,iBAAqD;QAfrD,iBAAY,GAAZ,YAAY,CAAiB;QAC7B,SAAI,GAAJ,IAAI,CAAiB;QAIrB,iBAAY,GAAZ,YAAY,CAAuB;QACnC,gBAAW,GAAX,WAAW,CAAqB;QAIhC,mBAAc,GAAd,cAAc,CAAuB;QAKrC,sBAAiB,GAAjB,iBAAiB,CAAoC;IACrE,CAAC;IAEJ;;;OAGG;IACH,gBAAgB,CAAC,QAAqC;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAAsB,EACtB,MAAc,EACd,oBAAiD;QAEjD,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,cAAc,GAClB,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,cAAc;YACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,yBAAyB,CAAC;YACtF,CAAC,CAAC,MAAM,CAAC;QAEb,0EAA0E;QAC1E,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,qEAAqE;QACrE,yEAAyE;QACzE,6DAA6D;QAC7D,OAAO,CAAC,GAAG,CACT,6BAA6B,MAAM,YAAY,OAAO,IAAI,MAAM,KAAK;YACnE,cAAc,KAAK,CAAC,MAAM,mBAAmB,OAAO,CAAC,MAAM,YAAY,CAC1E,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE;gBAClC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACrD,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;YACD,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE;gBAC7B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAC7C,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,kEAAkE;YAClE,mEAAmE;YACnE,0DAA0D;YAC1D,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,uEAAuE;YACvE,uDAAuD;YACvD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG;gBAC7B,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACf,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CACrC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EACjC,GAAG,EAAE,CAAC,KAAK,CACZ,CACF,CACF,CAAC;gBACF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,yEAAyE;YACzE,sDAAsD;YACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YACtC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,4CAA4C;gBAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CACV,6BAA6B,oBAAoB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,YAAY;oBAClF,WAAW,OAAO,CAAC,MAAM,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,gEAAgE;gBAChE,KAAK,EAAE,CAAC,GAAG,oBAAoB,EAAE,GAAG,MAAM,CAAC;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YAC7D,CAAC;YACD,0EAA0E;YAC1E,6EAA6E;YAC7E,oDAAoD;YACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACd,gEAAgE;gBAChE,uEAAuE;gBACvE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,oEAAoE;gBACpE,2DAA2D;gBAC3D,IAAI,SAAS,CAAC,YAAY,IAAI,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACxE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBACvC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC,MAAM,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACzD,MAAM,OAAO,GAAa,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,SAAS,EAAE,EAAE;aACd,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAA4B,EAAE;YAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,kBAAkB,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YACzF,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;aACtF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,cAAc,CAAC,MAAc;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAI,GAA0C,EAAE,MAAM,CAAC;QACnE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAE3D,CAAC;QACT,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,EAAE,IAAc;QACpF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,EAAE;gBAC7D,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,MAAM,EAAE;oBACjC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;aACjD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa;QACpE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,oBAAoB,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,oBAAoB,CAAC,MAAc;QAC/C,gFAAgF;QAChF,kFAAkF;QAClF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,kCAAkC,EAAE,WAAW,CAAC,CAEtF,CAAC;QACT,MAAM,UAAU,GAAc,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAE/E,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAI,GAA0B,EAAE,IAAI,KAAK,uBAAuB,CAAC;YAC3E,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,GAA8B,CAAC,CAAC,CAAC;gBAC9E,IAAI,IAAI;oBAAE,KAAK,GAAG,IAAI,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,MAAM,CAAE,GAA0B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC7D,IAAI,IAAI;oBAAE,MAAM,GAAG,CAAC,CAAC,+DAA+D;gBACpF,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QACD,+EAA+E;QAC/E,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uFAAuF;IAC/E,gBAAgB;QACtB,OAAO,sBAAsB,CAAC,YAAY,CAAC;YACzC,IAAI,EAAE,uBAAuB;YAC7B,kBAAkB,EAAE,MAAM;YAC1B,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,2BAA2B;YAChC,YAAY,EAAE,kBAAkB;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,0BAA0B,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,MAAc,EACd,OAAuB;QAEvB,uEAAuE;QACvE,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC,YAAY,CAAC;YAC3D,SAAS;YACT,mBAAmB,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,MAA0B,EAAE,OAAuB;QAC7E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;oBACvF,IAAI,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;oBAClE,OAAO,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,0DAA0D;gBAC1D,IAAI,IAAI;oBAAE,MAAM,GAAG,CAAC;gBACpB,OAAO,CAAC,IAAI,CACV,0BAA0B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;OAQG;IACK,KAAK,CAAC,gBAAgB,CAC5B,MAAc,EACd,IAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,wBAAwB,CAC9B,IAAI,CAAC,OAAO,EACZ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EACrC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,UAAU,CACzC;YACD,sEAAsE;YACtE,qEAAqE;YACrE,iEAAiE;YACjE,oDAAoD;YACpD,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;SAClD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAC9B,MAAc,EACd,IAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC9C,MAAM,EACN,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAqE,EAAE,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChC,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;YAC5D,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,0CAA0C;gBACxG,SAAS;YACX,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,wEAAwE;YACxE,gCAAgC;YAChC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,8EAA8E;YAC9E,4EAA4E;YAC5E,4EAA4E;YAC5E,gCAAgC;YAChC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,MAA0B,EAC1B,IAAiB,EACjB,OAAyG;IACzG,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,KAA0E;QAE1E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAE5C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QAC1D,IAAI,IAAa,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,IAAI,CAAC;YACH,wEAAwE;YACxE,2EAA2E;YAC3E,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,4CAA4C;YAC5C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBACxE,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,IAAI,CAAC,CAAC;oBACd,MAAM,KAAK;yBACR,gBAAgB,CAAC;wBAChB,MAAM,EAAE,wBAAwB;wBAChC,MAAM,EAAE;4BACN,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACzD,QAAQ;4BACR,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;yBAC9B;qBACF,CAAC;yBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,CAAC;gBACD,IAAI,GAAG,KAAK,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,IAAI,CAAC,OAAO,kBAAkB,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAC5B,MAA0B,EAC1B,IAAY,EACZ,IAA6B;QAE7B,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC7D,OAAO,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,UAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,MAAM,UAAU,GAAa,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC9C,IAAI,KAAK;wBAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;;wBACpE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACxB,CAAC;gBACD,OAAO,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,kBAAkB;YAClB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACzE,sEAAsE;YACtE,+EAA+E;YAC/E,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;gBACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;gBACxE,CAAC,CAAC,0BAA0B,CAAC;YACjC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5E,OAAO,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClE,OAAO,gBAAgB,CAAC;gBACtB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,GAAG;gBACf,YAAY,EAAE,KAAK;gBACnB,OAAO,EAAE,2BAA2B,QAAQ,CAAC,MAAM,4CAA4C,aAAa,qDAAqD,GAAG,sLAAsL;aAC3V,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,QAAQ,IAAI,kBAAkB,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF;AAaD;;;;;GAKG;AACH;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,IAAiB;IAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpF,OAAO,CAAC,IAAI,CACV,wBAAwB,IAAI,CAAC,OAAO,iDAAiD;YACnF,eAAe,gBAAgB,YAAY,iBAAiB,WAAW;YACvE,yFAAyF,CAC5F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAI,WAAW,GACb,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAI,GAA+B,EAAE;QACzD,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzC,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,4CAA4C;IAC5C,WAAW,GAAG,mBAAmB,CAAC,WAAW,CAA4B,CAAC;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,oEAAoE;IACpE,2DAA2D;IAC3D,WAAW,CAAC,IAAI,GAAG,QAAQ,CAAC;IAC5B,IAAI,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAClF,WAAW,CAAC,UAAU,GAAG,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,WAAqC;KACnD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,WAAW;IACX,MAAM;IACN,MAAM;IACN,UAAU;IACV,OAAO;IACP,UAAU;IACV,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC;IACpB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE;QAClD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACxD,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAW,EAAE;QACrD,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,8CAA8C;QACzE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxC,yEAAyE;YACzE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/C,OAAO,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACzE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAI,QAAoC,EAAE;gBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;oBAC5B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,aAAa;gBAAE,SAAS,CAAC,gBAAgB;YACxE,0EAA0E;YAC1E,gFAAgF;YAChF,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1F,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,OAAO;QACP,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,IAAc;IAClE,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;QAClF,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,wEAAwE;QACxE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;KAChE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,IAAI,GAAI,GAAyC,EAAE,QAAQ,EAAE,IAAI,CAAC;IACxE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,OAAO,GAAI,KAA+B,EAAE,OAAO,CAAC;IAC1D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrG,OAAO,KAAuB,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC/E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,2BAA2B,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,OAAiB,EACjB,UAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GACR,QAAQ,QAAQ,oDAAoD,KAAK,IAAI;QAC7E,QAAQ,UAAU,yEAAyE,CAAC;IAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/modules/mcp/oauth/bevel-oauth-provider.d.ts

