@brainmcp/brainmcp 0.1.11 → 0.1.13

package/dist/lib/oauth-client.d.ts

@@ -0,0 +1,55 @@
+import type { PkcePair } from './pkce.js';
+export declare function grantedCliScopes(requested: string[], tokenScope?: string): string[];
+export interface OAuthEndpoints {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    revocationEndpoint: string;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+    [key: string]: unknown;
+}
+export interface OAuthClientOptions {
+    issuerUrl?: string;
+    clientId?: string;
+    fetchFn?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare const DEFAULT_ISSUER = "https://mcp.brainmcp.ai";
+export declare class OAuthClient {
+    readonly issuer: string;
+    readonly clientId: string;
+    private fetchFn;
+    private timeoutMs;
+    constructor(options?: OAuthClientOptions);
+    discoverEndpoints(signal?: AbortSignal): Promise<OAuthEndpoints>;
+    buildAuthorizationUrl(input: {
+        authorizationEndpoint: string;
+        redirectUri: string;
+        pkce: PkcePair;
+        scopes?: string[];
+    }): string;
+    exchangeCodeForTokens(input: {
+        tokenEndpoint: string;
+        code: string;
+        redirectUri: string;
+        codeVerifier: string;
+        signal?: AbortSignal;
+    }): Promise<TokenResponse>;
+    refreshAccessToken(input: {
+        tokenEndpoint: string;
+        refreshToken: string;
+        signal?: AbortSignal;
+    }): Promise<TokenResponse>;
+    revokeToken(input: {
+        revocationEndpoint: string;
+        token: string;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
+}

