@cat-factory/server 0.222.2 → 0.223.0

package/dist/modules/publicApi/PublicDebugController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PublicDebugController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDebugController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAErE,+FAA+F;AAC/F,0FAA0F;AAC1F,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,0FAA0F;AAC1F,yBAAyB;AACzB,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,wFAAwF;AACxF,gFAAgF;AAChF,2FAA2F;AAC3F,mFAAmF;AACnF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,4CAA4C;AAC5C,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAE5F,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAC/B,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAEjC;;;;GAIG;AACH,MAAM,6BAA6B,GAAG,OAAO,CAAA;AAE7C,kGAAkG;AAClG,SAAS,YAAY,CAAmB,CAAa;IACnD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAA;AAC5C,CAAC;AAED,MAAM,WAAW,GAAG,CAAmB,CAAa,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE7F,MAAM,QAAQ,GAAG,CAAmB,CAAa,EAAE,IAAY,EAAE,EAAE,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE3E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1D,CAAC;AAED,MAAM,aAAa,GAAG,CAAmB,CAAa,EAAE,EAAE,CACxD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAmB,CAAa,EAAE,EAAE,CAC5D,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+EAA+E;KACzF;CACF,EACD,GAAG,CACJ,CAAA;AAEH,gGAAgG;AAChG,SAAS,YAAY,CAAI,IAAkB;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACvD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,gBAAgB;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,oFAAoF;IACpF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,0FAA0F;QAC1F,yFAAyF;QACzF,qEAAqE;QACrE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,yCAAyC;IACzC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YACtF,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,6BAA6B;YAC3D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK;SAC1B,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,oBAAoB;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,EAC/B,KAAK,CAAC,SAAS,IAAI,6BAA6B,EAChD,KAAK,CAAC,UAAU,IAAI,CAAC,CACtB,CAAA;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,uFAAuF;IACvF,gFAAgF;IAChF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,2FAA2F;IAC3F,oBAAoB;IACpB,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PublicDebugController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDebugController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAErE,+FAA+F;AAC/F,0FAA0F;AAC1F,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,0FAA0F;AAC1F,yBAAyB;AACzB,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,wFAAwF;AACxF,gFAAgF;AAChF,2FAA2F;AAC3F,mFAAmF;AACnF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,4CAA4C;AAC5C,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAE5F,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAC/B,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAEjC;;;;GAIG;AACH,MAAM,6BAA6B,GAAG,OAAO,CAAA;AAE7C,kGAAkG;AAClG,SAAS,YAAY,CAAmB,CAAa;IACnD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAA;AAC5C,CAAC;AAED,MAAM,WAAW,GAAG,CAAmB,CAAa,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE7F,MAAM,QAAQ,GAAG,CAAmB,CAAa,EAAE,IAAY,EAAE,EAAE,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE3E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1D,CAAC;AAED,MAAM,aAAa,GAAG,CAAmB,CAAa,EAAE,EAAE,CACxD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAmB,CAAa,EAAE,EAAE,CAC5D,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+EAA+E;KACzF;CACF,EACD,GAAG,CACJ,CAAA;AAEH,gGAAgG;AAChG,SAAS,YAAY,CAAI,IAAkB;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACvD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,gBAAgB;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,oFAAoF;IACpF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,0FAA0F;QAC1F,yFAAyF;QACzF,qEAAqE;QACrE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,yCAAyC;IACzC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YACtF,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,6BAA6B;YAC3D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK;SAC1B,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,oBAAoB;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,EAC/B,KAAK,CAAC,SAAS,IAAI,6BAA6B,EAChD,KAAK,CAAC,UAAU,IAAI,CAAC,CACtB,CAAA;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,uFAAuF;IACvF,gFAAgF;IAChF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,yFAAyF;YACzF,oFAAoF;YACpF,2FAA2F;YAC3F,gEAAgE;YAChE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,2FAA2F;IAC3F,oBAAoB;IACpB,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/toolServers/McpOAuthCompletionController.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+export declare function mcpOAuthCompletionController(): Hono<AppEnv>;
+//# sourceMappingURL=McpOAuthCompletionController.d.ts.map

package/dist/modules/toolServers/McpOAuthCompletionController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthCompletionController.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/McpOAuthCompletionController.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAmC/C,wBAAgB,4BAA4B,IAAI,IAAI,CAAC,MAAM,CAAC,CA4C3D"}

