npm - @bevel-software/platform-core-backend - Versions diffs - 0.1.0 - Mend

@bevel-software/platform-core-backend 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (720) hide show

package/dist/modules/secrets-vault/db-secrets-vault.service.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"db-secrets-vault.service.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/db-secrets-vault.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EASL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAErC,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,oEAAoE;AACpE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,0FAA0F;AAC1F,MAAM,wBAAwB,GAAG,MAAM,CAAC;AA6BxC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAqB;IAIb;IAEA;IACA;IAOA;IAbX,cAAc,GAAuB,IAAI,CAAC;IAElD,YACmB,EAAY;IAC7B,yFAAyF;IACxE,MAAc,EACd,MAAoB,IAAI,CAAC,GAAG;IAC7C;;;;;OAKG;IACc,OAA+B;QAV/B,OAAE,GAAF,EAAE,CAAU;QAEZ,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAyB;QAO5B,YAAO,GAAP,OAAO,CAAwB;IAC/C,CAAC;IAEJ,kGAAkG;IAC1F,MAAM;QACZ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAC1B,iGAAiG,CAClG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACjC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,EAAU;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA2B;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,aAAa,aAAa,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1D,yEAAyE;QACzE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aAC/E,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;YACrC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SACvF,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA6B;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;aACxE,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;YACrC,wEAAwE;YACxE,kEAAkE;YAClE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChF,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,EAAU;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAiC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,aAAa,aAAa,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1D,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACrF,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SACvF,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aACxD,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,GAAW;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aAC5D,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,IAAc;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YACvE,iFAAiF;YACjF,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnG,OAAO;gBACL,GAAG;gBACH,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;gBACrE,cAAc,EAAE,CAAC,CAAC,OAAO;gBACzB,sEAAsE;gBACtE,cAAc,EAAE,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBACrF,+EAA+E;gBAC/E,+EAA+E;gBAC/E,aAAa,EAAE,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,cAAsB;QAC3C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,EAAU,EAAE,WAAmB,EAAE,KAAa;QAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,eAAmC,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAc,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC3F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,+EAA+E;QAC/E,gFAAgF;QAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,eAAe;YACf,WAAW;YACX,cAAc;YACd,OAAO;YACP,OAAO;YACP,gBAAgB;YAChB,uBAAuB;YACvB,UAAU;SACX,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,EAAU,EAAE,IAAY,EAAE,WAAmB;QAC/E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5D,gFAAgF;QAChF,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC3F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,KAIhC;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAClE,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC3D,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;aACpF,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SACzE,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAMzB;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,8EAA8E;QAC9E,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,mDAAmD,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,gBAAgB,CAAC,mDAAmD,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACpC,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,6EAA6E;QAC7E,8EAA8E;QAC9E,+EAA+E;QAC/E,gFAAgF;QAChF,0DAA0D;QAC1D,IAAI,cAAyC,CAAC;QAC9C,IACE,eAAe,EAAE,IAAI,KAAK,OAAO;YACjC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAC9E,CAAC;YACD,IAAI,CAAC;gBACH,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,+CAA+C;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtF,+EAA+E;QAC/E,iFAAiF;QACjF,wEAAwE;QACxE,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;QAC3G,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aACxG,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;YACrC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC3F,CAAC;aACD,SAAS,EAAE,CAAC;QAEf,2EAA2E;QAC3E,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,eAAe;YACf,WAAW;YACX,cAAc;YACd,OAAO;YACP,OAAO;YACP,gBAAgB;YAChB,uBAAuB;YACvB,UAAU;SACX,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,GAAW;QACvC,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;QACrD,MAAM,WAAW,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aAC7C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,YAAY;YAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;QAE7D,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,GAAG,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3G,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,4BAA4B;QAEnF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,SAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,sEAAsE;YACtE,+DAA+D;YAC/D,qEAAqE;YACrE,yEAAyE;YACzE,0DAA0D;YAC1D,IACE,GAAG,YAAY,gBAAgB;gBAC/B,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,EAC1D,CAAC;gBACD,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC5D,kEAAkE;gBAClE,+DAA+D;gBAC/D,qEAAqE;gBACrE,sEAAsE;gBACtE,uCAAuC;gBACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;qBACxB,MAAM,CAAC,OAAO,CAAC;qBACf,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBAC3F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;qBAClF,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;yBAC5B,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;yBAClD,IAAI,CAAC,OAAO,CAAC;yBACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;yBAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;oBACZ,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBACrE,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;oBAC7C,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,sDAAsD;YACtD,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,CAAC;QACD,uEAAuE;QACvE,IAAI,CAAC,SAAS,CAAC,aAAa;YAAE,SAAS,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7E,6EAA6E;QAC7E,qEAAqE;QACrE,IAAI,CAAC,SAAS,CAAC,KAAK;YAAE,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE/E,8EAA8E;QAC9E,+EAA+E;QAC/E,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC3F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,SAAS,CAAC,YAAY,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAI5B;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;YAC/E,yDAAyD;YACzD,0EAA0E;YAC1E,yEAAyE;aACxE,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SACzE,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,GAAW;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAqB;QAChE,8EAA8E;QAC9E,+EAA+E;QAC/E,IAAI,CAAC;YACH,kBAAkB,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,4EAA4E;gBAC5E,8EAA8E;gBAC9E,QAAQ,EAAE,OAAO;gBACjB,4EAA4E;gBAC5E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GACP,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;gBACjD,CAAC,CAAC,kCAAkC,wBAAwB,IAAI;gBAChE,CAAC,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACtF,UAAU,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/E,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC7E,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,EAAU;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,EAAU;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,cAAsB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAc,CAAC;IAC3E,CAAC;IAEO,QAAQ,CAAC,GAAY;QAE3B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACpD,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO;YACL,gBAAgB;YAChB,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACxE,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;gBACpD,CAAC,CAAE,IAAI,CAAC,UAAqC;gBAC7C,CAAC,CAAC,SAAS;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YACxB,YAAY,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI;YACxC,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACzF,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,CAAsB;QAC/C,OAAO;YACL,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;YAC9B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,CAAU;QAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,UAAU,GACd,GAAG,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;YAClD,CAAC,CAAE,GAAG,CAAC,UAAqC;YAC5C,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,gBAAgB;YAChB,QAAQ;YACR,QAAQ;YACR,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YACjF,MAAM;YACN,UAAU;YACV,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI;YACvB,YAAY,EAAE,GAAG,CAAC,YAAY,KAAK,IAAI;YACvC,wEAAwE;YACxE,8EAA8E;YAC9E,QAAQ,EACN,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;gBACrD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;gBAC3C,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,KAAc,EAAE,KAAa;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC;YACH,kBAAkB,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,aAAa,CAAC,MAAe;QACnC,MAAM,OAAO,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,GAAY;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;YAAE,MAAM,IAAI,kBAAkB,CAAC,eAAe,WAAW,aAAa,CAAC,CAAC;QACxG,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,uDAAuD,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,aAAa,aAAa,CAAC,CAAC;QAC9G,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,SAAS,CAAC,GAAgC;QAChD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAuB,CAAC;QAC/E,MAAM,OAAO,GAAkB;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI;YACJ,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,8CAA8C;AAC9C,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC"}

