@creeperhost/modlens-mcp 1.6.20 → 1.6.22

package/dist/hosted-oauth.js

@@ -0,0 +1,522 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { getDb } from "./db.js";
+export class HostedOAuthError extends Error {
+    status;
+    code;
+    constructor(message, status = 400, code = "invalid_request") {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+const sha = (value) => createHash("sha256").update(value).digest("hex");
+const token = (prefix) => prefix + randomBytes(32).toString("base64url");
+const now = () => Math.floor(Date.now() / 1000);
+const json = (res, status, value, headers = {}) => {
+    res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers });
+    res.end(JSON.stringify(value));
+};
+const redirect = (res, url) => {
+    res.writeHead(302, { Location: url.toString(), "Cache-Control": "no-store" });
+    res.end();
+};
+const field = (value, path) => path.split(".").reduce((current, part) => current && typeof current === "object" && !Array.isArray(current) ? current[part] : undefined, value);
+function secureUrl(raw, label, loopback = false) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`${label} must be an absolute URL`);
+    }
+    if ((url.protocol !== "https:" && !(loopback && url.protocol === "http:"
+        && ["127.0.0.1", "[::1]"].includes(url.hostname))) || url.username || url.password || url.hash || url.search)
+        throw new Error(`${label} must be HTTPS (or loopback HTTP), without credentials, query or fragment`);
+    return url;
+}
+function callbackSafe(raw) {
+    try {
+        const url = new URL(raw);
+        return raw.length <= 2048 && !url.username && !url.password && !url.hash &&
+            (url.protocol === "https:" || (url.protocol === "http:" &&
+                ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname))) && url.toString() === raw;
+    }
+    catch {
+        return false;
+    }
+}
+async function body(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > 32 * 1024)
+            throw new HostedOAuthError("Request too large", 413);
+        chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function form(raw) {
+    const params = new URLSearchParams(raw);
+    const seen = new Set();
+    for (const [key] of params) {
+        if (seen.has(key))
+            throw new HostedOAuthError("Duplicate form parameter");
+        seen.add(key);
+    }
+    return params;
+}
+function uniqueQuery(params) {
+    const seen = new Set();
+    for (const [key] of params) {
+        if (seen.has(key))
+            throw new HostedOAuthError("Duplicate query parameter");
+        seen.add(key);
+    }
+}
+function required(params, key) {
+    const value = params.get(key);
+    if (!value)
+        throw new HostedOAuthError(`Missing ${key}`);
+    return value;
+}
+function challenge(verifier) {
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier))
+        throw new HostedOAuthError("Invalid PKCE verifier", 400, "invalid_grant");
+    return createHash("sha256").update(verifier).digest("base64url");
+}
+export class HostedOAuth {
+    config;
+    database;
+    ready;
+    requestCounts = new Map();
+    constructor(config, database) {
+        this.config = config;
+        this.database = database;
+    }
+    static async create(env = process.env, database = getDb) {
+        const resource = secureUrl(env.MODLENS_OAUTH_PUBLIC_URL ?? "", "MODLENS_OAUTH_PUBLIC_URL", true);
+        const issuer = secureUrl(env.MODLENS_OAUTH_ISSUER ?? "", "MODLENS_OAUTH_ISSUER", true).toString().replace(/\/$/, "");
+        const clientId = env.MODLENS_OAUTH_CLIENT_ID;
+        if (!clientId)
+            throw new Error("MODLENS_OAUTH_CLIENT_ID is required");
+        const scopes = env.MODLENS_OAUTH_SCOPES?.trim();
+        if (!scopes || scopes.length > 2048 || !/^[\x21-\x7e]+(?: [\x21-\x7e]+)*$/.test(scopes))
+            throw new Error("MODLENS_OAUTH_SCOPES must be a space-separated scope list");
+        const key = Buffer.from(env.MODLENS_OAUTH_STORAGE_KEY ?? "", "base64");
+        if (key.length !== 32)
+            throw new Error("MODLENS_OAUTH_STORAGE_KEY must be a base64-encoded 32-byte key");
+        const subjectField = env.MODLENS_OAUTH_SUBJECT_FIELD ?? "sub";
+        const requiredField = env.MODLENS_OAUTH_REQUIRED_FIELD;
+        if (![subjectField, requiredField].filter(Boolean).every(value => /^[A-Za-z_][A-Za-z0-9_.]*$/.test(value)))
+            throw new Error("OAuth profile field names must be dotted JSON paths");
+        if (!!requiredField !== (env.MODLENS_OAUTH_REQUIRED_VALUE !== undefined))
+            throw new Error("MODLENS_OAUTH_REQUIRED_FIELD and MODLENS_OAUTH_REQUIRED_VALUE must be configured together");
+        const path = new URL(issuer).pathname.replace(/\/$/, "");
+        const metadataUrl = new URL(`/.well-known/oauth-authorization-server${path === "/" ? "" : path}`, issuer);
+        let response = await fetch(metadataUrl, { redirect: "error", signal: AbortSignal.timeout(10000) });