package/dist/modules/toolServers/McpOAuthCompletionController.js

@@ -0,0 +1,125 @@
+import { completeToolServerOAuthContract } from '@cat-factory/contracts';
+import { ForbiddenError, UnauthorizedError, ValidationError } from '@cat-factory/kernel';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+import { resolveOAuthClientSecret } from '../../agents/mcpOAuthClientSecret.js';
+import { requireCapability } from '../../http/guards.js';
+import { requestLogger } from '../../http/requestLogging.js';
+import { loadWorkspaceAccess } from '../../http/workspaceAccess.js';
+import { resolveDeclaredToolServers } from './declaredToolServers.js';
+// ---------------------------------------------------------------------------
+// Finishing an OAuth grant against a remote MCP tool server.
+//
+// The vendor's redirect does NOT land here. It lands on the SPA, which re-presents the `code` and
+// `state` over the authenticated API, and that indirection is the entire security design rather
+// than a convenience:
+//
+// A redirect URI is one fixed string a third party has on file, so a route receiving it directly
+// is reached by a top-level browser navigation the vendor triggers. Sessions in this product are
+// BEARER TOKENS, which such a navigation cannot carry, so that route sees no user on every request
+// — on an auth-enabled deployment exactly as in dev-open. Any "the caller is who started the flow"
+// or "the caller still holds secrets.manage" check written there is unreachable code that reads
+// like protection, and it would additionally have to be exempted from the default-deny session gate
+// to be reachable at all. Routing the two values back through the SPA is what turns both checks
+// into things that actually run.
+//
+// So this route is ordinary session-gated API, and it is mounted at the ROOT because the board is
+// sealed into the state rather than carried in the path — the same shape `/user-secrets` has. Three
+// things gate it, each of which now genuinely executes:
+//
+//   1. the SESSION, via the shared default-deny gate (`mountAuthGate`), so an absent user here
+//      means auth is not configured at all rather than a caller who simply has no token;
+//   2. the sealed `state`, which only this deployment can mint and open, carries the workspace, the
+//      server and the PKCE verifier, and expires;
+//   3. the workspace PERMISSION, re-resolved at the moment the token is stored. A grant takes
+//      minutes of human time and `secrets.manage` can be revoked inside that window, so the start
+//      route's gate is not evidence about now.
+// ---------------------------------------------------------------------------
+export function mcpOAuthCompletionController() {
+    const app = new Hono();
+    buildHonoRoute(app, completeToolServerOAuthContract, async (c) => {
+        const container = c.get('container');
+        const logger = requestLogger(c);
+        const oauthService = requireCapability(container.mcpOAuth, 'Tool-server OAuth is not configured');
+        const { code, state } = c.req.valid('json');
+        const request = await oauthService.readAuthorizationRequest(state);
+        if (!request) {
+            logger.warn('mcp oauth completion carried no usable state');
+            throw new UnauthorizedError('This authorization request is invalid or has expired');
+        }
+        await assertMayCompleteGrant(c, request);
+        // Re-resolved from the registry rather than sealed into the state: the CLIENT is deployment
+        // code, so a deployment that fixed a wrong client id between the redirect and the completion
+        // should exchange with the corrected one. What is pinned in the state is the endpoint and the
+        // verifier, which are properties of the request the operator actually consented to.
+        const declared = resolveDeclaredToolServers(container.agentKindRegistry).get(request.serverId);
+        const oauth = declared?.definition.oauth;
+        if (!oauth) {
+            throw new ValidationError(`Tool server '${request.serverId}' no longer declares OAuth, so this grant cannot be ` +
+                `completed.`, { reason: 'tool_server_without_oauth' });
+        }
+        const clientSecret = await resolveClientSecret(c, request.workspaceId, request.serverId, oauth);
+        await oauthService.completeAuthorization(request, {
+            code,
+            clientId: oauth.clientId,
+            ...(clientSecret ? { clientSecret } : {}),
+        });
+        return c.json({ serverId: request.serverId, workspaceId: request.workspaceId }, 200);
+    });
+    return app;
+}
+/**
+ * The two checks a completion is worth having a session for.
+ *
+ * A `null` user is dev-open and allows everything, the same reading `requirePermission` takes and
+ * not a second policy. It is SOUND here only because the route sits behind the default-deny gate:
+ * with auth enabled, a request with no valid session never reaches the handler, so an absent user
+ * means auth is genuinely unconfigured. (That is precisely what a public redirect target could not
+ * say, which is why this flow does not have one.)
+ */
+async function assertMayCompleteGrant(c, request) {
+    const user = c.get('user');
+    if (!user)
+        return;
+    // Without this binding, getting an admin to open an attacker's authorization link would plant the
+    // ATTACKER's vendor account as the board's connection: the classic OAuth login-CSRF turned inside
+    // out. The state is sealed, so only someone who could already start a flow on this board can mint
+    // one, and this closes the case where such a value is captured and replayed by someone else.
+    if (request.userId && request.userId !== user.id) {
+        requestLogger(c).warn('mcp oauth completion attempted by a different user than the one who started it', { workspaceId: request.workspaceId, toolServerId: request.serverId });
+        throw new UnauthorizedError('This authorization request was started by someone else');
+    }
+    // Resolved through the ONE shared resolution the workspace gate uses. It cannot be the gate
+    // itself: the board is sealed into the state rather than named in the path, so there is no
+    // `:workspaceId` segment to bind to.
+    const access = await loadWorkspaceAccess(c.get('container'), request.workspaceId, user.id);
+    if (!access?.allowed || !access.permissions.has('secrets.manage')) {
+        throw new ForbiddenError('This action requires the secrets.manage permission', {
+            permission: 'secrets.manage',
+        });
+    }
+}
+/**
+ * The OAuth client secret for the exchange, through the SAME shared resolution the dispatch path
+ * uses — including its reserved-key floor, which is exactly why this is not a local lookup: a
+ * floor enforced at one of two call sites is not a floor.
+ *
+ * A declared-but-unresolvable secret REFUSES the completion with a 422 rather than exchanging as a
+ * public client. The operator is standing in front of this: telling them the client secret is
+ * missing is a fix they can make, where a vendor's `invalid_client` a second later is not.
+ */
+async function resolveClientSecret(c, workspaceId, serverId, oauth) {
+    const container = c.get('container');
+    const resolved = await resolveOAuthClientSecret({
+        workspaceId,
+        serverId,
+        oauth,
+        ...(container.toolSecretResolver ? { resolveToolSecrets: container.toolSecretResolver } : {}),
+        logger: requestLogger(c),
+    });
+    if (!resolved.ok) {
+        throw new ValidationError(resolved.error, { reason: 'oauth_client_secret_unavailable' });
+    }
+    return resolved.value;
+}
+//# sourceMappingURL=McpOAuthCompletionController.js.map