@@ -0,0 +1,76 @@
+import type { Response } from 'express';
+import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { Database } from '../../database/connection.js';
+import type { TokenCrypto } from '../../../shared/token-crypto.js';
+import { type McpAuthRequestState } from './oauth-state.js';
+export interface BevelOAuthProviderDeps {
+    db: Database;
+    /**
+     * Encrypts confidential-client secrets at rest (tokens/codes are hashed).
+     * Null when no encryption key is configured — public (PKCE-only) clients,
+     * which is what MCP clients register as, work regardless; only registering
+     * a CONFIDENTIAL client then fails, with a clear error.
+     */
+    crypto: TokenCrypto | null;
+    /** HMAC secret for the authorize→/connect→finish signed state. */
+    stateSecret: string;
+    /** SPA base URL — where `authorize` sends the browser (the /connect page). */
+    publicFrontendUrl: string;
+    /** Access-token plaintext prefix, e.g. `bevel-mcp_`. */
+    tokenPrefix: string;
+}
+/**
+ * Our own OAuth 2.1 authorization server for the MCP endpoint, backed by the
+ * `oauth_*` tables. Mounted through the MCP SDK's `mcpAuthRouter`, which owns
+ * request validation (client lookup, redirect_uri matching, PKCE S256
+ * enforcement) and calls into this provider for the actual decisions.
+ *
+ * The deliberate twist: `authorize` does NOT authenticate the user — the SDK
+ * hands it no request, so there is no cookie to read. It packs the validated
+ * request into a signed state and sends the browser to the SPA's `/connect`
+ * page; the JWT/cookie-authed Finish endpoint (oauth-consent.routes.ts) is
+ * where a Bevel user attaches to the flow, via `issueAuthCode`.
+ */
+export declare class BevelOAuthProvider implements OAuthServerProvider {
+    private readonly deps;
+    private readonly store;
+    constructor(deps: BevelOAuthProviderDeps);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    private get refreshPrefix();
+    /**
+     * True if a bearer string carries this tenant's MCP OAuth access-token
+     * prefix — the routing predicate for the middleware's OAuth branch (a
+     * refresh token shares the prefix but fails verification by hash miss).
+     */
+    looksLikeAccessToken(token: string): boolean;
+    private getClient;
+    private registerClient;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Called by the Finish endpoint once an authenticated user completes the
+     * /connect step: bind a one-time code to (user, client, redirect_uri, PKCE
+     * challenge) and hand back the client redirect the browser should follow.
+     */
+    issueAuthCode(userId: string, st: McpAuthRequestState): Promise<{
+        redirectTo: string;
+    }>;
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, // PKCE already verified locally by the SDK token handler
+    redirectUri?: string, _resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], _resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Internal revoke by the bearer itself (no client binding) — used by the MCP
+     * proxy to reset an interactive session whose TOOL sign-in died: revoking the
+     * pair makes the client's next request 401, its refresh fail, and its
+     * re-authorization run — landing the user on /connect to fix the sign-in.
+     * No-op for non-OAuth bearers (connection keys, JWTs) and unknown tokens.
+     */
+    revokeByAccessToken(token: string): Promise<void>;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    private mintTokens;
+}
+//# sourceMappingURL=bevel-oauth-provider.d.ts.map