package/dist/modules/secrets-vault/index.d.ts ADDED Viewed

@@ -0,0 +1,7 @@
+export { DbSecretsVaultService } from './db-secrets-vault.service.js';
+export { McpOAuthDiscoveryService, type McpAuthDiscovery } from './mcp-oauth-discovery.service.js';
+export { createSecretsVaultRoutes, createSecretsVaultPublicRoutes, type SecretsVaultRoutesDeps, } from './secrets-vault.routes.js';
+export type { ISecretsVaultService, SecretSummary, SecretKind, OAuthProviderConfig, PutStaticSecretInput, CreateOAuthSecretInput, } from './secrets-vault.contract.js';
+export { InvalidSecretError, SecretNotFoundError, SecretOAuthError, } from './secrets-vault.contract.js';
+export { registerBevelSecretsVariableLoader, bevelSecretsLoaderConfig, BEVEL_SECRETS_LOADER_TYPE, } from './secrets-variable-loader.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/secrets-vault/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC"}

package/dist/modules/secrets-vault/index.js ADDED Viewed

@@ -0,0 +1,6 @@
+export { DbSecretsVaultService } from './db-secrets-vault.service.js';
+export { McpOAuthDiscoveryService } from './mcp-oauth-discovery.service.js';
+export { createSecretsVaultRoutes, createSecretsVaultPublicRoutes, } from './secrets-vault.routes.js';
+export { InvalidSecretError, SecretNotFoundError, SecretOAuthError, } from './secrets-vault.contract.js';
+export { registerBevelSecretsVariableLoader, bevelSecretsLoaderConfig, BEVEL_SECRETS_LOADER_TYPE, } from './secrets-variable-loader.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/secrets-vault/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAyB,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AASnC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC"}