package/dist/modules/toolServers/McpOAuthCompletionController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthCompletionController.js","sourceRoot":"","sources":["../../../src/modules/toolServers/McpOAuthCompletionController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAA;AAExE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AAErE,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,sBAAsB;AACtB,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,gGAAgG;AAChG,oGAAoG;AACpG,gGAAgG;AAChG,iCAAiC;AACjC,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,wDAAwD;AACxD,EAAE;AACF,+FAA+F;AAC/F,yFAAyF;AACzF,oGAAoG;AACpG,kDAAkD;AAClD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,YAAY,GAAG,iBAAiB,CACpC,SAAS,CAAC,QAAQ,EAClB,qCAAqC,CACtC,CAAA;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;YAC3D,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAExC,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,oFAAoF;QACpF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC9F,MAAM,KAAK,GAAG,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAA;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CACvB,gBAAgB,OAAO,CAAC,QAAQ,sDAAsD;gBACpF,YAAY,EACd,EAAE,MAAM,EAAE,2BAA2B,EAAE,CACxC,CAAA;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE/F,MAAM,YAAY,CAAC,qBAAqB,CAAC,OAAO,EAAE;YAChD,IAAI;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,CAAa,EACb,OAAyE;IAEzE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACjD,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CACnB,gFAAgF,EAChF,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,CACrE,CAAA;QACD,MAAM,IAAI,iBAAiB,CAAC,wDAAwD,CAAC,CAAA;IACvF,CAAC;IAED,4FAA4F;IAC5F,2FAA2F;IAC3F,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,cAAc,CAAC,oDAAoD,EAAE;YAC7E,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAChC,CAAa,EACb,WAAmB,EACnB,QAAgB,EAChB,KAAqB;IAErB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW;QACX,QAAQ;QACR,KAAK;QACL,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;KACzB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAA;AACvB,CAAC"}

package/dist/modules/toolServers/ToolServerController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ToolServerController.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAO/C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAsCnD"}
+{"version":3,"file":"ToolServerController.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAS/C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAuGnD"}

