@chnxthr/knowledge-mcp 0.0.0-stage → 0.3.0

package/dist/core/oauth.js

@@ -0,0 +1,507 @@
+/**
+ * OAuth 2.1 Authorization Server + Resource Server (Route X) — Claude 앱 커스텀 커넥터용.
+ *
+ * 우리 MCP 서버가 AS 이자 RS(같은 프로세스)다:
+ *   - AS: /authorize·/token·/register(.well-known 메타) 는 SDK `mcpAuthRouter` 가 깔고,
+ *         실제 로직은 이 파일의 `KnowledgeOAuthProvider`(OAuthServerProvider 구현)가 담당.
+ *   - 동의: /authorize 는 바로 Google 로 보내지 않고 동의 화면을 먼저 보여 준다(어떤 앱이, 어디로 토큰을 받는지).
+ *           DCR 로 누구나 client 를 등록할 수 있어, 동의 없이 넘기면 링크 한 번에 토큰이 공격자 redirect_uri 로 간다
+ *           (MCP 보안 모범 사례의 confused deputy). 승인 버튼은 쿠키에 묶어 다른 사이트가 대신 누르지 못하게 한다.
+ *   - 로그인: Google Workspace(OIDC)로 브리지. 허용 도메인(hd) 또는 허용 이메일 중 하나에 들어야 한다.
+ *   - 토큰: access/refresh 를 HS256 JWT 로 자체 발급(AS=RS 라 JWKS 배포 불필요, 대칭키로 in-process 검증).
+ *           access token 의 aud = canonical resource(=우리 /mcp). RFC 8707.
+ *   - PKCE(S256): SDK token 핸들러가 challengeForAuthorizationCode() 로 받아 자체 검증.
+ *
+ * graceful: 필수 값이 없으면 isOAuthConfigured()=false → server/http.ts 가 라우터를 안 깐다(기존 Bearer 무손상).
+ *   허용 목록(도메인·이메일)도 필수 값이다. 둘 다 비면 아무 Google 계정이나 로그인되므로 OAuth 를 켜지 않는다.
+ */
+import { randomBytes, randomUUID } from 'node:crypto';
+import { SignJWT, jwtVerify, createRemoteJWKSet } from 'jose';
+import { getStore } from '../store/index.js';
+import { getConfig } from './config.js';
+import { timingSafeEqualStr } from './auth.js';
+import { InvalidGrantError, InvalidScopeError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+// ── 설정 (env) ──
+const ISSUER = (process.env.MCP_OAUTH_ISSUER || '').replace(/\/$/, ''); // e.g. https://mcp.example.com
+const RESOURCE = (process.env.MCP_RESOURCE || (ISSUER ? `${ISSUER}/mcp` : '')).replace(/\/$/, ''); // canonical, = token aud
+// 로그인 브리지용 Google 클라이언트. 전용 OAUTH_GOOGLE_* 우선, 없으면 기존 Drive용 GOOGLE_OAUTH_* 재사용.
+const GOOGLE_CLIENT_ID = process.env.OAUTH_GOOGLE_CLIENT_ID || process.env.GOOGLE_OAUTH_CLIENT_ID || '';
+const GOOGLE_CLIENT_SECRET = process.env.OAUTH_GOOGLE_CLIENT_SECRET || process.env.GOOGLE_OAUTH_CLIENT_SECRET || '';
+const JWT_SECRET = process.env.OAUTH_JWT_SECRET || '';
+const csv = (v) => v.split(',');
+const ALLOWED_DOMAINS = (process.env.OAUTH_ALLOWED_HD ? csv(process.env.OAUTH_ALLOWED_HD) : getConfig().oauth.allowedDomains)
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+const ALLOWED_EMAILS = (process.env.OAUTH_ALLOWED_EMAILS ? csv(process.env.OAUTH_ALLOWED_EMAILS) : getConfig().oauth.allowedEmails)
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+const emailDomain = (e) => e.slice(e.lastIndexOf('@') + 1);
+/**
+ * 계정 허용 판정 — 허용 이메일 목록에 있거나, 이메일 도메인이 허용 도메인이면 허용(합집합).
+ * 둘 다 비어 있으면 아무도 허용하지 않는다(fail-closed). 그 경우 OAuth 자체가 켜지지 않는다.
+ * 로그인뿐 아니라 **토큰 검증·refresh 마다 재확인**해서, 허용 목록에서 빠진 계정은
+ * 기존 토큰(특히 30일 refresh)이 남아 있어도 즉시 차단되도록 한다.
