@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/modules/mcp/mcp-auth.middleware.js

@@ -1,4 +1,7 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('mcp-auth');
 import { InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { rejectConnectionKey } from '../tool-auth/connection-key-rejection.js';
 import '../tool-auth/external-api-key.interface.js'; // Express Request augmentation (req.externalApiKeyId)
 /**
  * Auth middleware for the MCP endpoint. Accepts any of:
@@ -9,7 +12,8 @@ import '../tool-auth/external-api-key.interface.js'; // Express Request augmenta
  *      authorization server after the /connect consent flow, resolved via
  *      BevelOAuthProvider.
  *   3. An internal token (Bearer `<tenant>-int_…`) — minted server-side only
- *      (createSession's loopback bearer, the /mcp/local-token exchange). The
+ *      (the per-request loopback bearer `createRequestServer` mints, the
+ *      /mcp/local-token exchange). The
  *      local MCP server (hexis-mcp) exchanges its OAuth grant for one and
  *      then uses it EVERYWHERE a connection key goes — the agent REST surface
  *      already accepts it, and refusing it here made OAuth-mode hexis-mcp
@@ -22,13 +26,16 @@ import '../tool-auth/external-api-key.interface.js'; // Express Request augmenta
  *      hit the MCP endpoint from their browser if we ever need it
  *      (e.g. an in-app debugger). Keeps the surface from forking.
  *
- * The middleware **must** run before the MCP transport handler — the
- * transport pulls `req.userId` to populate the session row at `initialize`.
+ * The middleware **must** run before the MCP transport handler — every
+ * request's server is built from `req.userId` (there is no session row to
+ * carry it; the endpoint is stateless per request).
  *
  * Failures return 401 with a `WWW-Authenticate` challenge carrying
  * `resource_metadata` (RFC 9728) so an OAuth-capable MCP client discovers our
- * authorization server and starts the flow, while clients configured with a
- * key simply prompt for it.
+ * authorization server and starts the flow — EXCEPT a bearer shaped like a
+ * connection key that does not verify: that caller configured a key, so it
+ * gets a plain `invalid_token` answer and no sign-in invitation (see
+ * `connection-key-rejection.ts`).
  */
 export function createMcpAuthMiddleware(authService, externalApiKeyService, oauthProvider, resourceMetadataUrl, internalTokens) {
     const wwwAuthenticate = `Bearer realm="bevel-mcp", resource_metadata="${resourceMetadataUrl}"`;
@@ -62,7 +69,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
                 // `externalApiKeyId` unset and are not metered.
                 const resolved = await externalApiKeyService.verifyAndLoadToken(token);
                 if (!resolved) {
-                    unauthorized(res, 'Invalid or revoked connection key');
+                    rejectConnectionKey(res);
                     return;
                 }
                 req.userId = resolved.user.id;
@@ -74,7 +81,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
             catch (err) {
                 // A DB error during verification is a 500, not a 401 — the caller's
                 // credentials may be valid; we just can't check them right now.
-                console.error('[mcp-auth] connection-key verification failed:', err);
+                log.error('connection-key verification failed:', { err });
                 res.status(500).json({ error: 'Authentication backend unavailable' });
                 return;
             }
@@ -98,7 +105,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
                     unauthorized(res, 'Invalid, expired, or revoked access token');
                 }
                 else {
-                    console.error('[mcp-auth] OAuth token verification failed:', err);
+                    log.error('OAuth token verification failed:', { err });
                     res.status(500).json({ error: 'Authentication backend unavailable' });
                 }
                 return;
@@ -116,13 +123,14 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
         // downstream resolve access against it.
         //
         // ONLY the `externalProxy` shape is admitted: that claim marks the
-        // loopback identity of an external caller (createSession's session
-        // bearer, the /mcp/local-token exchange), which is the one internal-token
-        // kind that has any business arriving here as an MCP client. A plain
-        // in-process internal token — the per-run credential the agent factory
-        // mints for its own code-mode client — is a loopback-surface credential,
-        // and accepting it would let it open an MCP session (createSession would
-        // even mint it a fresh externalProxy bearer, upgrading it).