package/dist/modules/toolServers/ToolServerController.js

@@ -1,11 +1,15 @@
-import { listToolServersContract, probeToolServerContract } from '@cat-factory/contracts';
+import { disconnectToolServerOAuthContract, listToolServersContract, probeToolServerContract, startToolServerOAuthContract, } from '@cat-factory/contracts';
+import { NotFoundError, ValidationError } from '@cat-factory/kernel';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
+import { createMcpOAuthTokenSource } from '../../agents/mcpOAuthTokenSource.js';
+import { requireCapability } from '../../http/guards.js';
 import { requireWorkspacePermissionIncludingReads } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requestLogger } from '../../http/requestLogging.js';
-import { collectDeclaredToolServers } from './declaredToolServers.js';
+import { collectDeclaredToolServers, resolveDeclaredToolServers } from './declaredToolServers.js';
 import { probeToolServer } from './probeToolServer.js';
+import { requireMcpOAuthRedirectUrl } from './mcpOAuthRedirect.js';
 /**
  * TOOL SERVER (MCP) OPERABILITY: what this deployment declared, and whether one of them answers.
  *
@@ -33,9 +37,21 @@ export function toolServerController() {
     const gate = requireWorkspacePermissionIncludingReads('secrets.manage');
     app.use('/tool-servers', gate);
     app.use('/tool-servers/*', gate);
-    buildHonoRoute(app, listToolServersContract, (c) => {
+    buildHonoRoute(app, listToolServersContract, async (c) => {
         const container = c.get('container');
-        return c.json({ servers: collectDeclaredToolServers({ agentKindRegistry: container.agentKindRegistry }) }, 200);
+        // ONE read of the workspace's grants for the whole inventory, indexed by server id — the
+        // declarations are the deployment's entire registry, so a per-row lookup here would be an N+1
+        // over it. Absent store ⇒ an empty map, and each OAuth declaration renders as not connected,
+        // which is the true state of a deployment that cannot keep a grant.
+        const grants = container.mcpOAuth
+            ? await container.mcpOAuth.listStatuses(param(c, 'workspaceId'))
+            : new Map();
+        return c.json({
+            servers: collectDeclaredToolServers({
+                agentKindRegistry: container.agentKindRegistry,
+                oauthGrants: grants,
+            }),
+        }, 200);
     });
     buildHonoRoute(app, probeToolServerContract, async (c) => {
         const container = c.get('container');
@@ -49,9 +65,69 @@ export function toolServerController() {
             ...(container.toolSecretResolver
                 ? { resolveToolSecrets: container.toolSecretResolver }
                 : {}),
+            // The same token source a dispatch mints with, so an OAuth server's verdict is about this
+            // board's grant rather than about an unauthenticated request nobody makes.
+            ...(container.mcpOAuth
+                ? {
+                    resolveToolServerOAuth: createMcpOAuthTokenSource({
+                        oauth: container.mcpOAuth,
+                        ...(container.toolSecretResolver
+                            ? { resolveToolSecrets: container.toolSecretResolver }
+                            : {}),
+                        logger: requestLogger(c),
+                    }),
+                }
+                : {}),
             logger: requestLogger(c),
         }), 200);
     });
+    // Begin an interactive grant. Everything that can refuse does so BEFORE a browser leaves the
+    // app: an id nothing declares (404), a server that does not authenticate with OAuth or does so
+    // with the machine grant (422), a deployment with no grant store or no registered redirect URL
+    // (503). A refusal after the redirect would land on a vendor's error page instead.
+    buildHonoRoute(app, startToolServerOAuthContract, async (c) => {
+        const container = c.get('container');
+        const oauthService = requireCapability(container.mcpOAuth, 'Tool-server OAuth is not configured: this deployment has no encryption key, so it has ' +
+            'nowhere to keep a grant.');
+        const definition = requireOAuthServer(container.agentKindRegistry, c.req.valid('param').id);
+        return c.json(await oauthService.startAuthorization({
+            workspaceId: param(c, 'workspaceId'),
+            serverId: definition.id,
+            serverUrl: definition.url,
+            oauth: definition.oauth,
+            userId: c.get('user')?.id ?? null,
+            redirectUri: requireMcpOAuthRedirectUrl(container),
+        }), 200);
+    });
+    buildHonoRoute(app, disconnectToolServerOAuthContract, async (c) => {
+        const container = c.get('container');
+        const oauthService = requireCapability(container.mcpOAuth, 'Tool-server OAuth is not configured: this deployment has no encryption key, so it has ' +
+            'nowhere to keep a grant.');
+        // The id is NOT re-checked against a live declaration. A grant outlives the declaration that
+        // created it (a deployment retires a server, or renames it in a refactor), and the row is then
+        // a live vendor token nobody can reach — so the one action that removes it must not be gated
+        // on the registry still naming it.
+        await oauthService.disconnect(param(c, 'workspaceId'), c.req.valid('param').id);
+        return c.body(null, 204);
+    });
     return app;
 }
+/**
+ * The declared server behind an id, narrowed to one that can actually be granted.
+ *
+ * Both refusals are the operator's to act on and neither is the same as the other: an id nothing
+ * declares means the deployment changed under the panel they are looking at (404), while a server
+ * that declares no OAuth — or declares it on a transport with no request to authorise — means the
+ * button was rendered for a row it does not apply to (422, with a `reason` the SPA translates).
+ */
+function requireOAuthServer(registry, serverId) {
+    const declared = resolveDeclaredToolServers(registry).get(serverId);
+    if (!declared)
+        throw new NotFoundError('Tool server', serverId);
+    const { oauth, transport, id } = declared.definition;
+    if (!oauth || transport.kind !== 'http') {
+        throw new ValidationError(`Tool server '${serverId}' does not authenticate with OAuth, so there is nothing to grant.`, { reason: 'tool_server_without_oauth' });
+    }
+    return { id, url: transport.url, oauth };
+}
 //# sourceMappingURL=ToolServerController.js.map