+ */
+function emailAllowed(email) {
+    const e = (email || '').toLowerCase();
+    if (!e || !e.includes('@'))
+        return false;
+    return ALLOWED_EMAILS.includes(e) || ALLOWED_DOMAINS.includes(emailDomain(e));
+}
+const GOOGLE_CALLBACK = ISSUER ? `${ISSUER}/oauth/google/callback` : '';
+const SCOPE = 'mcp';
+const ACCESS_TTL = 3600; // 1h
+const REFRESH_TTL = 30 * 24 * 3600; // 30d
+const CODE_TTL = 300; // 5m
+const STATE_TTL = 600; // 10m
+const CONSENT_TTL = 600; // 10m
+export const CONSENT_COOKIE = 'kmcp_consent';
+export const CONSENT_PATH = '/oauth/consent';
+const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const GOOGLE_JWKS = createRemoteJWKSet(new URL('https://www.googleapis.com/oauth2/v3/certs'));
+/** OAuth 를 켜는 데 빠진 값 목록 (이름만, 값은 노출 안 함). 빈 배열이면 켤 수 있다. */
+export function oauthConfigProblems() {
+    const out = [];
+    if (!ISSUER)
+        out.push('MCP_OAUTH_ISSUER');
+    if (!GOOGLE_CLIENT_ID)
+        out.push('OAUTH_GOOGLE_CLIENT_ID');
+    if (!GOOGLE_CLIENT_SECRET)
+        out.push('OAUTH_GOOGLE_CLIENT_SECRET');
+    if (JWT_SECRET.length < 32)
+        out.push('OAUTH_JWT_SECRET (>= 32 chars)');
+    if (ALLOWED_DOMAINS.length === 0 && ALLOWED_EMAILS.length === 0) {
+        out.push('OAUTH_ALLOWED_HD or OAUTH_ALLOWED_EMAILS (config oauth.allowedDomains / allowedEmails)');
+    }
+    return out;
+}
+/** OAuth 를 하나라도 설정하려 한 흔적이 있는가 — 반쯤 설정된 상태를 부팅 로그에서 크게 알리기 위함. */
+export function oauthAttempted() {
+    return Boolean(ISSUER || process.env.OAUTH_GOOGLE_CLIENT_ID || JWT_SECRET);
+}
+/** OAuth 활성 조건 — 필수 값이 모두 있어야 함. 없으면 index 가 라우터 미장착(기존 Bearer 유지). */
+export function isOAuthConfigured() {
+    return Boolean(RESOURCE) && oauthConfigProblems().length === 0;
+}
+export const OAUTH_ISSUER_URL = ISSUER;
+export const OAUTH_RESOURCE = RESOURCE;
+export const OAUTH_SCOPES = [SCOPE];
+const jwtKey = () => new TextEncoder().encode(JWT_SECRET);
+const _authCodes = new Map();
+const _googlePending = new Map();
+const _consentPending = new Map();
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+/** 동의 화면 HTML. 앱 이름과 토큰이 돌아갈 주소를 그대로 보여 준다. */
+function consentPage(opts) {
+    const server = escapeHtml(getConfig().branding.name);
+    const app = escapeHtml(opts.appName);
+    let target = opts.redirectUri;
+    try {
+        const u = new URL(opts.redirectUri);
+        target = `${u.protocol}//${u.host}${u.pathname}`;
+    }
+    catch {
+        /* 등록 단계에서 URL 검증됨 — 그래도 원문 표시 */
+    }
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1"><title>${server} sign-in</title>
+<style>
+body{margin:0;font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#f6f6f4;color:#111}
+main{max-width:440px;margin:12vh auto;padding:32px;background:#fff;border:1px solid #e3e3df;border-radius:14px}
+h1{font-size:20px;margin:0 0 16px}p{margin:0 0 12px;color:#444}code{word-break:break-all;background:#f1f1ee;padding:2px 6px;border-radius:6px}
+.row{display:flex;gap:12px;margin-top:24px}button{flex:1;font:inherit;padding:10px 14px;border-radius:10px;border:1px solid #c8cbd0;background:#fff;cursor:pointer}
+button[value=approve]{background:#111;color:#fff;border-color:#111}
+</style></head><body><main>
+<h1>${app} wants to use ${server}</h1>
+<p>If you continue, you sign in with Google and this app receives a token that can read what your account can read.</p>
+<p>The token is sent to:<br><code>${escapeHtml(target)}</code></p>
+<p>Client ID: <code>${escapeHtml(opts.clientId)}</code></p>
+<p>Continue only if you started this connection yourself.</p>
+<form method="post" action="${escapeHtml(ISSUER + CONSENT_PATH)}">
+<input type="hidden" name="id" value="${escapeHtml(opts.id)}">
+<input type="hidden" name="csrf" value="${escapeHtml(opts.csrf)}">
+<div class="row"><button type="submit" name="action" value="deny">Cancel</button>
+<button type="submit" name="action" value="approve">Continue with Google</button></div>
+</form></main></body></html>`;
+}
+function sweep(m) {
+    const now = Date.now() / 1000;
+    for (const [k, v] of m)
+        if (v.exp <= now)
+            m.delete(k);
+}
+// ── 클라이언트 스토어 (DCR — Claude/ChatGPT 자동 등록) ──
+// 저장소(SQLite 파일 또는 Supabase mcp_oauth_clients) 영속화 + 인메모리 캐시.
