@cat-factory/integrations 0.130.2 → 0.131.1

package/dist/modules/mcpOAuth/McpOAuthService.js

@@ -0,0 +1,489 @@
+import { MCP_OAUTH_DEFAULT_HEADER, MCP_OAUTH_DEFAULT_HEADER_TEMPLATE, ValidationError, noopLogger, redactSecrets, } from '@cat-factory/kernel';
+import { McpOAuthError, assertAllowedOAuthUrl, buildAuthorizationUrl, discoverMcpOAuthEndpoints, exchangeAuthorizationCode, refreshAccessToken, requestClientCredentialsToken, } from './mcpOAuthClient.js';
+/**
+ * HKDF domain tag separating this store's ciphertexts from every other cipher in the platform.
+ * ONE tag covers both things sealed here (the stored token set and the in-flight authorization
+ * request), which is why each carries an explicit `kind` claim that the opener pins — the same
+ * discipline the token signer applies with its `aud`, so a value minted for one purpose can never
+ * be opened as the other.
+ */
+export const MCP_OAUTH_CIPHER_INFO = 'cat-factory:mcp-oauth';
+/**
+ * How long an in-flight authorization request stays valid. Long enough to sign in to a vendor and
+ * approve a consent screen, short enough that an abandoned one is not a lasting artefact.
+ */
+const AUTHORIZATION_REQUEST_TTL_MS = 10 * 60 * 1000;
+/**
+ * How far before its stated expiry an access token is treated as spent.
+ *
+ * A dispatched token is used by an agent in a container for the length of a run, not at the
+ * instant it is handed over, so "expires in 20 seconds" is functionally expired. Refreshing early
+ * costs one round trip; handing over a token that dies mid-run costs the agent its tool with no
+ * unavailability reason to state, because the platform believed it was wired.
+ */
+const EXPIRY_SKEW_MS = 60_000;
+/** How many times a lost refresh race re-reads before giving up. */
+const MAX_REFRESH_ATTEMPTS = 3;
+/**
+ * Owns a workspace's OAuth grants against remote (`http`) MCP tool servers: starting a grant,
+ * completing one, minting and refreshing access tokens for a dispatch, and reporting what a board
+ * is connected to.
+ *
+ * The split from `CapabilityCredentialsService` beside it is the split between a credential a
+ * human TYPES and one a human GRANTS. A typed credential is inert until a dispatch reads it; a
+ * granted one expires, refreshes, gets revoked at the vendor, and belongs to a named person's
+ * account. That is why this is a service of its own rather than another key in the checklist: the
+ * checklist's whole shape (a key, a write-only value, a last-written date) cannot express any of it.
+ *
+ * STRICTLY the store plus the protocol. What a deployment DECLARES is registry state, and the
+ * caller passes the declaration in — this package has no business reaching into the agent-kind
+ * registry, exactly as the credential service has none.
+ *
+ * CONCURRENCY: the refresh path is the contended one, and it is contended by two dispatches rather
+ * than two humans. It rides a rev-guarded `compareAndSwap`, and the loser does NOT re-apply its own
+ * write (the rule every other rev-guarded path in this repo follows) — it re-reads and adopts the
+ * winner's tokens. Re-applying would be actively wrong here: an authorization server that rotates
+ * refresh tokens has already invalidated the loser's, so re-applying replaces a working grant with
+ * a dead one.
+ */
+export class McpOAuthService {
+    deps;
+    log;
+    constructor(deps) {
+        this.deps = deps;
+        this.log = deps.logger ?? noopLogger;
+    }
+    get fetchDeps() {
+        return this.deps.fetchImpl ? { fetch: this.deps.fetchImpl } : {};
+    }
+    /**
+     * Begin an `authorization_code` grant: resolve the endpoints, mint a PKCE pair, and return the
+     * vendor URL to send the operator to.
+     *
+     * Throws rather than returning a status, because every failure here is a REFUSAL an operator
+     * asked for directly (a declaration that cannot be granted, a deployment with no redirect URL,
+     * an authorization server that publishes nothing) and the surface that called it is a button
+     * press, not a run.