+        // loopback identity of an external caller (the per-request bearer
+        // `createRequestServer` mints, the /mcp/local-token exchange), which is
+        // the one internal-token kind that has any business arriving here as an
+        // MCP client. A plain in-process internal token — the per-run credential
+        // the agent factory mints for its own code-mode client — is a
+        // loopback-surface credential, and accepting it would let it drive the
+        // MCP endpoint (createRequestServer would even mint it a fresh
+        // externalProxy bearer, upgrading it).
         if (internalTokens.looksLikeInternalToken(token)) {
             // `verify` answers null for the invalid/expired cases it can see coming,
             // but a malformed token of plausible shape can still THROW from inside
@@ -145,7 +153,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
                 user = await authService.getUserById(claim.userId);
             }
             catch (err) {
-                console.error('[mcp-auth] internal-token user lookup failed:', err);
+                log.error('internal-token user lookup failed:', { err });
                 res.status(500).json({ error: 'Authentication backend unavailable' });
                 return;
             }

package/dist/modules/mcp/mcp-auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAKpF,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAE3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwB,EACxB,qBAA6C,EAC7C,aAAiC,EACjC,mBAA2B,EAC3B,cAAoC;IAEpC,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;IAC/F,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,KAAa,EAAE,EAAE;QACpD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,qDAAqD;gBACrD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,gEAAgE;gBAChE,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBAChB,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,YAAY,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wCAAwC;QACxC,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,KAAiD,CAAC;YACtD,IAAI,CAAC;gBACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3C,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAIpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAE3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwB,EACxB,qBAA6C,EAC7C,aAAiC,EACjC,mBAA2B,EAC3B,cAAoC;IAEpC,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;IAC/F,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,KAAa,EAAE,EAAE;QACpD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,qDAAqD;gBACrD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,mBAAmB,CAAC,GAAG,CAAC,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,gEAAgE;gBAChE,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBAChB,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,YAAY,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wCAAwC;QACxC,EAAE;QACF,mEAAmE;QACnE,kEAAkE;QAClE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,8DAA8D;QAC9D,uEAAuE;QACvE,+DAA+D;QAC/D,uCAAuC;QACvC,IAAI,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,KAAiD,CAAC;YACtD,IAAI,CAAC;gBACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3C,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/mcp/mcp.routes.d.ts

@@ -9,9 +9,9 @@ import '../tool-auth/external-api-key.interface.js';
  * Routes for the remote MCP server + the connection-key management endpoints.
  *
  * Layout:
- *   POST   /mcp           — client→server MCP messages (initialize + tool calls)
- *   GET    /mcp           — server→client SSE channel (session-bound)
- *   DELETE /mcp           — terminate a session
+ *   POST   /mcp           — every client→server MCP message, each request on its own
+ *   GET    /mcp           — 405: no standalone server→client stream (stateless)
+ *   DELETE /mcp           — 405: there is no session to terminate (stateless)
  *
  *   GET    /mcp/external-api-keys         — list this user's connection keys
  *   POST   /mcp/external-api-keys         — mint a new key (returns plaintext ONCE)
@@ -20,7 +20,7 @@ import '../tool-auth/external-api-key.interface.js';
  *   POST   /mcp/local-token               — exchange an MCP OAuth access token
  *                                           for a loopback internal token
  *
- * The `/mcp` endpoints accept either a connection key or a JWT (see
+ * The `/mcp` POST accepts either a connection key or a JWT/OAuth token (see
  * McpAuthMiddleware). The `/mcp/external-api-keys/*` endpoints accept only the JWT —