package/dist/modules/mcp/oauth/bevel-oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bevel-oauth-provider.d.ts","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/bevel-oauth-provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAM/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAY7E,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,QAAQ,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAGhD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;gBAEvB,IAAI,EAAE,sBAAsB;IAOzD,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED,OAAO,KAAK,aAAa,GAExB;IAED;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;YAI9B,SAAS;YAoBT,cAAc;IA4BtB,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAkBhB;;;;OAIG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkB5B,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAYZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EAAE,yDAAyD;IACjF,WAAW,CAAC,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,GAAG,GACd,OAAO,CAAC,WAAW,CAAC;IA2BjB,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,SAAS,CAAC,EAAE,GAAG,GACd,OAAO,CAAC,WAAW,CAAC;IAoCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0CzD;;;;;;OAMG;IACG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;YAgBF,UAAU;CA6CzB"}

package/dist/modules/mcp/oauth/bevel-oauth-provider.js

@@ -0,0 +1,291 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { and, eq, gt, isNull, lt, or } from 'drizzle-orm';
+import { InvalidGrantError, InvalidScopeError, InvalidTokenError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { oauthAuthCodes, oauthClients, oauthTokens, users } from '../../database/schema.js';
+import { signAuthRequest } from './oauth-state.js';
+// Same entropy as connection keys: 32 random bytes, base64url. The prefix
+// (`<tenant>-mcp_`) routes the bearer in the MCP auth middleware without
+// colliding with connection keys (`<tenant>_`) or internal tokens
+// (`<tenant>-int_`).
+const TOKEN_BYTES = 32;
+const ACCESS_TTL_MS = 60 * 60_000; // 1 hour
+const REFRESH_TTL_MS = 30 * 24 * 60 * 60_000; // 30 days, rotated on use
+const CODE_TTL_MS = 60_000; // exchanged within seconds of Finish
+/**
+ * Our own OAuth 2.1 authorization server for the MCP endpoint, backed by the
+ * `oauth_*` tables. Mounted through the MCP SDK's `mcpAuthRouter`, which owns
+ * request validation (client lookup, redirect_uri matching, PKCE S256
+ * enforcement) and calls into this provider for the actual decisions.
+ *
+ * The deliberate twist: `authorize` does NOT authenticate the user — the SDK
+ * hands it no request, so there is no cookie to read. It packs the validated
+ * request into a signed state and sends the browser to the SPA's `/connect`
+ * page; the JWT/cookie-authed Finish endpoint (oauth-consent.routes.ts) is
+ * where a Bevel user attaches to the flow, via `issueAuthCode`.
+ */
+export class BevelOAuthProvider {
+    deps;
+    store;
+    constructor(deps) {
+        this.deps = deps;
+        this.store = {
+            getClient: (clientId) => this.getClient(clientId),
+            registerClient: (client) => this.registerClient(client),
+        };
+    }
+    get clientsStore() {
+        return this.store;
+    }
+    get refreshPrefix() {
+        return `${this.deps.tokenPrefix}r_`;
+    }
+    /**
+     * True if a bearer string carries this tenant's MCP OAuth access-token
+     * prefix — the routing predicate for the middleware's OAuth branch (a
+     * refresh token shares the prefix but fails verification by hash miss).
+     */
+    looksLikeAccessToken(token) {
+        return typeof token === 'string' && token.startsWith(this.deps.tokenPrefix);
+    }
+    async getClient(clientId) {
+        const [row] = await this.deps.db
+            .select()
+            .from(oauthClients)
+            .where(eq(oauthClients.clientId, clientId))
+            .limit(1);
+        if (!row)
+            return undefined;
+        // `metadata` snapshots the full registration object minus the secret, so
+        // rebuilding is a spread; only the secret needs decrypting back in (the
+        // SDK's token-endpoint client auth compares it in plaintext).
+        return {
+            ...row.metadata,
+            client_id: row.clientId,
+            client_secret: row.clientSecretEncrypted && this.deps.crypto
+                ? this.deps.crypto.decrypt(row.clientSecretEncrypted)
+                : undefined,
+        };
+    }
+    async registerClient(client) {
+        // Despite the Omit type, the SDK register handler generates client_id /
+        // client_id_issued_at before calling us (register.js), so the runtime
+        // object is complete.
+        const full = client;
+        const { client_secret: secret, ...publicMetadata } = full;
+        if (secret && !this.deps.crypto) {
+            throw new Error('Cannot register a confidential OAuth client: no encryption key configured (set CONNECTOR_CONFIG_ENC_KEY).');
+        }
+        await this.deps.db.insert(oauthClients).values({
+            clientId: full.client_id,
+            clientSecretEncrypted: secret && this.deps.crypto ? this.deps.crypto.encrypt(secret) : null,
+            // `0` is the RFC 7591 "never expires" sentinel — store as NULL.