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts ADDED Viewed

@@ -0,0 +1,63 @@
+import type { ISecretsVaultService, OAuthProviderConfig } from './secrets-vault.contract.js';
+export type McpAuthDiscovery =
+/** The server answered without demanding auth — nothing to configure. */
+{
+    status: 'open';
+}
+/** OAuth discovered (or already registered); per-user sign-in via the vault. */
+ | {
+    status: 'oauth';
+    provider: OAuthProviderConfig;
+}
+/** The server wants auth but the spec chain didn't complete — leave the tool as-is. */
+ | {
+    status: 'unsupported';
+    reason: string;
+};
+/**
+ * Zero-config OAuth for `type: mcp` `.tool`s — the MCP authorization spec makes
+ * everything a bare `url` needs discoverable, so a tool file shouldn't have to
+ * declare any of it. Given a manual that points at a remote MCP server:
+ *
+ *   1. probe the server — no 401 ⇒ it's open, done;
+ *   2. on 401, follow RFC 9728: the protected-resource metadata (from the
+ *      `WWW-Authenticate: resource_metadata` pointer or the well-known paths)
+ *      names the authorization server;
+ *   3. fetch the AS metadata, dynamically register (RFC 7591) as a PUBLIC
+ *      client — PKCE only, no client secret — with our existing secrets-vault
+ *      callback as the redirect URI;
+ *   4. persist the discovered provider as the SHARED vault row under the
+ *      synthetic key `<manual>_MCP_OAUTH`.
+ *
+ * From there the standard tool-OAuth machinery takes over unchanged: /connect
+ * shows an Authorize button (the manual is decorated with a synthetic
+ * user-scoped oauth variable), `beginToolOAuthByKey` provisions the caller's
+ * row from the shared one, and the UTCP variable loader injects the fresh
+ * access token into the manual's `Authorization` header at call time.
+ *
+ * Every fetch is SSRF-guarded (https-only, no redirects, bounded) — these URLs
+ * originate from user-authored `.tool` files and remote servers' own metadata.
+ */
+export declare class McpOAuthDiscoveryService {
+    private readonly deps;
+    private readonly cache;
+    private readonly inflight;
+    constructor(deps: {
+        secretsVault: ISecretsVaultService;
+        /** Our OAuth callback (`<publicBackendUrl>/api/secrets/oauth/callback`) — the DCR redirect_uri. */
+        redirectUri: string;
+        now?: () => number;
+        fetchFn?: typeof fetch;
+    });
+    private now;
+    /** The vault key the discovered provider (and each user's tokens) live under. */
+    static keyFor(manualName: string): string;
+    statusFor(manualName: string, mcpUrl: string): Promise<McpAuthDiscovery>;
+    private remember;
+    private discover;
+    private discoverFresh;
+    private fetchRaw;
+    /** GET a metadata document; null on any failure (fall through to the next candidate). */
+    private fetchJson;
+}
+//# sourceMappingURL=mcp-oauth-discovery.service.d.ts.map

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"mcp-oauth-discovery.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/mcp-oauth-discovery.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAI7F,MAAM,MAAM,gBAAgB;AAC1B,yEAAyE;AACvE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB,gFAAgF;GAC9E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE;AACpD,uFAAuF;GACrF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ9C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsE;IAC5F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;gBAGtD,IAAI,EAAE;QACrB,YAAY,EAAE,oBAAoB,CAAC;QACnC,mGAAmG;QACnG,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;KACxB;IAGH,OAAO,CAAC,GAAG;IAIX,iFAAiF;IACjF,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAInC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAY9E,OAAO,CAAC,QAAQ;YAMF,QAAQ;YAgCR,aAAa;YAiJb,QAAQ;IAUtB,yFAAyF;YAC3E,SAAS;CAUxB"}