+// 왜: 예전 순수 인메모리 Map 은 서버 재시작(재배포)마다 등록 클라이언트를 통째로 잃어, 커넥터가
+//     옛 client_id 로 재접속 시 "invalid_client" 를 냈다(특히 ChatGPT — 자동 재등록 안 함). DB 를
+//     정본으로 두면 재시작에도 살아남는다. 캐시는 핫패스(매 authorize/token 의 getClient)용.
+// graceful: DB 불가(마이그레이션 전 배포·일시 장애)면 캐시로 폴백 → 그 프로세스 세션 동안만 유효
+//           (기존 인메모리 동작과 동일). 배포 순서에 안전 — 테이블 없어도 안 깨진다.
+class ClientsStore {
+    cache = new Map();
+    static CACHE_MAX = 500; // 캐시 cap — 정본은 DB 라 evict 돼도 재조회로 복구(안전)
+    putCache(client) {
+        while (this.cache.size >= ClientsStore.CACHE_MAX) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.cache.delete(oldest);
+        }
+        this.cache.set(client.client_id, client);
+    }
+    async getClient(clientId) {
+        const cached = this.cache.get(clientId);
+        if (cached)
+            return cached;
+        try {
+            const store = await getStore();
+            const client = await store.getOAuthClient(clientId);
+            if (!client)
+                return undefined;
+            this.putCache(client);
+            // last_used 갱신 (best-effort — cleanup 판단용, 실패 무시)
+            void store.touchOAuthClient(clientId).catch((e) => {
+                console.error('[oauth] client last_used 갱신 실패:', e instanceof Error ? e.message : e);
+            });
+            return client;
+        }
+        catch (e) {
+            console.error('[oauth] client 조회 실패(캐시 폴백):', e instanceof Error ? e.message : e);
+            return undefined;
+        }
+    }
+    // register 핸들러가 client_id/secret 를 이미 생성해 넘김 → 캐시 + DB 저장.
+    async registerClient(client) {
+        this.putCache(client); // 즉시 사용 가능
+        try {
+            await (await getStore()).saveOAuthClient(client);
+        }
+        catch (e) {
+            // fail-open: 저장 실패해도 등록은 성공(그 세션 동안 캐시로 유효). 커넥터 설정을 하드 실패시키는
+            // 것보단 낫다(저장소 장애는 드묾). 경고 로그로 노출 — 재시작 시 유실될 수 있음.
+            console.error('[oauth] client 저장 실패(메모리만 유지, 재시작 시 유실 가능):', e instanceof Error ? e.message : e);
+        }
+        return client;
+    }
+}
+// ── Google id_token 검증 (hd + email allowlist 로 사내 제한) ──
+async function verifyGoogleIdToken(idToken) {
+    const { payload } = await jwtVerify(idToken, GOOGLE_JWKS, {
+        issuer: ['https://accounts.google.com', 'accounts.google.com'],
+        audience: GOOGLE_CLIENT_ID,
+        algorithms: ['RS256'], // alg 고정 (defense-in-depth)
+    });
+    const email = String(payload.email || '').toLowerCase();
+    const hd = payload.hd ? String(payload.hd).toLowerCase() : undefined;
+    const emailVerified = payload.email_verified === true || payload.email_verified === 'true';
+    if (!email || !emailVerified)
+        throw new Error('google: email 미검증');
+    // 허용 이메일 목록에 있으면 계정 종류와 무관하게 허용(외부 협력자 등).
+    if (ALLOWED_EMAILS.includes(email))
+        return { email, hd };
+    // 도메인으로 허용할 때는 hd 클레임이 그 도메인이어야 한다 — Workspace 가 관리하는 계정만.
+    // (hd 파라미터는 힌트일 뿐이라 신뢰 불가. 회사 주소로 만든 개인 Google 계정은 hd 가 없다.)
+    const domain = emailDomain(email);
+    if (ALLOWED_DOMAINS.includes(domain) && hd === domain)
+        return { email, hd };
+    throw new Error(`google: 허용되지 않은 계정(hd=${hd ?? 'none'})`);
+}
+// ── refresh token 상태 (저장소 mcp_refresh_tokens) ──
+// 왜: HS256 JWT 는 무상태라 rotation 해도 옛 refresh 가 만료(30일)까지 유효했다(P2 — 탈취 시 차단 불가).
+// jti 를 저장소에 기록해 rotation 시 옛 토큰을 즉시 폐기하고, 폐기된 토큰 재사용(탈취 신호)이 오면
+// 그 계정의 활성 refresh 전부를 강제 폐기한다. access token(1h)은 무상태 유지 — 요청 지연 없음.