+     */
+    async startAuthorization(input) {
+        if (input.oauth.grant !== 'authorization_code') {
+            throw new ValidationError(`Tool server '${input.serverId}' authenticates with the client-credentials grant, which ` +
+                `needs no authorization: its token is minted from the deployment's own client on the ` +
+                `first dispatch that needs one.`, { reason: 'oauth_grant_not_interactive' });
+        }
+        const endpoints = await this.resolveEndpoints(input.serverUrl, input.oauth);
+        const codeVerifier = randomCodeVerifier();
+        const request = {
+            kind: 'authorization-request',
+            workspaceId: input.workspaceId,
+            serverId: input.serverId,
+            userId: input.userId,
+            codeVerifier,
+            redirectUri: input.redirectUri,
+            tokenUrl: endpoints.tokenUrl,
+            useBasicAuth: endpoints.useBasicAuth,
+            resource: input.oauth.resource ?? input.serverUrl,
+            exp: this.deps.clock.now() + AUTHORIZATION_REQUEST_TTL_MS,
+        };
+        return {
+            url: buildAuthorizationUrl({
+                authorizationUrl: endpoints.authorizationUrl,
+                clientId: input.oauth.clientId,
+                redirectUri: input.redirectUri,
+                state: await this.deps.secretCipher.encrypt(JSON.stringify(request)),
+                codeChallenge: await codeChallengeFor(codeVerifier),
+                ...(input.oauth.scopes?.length ? { scopes: input.oauth.scopes } : {}),
+                resource: request.resource,
+            }),
+        };
+    }
+    /**
+     * Open the sealed `state` a callback carried, or null when it is absent, forged, expired or not
+     * an authorization request at all.
+     *
+     * Null rather than a thrown cause on purpose: the four are indistinguishable to the caller and
+     * every one of them is a 401, so telling them apart would only tell an attacker which of their
+     * guesses was closer.
+     */
+    async readAuthorizationRequest(state) {
+        if (!state)
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(await this.deps.secretCipher.decrypt(state));
+        }
+        catch {
+            // silent-catch-ok: a state that will not open is a 401 whatever the reason, and the reason is
+            // attacker-supplied. The caller logs the refusal with the request's own correlation id.
+            return null;
+        }
+        const request = parsed;
+        if (!request || request.kind !== 'authorization-request')
+            return null;
+        if (typeof request.exp !== 'number' || request.exp < this.deps.clock.now())
+            return null;
+        return request;
+    }
+    /**
+     * Complete a grant: exchange the code for tokens and seal them for the workspace.
+     *
+     * A BLIND upsert, unlike the refresh path: a human just authorised, and what they authorised
+     * supersedes whatever the row held — including a grant a colleague made a minute earlier, which
+     * is exactly the "reconnect with a different account" case a rev guard would turn into a
+     * spurious conflict.
+     */
+    async completeAuthorization(request, input) {
+        const tokens = await exchangeAuthorizationCode({
+            tokenUrl: request.tokenUrl,
+            clientId: input.clientId,
+            ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+            useBasicAuth: request.useBasicAuth,
+            resource: request.resource,
+            code: input.code,
+            redirectUri: request.redirectUri,
+            codeVerifier: request.codeVerifier,
+        }, this.fetchDeps).catch((error) => {
+            throw asRefusal(error);
+        });
+        const now = this.deps.clock.now();
+        await this.deps.mcpOAuthGrantRepository.upsert(await this.buildRecord({
+            workspaceId: request.workspaceId,
+            serverId: request.serverId,
+            tokens,
+            now,
+            rev: 0,
+            createdAt: now,
+            summary: {
+                connectedAt: now,
+                ...(request.userId ? { connectedBy: request.userId } : {}),
+            },
+        }));
+        this.log.info('mcp tool server oauth grant stored', {
+            workspaceId: request.workspaceId,
+            toolServerId: request.serverId,
+            refreshable: Boolean(tokens.refreshToken),
+        });
+    }
+    /** Drop a workspace's grant for one server. Idempotent: a missing row is already disconnected. */
+    async disconnect(workspaceId, serverId) {
+        await this.deps.mcpOAuthGrantRepository.delete(workspaceId, serverId);
+    }
+    /**
+     * The non-secret connection state of every grant a workspace holds, keyed by server id.
+     *
+     * ONE read for the whole inventory rather than a lookup per declared server: the operator surface
+     * renders a row per DECLARATION, and the declarations are the deployment's whole registry.
+     */
+    async listStatuses(workspaceId) {
+        const records = await this.deps.mcpOAuthGrantRepository.listByWorkspace(workspaceId);
+        return new Map(records.map((record) => [record.serverId, parseSummary(record)]));
+    }
+    /**
+     * The access token one dispatch needs, refreshing or minting it when what is stored will not do.