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js ADDED Viewed

@@ -0,0 +1,269 @@
+import { assertSafeFetchUrl } from '../../shared/ssrf.js';
+import { utcpNamespacedKey, MCP_OAUTH_VAR } from '../../shared/utcp-namespace.js';
+const FETCH_TIMEOUT_MS = 5_000;
+/** Re-probe an open/unsupported server after this long (it may grow/lose auth). */
+const NEGATIVE_TTL_MS = 5 * 60_000;
+/** A discovered provider is durable (shared vault row); cache is just DB-pressure relief. */
+const OAUTH_TTL_MS = 60 * 60_000;
+/**
+ * Zero-config OAuth for `type: mcp` `.tool`s — the MCP authorization spec makes
+ * everything a bare `url` needs discoverable, so a tool file shouldn't have to
+ * declare any of it. Given a manual that points at a remote MCP server:
+ *
+ *   1. probe the server — no 401 ⇒ it's open, done;
+ *   2. on 401, follow RFC 9728: the protected-resource metadata (from the
+ *      `WWW-Authenticate: resource_metadata` pointer or the well-known paths)
+ *      names the authorization server;
+ *   3. fetch the AS metadata, dynamically register (RFC 7591) as a PUBLIC
+ *      client — PKCE only, no client secret — with our existing secrets-vault
+ *      callback as the redirect URI;
+ *   4. persist the discovered provider as the SHARED vault row under the
+ *      synthetic key `<manual>_MCP_OAUTH`.
+ *
+ * From there the standard tool-OAuth machinery takes over unchanged: /connect
+ * shows an Authorize button (the manual is decorated with a synthetic
+ * user-scoped oauth variable), `beginToolOAuthByKey` provisions the caller's
+ * row from the shared one, and the UTCP variable loader injects the fresh
+ * access token into the manual's `Authorization` header at call time.
+ *
+ * Every fetch is SSRF-guarded (https-only, no redirects, bounded) — these URLs
+ * originate from user-authored `.tool` files and remote servers' own metadata.
+ */
+export class McpOAuthDiscoveryService {
+    deps;
+    cache = new Map();
+    inflight = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    /** The vault key the discovered provider (and each user's tokens) live under. */
+    static keyFor(manualName) {
+        return utcpNamespacedKey(manualName, MCP_OAUTH_VAR);
+    }
+    async statusFor(manualName, mcpUrl) {
+        const key = McpOAuthDiscoveryService.keyFor(manualName);
+        const cached = this.cache.get(key);
+        if (cached && cached.expiresAt > this.now())
+            return cached.result;
+        let pending = this.inflight.get(key);
+        if (!pending) {
+            pending = this.discover(key, manualName, mcpUrl).finally(() => this.inflight.delete(key));
+            this.inflight.set(key, pending);
+        }
+        return pending;
+    }
+    remember(key, result) {
+        const ttl = result.status === 'oauth' ? OAUTH_TTL_MS : NEGATIVE_TTL_MS;
+        this.cache.set(key, { result, expiresAt: this.now() + ttl });
+        return result;
+    }
+    async discover(key, manualName, mcpUrl) {
+        // A prior discovery (any replica, any boot) already registered a client —
+        // NEVER re-register: a new client_id would orphan every user's tokens.
+        // Fail CLOSED on a lookup error: a vault/DB blip must not read as "no
+        // provider exists", or we'd fall through to fresh RFC 7591 registration
+        // and orphan those tokens. Returned uncached so the next call retries
+        // once the store recovers.
+        let existing;
+        try {
+            existing = await this.deps.secretsVault.getSharedOAuthProvider(key);
+        }
+        catch (err) {
+            const reason = `provider lookup failed (not re-registering): ${err instanceof Error ? err.message : String(err)}`;
+            console.warn(`[mcp-oauth-discovery] "${manualName}" (${mcpUrl}): ${reason}`);
+            return { status: 'unsupported', reason };
+        }
+        if (existing)
+            return this.remember(key, { status: 'oauth', provider: existing });
+        let result;
+        try {
+            result = await this.discoverFresh(manualName, key, mcpUrl);
+        }
+        catch (err) {
+            result = {
+                status: 'unsupported',
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (result.status === 'unsupported') {
+            console.warn(`[mcp-oauth-discovery] "${manualName}" (${mcpUrl}): ${result.reason}`);
+        }
+        return this.remember(key, result);
+    }
+    async discoverFresh(manualName, key, mcpUrl) {
+        // 1. Probe: an unauthenticated initialize. A 401/403, or ANY response
+        //    carrying a `WWW-Authenticate` challenge, means the server wants OAuth;
+        //    a redirect to a login page (fetch throws under `redirect:'error'`)
+        //    counts too. Anything else means it served us without auth — nothing to
+        //    configure. `allow401` short-circuits `fetchRaw`'s ok/redirect handling
+        //    so the challenge itself is inspected rather than thrown.
+        let probe;
+        try {
+            probe = await this.fetchRaw(mcpUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json, text/event-stream',
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: 0,
+                    method: 'initialize',
+                    params: {
+                        protocolVersion: '2025-03-26',
+                        capabilities: {},
+                        clientInfo: { name: 'bevel-discovery', version: '0.0.0' },
+                    },
+                }),
+            });
+        }
+        catch (err) {
+            // A redirect to a login page (or a network refusal) — treat a redirect as
+            // "auth wanted" and keep going from the well-known metadata; a genuine
+            // network failure surfaces as unsupported.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!/redirect/i.test(msg))
+                return { status: 'unsupported', reason: `probe failed: ${msg}` };
+            probe = new Response(null, { status: 401 });
+        }
+        // 2. Protected-resource metadata (RFC 9728): prefer the server's own
+        //    pointer in the challenge, else the well-known locations. Fetch this
+        //    BEFORE deciding — a server can require OAuth for tool CALLS while
+        //    letting an unauthenticated `initialize` through (Google's gmail/