+            clientSecretExpiresAt: full.client_secret_expires_at
+                ? new Date(full.client_secret_expires_at * 1000)
+                : null,
+            redirectUris: full.redirect_uris ?? [],
+            tokenEndpointAuthMethod: full.token_endpoint_auth_method ?? 'none',
+            clientName: full.client_name ?? null,
+            metadata: publicMetadata,
+        });
+        return full;
+    }
+    async authorize(client, params, res) {
+        // The SDK handler has already validated client, redirect_uri, and PKCE
+        // method. No user yet (this is a bare browser navigation) — defer
+        // identity to the authed Finish endpoint by carrying the request in a
+        // signed state through the /connect page.
+        const state = signAuthRequest(this.deps.stateSecret, {
+            c: client.client_id,
+            r: params.redirectUri,
+            cc: params.codeChallenge,
+            s: params.state,
+            sc: params.scopes?.length ? params.scopes.join(' ') : undefined,
+            rs: params.resource?.href,
+        });
+        const url = new URL('/connect', this.deps.publicFrontendUrl);
+        url.searchParams.set('oauth', state);
+        res.redirect(302, url.toString());
+    }
+    /**
+     * Called by the Finish endpoint once an authenticated user completes the
+     * /connect step: bind a one-time code to (user, client, redirect_uri, PKCE
+     * challenge) and hand back the client redirect the browser should follow.
+     */
+    async issueAuthCode(userId, st) {
+        const code = this.deps.tokenPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
+        await this.deps.db.insert(oauthAuthCodes).values({
+            codeHash: hashToken(code),
+            clientId: st.c,
+            userId,
+            redirectUri: st.r,
+            codeChallenge: st.cc,
+            scope: st.sc ?? null,
+            resource: st.rs ?? null,
+            expiresAt: new Date(Date.now() + CODE_TTL_MS),
+        });
+        const redirect = new URL(st.r);
+        redirect.searchParams.set('code', code);
+        if (st.s)
+            redirect.searchParams.set('state', st.s);
+        return { redirectTo: redirect.toString() };
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const [row] = await this.deps.db
+            .select()
+            .from(oauthAuthCodes)
+            .where(eq(oauthAuthCodes.codeHash, hashToken(authorizationCode)))
+            .limit(1);
+        if (!row || row.clientId !== client.client_id || row.consumedAt || row.expiresAt <= new Date()) {
+            throw new InvalidGrantError('Invalid or expired authorization code');
+        }
+        return row.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, // PKCE already verified locally by the SDK token handler
+    redirectUri, _resource) {
+        // Atomic consume: two concurrent /token calls with the same code race on
+        // this UPDATE and exactly one wins — a select-then-update would let both
+        // through. `clientId` is IN the predicate so a mismatched client can't burn
+        // (consume) a code that isn't theirs — the update matches nothing and the
+        // code stays live for its rightful client.
+        const [row] = await this.deps.db
+            .update(oauthAuthCodes)
+            .set({ consumedAt: new Date() })
+            .where(and(eq(oauthAuthCodes.codeHash, hashToken(authorizationCode)), eq(oauthAuthCodes.clientId, client.client_id), isNull(oauthAuthCodes.consumedAt), gt(oauthAuthCodes.expiresAt, new Date())))
+            .returning();
+        if (!row) {
+            throw new InvalidGrantError('Invalid or expired authorization code');
+        }
+        if (redirectUri && redirectUri !== row.redirectUri) {
+            throw new InvalidGrantError('redirect_uri does not match the authorization request');
+        }
+        return this.mintTokens(row.userId, row.clientId, row.scope, row.resource);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, _resource) {
+        const now = new Date();
+        // Rotation: atomically revoke the presented refresh token; the winner of
+        // a concurrent double-refresh gets the new pair, the loser a clean 400.
+        // `clientId` is IN the predicate so a caller presenting a valid refresh
+        // token under the WRONG client can't revoke (kill) another client's
+        // session — the update matches nothing and their token stays live.
+        const [row] = await this.deps.db
+            .update(oauthTokens)
+            .set({ revokedAt: now })
+            .where(and(eq(oauthTokens.refreshTokenHash, hashToken(refreshToken)), eq(oauthTokens.clientId, client.client_id), isNull(oauthTokens.revokedAt)))
+            .returning();
+        if (!row) {
+            throw new InvalidGrantError('Invalid or revoked refresh token');
+        }
+        if (row.refreshExpiresAt && row.refreshExpiresAt <= now) {
+            throw new InvalidGrantError('Refresh token expired');
+        }
+        // Scope may only narrow on refresh (RFC 6749 §6).
+        let scope = row.scope;
+        if (scopes?.length) {