  * minting/revoking via a connection key would let a leaked key roll itself
  * over and stay alive forever. `/mcp/local-token` accepts ONLY an MCP OAuth

package/dist/modules/mcp/mcp.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAA+B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAUpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAA6B,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,4CAA4C,CAAC;AAoFpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,qBAAqB,EAAE,sBAAsB,EAC7C,iBAAiB,EAAE,cAAc,EACjC,iBAAiB,EAAE,cAAc,EACjC,eAAe,EAAE,cAAc,EAC/B,cAAc,EAAE,oBAAoB,EACpC,aAAa,EAAE,kBAAkB,EAGjC,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,MAAM,CA8VhB"}
+{"version":3,"file":"mcp.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAA+B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAYpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAA6B,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,4CAA4C,CAAC;AA4BpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,qBAAqB,EAAE,sBAAsB,EAC7C,iBAAiB,EAAE,cAAc,EACjC,iBAAiB,EAAE,cAAc,EACjC,eAAe,EAAE,cAAc,EAC/B,cAAc,EAAE,oBAAoB,EACpC,aAAa,EAAE,kBAAkB,EAGjC,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,MAAM,CA0ShB"}

package/dist/modules/mcp/mcp.routes.js

@@ -1,6 +1,8 @@
 import express from 'express';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { logger } from '../../shared/logging.js';
+const log = logger('mcp');
 import { InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { InvalidTokenLabelError, TokenNotFoundError, TokenStillActiveError, } from '../tool-auth/external-api-key.errors.js';
 import { MCP_LOOPBACK_TOKEN_TTL_MS } from './mcp.service.js';
 import '../tool-auth/external-api-key.interface.js'; // req.externalApiKeyId augmentation
@@ -11,78 +13,29 @@ function extractBearer(req) {
     return firstSpace >= 0 ? header.slice(firstSpace + 1).trim() : '';
 }
 /**
- * The two JSON-RPC codes the Streamable HTTP transport defines for a session
- * fault, paired with the HTTP status each rides on.
- *
- * `SESSION_NOT_FOUND` (404) is the one that carries meaning to a client: the
- * spec makes a 404 on a request bearing an `Mcp-Session-Id` the trigger to
- * start a new session with a fresh `initialize`. `BAD_REQUEST` (400) is the
- * client-side mistake — a non-initialize request that never carried a session
- * id at all — and has no recovery, because there is nothing to recover.
- */
-const SESSION_NOT_FOUND = -32001;
-const BAD_REQUEST = -32000;
-/**
- * The 403: a session id that exists but belongs to someone else. Its own code,
- * in the same implementation-defined range (-32000..-32099), because it is
- * neither of the two above — the request was well-formed and the session is
- * live; the caller simply may not have it. A client that reads only
- * `error.code` must not mistake an authorization refusal for a malformed
- * request, and must not re-initialize on it either. -32002 is skipped: the
- * MCP SDK spends it on "resource not found".
+ * `-32000` is the code the MCP SDK's own transport pairs with its 4xx transport
+ * refusals (including its 405); ours match it so a client sees one vocabulary.
  */
-const FORBIDDEN = -32003;
-/** JSON-RPC 2.0's own code for a fault on our side, used for the 500 catch-alls. */
+const TRANSPORT_ERROR = -32000;
+/** JSON-RPC 2.0's own code for a fault on our side, used for the 500 catch-all. */
 const INTERNAL_ERROR = -32603;
 /**
  * Answer in the transport's own wire shape
- * (`{ jsonrpc, error: { code, message }, id: null }`).
- *
- * These misses are caught by THIS router, one layer before the request would
- * have reached an SDK transport, so the router has to speak the transport's
- * language itself — a client that parses the body as JSON-RPC must not get a
- * bare `{ error }` blob just because we answered early. `id: null` matches the
- * SDK: the request id is not reliably known on a body we may never have
- * parsed as a single message.
+ * (`{ jsonrpc, error: { code, message }, id: null }`), for the answers this
+ * router gives without ever reaching an SDK transport. `id: null` matches the
+ * SDK: the request id is not reliably known on a body we may never have parsed
+ * as a single message.
  */
 function jsonRpcError(res, status, code, message) {
     res.status(status).json({ jsonrpc: '2.0', error: { code, message }, id: null });
 }
-/**
- * The answer to a session this router cannot resolve, shared by all three verbs.