package/dist/lib/oauth-client.js

@@ -0,0 +1,154 @@
+import { BRAINMCP_CLI_CLIENT_ID, BRAINMCP_CLI_ALLOWED_SCOPES, BRAINMCP_CLI_DEFAULT_SCOPES, BRAIN_MCP_ENDPOINT, } from '../agent-config.js';
+import { validateHttpUrl, withRequestDeadline } from './http.js';
+export function grantedCliScopes(requested, tokenScope) {
+    const allowed = new Set(BRAINMCP_CLI_ALLOWED_SCOPES);
+    const raw = tokenScope === undefined ? requested : tokenScope.split(/\s+/).filter(Boolean);
+    if (raw.some((scope) => !allowed.has(scope) || !requested.includes(scope))) {
+        throw new Error('The OAuth server granted unrequested or disallowed CLI scopes.');
+    }
+    const granted = [...new Set(raw)];
+    if (requested.some((scope) => !granted.includes(scope))) {
+        throw new Error('The OAuth server did not grant required CLI scopes.');
+    }
+    return granted;
+}
+function validateTokenResponse(value) {
+    const token = value;
+    if (!token || typeof token.access_token !== 'string' || !token.access_token.trim() ||
+        typeof token.token_type !== 'string' || token.token_type.toLowerCase() !== 'bearer' ||
+        (token.refresh_token !== undefined && (typeof token.refresh_token !== 'string' || !token.refresh_token.trim())) ||
+        (token.scope !== undefined && typeof token.scope !== 'string') ||
+        (token.expires_in !== undefined && (typeof token.expires_in !== 'number' || !Number.isFinite(token.expires_in) || token.expires_in <= 0))) {
+        throw new Error('OAuth server returned an invalid token response.');
+    }
+    return token;
+}
+export const DEFAULT_ISSUER = 'https://mcp.brainmcp.ai';
+export class OAuthClient {
+    issuer;
+    clientId;
+    fetchFn;
+    timeoutMs;
+    constructor(options = {}) {
+        this.issuer = (options.issuerUrl ?? process.env.BRAINMCP_API_URL ?? DEFAULT_ISSUER).replace(/\/+$/, '');
+        this.clientId = options.clientId ?? BRAINMCP_CLI_CLIENT_ID;
+        this.fetchFn = options.fetchFn ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+        validateHttpUrl(this.issuer);
+    }
+    async discoverEndpoints(signal) {
+        const discoveryUrl = `${this.issuer}/.well-known/oauth-authorization-server`;
+        return withRequestDeadline(this.timeoutMs, signal, async (requestSignal) => {
+            const res = await this.fetchFn(discoveryUrl, { signal: requestSignal, redirect: 'error' });
+            if (res.ok) {
+                const meta = (await res.json());
+                if (meta && typeof meta === 'object' && !Array.isArray(meta)) {
+                    const endpoints = {
+                        issuer: meta.issuer ?? this.issuer,
+                        authorizationEndpoint: meta.authorization_endpoint ?? `${this.issuer}/api/auth/oauth2/authorize`,
+                        tokenEndpoint: meta.token_endpoint ?? `${this.issuer}/api/auth/oauth2/token`,
+                        revocationEndpoint: meta.revocation_endpoint ?? `${this.issuer}/api/auth/oauth2/revoke`,
+                    };
+                    for (const endpoint of Object.values(endpoints))
+                        validateHttpUrl(endpoint, this.issuer);
+                    return endpoints;
+                }
+                throw new Error('OAuth server returned invalid discovery metadata.');
+            }
+            if (res.status !== 404)
+                throw new Error(`OAuth discovery failed (status ${res.status}).`);
+            return {
+                issuer: this.issuer,
+                authorizationEndpoint: `${this.issuer}/api/auth/oauth2/authorize`,
+                tokenEndpoint: `${this.issuer}/api/auth/oauth2/token`,
+                revocationEndpoint: `${this.issuer}/api/auth/oauth2/revoke`,
+            };
+        });
+    }
+    buildAuthorizationUrl(input) {
+        const scopes = input.scopes ?? [...BRAINMCP_CLI_DEFAULT_SCOPES];
+        const url = validateHttpUrl(input.authorizationEndpoint, this.issuer);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('client_id', this.clientId);
+        url.searchParams.set('redirect_uri', input.redirectUri);
+        url.searchParams.set('scope', scopes.join(' '));
+        url.searchParams.set('state', input.pkce.state);
+        url.searchParams.set('code_challenge', input.pkce.challenge);
+        url.searchParams.set('code_challenge_method', input.pkce.method);
+        url.searchParams.set('prompt', 'consent');
+        url.searchParams.set('resource', BRAIN_MCP_ENDPOINT);
+        return url.toString();
+    }
+    async exchangeCodeForTokens(input) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: this.clientId,
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            code_verifier: input.codeVerifier,
+            resource: BRAIN_MCP_ENDPOINT,
+        });
+        validateHttpUrl(input.tokenEndpoint, this.issuer);
+        return withRequestDeadline(this.timeoutMs, input.signal, async (signal) => {
+            const res = await this.fetchFn(input.tokenEndpoint, {
+                signal,
+                redirect: 'error',
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Accept: 'application/json',
+                },
+                body: body.toString(),
+            });
+            if (!res.ok) {
+                throw new Error(`Token exchange failed (status ${res.status}).`);
+            }
+            return validateTokenResponse(await res.json());
+        });
+    }
+    async refreshAccessToken(input) {
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: this.clientId,
+            refresh_token: input.refreshToken,
+            resource: BRAIN_MCP_ENDPOINT,
+        });
+        validateHttpUrl(input.tokenEndpoint, this.issuer);
+        return withRequestDeadline(this.timeoutMs, input.signal, async (signal) => {
+            const res = await this.fetchFn(input.tokenEndpoint, {
+                signal,
+                redirect: 'error',
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Accept: 'application/json',
+                },
+                body: body.toString(),
+            });
+            if (!res.ok) {
+                throw new Error(`Token refresh failed (status ${res.status}).`);
+            }
+            return validateTokenResponse(await res.json());
+        });
+    }
+    async revokeToken(input) {
+        const body = new URLSearchParams({
+            client_id: this.clientId,
+            token: input.token,
+        });
+        validateHttpUrl(input.revocationEndpoint, this.issuer);
+        return withRequestDeadline(this.timeoutMs, input.signal, async (signal) => {
+            const res = await this.fetchFn(input.revocationEndpoint, {
+                signal,
+                redirect: 'error',
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: body.toString(),
+            });
+            return res.ok;
+        });
+    }
+}
+//# sourceMappingURL=oauth-client.js.map