+        //    calendar MCP return 200 to initialize but still publish a PRM doc), so
+        //    the probe status alone is not a reliable "needs auth" signal.
+        const prmUrl = parseResourceMetadataUrl(probe.headers.get('www-authenticate')) ??
+            undefined;
+        const base = new URL(mcpUrl);
+        const prmCandidates = prmUrl
+            ? [prmUrl]
+            : [
+                new URL(`/.well-known/oauth-protected-resource${base.pathname === '/' ? '' : base.pathname}`, base).toString(),
+                new URL('/.well-known/oauth-protected-resource', base).toString(),
+            ];
+        let prm = null;
+        for (const candidate of prmCandidates) {
+            prm = await this.fetchJson(candidate);
+            if (prm)
+                break;
+        }
+        // Wants OAuth iff the probe demanded it (401/403/challenge) OR the server
+        // publishes protected-resource metadata. Neither → genuinely open.
+        const wantsAuth = probe.status === 401 ||
+            probe.status === 403 ||
+            probe.headers.get('www-authenticate') != null ||
+            prm != null;
+        if (!wantsAuth)
+            return { status: 'open' };
+        const authServers = Array.isArray(prm?.authorization_servers)
+            ? prm.authorization_servers.filter((s) => typeof s === 'string')
+            : [];
+        // MCP pre-RFC9728 fallback: the resource server's own origin is the AS.
+        const issuer = authServers[0] ?? base.origin;
+        const resource = typeof prm?.resource === 'string' ? prm.resource : mcpUrl;
+        const scopes = Array.isArray(prm?.scopes_supported) ? prm.scopes_supported.map(String) : undefined;
+        // 3. Authorization-server metadata (RFC 8414; OIDC discovery as fallback).
+        const issuerUrl = new URL(issuer);
+        const issuerPath = issuerUrl.pathname === '/' ? '' : issuerUrl.pathname;
+        const asCandidates = [
+            new URL(`/.well-known/oauth-authorization-server${issuerPath}`, issuerUrl).toString(),
+            new URL(`${issuerPath}/.well-known/openid-configuration`, issuerUrl).toString(),
+        ];
+        let asMeta = null;
+        for (const candidate of asCandidates) {
+            asMeta = await this.fetchJson(candidate);
+            if (asMeta)
+                break;
+        }
+        if (!asMeta) {
+            return { status: 'unsupported', reason: `no authorization-server metadata at ${issuer}` };
+        }
+        const authorizationUrl = typeof asMeta.authorization_endpoint === 'string' ? asMeta.authorization_endpoint : '';
+        const tokenUrl = typeof asMeta.token_endpoint === 'string' ? asMeta.token_endpoint : '';
+        const registrationUrl = typeof asMeta.registration_endpoint === 'string' ? asMeta.registration_endpoint : '';
+        if (!authorizationUrl || !tokenUrl) {
+            return { status: 'unsupported', reason: 'authorization-server metadata is missing endpoints' };
+        }
+        if (!registrationUrl) {
+            return {
+                status: 'unsupported',
+                reason: 'server requires sign-in but does not support automatic client registration — declare the oauth provider in the .tool file instead',
+            };
+        }
+        // 4. Dynamic client registration (RFC 7591), as a PUBLIC client: PKCE
+        //    carries the proof, no secret to store or leak.
+        assertSafeFetchUrl(registrationUrl, { requireHttps: true, label: 'registration_endpoint' });
+        const regRes = await this.fetchRaw(registrationUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({
+                client_name: 'Bevel Knowledge Base',
+                redirect_uris: [this.deps.redirectUri],
+                grant_types: ['authorization_code', 'refresh_token'],
+                response_types: ['code'],
+                token_endpoint_auth_method: 'none',
+            }),
+        });
+        if (!regRes.ok) {
+            return { status: 'unsupported', reason: `client registration failed: HTTP ${regRes.status}` };
+        }
+        const reg = (await regRes.json().catch(() => null));
+        const clientId = typeof reg?.client_id === 'string' ? reg.client_id : '';
+        if (!clientId) {
+            return { status: 'unsupported', reason: 'client registration returned no client_id' };
+        }
+        const clientSecret = typeof reg?.client_secret === 'string' && reg.client_secret ? reg.client_secret : undefined;
+        const provider = {
+            authorizationUrl,
+            tokenUrl,
+            clientId,
+            clientSecret,
+            scopes,
+            pkce: true,
+            publicClient: !clientSecret,
+            resource,
+        };
+        await this.deps.secretsVault.putSharedOAuthProvider({
+            key,
+            label: `${manualName} sign-in`,
+            provider,
+        });
+        // Return the stored (public) shape — no secret rides in cache entries.
+        const publicProvider = { ...provider };
+        delete publicProvider.clientSecret;
+        return { status: 'oauth', provider: publicProvider };
+    }
+    async fetchRaw(url, init) {
+        assertSafeFetchUrl(url, { requireHttps: true, label: 'mcp discovery url' });
+        const fetchFn = this.deps.fetchFn ?? fetch;
+        return fetchFn(url, {
+            ...init,
+            redirect: 'error',
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+    }
+    /** GET a metadata document; null on any failure (fall through to the next candidate). */
+    async fetchJson(url) {
+        try {
+            const res = await this.fetchRaw(url, { method: 'GET', headers: { Accept: 'application/json' } });
+            if (!res.ok)
+                return null;
+            const json = (await res.json());
+            return json && typeof json === 'object' ? json : null;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+/** Extract `resource_metadata="…"` from a WWW-Authenticate challenge (RFC 9728 §5.1). */
+function parseResourceMetadataUrl(header) {
+    if (!header)
+        return null;
+    const match = /resource_metadata\s*=\s*"([^"]+)"/i.exec(header);
+    return match ? match[1] : null;
+}
+//# sourceMappingURL=mcp-oauth-discovery.service.js.map