+            const granted = new Set((row.scope ?? '').split(' ').filter(Boolean));
+            if (!scopes.every((s) => granted.has(s))) {
+                throw new InvalidScopeError('Requested scope exceeds the originally granted scope');
+            }
+            scope = scopes.join(' ');
+        }
+        return this.mintTokens(row.userId, row.clientId, scope, row.resource);
+    }
+    async verifyAccessToken(token) {
+        const now = new Date();
+        const [row] = await this.deps.db
+            .select({
+            id: oauthTokens.id,
+            clientId: oauthTokens.clientId,
+            scope: oauthTokens.scope,
+            resource: oauthTokens.resource,
+            expiresAt: oauthTokens.expiresAt,
+            userId: users.id,
+            userEmail: users.email,
+        })
+            .from(oauthTokens)
+            .innerJoin(users, eq(oauthTokens.userId, users.id))
+            .where(and(eq(oauthTokens.accessTokenHash, hashToken(token)), isNull(oauthTokens.revokedAt), gt(oauthTokens.expiresAt, now)))
+            .limit(1);
+        if (!row) {
+            throw new InvalidTokenError('Invalid, expired, or revoked access token');
+        }
+        // Fire-and-forget like the connection-key path — a stale last_used_at is
+        // fine for audit, blocking verification on it is not.
+        this.deps.db
+            .update(oauthTokens)
+            .set({ lastUsedAt: now })
+            .where(eq(oauthTokens.id, row.id))
+            .then(undefined, (err) => console.warn('[mcp-oauth] touch lastUsedAt failed:', err));
+        return {
+            token,
+            clientId: row.clientId,
+            scopes: (row.scope ?? '').split(' ').filter(Boolean),
+            expiresAt: Math.floor(row.expiresAt.getTime() / 1000),
+            resource: row.resource ? new URL(row.resource) : undefined,
+            extra: { userId: row.userId, userEmail: row.userEmail },
+        };
+    }
+    /**
+     * Internal revoke by the bearer itself (no client binding) — used by the MCP
+     * proxy to reset an interactive session whose TOOL sign-in died: revoking the
+     * pair makes the client's next request 401, its refresh fail, and its
+     * re-authorization run — landing the user on /connect to fix the sign-in.
+     * No-op for non-OAuth bearers (connection keys, JWTs) and unknown tokens.
+     */
+    async revokeByAccessToken(token) {
+        if (!this.looksLikeAccessToken(token))
+            return;
+        await this.deps.db
+            .update(oauthTokens)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(oauthTokens.accessTokenHash, hashToken(token)), isNull(oauthTokens.revokedAt)));
+    }
+    async revokeToken(client, request) {
+        // RFC 7009: revoking an unknown/foreign/already-revoked token is a no-op.
+        // The token may be either half of a pair — one UPDATE matching either hash.
+        const hash = hashToken(request.token);
+        await this.deps.db
+            .update(oauthTokens)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(oauthTokens.clientId, client.client_id), isNull(oauthTokens.revokedAt), or(eq(oauthTokens.accessTokenHash, hash), eq(oauthTokens.refreshTokenHash, hash))));
+    }
+    async mintTokens(userId, clientId, scope, resource) {
+        const accessToken = this.deps.tokenPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
+        const refreshToken = this.refreshPrefix + randomBytes(TOKEN_BYTES).toString('base64url');
+        const now = Date.now();
+        // Opportunistic pruning, piggybacked on mint (one per sign-in / refresh —
+        // no scheduler needed) so the oauth tables stay bounded: a token row whose
+        // refresh window has closed can never authenticate again (revoked-but-live
+        // rows are kept until then, so revocation stays observable), and an auth
+        // code past its 60s TTL can never be exchanged. Best-effort — a cleanup
+        // hiccup must not fail the token issuance itself.
+        try {
+            const cutoff = new Date(now);
+            await this.deps.db.delete(oauthTokens).where(or(lt(oauthTokens.refreshExpiresAt, cutoff), and(isNull(oauthTokens.refreshExpiresAt), lt(oauthTokens.expiresAt, cutoff))));
+            await this.deps.db.delete(oauthAuthCodes).where(lt(oauthAuthCodes.expiresAt, cutoff));
+        }
+        catch (err) {
+            console.warn('[mcp-oauth] token-table prune failed (non-fatal):', err instanceof Error ? err.message : err);
+        }
+        await this.deps.db.insert(oauthTokens).values({
+            accessTokenHash: hashToken(accessToken),
+            refreshTokenHash: hashToken(refreshToken),
+            clientId,
+            userId,
+            scope,
+            resource,
+            expiresAt: new Date(now + ACCESS_TTL_MS),
+            refreshExpiresAt: new Date(now + REFRESH_TTL_MS),
+        });
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: Math.floor(ACCESS_TTL_MS / 1000),
+            refresh_token: refreshToken,
+            ...(scope ? { scope } : {}),
+        };
+    }
+}
+function hashToken(plaintext) {
+    return createHash('sha256').update(plaintext).digest('hex');
+}
+//# sourceMappingURL=bevel-oauth-provider.js.map