+     *
+     * Never throws: a dispatch asking for a tool is not a place to fail a run, so every failure comes
+     * back as a `token_failed` result the caller states to the agent. That is the same disposition
+     * `resolveToolServers` gives an unresolved static credential, and for the same reason.
+     */
+    async accessToken(input) {
+        try {
+            const token = await this.resolveToken(input);
+            return token
+                ? {
+                    status: 'ok',
+                    header: input.oauth.header ?? MCP_OAUTH_DEFAULT_HEADER,
+                    value: (input.oauth.headerTemplate ?? MCP_OAUTH_DEFAULT_HEADER_TEMPLATE).replaceAll('{value}', token),
+                }
+                : { status: 'not_connected' };
+        }
+        catch (error) {
+            const message = describeOAuthError(error);
+            this.log.warn('mcp tool server oauth token could not be obtained', {
+                workspaceId: input.workspaceId,
+                toolServerId: input.serverId,
+                detail: message,
+            });
+            await this.recordFailure(input.workspaceId, input.serverId, message);
+            return { status: 'token_failed', error: message };
+        }
+    }
+    /** The raw access token, or null when nothing is granted. Throws on a real failure. */
+    async resolveToken(input) {
+        for (let attempt = 0; attempt < MAX_REFRESH_ATTEMPTS; attempt++) {
+            const record = await this.deps.mcpOAuthGrantRepository.get(input.workspaceId, input.serverId);
+            const stored = record ? await this.openTokens(record) : null;
+            if (stored && !this.isSpent(stored)) {
+                // A live token also settles any failure the summary still claims: `lastError` is written by
+                // whichever dispatch could not mint one, and nothing else would ever take it back off a
+                // connection that started working again. Only touches the row when there is something to
+                // clear, so the ordinary dispatch stays a single read.
+                if (record && parseSummary(record).lastError !== undefined)
+                    await this.clearFailure(record);
+                return stored.accessToken;
+            }
+            if (input.oauth.grant === 'authorization_code' && !stored)
+                return null;
+            if (input.oauth.grant === 'authorization_code' && !stored?.refreshToken) {
+                throw new McpOAuthError(`The stored access token has expired and the authorization server issued no refresh ` +
+                    `token, so the connection has to be granted again.`, true);
+            }
+            let tokens;
+            try {
+                tokens = await this.mintTokens(input, stored?.refreshToken);
+            }
+            catch (error) {
+                // The refresh race the rev guard below CANNOT settle, and the likelier half of it against a
+                // rotating authorization server. Two dispatches find the same token spent and POST the same
+                // refresh token; the winner's exchange rotates it, which INVALIDATES the loser's copy, so
+                // the loser fails right here with `invalid_grant` and never reaches the compareAndSwap that
+                // would have told it it lost. Re-reading is what tells the two apart: a row that has moved
+                // on to a live token means a peer succeeded, and this dispatch wants a token rather than a
+                // diagnosis. With nothing new stored, the failure is real and propagates untouched.
+                const adopted = await this.adoptConcurrentToken(input.workspaceId, input.serverId, record);
+                if (adopted) {
+                    this.log.info('adopted a concurrently refreshed mcp oauth token after a lost race', {
+                        workspaceId: input.workspaceId,
+                        toolServerId: input.serverId,
+                    });
+                    return adopted;
+                }
+                throw error;
+            }
+            const now = this.deps.clock.now();
+            const swapped = await this.deps.mcpOAuthGrantRepository.compareAndSwap(await this.buildRecord({
+                workspaceId: input.workspaceId,
+                serverId: input.serverId,
+                tokens: {
+                    ...tokens,
+                    // An authorization server that rotates refresh tokens returns a new one; one that does
+                    // not returns none, and DROPPING the old one there would turn a working grant into a
+                    // single-use one. Carrying it forward is what makes both behaviours refreshable.
+                    ...(tokens.refreshToken ? {} : { refreshToken: stored?.refreshToken }),
+                },
+                now,
+                rev: (record?.rev ?? -1) + 1,
+                createdAt: record?.createdAt ?? now,
+                summary: {
+                    ...(record ? dropError(parseSummary(record)) : {}),
+                    ...(record ? {} : { connectedAt: now }),
+                },
+            }), record?.rev ?? null);
+            // Lost the race: another dispatch refreshed first. Loop back and read THEIR tokens rather
+            // than re-applying ours — a rotated refresh token makes ours the stale set, so re-applying
+            // would replace a working grant with a dead one.