package/dist/modules/secrets-vault/mcp-oauth-discovery.service.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"mcp-oauth-discovery.service.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/mcp-oauth-discovery.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAUlF,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,mFAAmF;AACnF,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AACnC,6FAA6F;AAC7F,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,wBAAwB;IAKhB;IAJF,KAAK,GAAG,IAAI,GAAG,EAA2D,CAAC;IAC3E,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IAEzE,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEI,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,MAAM,CAAC,UAAkB;QAC9B,OAAO,iBAAiB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,MAAc;QAChD,MAAM,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAClE,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,MAAwB;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,UAAkB,EAAE,MAAc;QACpE,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,2BAA2B;QAC3B,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClH,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,MAAM,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;YAC7E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEjF,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,0BAA0B,UAAU,MAAM,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,GAAW,EAAE,MAAc;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAClC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,qCAAqC;iBAC9C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,YAAY,EAAE,EAAE;wBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;qBAC1D;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,EAAE,CAAC;YAC7F,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GACV,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC/D,SAAS,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,aAAa,GAAG,MAAM;YAC1B,CAAC,CAAC,CAAC,MAAM,CAAC;YACV,CAAC,CAAC;gBACE,IAAI,GAAG,CAAC,wCAAwC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;gBAC9G,IAAI,GAAG,CAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;aAClE,CAAC;QACN,IAAI,GAAG,GAAmC,IAAI,CAAC;QAC/C,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,MAAM;QACjB,CAAC;QACD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;YAC7C,GAAG,IAAI,IAAI,CAAC;QACd,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC;YAC3D,CAAC,CAAC,GAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,wEAAwE;QACxE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpG,2EAA2E;QAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;QACxE,MAAM,YAAY,GAAG;YACnB,IAAI,GAAG,CAAC,0CAA0C,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;YACrF,IAAI,GAAG,CAAC,GAAG,UAAU,mCAAmC,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;SAChF,CAAC;QACF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,MAAM;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,uCAAuC,MAAM,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EACJ,mIAAmI;aACtI,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,oDAAoD;QACpD,kBAAkB,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,sBAAsB;gBACnC,aAAa,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBACtC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;aACnC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,QAAQ,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,GAAG,EAAE,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjH,MAAM,QAAQ,GAAwB;YACpC,gBAAgB;YAChB,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,CAAC,YAAY;YAC3B,QAAQ;SACT,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC;YAClD,GAAG;YACH,KAAK,EAAE,GAAG,UAAU,UAAU;YAC9B,QAAQ;SACT,CAAC,CAAC;QACH,uEAAuE;QACvE,MAAM,cAAc,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC,YAAY,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAiB;QACnD,kBAAkB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,yFAAyF;AACzF,SAAS,wBAAwB,CAAC,MAAqB;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/modules/secrets-vault/secrets-variable-loader.d.ts ADDED Viewed