package/dist/modules/mcp/oauth/bevel-oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bevel-oauth-provider.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/bevel-oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAQ1D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AAOzD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAE7E,0EAA0E;AAC1E,yEAAyE;AACzE,kEAAkE;AAClE,qBAAqB;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,SAAS;AAC5C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,0BAA0B;AACxE,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,qCAAqC;AAmBjE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAkB;IAGA;IAFZ,KAAK,CAA8B;IAEpD,YAA6B,IAA4B;QAA5B,SAAI,GAAJ,IAAI,CAAwB;QACvD,IAAI,CAAC,KAAK,GAAG;YACX,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjD,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,IAAY,aAAa;QACvB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,KAAa;QAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO;YACL,GAAI,GAAG,CAAC,QAAuC;YAC/C,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,aAAa,EACX,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACrD,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA6E;QAE7E,wEAAwE;QACxE,sEAAsE;QACtE,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAoC,CAAC;QAClD,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,GAAG,IAAI,CAAC;QAC1D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YAC7C,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,qBAAqB,EAAE,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC3F,gEAAgE;YAChE,qBAAqB,EAAE,IAAI,CAAC,wBAAwB;gBAClD,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;gBAChD,CAAC,CAAC,IAAI;YACR,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;YACtC,uBAAuB,EAAE,IAAI,CAAC,0BAA0B,IAAI,MAAM;YAClE,UAAU,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACpC,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,uEAAuE;QACvE,kEAAkE;QAClE,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACnD,CAAC,EAAE,MAAM,CAAC,SAAS;YACnB,CAAC,EAAE,MAAM,CAAC,WAAW;YACrB,EAAE,EAAE,MAAM,CAAC,aAAa;YACxB,CAAC,EAAE,MAAM,CAAC,KAAK;YACf,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/D,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,EAAuB;QAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpF,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YAC/C,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;YACzB,QAAQ,EAAE,EAAE,CAAC,CAAC;YACd,MAAM;YACN,WAAW,EAAE,EAAE,CAAC,CAAC;YACjB,aAAa,EAAE,EAAE,CAAC,EAAE;YACpB,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,IAAI;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,IAAI;YACvB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,EAAE,CAAC,CAAC;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,iBAAyB;QAEzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;aAChE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/F,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EAAE,yDAAyD;IACjF,WAAoB,EACpB,SAAe;QAEf,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,2CAA2C;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,EACzD,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAC7C,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EACjC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CACzC,CACF;aACA,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,WAAW,IAAI,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,SAAe;QAEf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,EACzD,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAC1C,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC9B,CACF;aACA,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,kDAAkD;QAClD,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACtB,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;YACtF,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC;YACN,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,SAAS,EAAE,KAAK,CAAC,KAAK;SACvB,CAAC;aACD,IAAI,CAAC,WAAW,CAAC;aACjB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EACjD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EAC7B,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAC/B,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,CAAC,CAAC;QAC3E,CAAC;QACD,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE;aACT,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aACjC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YACrD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;SACxD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACf,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACf,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAC1C,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EAC7B,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAClF,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAc,EACd,QAAgB,EAChB,KAAoB,EACpB,QAAuB;QAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3F,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAC1C,EAAE,CACA,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,EACxC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAC7E,CACF,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YAC5C,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC;YACvC,gBAAgB,EAAE,SAAS,CAAC,YAAY,CAAC;YACzC,QAAQ;YACR,MAAM;YACN,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC;YACxC,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5C,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC"}