- *
- * POST and GET/DELETE reach the miss from opposite directions — POST falls
- * through to it, GET/DELETE test for it up front — but owe the caller the same
- * two answers, and they were hand-synchronised copies of the same pair of
- * codes and strings. Sharing the mechanism makes that parity structural
- * instead of merely asserted by tests.
- *
- * Call only once the session is known to be a miss; a live session id never
- * reaches here.
- */
-function rejectSessionMiss(res, sessionIdHeader) {
-    if (sessionIdHeader) {
-        // A session id we hold no transport for: the store evicted it, or the
-        // process restarted and this in-memory map went with it. 404 + `-32001`
-        // is what the spec reserves for that, and it is the signal a client keys
-        // its re-initialize on. Answering 400 here read as "you sent a malformed
-        // request" and stranded the client on a session that can never come
-        // back — every connected agent, on every restart, until a human
-        // reconnected it by hand.
-        jsonRpcError(res, 404, SESSION_NOT_FOUND, 'Session not found');
-        return;
-    }
-    // No session id at all: the one case here that genuinely is the caller's
-    // mistake, and the only one 400 fits.
-    jsonRpcError(res, 400, BAD_REQUEST, 'Bad Request: Mcp-Session-Id header is required');
-}
 /**
  * Routes for the remote MCP server + the connection-key management endpoints.
  *
  * Layout:
- *   POST   /mcp           — client→server MCP messages (initialize + tool calls)
- *   GET    /mcp           — server→client SSE channel (session-bound)
- *   DELETE /mcp           — terminate a session
+ *   POST   /mcp           — every client→server MCP message, each request on its own
+ *   GET    /mcp           — 405: no standalone server→client stream (stateless)
+ *   DELETE /mcp           — 405: there is no session to terminate (stateless)
  *
  *   GET    /mcp/external-api-keys         — list this user's connection keys
  *   POST   /mcp/external-api-keys         — mint a new key (returns plaintext ONCE)
@@ -91,7 +44,7 @@ function rejectSessionMiss(res, sessionIdHeader) {
  *   POST   /mcp/local-token               — exchange an MCP OAuth access token
  *                                           for a loopback internal token
  *
- * The `/mcp` endpoints accept either a connection key or a JWT (see
+ * The `/mcp` POST accepts either a connection key or a JWT/OAuth token (see
  * McpAuthMiddleware). The `/mcp/external-api-keys/*` endpoints accept only the JWT —
  * minting/revoking via a connection key would let a leaked key roll itself
  * over and stay alive forever. `/mcp/local-token` accepts ONLY an MCP OAuth
@@ -102,94 +55,58 @@ export function createMcpRoutes(mcpService, externalApiKeyService, mcpAuthMiddle
 // local-token exchange), same value McpAuthMiddleware advertises.
 resourceMetadataUrl) {
     const router = express.Router();
-    // Per-process map of live MCP sessions. In-memory mirror of McpSessionStore
-    // — McpSessionStore holds the *domain* state (userId, threadId, idle TTL),
-    // this map holds the *transport* state (the SDK objects we need to route
-    // a subsequent HTTP request to the correct session). Both are cleared on
-    // restart; clients re-initialize.
-    const active = new Map();
-    // When McpSessionStore drops a session on its own (idle-TTL sweep or
-    // size-cap eviction), the matching transport pair would otherwise leak
-    // here — `active.has(id)` would still return true and route requests to a
-    // McpServer whose backing domain state is gone. Subscribe to the store and
-    // tear down the transport so the resources free immediately and the next
-    // request with that id correctly 404s.
-    mcpService.onSessionEvicted((sessionId) => {
-        const entry = active.get(sessionId);
-        if (!entry)
-            return;
-        active.delete(sessionId);
-        // close() is async; fire-and-forget so a slow socket teardown can't
-        // block the store's eviction loop. transport.onclose still fires but
-        // its `active.delete` is now a no-op.
-        void entry.transport.close().catch((err) => {
-            console.warn('[mcp] transport close on eviction failed:', err);
-        });
-    });
-    // ── MCP transport ──────────────────────────────────────────────────────
+    // ── MCP transport (stateless) ──────────────────────────────────────────
+    /**
+     * One request, one MCP server, one transport — and nothing kept afterwards.