package/dist/modules/toolServers/ToolServerController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ToolServerController.js","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAA;AACxF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,2EAA2E;IAC3E,MAAM,IAAI,GAAG,wCAAwC,CAAC,gBAAgB,CAAC,CAAA;IACvE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IAEhC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAC3F,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,eAAe,CAAC;YACpB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;YAC9C,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;YACjC,6FAA6F;YAC7F,0FAA0F;YAC1F,sCAAsC;YACtC,GAAG,CAAC,SAAS,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;SACzB,CAAC,EACF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"ToolServerController.js","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAA;AACxF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,2EAA2E;IAC3E,MAAM,IAAI,GAAG,wCAAwC,CAAC,gBAAgB,CAAC,CAAA;IACvE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IAEhC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,yFAAyF;QACzF,8FAA8F;QAC9F,6FAA6F;QAC7F,oEAAoE;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ;YAC/B,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,CAAC,IAAI,CACX;YACE,OAAO,EAAE,0BAA0B,CAAC;gBAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;gBAC9C,WAAW,EAAE,MAAM;aACpB,CAAC;SACH,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,eAAe,CAAC;YACpB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;YAC9C,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;YACjC,6FAA6F;YAC7F,0FAA0F;YAC1F,sCAAsC;YACtC,GAAG,CAAC,SAAS,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,0FAA0F;YAC1F,2EAA2E;YAC3E,GAAG,CAAC,SAAS,CAAC,QAAQ;gBACpB,CAAC,CAAC;oBACE,sBAAsB,EAAE,yBAAyB,CAAC;wBAChD,KAAK,EAAE,SAAS,CAAC,QAAQ;wBACzB,GAAG,CAAC,SAAS,CAAC,kBAAkB;4BAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;wBACP,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;qBACzB,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;SACzB,CAAC,EACF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,mFAAmF;IACnF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,YAAY,GAAG,iBAAiB,CACpC,SAAS,CAAC,QAAQ,EAClB,wFAAwF;YACtF,0BAA0B,CAC7B,CAAA;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3F,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,YAAY,CAAC,kBAAkB,CAAC;YACpC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACpC,QAAQ,EAAE,UAAU,CAAC,EAAE;YACvB,SAAS,EAAE,UAAU,CAAC,GAAG;YACzB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI;YACjC,WAAW,EAAE,0BAA0B,CAAC,SAAS,CAAC;SACnD,CAAC,EACF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,YAAY,GAAG,iBAAiB,CACpC,SAAS,CAAC,QAAQ,EAClB,wFAAwF;YACtF,0BAA0B,CAC7B,CAAA;QACD,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,mCAAmC;QACnC,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CACzB,QAA2B,EAC3B,QAAgB;IAEhB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAA;IACpD,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,gBAAgB,QAAQ,mEAAmE,EAC3F,EAAE,MAAM,EAAE,2BAA2B,EAAE,CACxC,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}

package/dist/modules/toolServers/declaredToolServers.d.ts

@@ -1,8 +1,22 @@
 import type { AgentKind, McpServerDefinition } from '@cat-factory/kernel';
 import type { AgentKindRegistry } from '@cat-factory/agents';
-import type { ToolServerNotProbeableReason, ToolServerView } from '@cat-factory/contracts';
+import type { ToolServerNotProbeableReason, ToolServerOAuthStatus, ToolServerView } from '@cat-factory/contracts';
+/**
+ * The non-secret half of a stored grant, as `McpOAuthService.listStatuses` returns it: everything
+ * `ToolServerOAuthStatus` holds except the two fields the DECLARATION decides (`grant`) and this
+ * projection derives (`connected`).
+ */
+export type StoredOAuthGrants = ReadonlyMap<string, Omit<ToolServerOAuthStatus, 'grant' | 'connected'>>;
 export interface CollectDeclaredToolServersInput {
     agentKindRegistry: AgentKindRegistry;
+    /**
+     * This workspace's grants, keyed by server id — read ONCE for the whole inventory rather than
+     * per row, because the rows are the deployment's entire registry.
+     *
+     * Omitted ⇒ no grant store is wired, and every OAuth declaration renders as not connected, which
+     * is the true state of a deployment that has nowhere to keep a grant.
+     */
+    oauthGrants?: StoredOAuthGrants;
 }
 /** One declared server: the definition this surface answers for, and the kinds that reach it. */
 export interface DeclaredToolServer {