+            if (swapped)
+                return tokens.accessToken;
+        }
+        throw new McpOAuthError(`The stored grant is being refreshed by several runs at once and this dispatch could not ` +
+            `settle on a token; retry.`, false);
+    }
+    /**
+     * One exchange at the token endpoint: the machine grant mints from the deployment's own client,
+     * the interactive one spends the stored refresh token.
+     *
+     * Split out of {@link resolveToken} so that method reads as what it is (the read, the spend
+     * check, the race handling and the swap) rather than carrying the wire shape of two requests
+     * through the middle of it.
+     */
+    async mintTokens(input, refreshToken) {
+        const endpoints = await this.resolveEndpoints(input.serverUrl, input.oauth);
+        const common = {
+            tokenUrl: endpoints.tokenUrl,
+            clientId: input.oauth.clientId,
+            ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+            useBasicAuth: endpoints.useBasicAuth,
+            resource: input.oauth.resource ?? input.serverUrl,
+        };
+        const scopes = input.oauth.scopes?.length ? { scopes: input.oauth.scopes } : {};
+        return input.oauth.grant === 'client_credentials'
+            ? requestClientCredentialsToken({ ...common, ...scopes }, this.fetchDeps)
+            : // Reached only past the guards above, which return or throw when there is no refresh token.
+                refreshAccessToken({ ...common, refreshToken: refreshToken }, this.fetchDeps);
+    }
+    /**
+     * The token a CONCURRENT dispatch stored while this one was failing to mint its own, or null.
+     *
+     * Best effort by construction: it runs on a path that already has a real error to report, so
+     * anything that goes wrong here (an unreadable row, a rotated key) means only that there is
+     * nothing to adopt, and the caller rethrows the failure that brought it here. Requires the row to
+     * have MOVED: an unchanged `rev` is the same grant this attempt already read and failed with,
+     * and returning its expired token would hand the run a credential the vendor has finished with.
+     */
+    async adoptConcurrentToken(workspaceId, serverId, seen) {
+        try {
+            const record = await this.deps.mcpOAuthGrantRepository.get(workspaceId, serverId);
+            if (!record || record.rev === seen?.rev)
+                return null;
+            const stored = await this.openTokens(record);
+            return stored && !this.isSpent(stored) ? stored.accessToken : null;
+        }
+        catch {
+            // silent-catch-ok: this is a recovery read behind an error that is about to propagate, and
+            // its own failure is not a second thing to report: it only means nothing could be adopted.
+            return null;
+        }
+    }
+    /** Endpoints: the declaration's, when it pinned them, else discovered from the server url. */
+    async resolveEndpoints(serverUrl, oauth) {
+        if (oauth.authorizationUrl && oauth.tokenUrl) {
+            // The SAME floor a discovered endpoint and every redirect hop is held to, from the one
+            // implementation: a rule enforced on two of three paths is not a rule.
+            assertAllowedOAuthUrl(oauth.authorizationUrl, 'declared OAuth authorizationUrl');
+            assertAllowedOAuthUrl(oauth.tokenUrl, 'declared OAuth tokenUrl');
+            return {
+                authorizationUrl: oauth.authorizationUrl,
+                tokenUrl: oauth.tokenUrl,
+                useBasicAuth: false,
+            };
+        }
+        const discovered = await discoverMcpOAuthEndpoints(serverUrl, this.fetchDeps);
+        // A HALF-declared pair still overrides its half: pinning one endpoint and discovering the other
+        // is a legitimate declaration (a vendor whose metadata is right about one and stale about the
+        // other), and silently ignoring the pin would send tokens somewhere the operator refused.
+        return {
+            authorizationUrl: oauth.authorizationUrl ?? discovered.authorizationUrl,
+            tokenUrl: oauth.tokenUrl ?? discovered.tokenUrl,
+            useBasicAuth: discovered.useBasicAuth,
+        };
+    }
+    /** Whether a stored access token is too close to its expiry to hand to a run. */
+    isSpent(tokens) {
+        return (tokens.expiresAt !== undefined && tokens.expiresAt - EXPIRY_SKEW_MS <= this.deps.clock.now());
+    }
+    async openTokens(record) {
+        try {
+            const parsed = JSON.parse(await this.deps.secretCipher.decrypt(record.tokens));
+            return parsed?.kind === 'tokens' && typeof parsed.accessToken === 'string' ? parsed : null;
+        }
+        catch (error) {
+            // A row that will not open is a rotated ENCRYPTION_KEY or a corrupt blob, and it is
+            // permanent: nothing this process does will decrypt it, so it must read as a broken
+            // connection to be re-granted rather than as an absent one that a dispatch quietly retries.