+     *
+     * The Streamable HTTP transport makes the session id OPTIONAL: a server that
+     * never assigns one (`sessionIdGenerator: undefined`, the SDK's stateless
+     * profile) is served by clients that treat every request independently. So
+     * there is no `initialize`-first rule, no session to look up, and no
+     * "Session not found" to answer: identity, the metering key and the
+     * ACL-filtered tool surface all come from THIS request's bearer. A platform
+     * restart between two requests of one conversation is therefore invisible —
+     * the next request is served exactly as it would have been before it.
+     *
+     * A stale `Mcp-Session-Id` from a client that connected before this endpoint
+     * went stateless is ignored by the stateless transport, not refused.
+     *
+     * Notifications a request emits (tool-call progress) ride that request's own
+     * response stream. The server and transport are closed when the response
+     * closes — finished, or abandoned by the client mid-call.
+     */
     router.post('/mcp', mcpAuthMiddleware, async (req, res) => {
+        let server;
+        res.on('close', () => {
+            // Closing the server closes its transport too.
+            void server?.close().catch((err) => {
+                log.warn('closing a request server failed:', { err });
+            });
+        });
         try {
-            const sessionIdHeader = req.headers['mcp-session-id'];
-            const body = req.body;
-            // Four request shapes on POST /mcp, in this order:
-            //  1. Session id naming a live session → forward to its transport
-            //     (unless it is someone else's → 403 (`-32003`)).
-            //  2. An initialize body → spin up a new transport, whatever stale
-            //     session id the client still has attached.
-            //  3. A session id we have no transport for → 404 (`-32001`).
-            //  4. No session id on a non-initialize request → 400 (`-32000`).
-            if (sessionIdHeader && active.has(sessionIdHeader)) {
-                const session = active.get(sessionIdHeader);
-                // Defense in depth: the auth middleware bound a userId for this
-                // request; refuse if it doesn't match the session's owner. Stops
-                // a leaked session id from being used cross-user even if the
-                // attacker has their own valid connection key.
-                if (session.userId !== req.userId) {
-                    jsonRpcError(res, 403, FORBIDDEN, 'Session does not belong to this user');
-                    return;
-                }
-                await session.transport.handleRequest(req, res, body);
-                return;
-            }
-            // An initialize starts a fresh session even when the client is STILL
-            // sending a stale `mcp-session-id`. Requiring the header to be absent
-            // deadlocked exactly the client this endpoint most needs to let back in:
-            // one whose session died with the server and that re-initializes without
-            // first clearing the id — it got the catch-all below forever. The SDK's
-            // own transport orders the two checks this way for the same reason:
-            // initialize is never session-validated. A LIVE session id is still
-            // caught by the branch above, so re-initializing over a working session
-            // stays the SDK's `-32600 Server already initialized`, not a silent
-            // second session.
-            if (isInitializeRequest(body)) {
-                // The proxy authenticates its loopback calls with the SAME bearer the
-                // client used here, so it acts on the request exactly as the caller
-                // would. Captured at initialize and seeded into the session's UtcpClient.
-                const { transport, server } = await mcpService.createSession(req.userId, 
+            const built = await mcpService.createRequestServer({
+                userId: req.userId,
                 // Connection-key id (set by mcpAuthMiddleware for `bevel_…` bearers;
-                // undefined for browser JWT) — kept for audit/diagnostics.
-                req.externalApiKeyId ?? null, extractBearer(req), (sessionId) => {
-                    active.set(sessionId, { transport, server, userId: req.userId });
-                });
-                // Closing the transport (DELETE /mcp, or client disconnect during
-                // close) should drop both the active map and the McpSessionStore
-                // entry. McpService wired onsessionclosed → sessionStore.delete; we
-                // mirror it here.
-                transport.onclose = () => {
-                    if (transport.sessionId)
-                        active.delete(transport.sessionId);
-                };
-                await server.connect(transport);
-                await transport.handleRequest(req, res, body);
+                // undefined for OAuth/JWT) — resolved per request, so per-key metering
+                // never depends on anything remembered from an earlier request.