package/dist/modules/toolServers/declaredToolServers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declaredToolServers.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAOzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAa1F,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,iBAAiB,CAAA;CACrC;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,iBAAiB,GAC1B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAejC;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,+BAA+B,GACrC,cAAc,EAAE,CAIlB;AA2CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,mBAAmB,GAC9B,4BAA4B,GAAG,SAAS,CAS1C"}
+{"version":3,"file":"declaredToolServers.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAOzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACf,MAAM,wBAAwB,CAAA;AAa/B;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,WAAW,CAAC,CACnD,CAAA;AAED,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;CAChC;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,iBAAiB,GAC1B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAejC;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,+BAA+B,GACrC,cAAc,EAAE,CAMlB;AAsED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,mBAAmB,GAC9B,4BAA4B,GAAG,SAAS,CAS1C"}

package/dist/modules/toolServers/declaredToolServers.js

@@ -43,11 +43,11 @@ export function resolveDeclaredToolServers(registry) {
 /** Every declared tool server, projected non-secretly and sorted by id. */
 export function collectDeclaredToolServers(input) {
     return [...resolveDeclaredToolServers(input.agentKindRegistry).values()]
-        .map((declared) => toView(declared.definition, declared.declaredBy))
+        .map((declared) => toView(declared.definition, declared.declaredBy, input.oauthGrants ?? new Map()))
         .sort((a, b) => a.id.localeCompare(b.id));
 }
 /** Project one definition into its non-secret operator-facing view. */
-function toView(definition, declaredBy) {
+function toView(definition, declaredBy, grants) {
     const notProbeable = notProbeableReason(definition);
     return {
         id: definition.id,
@@ -65,10 +65,30 @@ function toView(definition, declaredBy) {
             required: secret.required !== false,
             ...(secret.usage ? { usage: secret.usage } : {}),
         })),
+        ...oauthStatus(definition, grants),
         probeable: notProbeable === undefined,
         ...(notProbeable ? { notProbeableReason: notProbeable } : {}),
     };
 }
+/**
+ * The OAuth half of a row: the declaration's grant type, joined to whether THIS workspace holds a
+ * grant for it.
+ *
+ * Absent for a server that declares no OAuth, which is what keeps the Connect affordance off every
+ * row it does not apply to. `connected` is derived from the presence of a stored grant rather than
+ * stored as a flag, so a disconnect that removed the row cannot leave a row claiming otherwise.
+ */
+function oauthStatus(definition, grants) {
+    const oauth = definition.oauth;
+    if (!oauth)
+        return {};
+    const stored = grants.get(definition.id);
+    // The stored half is spread FIRST so the two derived fields cannot be overwritten by it. The
+    // summary is a JSON blob parsed back out of a row, so its shape is a claim rather than a
+    // guarantee, and a drifted one must not be able to say a server is `connected` when no row was
+    // read or to rename the grant the DECLARATION states.
+    return { oauth: { ...stored, grant: oauth.grant, connected: Boolean(stored) } };
+}
 /**
  * What the declaration points at, for recognition on the surface.
  *

package/dist/modules/toolServers/declaredToolServers.js.map

@@ -1 +1 @@
-{"version":3,"file":"declaredToolServers.js","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAsBxE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEtD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,QAAQ;gBAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;gBACvC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,KAAsC;IAEtC,OAAO,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;SACrE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;SACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CAAC,UAA+B,EAAE,UAAuB;IACtE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE;QACxC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;QACpC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,iBAAiB,EAAE,oBAAoB,CAAC,UAAU,CAAC;QACnD,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,yFAAyF;YACzF,2EAA2E;YAC3E,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,SAAS,EAAE,YAAY,KAAK,SAAS;QACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,UAA+B;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5C,OAAO,aAAa,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA+B;IAE/B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAA;IACnE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAA;IACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAA;IACvD,iGAAiG;IACjG,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAA;IAC3D,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"declaredToolServers.js","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAwCxE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEtD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,QAAQ;gBAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;gBACvC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,KAAsC;IAEtC,OAAO,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;SACrE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,GAAG,EAAE,CAAC,CACjF;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CACb,UAA+B,EAC/B,UAAuB,EACvB,MAAyB;IAEzB,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE;QACxC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;QACpC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,iBAAiB,EAAE,oBAAoB,CAAC,UAAU,CAAC;QACnD,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,yFAAyF;YACzF,2EAA2E;YAC3E,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,GAAG,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC;QAClC,SAAS,EAAE,YAAY,KAAK,SAAS;QACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,UAA+B,EAC/B,MAAyB;IAEzB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACxC,6FAA6F;IAC7F,yFAAyF;IACzF,+FAA+F;IAC/F,sDAAsD;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;AACjF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,UAA+B;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5C,OAAO,aAAa,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA+B;IAE/B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAA;IACnE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAA;IACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAA;IACvD,iGAAiG;IACjG,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAA;IAC3D,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/modules/toolServers/mcpOAuthRedirect.d.ts