@@ -0,0 +1,46 @@
+import { type VariableLoader } from '@utcp/sdk';
+import type { ISecretsVaultService } from './secrets-vault.contract.js';
+/**
+ * The `bevel-secrets` UTCP variable loader — the swappable seam that lets any
+ * UTCP client resolve `${VAR}` placeholders from the Secrets Vault at tool-call
+ * time (lazily, so OAuth tokens are refreshed on demand).
+ *
+ * UTCP resolves a variable in three tiers (see `DefaultVariableSubstitutor`):
+ * `config.variables` (exact) → each `config.load_variables_from` loader's
+ * async `get()` → `process.env`. We seed a per-user loader instance here so any
+ * tool var not already in `config.variables` (the reserved `API_URL` /
+ * `CONNECTION_KEY`) is resolved from this user's secrets.
+ *
+ * The `UtcpClient.create` path re-validates the whole config through the
+ * serializer registry, so a loader can't be handed in as a bare live object — it
+ * must round-trip through a registered serializer. We therefore put a plain
+ * descriptor `{ variable_loader_type, user_id }` in `load_variables_from` (via
+ * {@link bevelSecretsLoaderConfig}) and let the registered serializer rebuild a
+ * live loader bound to the process-wide vault. Swapping the vault backend (e.g.
+ * to a client's external secret manager) is just a different
+ * `ISecretsVaultService` passed to {@link registerBevelSecretsVariableLoader}.
+ */
+export declare const BEVEL_SECRETS_LOADER_TYPE = "bevel_secrets";
+export declare class BevelSecretsVariableLoader implements VariableLoader {
+    readonly variable_loader_type = "bevel_secrets";
+    readonly user_id: string;
+    [key: string]: unknown;
+    constructor(userId: string);
+    /**
+     * Resolve `effectiveKey` — the UTCP-namespaced `<manual>_<VAR>` — against the
+     * vault VERBATIM. Preserving the manual prefix binds a secret to exactly ONE
+     * manual: another manual referencing the same bare `${VAR}` forms a different
+     * key and misses. This is the per-manual isolation UTCP's namespacing gives us
+     * — we intentionally do NOT strip the prefix, so a malicious `.tool` can't
+     * harvest a secret the user configured for a different manual.
+     */
+    get(effectiveKey: string): Promise<string | null>;
+}
+/**
+ * Bind the process-wide vault the reconstructed loaders read through. Called
+ * once at composition time; before it runs, loaders resolve to null.
+ */
+export declare function registerBevelSecretsVariableLoader(secretsVault: ISecretsVaultService): void;
+/** The plain descriptor to place in a `UtcpClientConfig.load_variables_from` for a given user. */
+export declare function bevelSecretsLoaderConfig(userId: string): Record<string, unknown>;
+//# sourceMappingURL=secrets-variable-loader.d.ts.map

package/dist/modules/secrets-vault/secrets-variable-loader.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"secrets-variable-loader.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-variable-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAwC,MAAM,WAAW,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AASzD,qBAAa,0BAA2B,YAAW,cAAc;IAC/D,QAAQ,CAAC,oBAAoB,mBAA6B;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;gBAEX,MAAM,EAAE,MAAM;IAI1B;;;;;;;OAOG;IACG,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAcxD;AA4BD;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAE3F;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhF"}