+                tokenId: req.externalApiKeyId ?? null,
+                // The proxy authenticates its loopback calls with the SAME bearer the
+                // client used here, so it acts on the request exactly as the caller would.
+                bearer: extractBearer(req),
+            }, req.body);
+            // The client gave up while the server was being built: nothing to answer.
+            if (res.writableEnded || res.destroyed) {
+                await built.close().catch(() => { });
                 return;
             }
-            // Neither a live session nor an initialize: whichever miss this is,
-            // `rejectSessionMiss` owns both answers.
-            rejectSessionMiss(res, sessionIdHeader);
+            server = built;
+            const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : 'Unknown error';
-            console.error('[mcp] POST /mcp failed:', msg);
+            log.error('POST /mcp failed:', { detail: msg });
             if (!res.headersSent) {
                 jsonRpcError(res, 500, INTERNAL_ERROR, msg);
             }
@@ -198,38 +115,25 @@ resourceMetadataUrl) {
             }
         }
     });
-    const sessionRequest = async (req, res) => {
-        const sessionIdHeader = req.headers['mcp-session-id'];
-        // The same two answers POST gives, from the same helper: these were
-        // collapsed into a single 404 — right for the unknown-session case, wrong
-        // for the missing-header one, and neither parseable as JSON-RPC.
-        if (!sessionIdHeader || !active.has(sessionIdHeader)) {
-            rejectSessionMiss(res, sessionIdHeader);
-            return;
-        }
-        const session = active.get(sessionIdHeader);
-        if (session.userId !== req.userId) {
-            jsonRpcError(res, 403, FORBIDDEN, 'Session does not belong to this user');
-            return;
-        }
-        try {
-            await session.transport.handleRequest(req, res);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : 'Unknown error';
-            console.error('[mcp] session request failed:', msg);
-            if (!res.headersSent)
-                jsonRpcError(res, 500, INTERNAL_ERROR, msg);
-            else
-                res.end();
-        }
+    /**
+     * GET and DELETE are retired, per the stateless profile.
+     *
+     * GET would open a standalone server→client stream; with no session there is
+     * nothing to push on one, and the spec's answer for a server that offers none
+     * is 405 — which spec-conformant clients (the SDK's among them) treat as "no
+     * stream", not as a failure. DELETE would terminate a session; there is none,
+     * and 405 is the spec's answer for a server that does not support it.
+     *
+     * Deliberately NOT behind the auth middleware: the answer is the same for
+     * everyone and reveals nothing, and a 401 here would send an OAuth-capable
+     * client into an authorization flow for a stream that does not exist.
+     */
+    const methodNotAllowed = (_req, res) => {
+        res.setHeader('Allow', 'POST');
+        jsonRpcError(res, 405, TRANSPORT_ERROR, 'Method not allowed.');
     };
-    // GET is the server→client SSE channel for session-scoped notifications.
-    router.get('/mcp', mcpAuthMiddleware, sessionRequest);
-    // DELETE terminates the session — SDK closes the transport, our
-    // onclose handler cleans up the active map, and McpService's
-    // onsessionclosed clears the McpSessionStore entry.
-    router.delete('/mcp', mcpAuthMiddleware, sessionRequest);
+    router.get('/mcp', methodNotAllowed);
+    router.delete('/mcp', methodNotAllowed);
     // ── Connection-key management (JWT-only) ───────────────────────────────
     router.get('/mcp/external-api-keys', jwtAuthMiddleware, async (req, res) => {
         try {
@@ -322,16 +226,16 @@ resourceMetadataUrl) {
      * Why it exists: the LOCAL MCP server's REST reads — the all-tools manual,
      * `list_local_tools`, the plugin archive — live on `/api/agent/*`, which
      * accepts connection keys and internal tokens ONLY; an MCP OAuth access
-     * token deliberately 401s there. Hosted OAuth sessions cross that gap
-     * inside `McpService.createSession`, which mints a loopback internal token
-     * for the resolved user. This endpoint is the same exchange for an external
-     * caller: the one bridge that lets a local server configured via the
+     * token deliberately 401s there. Hosted OAuth requests cross that gap
+     * inside `McpService.createRequestServer`, which mints a loopback internal
+     * token for the resolved user. This endpoint is the same exchange for an
+     * external caller: the one bridge that lets a local server configured via the
      * deployment's MCP OAuth (instead of a connection key) reach those reads.