package/dist/lib/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../src/lib/oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,UAAU,gBAAgB,CAAC,SAAmB,EAAE,UAAmB;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,2BAA2B,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,KAAK,GAAG,KAA6B,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;QAC9E,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ;QACnF,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/G,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC9D,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9I,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA0BD,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAExD,MAAM,OAAO,WAAW;IACN,MAAM,CAAS;IACf,QAAQ,CAAS;IACzB,OAAO,CAAe;IACtB,SAAS,CAAS;IAE1B,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAoB;QAC1C,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,MAAM,yCAAyC,CAAC;QAC7E,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;gBACvC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,SAAS,GAAG;wBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;wBAClC,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,IAAI,GAAG,IAAI,CAAC,MAAM,4BAA4B;wBAChG,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,GAAG,IAAI,CAAC,MAAM,wBAAwB;wBAC5E,kBAAkB,EAAE,IAAI,CAAC,mBAAmB,IAAI,GAAG,IAAI,CAAC,MAAM,yBAAyB;qBACxF,CAAC;oBACF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;wBAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBACxF,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC1F,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,qBAAqB,EAAE,GAAG,IAAI,CAAC,MAAM,4BAA4B;gBACjE,aAAa,EAAE,GAAG,IAAI,CAAC,MAAM,wBAAwB;gBACrD,kBAAkB,EAAE,GAAG,IAAI,CAAC,MAAM,yBAAyB;aAC1D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB,CAAC,KAKrB;QACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,2BAA2B,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACrD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAM3B;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAC;QAEH,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE;gBAClD,MAAM;gBACN,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YACnE,CAAC;YAED,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAIxB;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAC;QAEH,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE;gBAClD,MAAM;gBACN,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAIjB;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QAEH,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBACvD,MAAM;gBACN,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/pkce.d.ts

@@ -0,0 +1,14 @@
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+    method: 'S256';
+    state: string;
+}
+export type RandomSource = (bytes: number) => Buffer;
+export declare function base64UrlEncode(buffer: Buffer): string;
+/**
+ * Generate PKCE verifier, challenge (S256), and state (AHI-032).
+ * Optional randomSource allows deterministic testing vectors.
+ */
+export declare function generatePkce(randomSource?: RandomSource): PkcePair;
+export declare function computeS256Challenge(verifier: string): string;

package/dist/lib/pkce.js

@@ -0,0 +1,33 @@
+import { createHash, randomBytes } from 'node:crypto';
+export function base64UrlEncode(buffer) {
+    return buffer
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+/**
+ * Generate PKCE verifier, challenge (S256), and state (AHI-032).
+ * Optional randomSource allows deterministic testing vectors.
+ */
+export function generatePkce(randomSource = randomBytes) {
+    // RFC 7636: verifier length between 43 and 128 characters
+    // 32 bytes of entropy encoded as base64url gives 43 chars
+    const verifierBytes = randomSource(32);
+    const verifier = base64UrlEncode(verifierBytes);
+    const hash = createHash('sha256').update(verifier, 'ascii').digest();
+    const challenge = base64UrlEncode(hash);
+    const stateBytes = randomSource(24);
+    const state = base64UrlEncode(stateBytes);
+    return {
+        verifier,
+        challenge,
+        method: 'S256',
+        state,
+    };
+}
+export function computeS256Challenge(verifier) {
+    const hash = createHash('sha256').update(verifier, 'ascii').digest();
+    return base64UrlEncode(hash);
+}
+//# sourceMappingURL=pkce.js.map

package/dist/lib/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAWtD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM;SACV,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,eAA6B,WAAW;IACnE,0DAA0D;IAC1D,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE1C,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;QACd,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/lib/vault.d.ts