package/dist/modules/secrets-vault/secrets-variable-loader.js ADDED Viewed

@@ -0,0 +1,87 @@
+import { VariableLoaderSerializer, Serializer } from '@utcp/sdk';
+/**
+ * The `bevel-secrets` UTCP variable loader — the swappable seam that lets any
+ * UTCP client resolve `${VAR}` placeholders from the Secrets Vault at tool-call
+ * time (lazily, so OAuth tokens are refreshed on demand).
+ *
+ * UTCP resolves a variable in three tiers (see `DefaultVariableSubstitutor`):
+ * `config.variables` (exact) → each `config.load_variables_from` loader's
+ * async `get()` → `process.env`. We seed a per-user loader instance here so any
+ * tool var not already in `config.variables` (the reserved `API_URL` /
+ * `CONNECTION_KEY`) is resolved from this user's secrets.
+ *
+ * The `UtcpClient.create` path re-validates the whole config through the
+ * serializer registry, so a loader can't be handed in as a bare live object — it
+ * must round-trip through a registered serializer. We therefore put a plain
+ * descriptor `{ variable_loader_type, user_id }` in `load_variables_from` (via
+ * {@link bevelSecretsLoaderConfig}) and let the registered serializer rebuild a
+ * live loader bound to the process-wide vault. Swapping the vault backend (e.g.
+ * to a client's external secret manager) is just a different
+ * `ISecretsVaultService` passed to {@link registerBevelSecretsVariableLoader}.
+ */
+export const BEVEL_SECRETS_LOADER_TYPE = 'bevel_secrets';
+/**
+ * Process-wide vault the reconstructed loaders read through. Set once at
+ * composition time (before any client is built) so the serializer — which only
+ * receives a plain dict — can bind live loaders to it.
+ */
+let sharedSecretsVault = null;
+export class BevelSecretsVariableLoader {
+    variable_loader_type = BEVEL_SECRETS_LOADER_TYPE;
+    user_id;
+    constructor(userId) {
+        this.user_id = userId;
+    }
+    /**
+     * Resolve `effectiveKey` — the UTCP-namespaced `<manual>_<VAR>` — against the
+     * vault VERBATIM. Preserving the manual prefix binds a secret to exactly ONE
+     * manual: another manual referencing the same bare `${VAR}` forms a different
+     * key and misses. This is the per-manual isolation UTCP's namespacing gives us
+     * — we intentionally do NOT strip the prefix, so a malicious `.tool` can't
+     * harvest a secret the user configured for a different manual.
+     */
+    async get(effectiveKey) {
+        if (!sharedSecretsVault || !this.user_id)
+            return null;
+        try {
+            return await sharedSecretsVault.resolve(this.user_id, effectiveKey);
+        }
+        catch (err) {
+            // Log the fault so a backend failure is distinguishable from a merely
+            // unset secret (resolve returning null) when troubleshooting.
+            console.error(`[secrets-vault] resolve failed for user=${this.user_id} key=${effectiveKey}:`, err instanceof Error ? err.message : String(err));
+            return null;
+        }
+    }
+}
+class BevelSecretsVariableLoaderSerializer extends Serializer {
+    toDict(obj) {
+        return {
+            variable_loader_type: BEVEL_SECRETS_LOADER_TYPE,
+            user_id: obj.user_id ?? '',
+        };
+    }
+    validateDict(obj) {
+        const userId = typeof obj.user_id === 'string' ? obj.user_id : '';
+        return new BevelSecretsVariableLoader(userId);
+    }
+}
+// Register the serializer on module load so a `{ variable_loader_type:
+// 'bevel_secrets' }` descriptor round-trips through `UtcpClient.create` as soon
+// as this module is imported — independent of whether a vault has been bound
+// yet. Until `registerBevelSecretsVariableLoader` binds a vault, loaders simply
+// resolve to null (no secrets available), so `create` never throws for lack of
+// registration. Idempotent (safe under tsx hot-reload).
+VariableLoaderSerializer.registerVariableLoader(BEVEL_SECRETS_LOADER_TYPE, new BevelSecretsVariableLoaderSerializer(), true);
+/**
+ * Bind the process-wide vault the reconstructed loaders read through. Called
+ * once at composition time; before it runs, loaders resolve to null.
+ */
+export function registerBevelSecretsVariableLoader(secretsVault) {
+    sharedSecretsVault = secretsVault;
+}
+/** The plain descriptor to place in a `UtcpClientConfig.load_variables_from` for a given user. */
+export function bevelSecretsLoaderConfig(userId) {
+    return { variable_loader_type: BEVEL_SECRETS_LOADER_TYPE, user_id: userId };
+}
+//# sourceMappingURL=secrets-variable-loader.js.map

package/dist/modules/secrets-vault/secrets-variable-loader.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"secrets-variable-loader.js","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-variable-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,wBAAwB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGtF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;;;;GAIG;AACH,IAAI,kBAAkB,GAAgC,IAAI,CAAC;AAE3D,MAAM,OAAO,0BAA0B;IAC5B,oBAAoB,GAAG,yBAAyB,CAAC;IACjD,OAAO,CAAS;IAIzB,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,YAAoB;QAC5B,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CACX,2CAA2C,IAAI,CAAC,OAAO,QAAQ,YAAY,GAAG,EAC9E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,oCAAqC,SAAQ,UAA0B;IAC3E,MAAM,CAAC,GAAmB;QACxB,OAAO;YACL,oBAAoB,EAAE,yBAAyB;YAC/C,OAAO,EAAG,GAAkC,CAAC,OAAO,IAAI,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,GAA4B;QACvC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;CACF;AAED,uEAAuE;AACvE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,wDAAwD;AACxD,wBAAwB,CAAC,sBAAsB,CAC7C,yBAAyB,EACzB,IAAI,oCAAoC,EAAE,EAC1C,IAAI,CACL,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,YAAkC;IACnF,kBAAkB,GAAG,YAAY,CAAC;AACpC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC"}