      *
      * Why it is NOT a widening of the trust boundary: the caller must present a
      * VERIFIED OAuth grant for this exact user — the same credential that
      * already drives full tool execution through the hosted `/mcp` endpoint.
-     * The minted token is identical in shape to createSession's loopback bearer
+     * The minted token is identical in shape to the hosted proxy's loopback bearer
      * (`{ userId, externalProxy: true }` → resolved as `source: 'external'` by
      * the tool-auth verifier, admitted to the external surface, refused from
      * internal-only tools) and carries the same TTL — CAPPED to the presented
@@ -425,7 +329,7 @@ resourceMetadataUrl) {
                 unauthorized('Invalid, expired, or revoked access token');
             }
             else {
-                console.error('[mcp] local-token exchange failed:', err);
+                log.error('local-token exchange failed:', { err });
                 res.status(500).json({ error: 'Authentication backend unavailable' });
             }
         }

package/dist/modules/mcp/mcp.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.routes.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAA6D,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,yBAAyB,EAAmB,MAAM,kBAAkB,CAAC;AAG9E,OAAO,4CAA4C,CAAC,CAAC,oCAAoC;AAQzF,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,CAAC,KAAK,CAAC;AACjC,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC;AAC3B;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC;AACzB,oFAAoF;AACpF,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,GAAa,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IAChF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,GAAa,EAAE,eAAmC;IAC3E,IAAI,eAAe,EAAE,CAAC;QACpB,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,gEAAgE;QAChE,0BAA0B;QAC1B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,yEAAyE;IACzE,sCAAsC;IACtC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,gDAAgD,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAsB,EACtB,qBAA6C,EAC7C,iBAAiC,EACjC,iBAAiC,EACjC,eAA+B,EAC/B,cAAoC,EACpC,aAAiC;AACjC,oEAAoE;AACpE,kEAAkE;AAClE,mBAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEhD,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uCAAuC;IACvC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,oEAAoE;QACpE,qEAAqE;QACrE,sCAAsC;QACtC,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzC,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAEtB,mDAAmD;YACnD,kEAAkE;YAClE,sDAAsD;YACtD,mEAAmE;YACnE,gDAAgD;YAChD,8DAA8D;YAC9D,kEAAkE;YAClE,IAAI,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;gBAC7C,gEAAgE;gBAChE,iEAAiE;gBACjE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;oBAClC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,sCAAsC,CAAC,CAAC;oBAC1E,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,wEAAwE;YACxE,oEAAoE;YACpE,kBAAkB;YAClB,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,sEAAsE;gBACtE,oEAAoE;gBACpE,0EAA0E;gBAC1E,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,aAAa,CAC1D,GAAG,CAAC,MAAO;gBACX,qEAAqE;gBACrE,2DAA2D;gBAC3D,GAAG,CAAC,gBAAgB,IAAI,IAAI,EAC5B,aAAa,CAAC,GAAG,CAAC,EAClB,CAAC,SAAS,EAAE,EAAE;oBACZ,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAO,EAAE,CAAC,CAAC;gBACpE,CAAC,CACF,CAAC;gBACF,kEAAkE;gBAClE,iEAAiE;gBACjE,oEAAoE;gBACpE,kBAAkB;gBAClB,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,IAAI,SAAS,CAAC,SAAS;wBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC9D,CAAC,CAAC;gBACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,yCAAyC;YACzC,iBAAiB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAC5E,oEAAoE;QACpE,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACrD,iBAAiB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,sCAAsC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;;gBAC7D,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAEtD,gEAAgE;IAChE,6DAA6D;IAC7D,oDAAoD;IACpD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAEzD,0EAA0E;IAE1E,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACpE,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjB,GAAG,CAAC;gBACJ,QAAQ,EAAE;oBACR,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;oBACjC,aAAa,EAAE,eAAe,CAAC,QAAQ;iBACxC;aACF,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1E,IAAI,CAAC;YACH,mEAAmE;YACnE,iEAAiE;YACjE,uEAAuE;YACvE,oDAAoD;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAA0B,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAO,EAAE,KAAK,CAAC,CAAC;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAO,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,CAAC,MAAM,CAAC,sCAAsC,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAO,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;QAC/F,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE;YACrC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,8DAA8D;YAC9D,gEAAgE;YAChE,sEAAsE;YACtE,8CAA8C;YAC9C,IACE,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBACpD,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC;gBAC5C,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EACvB,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EACH,yEAAyE;wBACzE,iEAAiE;iBACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,oEAAoE;YACpE,YAAY,CAAC,sBAAsB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,YAAY,CAAC,sBAAsB,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,6DAA6D;YAC7D,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,uEAAuE;YACvE,+CAA+C;YAC/C,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnG,YAAY,CAAC,2CAA2C,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GACT,gBAAgB,KAAK,SAAS;gBAC5B,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3E,mEAAmE;YACnE,qCAAqC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,uEAAuE;YACvE,6CAA6C;YAC7C,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,YAAY,CAAC,2CAA2C,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"mcp.routes.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAA6D,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAEpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,yBAAyB,EAAmB,MAAM,kBAAkB,CAAC;AAG9E,OAAO,4CAA4C,CAAC,CAAC,oCAAoC;AAEzF,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC;AAC/B,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC;AAE9B;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,GAAa,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IAChF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAsB,EACtB,qBAA6C,EAC7C,iBAAiC,EACjC,iBAAiC,EACjC,eAA+B,EAC/B,cAAoC,EACpC,aAAiC;AACjC,oEAAoE;AACpE,kEAAkE;AAClE,mBAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,0EAA0E;IAE1E;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,MAA0B,CAAC;QAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,+CAA+C;YAC/C,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAChD;gBACE,MAAM,EAAE,GAAG,CAAC,MAAO;gBACnB,qEAAqE;gBACrE,uEAAuE;gBACvE,gEAAgE;gBAChE,OAAO,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;gBACrC,sEAAsE;gBACtE,2EAA2E;gBAC3E,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;aAC3B,EACD,GAAG,CAAC,IAAI,CACT,CAAC;YACF,0EAA0E;YAC1E,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;OAYG;IACH,MAAM,gBAAgB,GAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrD,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAExC,0EAA0E;IAE1E,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACpE,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjB,GAAG,CAAC;gBACJ,QAAQ,EAAE;oBACR,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;oBACjC,aAAa,EAAE,eAAe,CAAC,QAAQ;iBACxC;aACF,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1E,IAAI,CAAC;YACH,mEAAmE;YACnE,iEAAiE;YACjE,uEAAuE;YACvE,oDAAoD;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAA0B,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAO,EAAE,KAAK,CAAC,CAAC;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,kEAAkE;YAClE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAO,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,CAAC,MAAM,CAAC,sCAAsC,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAO,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;QAC/F,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE;YACrC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,8DAA8D;YAC9D,gEAAgE;YAChE,sEAAsE;YACtE,8CAA8C;YAC9C,IACE,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBACpD,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC;gBAC5C,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EACvB,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EACH,yEAAyE;wBACzE,iEAAiE;iBACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,oEAAoE;YACpE,YAAY,CAAC,sBAAsB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,YAAY,CAAC,sBAAsB,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,6DAA6D;YAC7D,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,gEAAgE;YAChE,uEAAuE;YACvE,+CAA+C;YAC/C,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnG,YAAY,CAAC,2CAA2C,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GACT,gBAAgB,KAAK,SAAS;gBAC5B,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3E,mEAAmE;YACnE,qCAAqC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,uEAAuE;YACvE,6CAA6C;YAC7C,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,YAAY,CAAC,2CAA2C,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}