+/** 발급한 refresh jti 기록. 만료 row 도 김에 정리. 실패 시 throw — 기록 안 된 토큰은 refresh 불가라 발급 자체를 실패시킨다. */
+async function recordRefreshToken(jti, email, clientId) {
+    const store = await getStore();
+    try {
+        await store.recordRefreshToken(jti, email, clientId, new Date(Date.now() + REFRESH_TTL * 1000).toISOString());
+    }
+    catch (e) {
+        throw new Error(`refresh 토큰 기록 실패: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    void store.purgeExpiredRefreshTokens().catch((e) => {
+        console.error('[oauth] refresh 만료분 정리 실패:', e instanceof Error ? e.message : e);
+    });
+}
+/**
+ * refresh jti 소비(rotation) — 활성 row 만 원자적으로 폐기 표시.
+ *   'ok'      : 정상 — 폐기 완료, 새 토큰 발급 진행
+ *   'reused'  : 이미 폐기된 jti 재사용(탈취 신호) → 계정 전체 refresh 폐기됨
+ *   'unknown' : 기록에 없음(구형 토큰·저장소 유실) → 거부(재로그인)
+ * 저장소 오류는 throw — fail-closed (revocation 체크를 못 하면 refresh 를 내주지 않는다).
+ */
+async function consumeRefreshToken(jti, email, rotatedTo) {
+    const store = await getStore();
+    let state;
+    try {
+        state = await store.consumeRefreshToken(jti, rotatedTo);
+    }
+    catch (e) {
+        throw new Error(`refresh 상태 확인 실패: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (state !== 'revoked')
+        return state;
+    console.error(`[oauth] ⚠️ 폐기된 refresh 재사용 감지 — ${email} 의 활성 refresh 전부 폐기`);
+    try {
+        await store.revokeAllRefreshForEmail(email);
+    }
+    catch (e) {
+        console.error('[oauth] 계정 refresh 일괄 폐기 실패:', e instanceof Error ? e.message : e);
+    }
+    return 'reused';
+}
+async function signJwt(claims, ttl, typ) {
+    return new SignJWT({ ...claims, typ })
+        .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+        .setIssuer(ISSUER)
+        .setAudience(RESOURCE)
+        .setIssuedAt()
+        .setExpirationTime(`${ttl}s`)
+        .sign(jwtKey());
+}
+export class KnowledgeOAuthProvider {
+    _clients = new ClientsStore();
+    get clientsStore() {
+        return this._clients;
+    }
+    // PKCE 는 우리(AS)가 자체 검증 (Google 으로 넘기지 않음)
+    skipLocalPkceValidation = false;
+    /**
+     * authorize: 동의 화면을 먼저 보여 준다. 승인(POST /oauth/consent)이 와야 Google 로그인으로 넘긴다.
+     * 우리 code 는 Google 콜백에서 발급.
+     */
+    async authorize(client, params, res) {
+        sweep(_consentPending);
+        const id = randomBytes(18).toString('base64url');
+        const csrf = randomBytes(24).toString('base64url');
+        _consentPending.set(id, {
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            codeChallenge: params.codeChallenge,
+            clientState: params.state,
+            scopes: params.scopes && params.scopes.length ? params.scopes : [SCOPE],
+            resource: params.resource?.href,
+            exp: Date.now() / 1000 + CONSENT_TTL,
+            csrf,
+        });
+        const secure = ISSUER.startsWith('https://') ? '; Secure' : '';
+        // SameSite=Lax: 다른 사이트가 자동 제출하는 POST 에는 쿠키가 실리지 않아 승인을 대신 누를 수 없다.
+        res.setHeader('Set-Cookie', `${CONSENT_COOKIE}=${csrf}; Path=${CONSENT_PATH}; Max-Age=${CONSENT_TTL}; HttpOnly; SameSite=Lax${secure}`);
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('X-Frame-Options', 'DENY'); // 클릭재킹 방지 (승인 버튼을 투명 iframe 으로 누르게 하는 공격)
+        res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'");
+        res
+            .status(200)
+            .type('html')
+            .send(consentPage({
+            appName: typeof client.client_name === 'string' && client.client_name ? client.client_name : 'An app',
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            id,
+            csrf,
+        }));
+    }
+    /**
+     * 동의 화면의 POST 처리 (server/http.ts 의 POST /oauth/consent 가 호출). 돌려줄 redirect URL 을 반환한다.
+     * 승인: 폼 csrf·쿠키 csrf·저장된 csrf 가 모두 같을 때만 Google 로그인으로. 거절: client 로 access_denied.
+     * 검증 실패는 throw — 호출부가 400 으로 끝낸다(공격자 redirect_uri 로 보내지 않는다).