+            throw new McpOAuthError(`The stored grant could not be opened (${describeOAuthError(error)}). It was sealed with a ` +
+                `different encryption key; disconnect and grant it again.`, true);
+        }
+    }
+    async buildRecord(input) {
+        const expiresAt = input.tokens.expiresIn !== undefined ? input.now + input.tokens.expiresIn * 1000 : undefined;
+        const stored = {
+            kind: 'tokens',
+            accessToken: input.tokens.accessToken,
+            ...(input.tokens.refreshToken ? { refreshToken: input.tokens.refreshToken } : {}),
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+            ...(input.tokens.scope ? { scope: input.tokens.scope } : {}),
+        };
+        const summary = {
+            ...input.summary,
+            ...(input.tokens.scope ? { scopes: input.tokens.scope.split(/\s+/).filter(Boolean) } : {}),
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+            refreshable: Boolean(stored.refreshToken),
+        };
+        return {
+            workspaceId: input.workspaceId,
+            serverId: input.serverId,
+            tokens: await this.deps.secretCipher.encrypt(JSON.stringify(stored)),
+            summary: JSON.stringify(summary),
+            rev: input.rev,
+            createdAt: input.createdAt,
+            updatedAt: input.now,
+        };
+    }
+    /**
+     * Record on the SUMMARY that the last token exchange failed, so the operator surface can say a
+     * connection stopped working without anyone reading a run's prompt.
+     *
+     * Best effort by construction, and it only ever touches a row that already exists: a failure with
+     * nothing stored is `not_connected`, which the surface already states. The rev guard is NOT
+     * retried on a lost swap: the note is advisory, and losing it to a concurrent refresh that
+     * SUCCEEDED is the correct outcome rather than a lost write.
+     */
+    async recordFailure(workspaceId, serverId, message) {
+        const record = await this.deps.mcpOAuthGrantRepository.get(workspaceId, serverId);
+        if (!record)
+            return;
+        await this.writeSummary(record, { ...parseSummary(record), lastError: message });
+    }
+    /**
+     * Take a recorded failure back off a connection that has started working again.
+     *
+     * The other half of {@link recordFailure}, and the surface reads wrong without it: `lastError`
+     * describes the last exchange that failed, so on a token that is merely CACHED (the common
+     * dispatch, which mints nothing) nothing would ever clear it, and one transient vendor outage
+     * would leave a red "the last token renewal failed" banner on a working grant until the access
+     * token happened to expire. Same advisory, same unretried rev guard.
+     */
+    async clearFailure(record) {
+        await this.writeSummary(record, dropError(parseSummary(record)));
+    }
+    /** One rev-guarded, unretried write of the non-secret half. */
+    async writeSummary(record, summary) {
+        await this.deps.mcpOAuthGrantRepository.compareAndSwap({
+            ...record,
+            summary: JSON.stringify(summary),
+            rev: record.rev + 1,
+            updatedAt: this.deps.clock.now(),
+        }, record.rev);
+    }
+}
+/** Parse the persisted non-secret summary, tolerating a corrupt row (the view still loads). */
+function parseSummary(record) {
+    try {
+        const parsed = JSON.parse(record.summary);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        // silent-catch-ok: a summary is a display projection of a row whose SEALED half is the truth,
+        // so a drifted one must never keep an operator from seeing that the grant exists.
+        return {};
+    }
+}
+/** The summary with any recorded failure cleared — what a successful exchange leaves behind. */
+function dropError(summary) {
+    const { lastError: _dropped, ...rest } = summary;
+    return rest;
+}
+/**
+ * An OAuth failure as an operator-facing sentence, scrubbed.
+ *
+ * `describeError` in kernel would do the scrubbing, and this exists beside it because an
+ * `McpOAuthError`'s message IS the operator-facing sentence: wrapping it in a generic description
+ * would bury the one part of it that names the fix.
+ */
+function describeOAuthError(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    return redactSecrets(raw) ?? 'unknown error';
+}
+/**
+ * An OAuth failure as an HTTP refusal, for the INTERACTIVE paths (starting and completing a grant),
+ * where the caller is a person and a thrown cause is the answer they asked for.