package/dist/modules/mcp/oauth/oauth-consent.routes.d.ts

@@ -0,0 +1,18 @@
+import express from 'express';
+import type { BevelOAuthProvider } from './bevel-oauth-provider.js';
+import '../../auth/auth.middleware.js';
+export interface OAuthConsentRoutesDeps {
+    provider: BevelOAuthProvider;
+    /** Same HMAC secret the provider signs the authorize state with. */
+    stateSecret: string;
+}
+/**
+ * The authenticated tail of the MCP OAuth flow. `/authorize` (SDK-owned)
+ * validated the client's request, packed it into a signed state, and sent the
+ * browser to the SPA's `/connect?oauth=<state>` page; these routes are what
+ * that page calls. Mounted behind the regular JWT middleware — a browser
+ * landing from the redirect chain authenticates via the HttpOnly bevel_token
+ * cookie fallback, so THIS is where a Bevel user attaches to the flow.
+ */
+export declare function createOAuthConsentRoutes(deps: OAuthConsentRoutesDeps): express.Router;
+//# sourceMappingURL=oauth-consent.routes.d.ts.map

package/dist/modules/mcp/oauth/oauth-consent.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-consent.routes.d.ts","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/oauth-consent.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,+BAA+B,CAAC;AAEvC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAwCrF"}

package/dist/modules/mcp/oauth/oauth-consent.routes.js

@@ -0,0 +1,52 @@
+import express from 'express';
+import { verifyAuthRequest } from './oauth-state.js';
+import '../../auth/auth.middleware.js'; // Express Request augmentation (req.userId / req.userEmail)
+/**
+ * The authenticated tail of the MCP OAuth flow. `/authorize` (SDK-owned)
+ * validated the client's request, packed it into a signed state, and sent the
+ * browser to the SPA's `/connect?oauth=<state>` page; these routes are what
+ * that page calls. Mounted behind the regular JWT middleware — a browser
+ * landing from the redirect chain authenticates via the HttpOnly bevel_token
+ * cookie fallback, so THIS is where a Bevel user attaches to the flow.
+ */
+export function createOAuthConsentRoutes(deps) {
+    const router = express.Router();
+    // Describe the pending authorization so /connect can say who's asking.
+    router.get('/mcp/oauth/request', async (req, res) => {
+        if (!req.userId)
+            return void res.status(401).json({ error: 'Not authenticated' });
+        const raw = typeof req.query.state === 'string' ? req.query.state : '';
+        const st = raw ? verifyAuthRequest(deps.stateSecret, raw) : null;
+        if (!st)
+            return void res.status(400).json({ error: 'Invalid or expired authorization request. Restart the connection from your agent.' });
+        const client = await deps.provider.clientsStore.getClient(st.c);
+        res.json({
+            clientName: client?.client_name ?? null,
+            scope: st.sc ?? null,
+            resource: st.rs ?? null,
+        });
+    });
+    // Finish: the user is done configuring tools on /connect — issue the
+    // one-time code bound to them and hand the SPA the client redirect.
+    router.post('/mcp/oauth/complete', async (req, res) => {
+        const userId = req.userId;
+        if (!userId)
+            return void res.status(401).json({ error: 'Not authenticated' });
+        const raw = typeof (req.body ?? {}).state === 'string' ? req.body.state : '';
+        const st = raw ? verifyAuthRequest(deps.stateSecret, raw) : null;
+        if (!st)
+            return void res.status(400).json({ error: 'Invalid or expired authorization request. Restart the connection from your agent.' });
+        try {
+            const { redirectTo } = await deps.provider.issueAuthCode(userId, st);
+            res.json({ redirectTo });
+        }
+        catch (err) {
+            // Message only — the raw error object can carry sensitive context
+            // (redirect URIs with tokens, DB details) that must not hit stdout.
+            console.error(`[mcp-oauth] complete failed for client=${st.c}:`, err instanceof Error ? err.message : String(err));
+            res.status(500).json({ error: 'Internal error' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=oauth-consent.routes.js.map