@@ -0,0 +1,26 @@
+export declare const LEGACY_VAULT_ACCOUNT = "oauth";
+export declare function vaultAccountKey(accountId: string): string;
+export interface SecretVault {
+    readonly name: string;
+    isAvailable(): Promise<boolean>;
+    getSecret(key?: string): Promise<string | null>;
+    setSecret(value: string, key?: string): Promise<void>;
+    deleteSecret(key?: string): Promise<void>;
+}
+export declare class MemorySecretVault implements SecretVault {
+    readonly name = "memory";
+    private readonly secrets;
+    available: boolean;
+    isAvailable(): Promise<boolean>;
+    getSecret(key?: string): Promise<string | null>;
+    setSecret(value: string, key?: string): Promise<void>;
+    deleteSecret(key?: string): Promise<void>;
+}
+export declare class UnavailableSecretVault implements SecretVault {
+    readonly name = "unavailable";
+    isAvailable(): Promise<boolean>;
+    getSecret(): Promise<string | null>;
+    setSecret(): Promise<void>;
+    deleteSecret(): Promise<void>;
+}
+export declare function createPlatformVault(): SecretVault;

package/dist/lib/vault.js

@@ -0,0 +1,221 @@
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const VAULT_SERVICE = 'brainmcp.credentials';
+export const LEGACY_VAULT_ACCOUNT = 'oauth';
+const VAULT_ACCOUNT = LEGACY_VAULT_ACCOUNT;
+const EXEC_TIMEOUT_MS = 4_000;
+export function vaultAccountKey(accountId) {
+    return `oauth:${accountId}`;
+}
+export class MemorySecretVault {
+    name = 'memory';
+    secrets = new Map();
+    available = true;
+    async isAvailable() {
+        return this.available;
+    }
+    async getSecret(key = VAULT_ACCOUNT) {
+        return this.secrets.get(key) ?? null;
+    }
+    async setSecret(value, key = VAULT_ACCOUNT) {
+        this.secrets.set(key, value);
+    }
+    async deleteSecret(key = VAULT_ACCOUNT) {
+        this.secrets.delete(key);
+    }
+}
+export class UnavailableSecretVault {
+    name = 'unavailable';
+    async isAvailable() {
+        return false;
+    }
+    async getSecret() {
+        return null;
+    }
+    async setSecret() {
+        throw new Error('OS credential vault is unavailable.');
+    }
+    async deleteSecret() { }
+}
+class MacosSecurityVault {
+    name = 'macos-keychain';
+    async isAvailable() {
+        try {
+            await execFileAsync('which', ['security'], { timeout: EXEC_TIMEOUT_MS });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async getSecret(key = VAULT_ACCOUNT) {
+        try {
+            const { stdout } = await execFileAsync('security', ['find-generic-password', '-s', VAULT_SERVICE, '-a', key, '-w'], { timeout: EXEC_TIMEOUT_MS });
+            const value = stdout.trim();
+            if (!value)
+                return null;
+            if (value.startsWith('{'))
+                return value;
+            if (/^[0-9a-fA-F]+$/.test(value) && value.length % 2 === 0) {
+                const decoded = Buffer.from(value, 'hex').toString('utf8');
+                return decoded.length > 0 ? decoded : null;
+            }
+            return value;
+        }
+        catch {
+            return null;
+        }
+    }
+    async setSecret(value, key = VAULT_ACCOUNT) {
+        const hex = Buffer.from(value, 'utf8').toString('hex');
+        await new Promise((resolve, reject) => {
+            const child = spawn('security', ['-i'], { stdio: ['pipe', 'ignore', 'ignore'] });
+            const timer = setTimeout(() => {
+                child.kill('SIGKILL');
+                reject(new Error('macOS keychain store timed out'));
+            }, EXEC_TIMEOUT_MS);
+            const done = (fn) => {
+                clearTimeout(timer);
+                fn();
+            };
+            child.on('error', (error) => done(() => reject(error)));
+            child.on('close', (code) => {
+                if (code === 0)
+                    done(() => resolve());
+                else
+                    done(() => reject(new Error('macOS keychain store failed')));
+            });
+            child.stdin.write(`add-generic-password -U -s ${VAULT_SERVICE} -a ${key} -w ${hex}\n`);
+            child.stdin.end();
+        });
+    }
+    async deleteSecret(key = VAULT_ACCOUNT) {
+        try {
+            await execFileAsync('security', ['delete-generic-password', '-s', VAULT_SERVICE, '-a', key], { timeout: EXEC_TIMEOUT_MS });
+        }
+        catch {
+            // Missing item is success for logout.
+        }
+    }
+}
+class LinuxSecretToolVault {
+    name = 'libsecret';