+     */
+    consumeConsent(id, formCsrf, cookieCsrf, approve) {
+        sweep(_consentPending);
+        const pending = _consentPending.get(id);
+        if (!pending)
+            throw new Error('알 수 없거나 만료된 요청입니다. 연결을 처음부터 다시 시작해 주세요.');
+        if (!formCsrf ||
+            !cookieCsrf ||
+            !timingSafeEqualStr(formCsrf, pending.csrf) ||
+            !timingSafeEqualStr(cookieCsrf, pending.csrf)) {
+            throw new Error('요청을 확인할 수 없습니다. 연결을 처음부터 다시 시작해 주세요.');
+        }
+        _consentPending.delete(id);
+        if (!approve) {
+            const u = new URL(pending.redirectUri);
+            u.searchParams.set('error', 'access_denied');
+            u.searchParams.set('error_description', 'user cancelled');
+            if (pending.clientState)
+                u.searchParams.set('state', pending.clientState);
+            return u.toString();
+        }
+        const { csrf: _csrf, ...rest } = pending;
+        return this.googleRedirect(rest);
+    }
+    /** Google 로그인 URL 을 만들고 state 를 기록한다. */
+    googleRedirect(pending) {
+        sweep(_googlePending);
+        const state = randomBytes(24).toString('base64url');
+        _googlePending.set(state, { ...pending, exp: Date.now() / 1000 + STATE_TTL });
+        const u = new URL(GOOGLE_AUTH_URL);
+        u.searchParams.set('client_id', GOOGLE_CLIENT_ID);
+        u.searchParams.set('redirect_uri', GOOGLE_CALLBACK);
+        u.searchParams.set('response_type', 'code');
+        u.searchParams.set('scope', 'openid email profile');
+        u.searchParams.set('access_type', 'online');
+        u.searchParams.set('prompt', 'select_account');
+        // hd 는 계정 선택 화면 힌트일 뿐(검증은 id_token 에서). 허용 도메인이 하나이고 이메일 목록이 없을 때만 붙인다.
+        if (ALLOWED_DOMAINS.length === 1 && ALLOWED_EMAILS.length === 0)
+            u.searchParams.set('hd', ALLOWED_DOMAINS[0]);
+        u.searchParams.set('state', state);
+        return u.toString();
+    }
+    /**
+     * Google 콜백 처리 (server/http.ts 의 /oauth/google/callback 라우트가 호출).
+     * 성공/실패 모두 client redirect_uri 로 돌려보낼 URL 을 반환한다.
+     */
+    async completeGoogleLogin(googleCode, state) {
+        sweep(_googlePending);
+        const pending = _googlePending.get(state);
+        if (!pending)
+            throw new Error('알 수 없거나 만료된 state');
+        _googlePending.delete(state);
+        const redirectErr = (err, desc) => {
+            const u = new URL(pending.redirectUri);
+            u.searchParams.set('error', err);
+            u.searchParams.set('error_description', desc);
+            if (pending.clientState)
+                u.searchParams.set('state', pending.clientState);
+            return u.toString();
+        };
+        let email;
+        try {
+            // Google code → id_token 교환
+            const body = new URLSearchParams({
+                code: googleCode,
+                client_id: GOOGLE_CLIENT_ID,
+                client_secret: GOOGLE_CLIENT_SECRET,
+                redirect_uri: GOOGLE_CALLBACK,
+                grant_type: 'authorization_code',
+            });
+            const r = await fetch(GOOGLE_TOKEN_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString(),
+            });
+            const j = (await r.json());
+            if (!r.ok || !j.id_token)
+                throw new Error(j.error_description || j.error || `google token ${r.status}`);
+            ({ email } = await verifyGoogleIdToken(j.id_token));
+        }
+        catch (e) {
+            return redirectErr('access_denied', e instanceof Error ? e.message : '로그인 실패');
+        }
+        // 우리 authorization code 발급 (one-time, 짧은 TTL)
+        sweep(_authCodes);
+        const code = randomBytes(24).toString('base64url');
+        _authCodes.set(code, {
+            codeChallenge: pending.codeChallenge,
+            clientId: pending.clientId,
+            redirectUri: pending.redirectUri,
+            email,
+            scopes: pending.scopes,
+            resource: pending.resource,
+            exp: Date.now() / 1000 + CODE_TTL,
+        });
+        const u = new URL(pending.redirectUri);
+        u.searchParams.set('code', code);
+        if (pending.clientState)
+            u.searchParams.set('state', pending.clientState);
+        return u.toString();
+    }
+    async challengeForAuthorizationCode(_client, authorizationCode) {
+        const entry = _authCodes.get(authorizationCode);
+        if (!entry || entry.exp <= Date.now() / 1000)
+            throw new InvalidGrantError('authorization code 없음/만료');
+        return entry.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, // SDK 가 challengeForAuthorizationCode 와 PKCE 검증 완료
+    redirectUri, _resource) {
+        const entry = _authCodes.get(authorizationCode);
+        if (!entry || entry.exp <= Date.now() / 1000)
+            throw new InvalidGrantError('authorization code 없음/만료');
+        _authCodes.delete(authorizationCode); // one-time
+        if (entry.clientId !== client.client_id)
+            throw new InvalidGrantError('client 불일치');
+        if (redirectUri && redirectUri !== entry.redirectUri)
+            throw new InvalidGrantError('redirect_uri 불일치');
+        const scope = entry.scopes.join(' ') || SCOPE;
+        const claims = { sub: entry.email, email: entry.email, scope, client_id: client.client_id };
+        const access_token = await signJwt(claims, ACCESS_TTL, 'access');
+        // refresh 는 jti 발급 + DB 기록 — rotation 시 즉시 폐기 가능하게 (P2)
+        const jti = randomUUID();
+        const refresh_token = await signJwt({ ...claims, jti }, REFRESH_TTL, 'refresh');
+        await recordRefreshToken(jti, entry.email, client.client_id);
+        return { access_token, token_type: 'Bearer', expires_in: ACCESS_TTL, scope, refresh_token };
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, _resource) {
+        let email = '';
+        let jti = '';
+        let tokenClientId = '';
+        let grantedScopes = [];
+        try {
+            const { payload } = await jwtVerify(refreshToken, jwtKey(), {
+                issuer: ISSUER,
+                audience: RESOURCE,
+                algorithms: ['HS256'],
+            });
+            if (payload.typ !== 'refresh')
+                throw new Error('not a refresh token');
+            email = String(payload.email || payload.sub || '');
+            jti = typeof payload.jti === 'string' ? payload.jti : '';
+            tokenClientId = typeof payload.client_id === 'string' ? payload.client_id : '';
+            grantedScopes = String(payload.scope || SCOPE).split(' ').filter(Boolean);
+        }
+        catch {
+            throw new InvalidGrantError('refresh token 무효');
+        }
+        // refresh token 은 발급받은 client 만 쓸 수 있다 — 새어 나간 토큰을 다른(공격자가 등록한) client 로 바꾸지 못하게.