@@ -0,0 +1,27 @@
+import type { ServerContainer } from '../../http/env.js';
+/**
+ * The path in the SPA that a vendor's authorization server redirects an operator's browser to.
+ *
+ * A page in the APP rather than a route on this backend, and that is a security decision rather
+ * than a routing preference. A redirect target is reached by a third-party browser navigation,
+ * which carries no bearer token, so a backend route receiving it could never tell who was
+ * completing the grant; the page re-presents the vendor's `code` and `state` over the authenticated
+ * API instead (`completeToolServerOAuthContract`), where the session, the user binding and the
+ * `secrets.manage` re-check all apply. Exported for the docs and tests that must state the exact
+ * string an operator registers at the vendor.
+ */
+export declare const MCP_OAUTH_CALLBACK_PATH = "/mcp-oauth-callback";
+/**
+ * The configured redirect URL, or the refusal that names what to configure.
+ *
+ * Deliberately not derived from the incoming request. The value has to match, to the byte, what
+ * the deployment registered as its OAuth client's redirect URI, and a `Host`-derived string is a
+ * different value behind every proxy, preview URL and private hostname a deployment sits behind —
+ * so deriving it turns a one-time configuration step into an exchange that fails at the vendor
+ * with `redirect_uri_mismatch`, which names nothing on this side.
+ *
+ * A 503 with its own `reason` rather than a generic unavailability, because the deployment IS
+ * otherwise wired: the store exists, the declaration is sound, and one variable is missing.
+ */
+export declare function requireMcpOAuthRedirectUrl(container: ServerContainer): string;
+//# sourceMappingURL=mcpOAuthRedirect.d.ts.map

package/dist/modules/toolServers/mcpOAuthRedirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpOAuthRedirect.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAA;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAW7E"}

package/dist/modules/toolServers/mcpOAuthRedirect.js

@@ -0,0 +1,35 @@
+import { UnavailableError } from '@cat-factory/kernel';
+/**
+ * The path in the SPA that a vendor's authorization server redirects an operator's browser to.
+ *
+ * A page in the APP rather than a route on this backend, and that is a security decision rather
+ * than a routing preference. A redirect target is reached by a third-party browser navigation,
+ * which carries no bearer token, so a backend route receiving it could never tell who was
+ * completing the grant; the page re-presents the vendor's `code` and `state` over the authenticated
+ * API instead (`completeToolServerOAuthContract`), where the session, the user binding and the
+ * `secrets.manage` re-check all apply. Exported for the docs and tests that must state the exact
+ * string an operator registers at the vendor.
+ */
+export const MCP_OAUTH_CALLBACK_PATH = '/mcp-oauth-callback';
+/**
+ * The configured redirect URL, or the refusal that names what to configure.
+ *
+ * Deliberately not derived from the incoming request. The value has to match, to the byte, what
+ * the deployment registered as its OAuth client's redirect URI, and a `Host`-derived string is a
+ * different value behind every proxy, preview URL and private hostname a deployment sits behind —
+ * so deriving it turns a one-time configuration step into an exchange that fails at the vendor
+ * with `redirect_uri_mismatch`, which names nothing on this side.
+ *
+ * A 503 with its own `reason` rather than a generic unavailability, because the deployment IS
+ * otherwise wired: the store exists, the declaration is sound, and one variable is missing.
+ */
+export function requireMcpOAuthRedirectUrl(container) {
+    const url = container.mcpOAuthRedirectUrl?.trim();
+    if (!url) {
+        throw new UnavailableError('Tool-server OAuth needs a redirect URL. Set MCP_OAUTH_REDIRECT_URL to this deployment’s ' +
+            `public app URL followed by ${MCP_OAUTH_CALLBACK_PATH}, and register the same value as ` +
+            'the OAuth client’s redirect URI at the vendor.', 'mcp_oauth_redirect_url_not_configured');
+    }
+    return url;
+}
+//# sourceMappingURL=mcpOAuthRedirect.js.map

package/dist/modules/toolServers/mcpOAuthRedirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpOAuthRedirect.js","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAA;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA0B;IACnE,MAAM,GAAG,GAAG,SAAS,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,gBAAgB,CACxB,0FAA0F;YACxF,8BAA8B,uBAAuB,mCAAmC;YACxF,gDAAgD,EAClD,uCAAuC,CACxC,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/toolServers/probeToolServer.d.ts