+ *
+ * A PERMANENT failure becomes a 422 carrying `details.reason`, because what must change is the
+ * declaration or the grant and the operator is the one who can change it. A TRANSIENT one is
+ * rethrown untouched and surfaces as a 500, which is the honest status for "the vendor's
+ * authorization server did not answer": mapping it to a 4xx would tell the operator to fix
+ * something that is not theirs.
+ */
+function asRefusal(error) {
+    if (error instanceof McpOAuthError && error.permanent) {
+        return new ValidationError(describeOAuthError(error), { reason: 'oauth_exchange_refused' });
+    }
+    return error;
+}
+/** A PKCE code verifier: 32 random bytes, base64url — the RFC 7636 recommended shape. */
+function randomCodeVerifier() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return base64url(bytes);
+}
+/** The S256 challenge for a verifier. */
+async function codeChallengeFor(verifier) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return base64url(new Uint8Array(digest));
+}
+function base64url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=McpOAuthService.js.map

package/dist/modules/mcpOAuth/McpOAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthService.js","sourceRoot":"","sources":["../../../src/modules/mcpOAuth/McpOAuthService.ts"],"names":[],"mappings":"AASA,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,eAAe,EACf,UAAU,EACV,aAAa,GACd,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAEL,aAAa,EAGb,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAA;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAE5D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,CAAC,CAAA;AA4D9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,eAAe;IAGG,IAAI;IAFhB,GAAG,CAAQ;IAE5B,YAA6B,IAAiC;oBAAjC,IAAI;QAC/B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAA;IACtC,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAOxB;QACC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CACvB,gBAAgB,KAAK,CAAC,QAAQ,2DAA2D;gBACvF,sFAAsF;gBACtF,gCAAgC,EAClC,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAC1C,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3E,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAA;QACzC,MAAM,OAAO,GAA4B;YACvC,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY;YACZ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS;YACjD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,4BAA4B;SAC1D,CAAA;QACD,OAAO;YACL,GAAG,EAAE,qBAAqB,CAAC;gBACzB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;gBAC5C,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACpE,aAAa,EAAE,MAAM,gBAAgB,CAAC,YAAY,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;SACH,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAAoB;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,wFAAwF;YACxF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,OAAO,GAAG,MAAiC,CAAA;QACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB;YAAE,OAAO,IAAI,CAAA;QACrE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAAgC,EAChC,KAAgE;QAEhE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,EACD,IAAI,CAAC,SAAS,CACf,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAC5C,MAAM,IAAI,CAAC,WAAW,CAAC;YACrB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,GAAG;YACH,GAAG,EAAE,CAAC;YACN,SAAS,EAAE,GAAG;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,GAAG;gBAChB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;SACF,CAAC,CACH,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAClD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,QAAQ;YAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1C,CAAC,CAAA;IACJ,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,QAAgB;QACpD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QACpF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAClF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,KAOjB;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5C,OAAO,KAAK;gBACV,CAAC,CAAC;oBACE,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,wBAAwB;oBACtD,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,iCAAiC,CAAC,CAAC,UAAU,CACjF,SAAS,EACT,KAAK,CACN;iBACF;gBACH,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE;gBACjE,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,QAAQ;gBAC5B,MAAM,EAAE,OAAO;aAChB,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QACnD,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,KAAK,CAAC,YAAY,CAAC,KAM1B;QACC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC5D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,4FAA4F;gBAC5F,wFAAwF;gBACxF,yFAAyF;gBACzF,uDAAuD;gBACvD,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,KAAK,SAAS;oBAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;gBAC3F,OAAO,MAAM,CAAC,WAAW,CAAA;YAC3B,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACtE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;gBACxE,MAAM,IAAI,aAAa,CACrB,qFAAqF;oBACnF,mDAAmD,EACrD,IAAI,CACL,CAAA;YACH,CAAC;YACD,IAAI,MAAsB,CAAA;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4FAA4F;gBAC5F,4FAA4F;gBAC5F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,oFAAoF;gBACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAC1F,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oEAAoE,EAAE;wBAClF,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,YAAY,EAAE,KAAK,CAAC,QAAQ;qBAC7B,CAAC,CAAA;oBACF,OAAO,OAAO,CAAA;gBAChB,