+    async isAvailable() {
+        try {
+            await execFileAsync('which', ['secret-tool'], { timeout: EXEC_TIMEOUT_MS });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async getSecret(key = VAULT_ACCOUNT) {
+        try {
+            const { stdout } = await execFileAsync('secret-tool', ['lookup', 'service', VAULT_SERVICE, 'account', key], { timeout: EXEC_TIMEOUT_MS });
+            const value = stdout.trim();
+            return value.length > 0 ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async setSecret(value, key = VAULT_ACCOUNT) {
+        await new Promise((resolve, reject) => {
+            const child = spawn('secret-tool', ['store', '--label', 'BrainMCP CLI', 'service', VAULT_SERVICE, 'account', key], { stdio: ['pipe', 'ignore', 'ignore'] });
+            const timer = setTimeout(() => {
+                child.kill('SIGKILL');
+                reject(new Error('secret-tool store timed out'));
+            }, EXEC_TIMEOUT_MS);
+            const done = (fn) => {
+                clearTimeout(timer);
+                fn();
+            };
+            child.on('error', (error) => done(() => reject(error)));
+            child.on('close', (code) => {
+                if (code === 0)
+                    done(() => resolve());
+                else
+                    done(() => reject(new Error('secret-tool store failed')));
+            });
+            child.stdin.write(value);
+            child.stdin.end();
+        });
+    }
+    async deleteSecret(key = VAULT_ACCOUNT) {
+        try {
+            await execFileAsync('secret-tool', ['clear', 'service', VAULT_SERVICE, 'account', key], { timeout: EXEC_TIMEOUT_MS });
+        }
+        catch {
+            // Missing item is success for logout.
+        }
+    }
+}
+class WindowsCredentialVault {
+    name = 'windows-credential-manager';
+    async isAvailable() {
+        return process.platform === 'win32';
+    }
+    async getSecret(key = VAULT_ACCOUNT) {
+        try {
+            const { stdout } = await execFileAsync('powershell.exe', [
+                '-NoProfile',
+                '-Command',
+                `try { $v = New-Object Windows.Security.Credentials.PasswordVault; ($v.Retrieve('${VAULT_SERVICE}','${key}')).Password } catch { '' }`,
+            ], { timeout: EXEC_TIMEOUT_MS });
+            const value = stdout.trim();
+            return value.length > 0 ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async setSecret(value, key = VAULT_ACCOUNT) {
+        await new Promise((resolve, reject) => {
+            const child = spawn('powershell.exe', [
+                '-NoProfile',
+                '-Command',
+                `$svc='${VAULT_SERVICE}'; $acct='${key}'; $p=[Console]::In.ReadToEnd(); $v=New-Object Windows.Security.Credentials.PasswordVault; try { $v.Remove($v.Retrieve($svc,$acct)) } catch {}; $v.Add((New-Object Windows.Security.Credentials.PasswordCredential($svc,$acct,$p)))`,
+            ], { stdio: ['pipe', 'ignore', 'ignore'] });
+            const timer = setTimeout(() => {
+                child.kill('SIGKILL');
+                reject(new Error('Windows PasswordVault store timed out'));
+            }, EXEC_TIMEOUT_MS);
+            const done = (fn) => {
+                clearTimeout(timer);
+                fn();
+            };
+            child.on('error', (error) => done(() => reject(error)));
+            child.on('close', (code) => {
+                if (code === 0)
+                    done(() => resolve());
+                else
+                    done(() => reject(new Error('Windows PasswordVault store failed')));
+            });
+            child.stdin.write(value);
+            child.stdin.end();
+        });
+    }
+    async deleteSecret(key = VAULT_ACCOUNT) {
+        try {
+            await execFileAsync('powershell.exe', [
+                '-NoProfile',
+                '-Command',
+                `try { $v = New-Object Windows.Security.Credentials.PasswordVault; $v.Remove($v.Retrieve('${VAULT_SERVICE}','${key}')) } catch {}`,
+            ], { timeout: EXEC_TIMEOUT_MS });
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+export function createPlatformVault() {
+    if (process.platform === 'darwin')
+        return new MacosSecurityVault();
+    if (process.platform === 'linux')
+        return new LinuxSecretToolVault();
+    if (process.platform === 'win32')
+        return new WindowsCredentialVault();
+    return new UnavailableSecretVault();
+}
+//# sourceMappingURL=vault.js.map