+        if (!tokenClientId || tokenClientId !== client.client_id)
+            throw new InvalidGrantError('refresh token 의 client 불일치');
+        // 처음 허용된 범위보다 넓힐 수 없다.
+        if (scopes && scopes.some((s) => !grantedScopes.includes(s)))
+            throw new InvalidScopeError('요청 scope 가 원래 범위를 넘습니다');
+        // refresh 시 허용 목록 재확인 — 빠진 계정은 30일 refresh 가 남아도 즉시 차단.
+        if (!emailAllowed(email))
+            throw new InvalidGrantError('계정이 더 이상 허용되지 않음');
+        // jti 없는 구형 refresh 는 거부(재로그인 1회 유도). jti 는 DB 에서 소비(rotation) —
+        // 옛 토큰 즉시 폐기, 폐기된 토큰 재사용(탈취 신호)이면 계정 전체 refresh 폐기.
+        if (!jti)
+            throw new InvalidGrantError('refresh token 무효(구형) — 재로그인 필요');
+        const newJti = randomUUID();
+        const state = await consumeRefreshToken(jti, email, newJti);
+        if (state !== 'ok')
+            throw new InvalidGrantError('refresh token 무효(폐기됨) — 재로그인 필요');
+        const scope = (scopes && scopes.length ? scopes : grantedScopes).join(' ') || SCOPE;
+        const claims = { sub: email, email, scope, client_id: client.client_id };
+        const access_token = await signJwt(claims, ACCESS_TTL, 'access');
+        const refresh_token = await signJwt({ ...claims, jti: newJti }, REFRESH_TTL, 'refresh'); // rotation
+        await recordRefreshToken(newJti, email, client.client_id);
+        return { access_token, token_type: 'Bearer', expires_in: ACCESS_TTL, scope, refresh_token };
+    }
+    /** RS: access token 검증 (requireBearerAuth + 우리 /mcp dual-auth 가 사용) */
+    async verifyAccessToken(token) {
+        const { payload } = await jwtVerify(token, jwtKey(), {
+            issuer: ISSUER,
+            audience: RESOURCE,
+            algorithms: ['HS256'], // alg 고정 (none/RS256 confusion 차단)
+        });
+        if (payload.typ === 'refresh')
+            throw new Error('refresh token 으로 접근 불가');
+        const email = typeof payload.sub === 'string' ? payload.sub : '';
+        // P1: 매 요청 allowlist 재확인 — allowlist 에서 빠지면 미만료 토큰도 즉시 거부.