@@ -1,4 +1,4 @@
-import type { Logger, ToolSecretResolver } from '@cat-factory/kernel';
+import type { Logger, McpOAuthTokenSource, ToolSecretResolver } from '@cat-factory/kernel';
 import type { ToolServerProbeResult } from '@cat-factory/contracts';
 import type { AgentKindRegistry } from '@cat-factory/agents';
 import { type McpProbeDeps } from './mcpProbe.js';
@@ -14,6 +14,13 @@ export interface ProbeToolServerInput {
      * path already applies to the same state.
      */
     resolveToolSecrets?: ToolSecretResolver;
+    /**
+     * The facade's OAuth token source — the SAME one a dispatch mints an `Authorization` header
+     * with. Absent ⇒ the deployment has no grant store, and a server declaring OAuth is reported as
+     * `oauth_not_connected` rather than probed unauthenticated, which would report a working server
+     * as a 401 and send the operator to the wrong fix.
+     */
+    resolveToolServerOAuth?: McpOAuthTokenSource;
     logger?: Logger;
     /** Injected for tests; forwarded to the protocol client. */
     probe?: McpProbeDeps;

package/dist/modules/toolServers/probeToolServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probeToolServer.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EAGN,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,eAAe,CAAA;AAuBrE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8CjG"}
+{"version":3,"file":"probeToolServer.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EAGnB,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAG5D,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,eAAe,CAAA;AAuBrE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,mBAAmB,CAAA;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqDjG"}

package/dist/modules/toolServers/probeToolServer.js

@@ -1,6 +1,7 @@
 import { NotFoundError, isValidMcpToolName, noopLogger, runBestEffort } from '@cat-factory/kernel';
 import { isReservedPlatformEnvKey, reservedEnvKeyMessage } from '@cat-factory/contracts';
 import { MCP_PROBE_TOOL_NAME_CAP } from '@cat-factory/contracts';
+import { mergeHeaders } from '../../agents/toolServers.js';
 import { notProbeableReason, resolveDeclaredToolServers } from './declaredToolServers.js';
 import { probeMcpHttpServer } from './mcpProbe.js';
 /**
@@ -25,13 +26,21 @@ export async function probeToolServer(input) {
     const credentials = await resolveCredentials(input, definition);
     if (!credentials.ok)
         return { serverId, ...credentials.failure };
+    const granted = await resolveOAuthHeader(input, definition, definition.transport.url);
+    if (!granted.ok)
+        return { serverId, ...granted.failure };
     const outcome = await probeMcpHttpServer({
         url: definition.transport.url,
         // The declaration's own headers and the RESOLVED CREDENTIAL stay apart, because the protocol
         // client treats them differently at a redirect: a hop off the declared origin is refused while
         // a credential is riding, and a non-secret `x-tenant` is no reason to refuse anything.
         headers: { ...definition.transport.headers },
-        credentialHeaders: credentials.headers,
+        // The granted token joins the CREDENTIAL side, not the declaration's own headers: it is the
+        // secret a cross-origin redirect must not carry, which is the whole reason the probe keeps
+        // the two apart. Last, so it wins a header a static credential also names — the same
+        // precedence the dispatch applies (through the same case-insensitive merge, so the probe
+        // cannot report on a header pair the dispatch would collapse), and boot warns about it.
+        credentialHeaders: mergeHeaders(credentials.headers, granted.headers),
     }, input.probe);
     if (outcome.status !== 'ok') {
         input.logger?.warn('tool server probe failed', {
@@ -96,6 +105,47 @@ function checkAllowedTools(definition, tools, toolsComplete) {
         },
     };
 }
+/**
+ * Mint the access token an OAuth-declaring server needs, as the header its declaration named.
+ *
+ * The two failure statuses are the probe's whole value here. `oauth_not_connected` says nobody has
+ * granted this board access, which is a Connect button rather than anything about the endpoint;
+ * `oauth_token_failed` says a grant IS on file and produced nothing, which is a revocation, an
+ * expiry, or an authorization server having a bad day. Probing anyway and reporting the 401 would
+ * collapse both into "your credential is wrong", the one diagnosis that is false in both cases.
+ */
+async function resolveOAuthHeader(input, definition, serverUrl) {
+    const oauth = definition.oauth;
+    if (!oauth)
+        return { ok: true, headers: {} };
+    const source = input.resolveToolServerOAuth;
+    if (!source) {
+        return {
+            ok: false,
+            failure: {
+                status: 'oauth_not_connected',
+                error: 'This deployment has no encryption key, so it has nowhere to keep an OAuth grant and ' +
+                    'no run can authenticate against this server either.',
+            },
+        };
+    }
+    const result = await source.accessToken({
+        workspaceId: input.workspaceId,
+        serverId: definition.id,
+        serverUrl,
+        oauth,
+    });
+    if (result.status === 'ok')
+        return { ok: true, headers: { [result.header]: result.value } };
+    if (result.status === 'not_connected')
+        return { ok: false, failure: { status: 'oauth_not_connected' } };
+    input.logger?.warn('tool server probe could not obtain an oauth token', {
+        toolServerId: definition.id,
+        workspaceId: input.workspaceId,
+        detail: result.error,
+    });
+    return { ok: false, failure: { status: 'oauth_token_failed', error: result.error } };
+}
 /**
  * Resolve the declared credentials into request headers, or report why the probe cannot proceed.
  *