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,cAAc,CACpE,MAAM,IAAI,CAAC,WAAW,CAAC;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE;oBACN,GAAG,MAAM;oBACT,uFAAuF;oBACvF,qFAAqF;oBACrF,iFAAiF;oBACjF,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;iBACvE;gBACD,GAAG;gBACH,GAAG,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5B,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,GAAG;gBACnC,OAAO,EAAE;oBACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;iBACxC;aACF,CAAC,EACF,MAAM,EAAE,GAAG,IAAI,IAAI,CACpB,CAAA;YACD,0FAA0F;YAC1F,2FAA2F;YAC3F,iDAAiD;YACjD,IAAI,OAAO;gBAAE,OAAO,MAAM,CAAC,WAAW,CAAA;QACxC,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,0FAA0F;YACxF,2BAA2B,EAC7B,KAAK,CACN,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU,CACtB,KAIC,EACD,YAAgC;QAEhC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG;YACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS;SAClD,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,oBAAoB;YAC/C,CAAC,CAAC,6BAA6B,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC;YACzE,CAAC,CAAC,4FAA4F;gBAC5F,kBAAkB,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,YAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACpF,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,QAAgB,EAChB,IAAgC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;YACjF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,GAAG;gBAAE,OAAO,IAAI,CAAA;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC5C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;YAC3F,2FAA2F;YAC3F,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,gBAAgB,CAC5B,SAAiB,EACjB,KAAqB;QAErB,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7C,uFAAuF;YACvF,uEAAuE;YACvE,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAA;YAChF,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAA;YAChE,OAAO;gBACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK;aACpB,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC7E,gGAAgG;QAChG,8FAA8F;QAC9F,0FAA0F;QAC1F,OAAO;YACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,UAAU,CAAC,gBAAgB;YACvE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;YAC/C,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAA;IACH,CAAC;IAED,iFAAiF;IACzE,OAAO,CAAC,MAAoB;QAClC,OAAO,CACL,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAC7F,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAA2B;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAiB,CAAA;YAC9F,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,oFAAoF;YACpF,4FAA4F;YAC5F,MAAM,IAAI,aAAa,CACrB,yCAAyC,kBAAkB,CAAC,KAAK,CAAC,0BAA0B;gBAC1F,0DAA0D,EAC5D,IAAI,CACL,CAAA;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAQzB;QACC,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9F,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAA;QACD,MAAM,OAAO,GAAiB;YAC5B,GAAG,KAAK,CAAC,OAAO;YAChB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1C,CAAA;QACD,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CACzB,WAAmB,EACnB,QAAgB,EAChB,OAAe;QAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IAClF,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,YAAY,CAAC,MAA2B;QACpD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,+DAA+D;IACvD,KAAK,CAAC,YAAY,CAAC,MAA2B,EAAE,OAAqB;QAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,cAAc,CACpD;YACE,GAAG,MAAM;YACT,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;YACnB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACjC,EACD,MAAM,CAAC,GAAG,CACX,CAAA;IACH,CAAC;CACF;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,MAA2B;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAY,CAAA;QACpD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAuB,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,kFAAkF;QAClF,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAAC,OAAqB;IACtC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAChD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClE,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,eAAe,CAAA;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACtD,OAAO,IAAI,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yFAAyF;AACzF,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,yCAAyC;AACzC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC"}

package/dist/modules/mcpOAuth/mcpOAuthClient.d.ts

@@ -0,0 +1,101 @@
+/** How long the whole discovery walk, or one token call, may take. */
+export declare const MCP_OAUTH_TIMEOUT_MS = 10000;
+/**
+ * The one URL floor every request in this module is held to, applied to DECLARED endpoints,
+ * DISCOVERED ones, and every redirect hop alike.
+ *
+ * Two rules, and the second is here because discovery reads a THIRD PARTY's document. A remote
+ * server's protected-resource metadata names its authorization servers, so a compromised or hostile
+ * server chooses URLs this deployment then fetches; `isAllowedMcpHttpUrl` alone would accept
+ * `https://169.254.169.254/…` and turn the walk into a probe of the instance-metadata service.
+ * Blocking metadata hosts while still ALLOWING private and loopback ones is the same trade the
+ * Kubernetes apiserver guard makes, and it keeps a sidecar MCP server on a private host connectable.
+ *
+ * One floor for every URL rather than a stricter rule for discovered ones: a declaration pointing an
+ * OAuth endpoint at a metadata host is nonsense too, so there is nothing to gain by admitting it.