+        if (!emailAllowed(email))
+            throw new Error('계정이 더 이상 허용되지 않음');
+        const scopes = String(payload.scope || '').split(' ').filter(Boolean);
+        return {
+            token,
+            clientId: String(payload.client_id || ''),
+            scopes,
+            expiresAt: typeof payload.exp === 'number' ? payload.exp : undefined,
+            resource: new URL(RESOURCE),
+            extra: { email },
+        };
+    }
+}
+export const oauthProvider = new KnowledgeOAuthProvider();
+//# sourceMappingURL=oauth.js.map

package/dist/core/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/core/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAM/C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAEvG,iBAAiB;AACjB,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,+BAA+B;AACvG,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,yBAAyB;AAC5H,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;AACxG,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;AACpH,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;AACtD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACxC,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;KAC1H,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KAClC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnB,MAAM,cAAc,GAAG,CACrB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,aAAa,CAC3G;KACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KAClC,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,MAAM,KAAK,GAAG,KAAK,CAAC;AACpB,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,KAAK;AAC9B,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,KAAK;AAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM;AAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,MAAM;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE7C,MAAM,eAAe,GAAG,8CAA8C,CAAC;AACvE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;AAE9F,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB;QAAE,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC1D,IAAI,CAAC,oBAAoB;QAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACvE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,UAAU,CAAC,CAAC;AAC7E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,mBAAmB,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC;AAEpC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAyB1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;AACxD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE1D,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACrH,CAAC;AAED,+CAA+C;AAC/C,SAAS,WAAW,CAAC,IAA0F;IAC7G,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,OAAO;6EACoE,MAAM;;;;;;;;MAQ7E,GAAG,iBAAiB,MAAM;;oCAEI,UAAU,CAAC,MAAM,CAAC;sBAChC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;;8BAEjB,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC;wCACvB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;0CACjB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;;;6BAGlC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAA4B,CAAiB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG;YAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,+CAA+C;AAC/C,8DAA8D;AAC9D,2DAA2D;AAC3D,+EAA+E;AAC/E,oEAAoE;AACpE,gEAAgE;AAChE,yDAAyD;AACzD,MAAM,YAAY;IACR,KAAK,GAAG,IAAI,GAAG,EAAsC,CAAC;IACtD,MAAM,CAAU,SAAS,GAAG,GAAG,CAAC,CAAC,yCAAyC;IAE1E,QAAQ,CAAC,MAAkC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtB,kDAAkD;YAClD,KAAK,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACzD,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,cAAc,CAAC,MAAkC;QACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;QAClC,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,8DAA8D;YAC9D,kDAAkD;YAClD,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;;AAGH,0DAA0D;AAC1D,KAAK,UAAU,mBAAmB,CAAC,OAAe;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE;QACxD,MAAM,EAAE,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;QAC9D,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,4BAA4B;KACpD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC;IAC3F,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnE,2CAA2C;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzD,2DAA2D;IAC3D,6DAA6D;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5E,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,kDAAkD;AAClD,+EAA+E;AAC/E,iEAAiE;AACjE,qEAAqE;AAErE,4FAA4F;AAC5F,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;IAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,KAAK,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,KAAa,EAAE,SAAiB;IAC9E,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC/B,IAAI,KAAmC,CAAC;IACxC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,mCAAmC,KAAK,qBAAqB,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAA+B,EAAE,GAAW,EAAE,GAAyB;IAC5F,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC;SACnC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;SAC5B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,sBAAsB;IACzB,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACtC,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IACD,0CAA0C;IAC1C,uBAAuB,GAAG,KAAK,CAAC;IAEhC;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,KAAK,CAAC,eAAe,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE;YACtB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW;YACpC,IAAI;SACL,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,mEAAmE;QACnE,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,GAAG,cAAc,IAAI,IAAI,UAAU,YAAY,aAAa,WAAW,2BAA2B,MAAM,EAAE,CAC3G,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,0CAA0C;QACpF,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,wFAAwF,CACzF,CAAC;QACF,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CACH,WAAW,CAAC;YACV,OAAO,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACrG,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,EAAE;YACF,IAAI;SACL,CAAC,CACH,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,EAAU,EAAE,QAAgB,EAAE,UAAkB,EAAE,OAAgB;QAC/E,KAAK,CAAC,eAAe,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzE,IACE,CAAC,QAAQ;YACT,CAAC,UAAU;YACX,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;YAC3C,CAAC,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC7C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,WAAW;gBAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,yCAAyC;IACjC,cAAc,CAAC,OAAsB;QAC3C,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAClD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC/C,wEAAwE;QACxE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,KAAa;QACzD,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnD,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7B,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,EAAE;YAChD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,WAAW;gBAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC,CAAC;QAEF,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,4BAA4B;YAC5B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,gBAAgB;gBAC3B,aAAa,EAAE,oBAAoB;gBACnC,YAAY,EAAE,eAAe;gBAC7B,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAsE,CAAC;YAChG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACxG,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,WAAW,CAAC,eAAe,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjF,CAAC;QAED,8CAA8C;QAC9C,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,QAAQ;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,WAAW;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,OAAmC,EAAE,iBAAyB;QAChG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;QACtG,OAAO,KAAK,CAAC,aAAa,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EAAE,mDAAmD;IAC3E,WAAoB,EACpB,SAAe;QAEf,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;QACtG,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACnF,IAAI,WAAW,IAAI,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAEtG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5F,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjE,wDAAwD;QACxD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAChF,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,SAAe;QAEf,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,aAAa,GAAG,EAAE,CAAC;QACvB,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;gBAC1D,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACtE,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,aAAa,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,kFAAkF;QAClF,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QACpH,uBAAuB;QACvB,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACpH,wDAAwD;QACxD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAC1E,iEAAiE;QACjE,oDAAoD;QACpD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;QAEnF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;QACpF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACzE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW;QACpG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC9F,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,mCAAmC;SAC3D,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,2DAA2D;QAC3D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;YACzC,MAAM;YACN,SAAS,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YACpE,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;YAC3B,KAAK,EAAE,EAAE,KAAK,EAAE;SACjB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/core/paths.d.ts

@@ -0,0 +1,5 @@
+export declare function appRoot(): string;
+/** Candidate paths for a file: working directory first, then the app root. Duplicates removed. */
+export declare function candidates(file: string): string[];
+/** Data directory (SQLite store, checkpoints). MCP_DATA_DIR, else <app root>/data. */
+export declare function dataDir(): string;

package/dist/core/paths.js

@@ -0,0 +1,47 @@
+/**
+ * Where the server looks for .env, mcp.config.json and its data directory.