package/dist/modules/mcp/oauth/oauth-consent.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-consent.routes.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/oauth-consent.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,+BAA+B,CAAC,CAAC,4DAA4D;AAQpG;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mFAAmF,EAAE,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI;YACvC,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,IAAI;YACpB,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,IAAI;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mFAAmF,EAAE,CAAC,CAAC;QAC1I,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CACX,0CAA0C,EAAE,CAAC,CAAC,GAAG,EACjD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/mcp/oauth/oauth-state.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Signed carrier for a validated MCP OAuth authorization request across the
+ * browser round-trip: `/authorize` packs the request into this state and
+ * redirects to the SPA's `/connect?oauth=<state>`; the Finish endpoint
+ * verifies it and issues the auth code. Same HMAC-base64url-JSON shape as the
+ * secrets-vault OAuth state (see secrets-vault.routes.ts) — kept separate
+ * because the payload differs and the two flows must not accept each other's
+ * tokens (different field sets make cross-verification fail structurally).
+ *
+ * The state carries NO user identity: the user is whoever the Finish
+ * endpoint authenticates (JWT or the bevel_token cookie). It only pins the
+ * client's request so the issued code binds to exactly what was validated.
+ */
+export interface McpAuthRequestState {
+    /** client_id of the registered OAuth client. */
+    c: string;
+    /** redirect_uri (already validated against the client's registration). */
+    r: string;
+    /** PKCE code_challenge (S256 — the SDK authorize handler enforces it). */
+    cc: string;
+    /** The client's own `state` parameter, echoed back on the code redirect. */
+    s?: string;
+    /** Requested scope (space-joined). */
+    sc?: string;
+    /** RFC 8707 resource indicator, if the client sent one. */
+    rs?: string;
+    /** Issued-at (epoch ms). */
+    iat: number;
+}
+export declare function signAuthRequest(secret: string, state: Omit<McpAuthRequestState, 'iat'>): string;
+export declare function verifyAuthRequest(secret: string, token: string): McpAuthRequestState | null;
+//# sourceMappingURL=oauth-state.d.ts.map

package/dist/modules/mcp/oauth/oauth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.d.ts","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/oauth-state.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,CAAC,EAAE,MAAM,CAAC;IACV,0EAA0E;IAC1E,CAAC,EAAE,MAAM,CAAC;IACV,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAOD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,GAAG,MAAM,CAK/F;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAgB3F"}

package/dist/modules/mcp/oauth/oauth-state.js

@@ -0,0 +1,34 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+// Generous enough for the user to configure several tools on /connect, short
+// enough that a leaked link goes stale the same session.
+const STATE_MAX_AGE_MS = 30 * 60_000;
+const STATE_SKEW_MS = 60_000;
+export function signAuthRequest(secret, state) {
+    const full = { ...state, iat: Date.now() };
+    const body = Buffer.from(JSON.stringify(full)).toString('base64url');
+    const sig = createHmac('sha256', secret).update(body).digest('base64url');
+    return `${body}.${sig}`;
+}
+export function verifyAuthRequest(secret, token) {
+    const [body, sig] = token.split('.');
+    if (!body || !sig)
+        return null;
+    const expected = createHmac('sha256', secret).update(body).digest('base64url');
+    const a = Buffer.from(sig);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString());
+        if (typeof parsed.iat !== 'number' || !parsed.c || !parsed.r || !parsed.cc)
+            return null;
+        const age = Date.now() - parsed.iat;
+        if (age > STATE_MAX_AGE_MS || age < -STATE_SKEW_MS)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-state.js.map

package/dist/modules/mcp/oauth/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/oauth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgC1D,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrC,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAuC;IACrF,MAAM,IAAI,GAAwB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAa;IAC7D,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAwB,CAAC;QAC5F,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QACpC,IAAI,GAAG,GAAG,gBAAgB,IAAI,GAAG,GAAG,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}