+ */
+export declare function assertAllowedOAuthUrl(raw: string, what: string): void;
+/** Injected so tests drive the whole flow without a network. */
+export interface McpOAuthFetch {
+    fetch?: typeof fetch;
+}
+/** Where a server's authorization server is, and how it wants the client to authenticate. */
+export interface McpOAuthEndpoints {
+    authorizationUrl: string;
+    tokenUrl: string;
+    /**
+     * Whether the token endpoint is asked for HTTP Basic client authentication instead of the
+     * credentials-in-the-body form.
+     *
+     * Defaults to the body form (`client_secret_post`), which every authorization server this
+     * platform has met accepts, and flips only when the AS metadata advertises Basic and NOT post.
+     * Deciding it from the metadata rather than trying both matters because a retry-on-401 would
+     * send the client secret twice, to a server that has already refused it once.
+     */
+    useBasicAuth: boolean;
+}
+/** A token response, normalised. `expiresIn` is seconds, as the wire states it. */
+export interface McpOAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    scope?: string;
+    tokenType?: string;
+}
+/** A failure with a cause an operator can act on. Never carries a credential (see `describe`). */
+export declare class McpOAuthError extends Error {
+    /** True when retrying cannot help: the grant or the client registration must change. */
+    readonly permanent: boolean;
+    constructor(message: string, 
+    /** True when retrying cannot help: the grant or the client registration must change. */
+    permanent: boolean);
+}
+/**
+ * Discover a remote MCP server's authorization endpoints, per the MCP authorization spec: the
+ * server's own protected-resource metadata (RFC 9728) names its authorization server, and that
+ * server's metadata (RFC 8414, or OpenID Connect discovery) names the endpoints.
+ *
+ * The walk is what makes a vendor server connectable from a declaration that names only its url.
+ * Without it a deployment has to find two endpoint URLs in a vendor's docs, and they are exactly
+ * the strings a vendor changes when it re-platforms.
+ *
+ * EVERY url the walk touches goes through {@link assertAllowedOAuthUrl}: each candidate, each
+ * redirect hop, and both endpoints that come out of it. A metadata document is a third party
+ * telling this deployment where to send its client secret and receive its tokens, which is the one
+ * place in this flow where an outsider chooses a URL this side then fetches, so it is also the one
+ * place where checking the first URL and trusting the rest would not be checking at all.
+ */
+export declare function discoverMcpOAuthEndpoints(serverUrl: string, deps?: McpOAuthFetch): Promise<McpOAuthEndpoints>;
+/** The authorization URL an operator's browser is sent to. */
+export declare function buildAuthorizationUrl(input: {
+    authorizationUrl: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    scopes?: string[];
+    resource: string;
+}): string;
+export interface TokenRequestInput {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    useBasicAuth?: boolean;
+    resource: string;
+}
+/** Exchange an authorization code (plus its PKCE verifier) for a token set. */
+export declare function exchangeAuthorizationCode(input: TokenRequestInput & {
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+}, deps?: McpOAuthFetch): Promise<McpOAuthTokens>;
+/** Exchange a refresh token for a fresh token set. */
+export declare function refreshAccessToken(input: TokenRequestInput & {
+    refreshToken: string;
+    scopes?: string[];
+}, deps?: McpOAuthFetch): Promise<McpOAuthTokens>;
+/** Mint a token from the deployment's own client credentials — the no-human grant. */
+export declare function requestClientCredentialsToken(input: TokenRequestInput & {
+    scopes?: string[];
+}, deps?: McpOAuthFetch): Promise<McpOAuthTokens>;
+//# sourceMappingURL=mcpOAuthClient.d.ts.map

package/dist/modules/mcpOAuth/mcpOAuthClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpOAuthClient.d.ts","sourceRoot":"","sources":["../../../src/modules/mcpOAuth/mcpOAuthClient.ts"],"names":[],"mappings":"AAkBA,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAa1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAwBrE;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,kGAAkG;AAClG,qBAAa,aAAc,SAAQ,KAAK;IAGpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,OAAO;IAH7B,YACE,OAAO,EAAE,MAAM;IACf,wFAAwF;IAC/E,SAAS,EAAE,OAAO,EAI5B;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CA2D5B;AA6ED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,CAcT;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EACtF,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,iBAAiB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EACtE,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,cAAc,CAAC,CAUzB;AAED,sFAAsF;AACtF,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,iBAAiB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAChD,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,cAAc,CAAC,CASzB"}