+ *
+ * MCP clients often spawn stdio servers from a different working directory, so the current directory
+ * alone is not enough. The "app root" is the nearest folder with a package.json above the entry script
+ * (your project when you run `node dist/server.js`), unless that is inside node_modules (npx), in which
+ * case the working directory is used.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+let _appRoot;
+export function appRoot() {
+    if (_appRoot)
+        return _appRoot;
+    _appRoot = process.cwd();
+    const entry = process.argv[1];
+    if (entry) {
+        try {
+            let dir = dirname(realpathSync(entry));
+            for (let i = 0; i < 8; i++) {
+                if (existsSync(join(dir, 'package.json'))) {
+                    if (!dir.split(/[\\/]/).includes('node_modules'))
+                        _appRoot = dir;
+                    break;
+                }
+                const up = dirname(dir);
+                if (up === dir)
+                    break;
+                dir = up;
+            }
+        }
+        catch {
+            /* entry not on disk (REPL, eval) → working directory */
+        }
+    }
+    return _appRoot;
+}
+/** Candidate paths for a file: working directory first, then the app root. Duplicates removed. */
+export function candidates(file) {
+    const list = [resolve(process.cwd(), file), resolve(appRoot(), file)];
+    return [...new Set(list)];
+}
+/** Data directory (SQLite store, checkpoints). MCP_DATA_DIR, else <app root>/data. */
+export function dataDir() {
+    return process.env.MCP_DATA_DIR ? resolve(process.env.MCP_DATA_DIR) : join(appRoot(), 'data');
+}
+//# sourceMappingURL=paths.js.map

package/dist/core/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/core/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,IAAI,QAA4B,CAAC;AAEjC,MAAM,UAAU,OAAO;IACrB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAAE,QAAQ,GAAG,GAAG,CAAC;oBACjE,MAAM;gBACR,CAAC;gBACD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACxB,IAAI,EAAE,KAAK,GAAG;oBAAE,MAAM;gBACtB,GAAG,GAAG,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAChG,CAAC"}

package/dist/core/scope.d.ts

@@ -0,0 +1,28 @@
+/**
+ * 직원별 권한 판정 — 도구군(= 플러그인 id)과 AuthContext.scopes(app_users allowed_*)로 도구·채널·폴더를 거른다.
+ *
+ * 원칙:
+ *   - admin 은 모든 scope 무시(전체 허용) — 운영 잠금 방지.
+ *   - member(app_users 에 등록된 사용자): 각 차원 scope 가 null/undefined/빈배열이면 그 차원은 전체 허용
+ *     (미설정 = 점진 도입). 명시 배열이 있으면 그 안의 것만 허용.
+ *   - viewer(app_users 에 없음, 또는 조회 실패): 기본 거부. config access.viewerTools 에 적은 도구군만 허용.
+ *     로그인만 통과한 계정이 Drive·Slack·로그 전체를 읽는 것을 막는다.
+ *   - 도구군이 없는 도구는 ping 만 허용한다. 플러그인에 속하지 않는 도구가 생겨도 기본 거부.
+ * Drive 제외 폴더(PII·계약·HR)는 이 scope 와 별개로 항상 적용된다.
+ */
+import type { AuthContext } from './auth.js';
+/**
+ * 이 도구를 노출·호출해도 되는가. group = 도구가 속한 플러그인 id(registry.groupOf), 없으면 null.
+ * admin = 전체, member = allowed_tools(미설정=전체), viewer = config access.viewerTools 로 연 것만.
+ */
+export declare function isToolAllowed(auth: AuthContext, name: string, group: string | null): boolean;
+/** 허용 Slack 채널 id Set. null = 전체 허용(admin·미설정). */
+export declare function allowedSlackChannels(auth: AuthContext): Set<string> | null;
+/** 허용 Drive 폴더 path prefix 배열. null = 전체 허용(admin·미설정). */
+export declare function allowedDriveFolders(auth: AuthContext): string[] | null;
+/**
+ * path 가 허용 폴더 prefix 하위인가. prefixes null = 전체 허용.
+ * path 예: "개발문서/backend/..." · "01_고객사/Acme/제안서.pptx".
+ * prefix 예: "01_고객사" → 그 하위 전부 허용. 정확 일치 또는 "prefix/" 로 시작.
+ */
+export declare function isPathInScope(path: string, prefixes: string[] | null): boolean;