package/dist/lib/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/lib/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAC5C,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,SAAS,SAAS,EAAE,CAAC;AAC9B,CAAC;AAUD,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,QAAQ,CAAC;IACR,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,SAAS,GAAG,IAAI,CAAC;IAEjB,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,aAAa;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,GAAG,GAAG,aAAa;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,aAAa;QACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IACxB,IAAI,GAAG,aAAa,CAAC;IAC9B,KAAK,CAAC,WAAW;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,YAAY,KAAmB,CAAC;CACvC;AAED,MAAM,kBAAkB;IACb,IAAI,GAAG,gBAAgB,CAAC;IAEjC,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,aAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAC/D,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC3D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,GAAG,GAAG,aAAa;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,EAAc,EAAE,EAAE;gBAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;;oBACjC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,aAAa,OAAO,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;YACvF,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,aAAa;QACpC,IAAI,CAAC;YACH,MAAM,aAAa,CACjB,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,EAC3D,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;CACF;AAED,MAAM,oBAAoB;IACf,IAAI,GAAG,WAAW,CAAC;IAE5B,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,aAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,EACpD,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,GAAG,GAAG,aAAa;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,KAAK,CACjB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,EAC9E,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACnD,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,EAAc,EAAE,EAAE;gBAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;;oBACjC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,aAAa;QACpC,IAAI,CAAC;YACH,MAAM,aAAa,CACjB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,EACnD,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;CACF;AAED,MAAM,sBAAsB;IACjB,IAAI,GAAG,4BAA4B,CAAC;IAE7C,KAAK,CAAC,WAAW;QACf,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,aAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,gBAAgB,EAChB;gBACE,YAAY;gBACZ,UAAU;gBACV,mFAAmF,aAAa,MAAM,GAAG,6BAA6B;aACvI,EACD,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,GAAG,GAAG,aAAa;QAChD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,KAAK,CACjB,gBAAgB,EAChB;gBACE,YAAY;gBACZ,UAAU;gBACV,SAAS,aAAa,aAAa,GAAG,qOAAqO;aAC5Q,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAC7D,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,EAAc,EAAE,EAAE;gBAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;;oBACjC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,aAAa;QACpC,IAAI,CAAC;YACH,MAAM,aAAa,CACjB,gBAAgB,EAChB;gBACE,YAAY;gBACZ,UAAU;gBACV,4FAA4F,aAAa,MAAM,GAAG,gBAAgB;aACnI,EACD,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,kBAAkB,EAAE,CAAC;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;IACtE,OAAO,IAAI,sBAAsB,EAAE,CAAC;AACtC,CAAC"}