+        if (response.status === 404)
+            response = await fetch(new URL(".well-known/openid-configuration", issuer + "/"), { redirect: "error", signal: AbortSignal.timeout(10000) });
+        if (!response.ok)
+            throw new Error("OAuth provider metadata unavailable");
+        const metadata = await response.json();
+        if (metadata.issuer !== issuer)
+            throw new Error("OAuth provider issuer mismatch");
+        const authorizeUrl = secureUrl(String(metadata.authorization_endpoint ?? ""), "authorization endpoint", true).toString();
+        const tokenUrl = secureUrl(String(metadata.token_endpoint ?? ""), "token endpoint", true).toString();
+        const profileUrl = secureUrl(String(env.MODLENS_OAUTH_PROFILE_URL ?? metadata.userinfo_endpoint ?? ""), "MODLENS_OAUTH_PROFILE_URL", true).toString();
+        const instance = new HostedOAuth({ resource, issuer, clientId, clientSecret: env.MODLENS_OAUTH_CLIENT_SECRET,
+            scopes, profileUrl, subjectField, requiredField, requiredValue: env.MODLENS_OAUTH_REQUIRED_VALUE,
+            key, authorizeUrl, tokenUrl, requiresIss: metadata.authorization_response_iss_parameter_supported === true }, database);
+        await instance.db();
+        return instance;
+    }
+    async db() {
+        const db = await this.database();
+        if (!this.ready)
+            this.ready = (async () => {
+                await db.$executeRawUnsafe(`CREATE TABLE IF NOT EXISTS hosted_oauth_clients (
+                id TEXT PRIMARY KEY, redirect_uris TEXT NOT NULL, created BIGINT NOT NULL)`);
+                await db.$executeRawUnsafe(`CREATE TABLE IF NOT EXISTS hosted_oauth_objects (
+                id TEXT PRIMARY KEY, kind TEXT NOT NULL, payload TEXT NOT NULL, expires BIGINT NOT NULL)`);
+                await db.$executeRawUnsafe(`CREATE TABLE IF NOT EXISTS hosted_oauth_grants (
+                id TEXT PRIMARY KEY, client_id TEXT NOT NULL, subject TEXT NOT NULL, resource TEXT NOT NULL,
+                upstream_access TEXT NOT NULL, upstream_refresh TEXT, upstream_expires BIGINT NOT NULL,
+                refresh_hash TEXT, refresh_expires BIGINT NOT NULL)`);
+                await db.$executeRawUnsafe(`CREATE TABLE IF NOT EXISTS hosted_oauth_access (
+                token_hash TEXT PRIMARY KEY, grant_id TEXT NOT NULL, expires BIGINT NOT NULL)`);
+            })().catch(error => { this.ready = undefined; throw error; });
+        await this.ready;
+        return db;
+    }
+    seal(value) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.config.key, iv);
+        const data = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        return Buffer.concat([iv, cipher.getAuthTag(), data]).toString("base64url");
+    }
+    open(value) {
+        const bytes = Buffer.from(value, "base64url");
+        const decipher = createDecipheriv("aes-256-gcm", this.config.key, bytes.subarray(0, 12));
+        decipher.setAuthTag(bytes.subarray(12, 28));
+        return Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString("utf8");
+    }
+    async putObject(kind, payload, ttl) {
+        const id = token("mlo_");
+        const db = await this.db();
+        await db.$executeRawUnsafe(`DELETE FROM hosted_oauth_objects WHERE expires<$1`, now());
+        await db.$executeRawUnsafe(`INSERT INTO hosted_oauth_objects (id,kind,payload,expires) VALUES ($1,$2,$3,$4)`, sha(id), kind, this.seal(JSON.stringify(payload)), now() + ttl);
+        return id;
+    }
+    async takeObject(id, kind) {
+        const db = await this.db();
+        const rows = await db.$queryRawUnsafe(`DELETE FROM hosted_oauth_objects
+            WHERE id=$1 AND kind=$2 AND expires>$3 RETURNING id,kind,payload,expires`, sha(id), kind, now());
+        if (rows.length !== 1)
+            throw new HostedOAuthError("Expired or reused authorization", 400, "invalid_grant");
+        return JSON.parse(this.open(rows[0].payload));
+    }
+    async client(clientId) {
+        const db = await this.db();
+        const rows = await db.$queryRawUnsafe(`SELECT redirect_uris FROM hosted_oauth_clients WHERE id=$1`, clientId);
+        if (rows.length !== 1)
+            throw new HostedOAuthError("Unknown OAuth client", 400, "invalid_client");
+        return JSON.parse(rows[0].redirect_uris);
+    }
+    async upstreamToken(values) {
+        const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+        values.set("client_id", this.config.clientId);
+        if (this.config.clientSecret)
+            headers.Authorization = `Basic ${Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString("base64")}`;
+        let response;
+        try {
+            response = await fetch(this.config.tokenUrl, { method: "POST", headers, body: values,
+                redirect: "error", signal: AbortSignal.timeout(10000) });
+        }
+        catch {
+            throw new HostedOAuthError("Provider token endpoint unavailable", 503, "temporarily_unavailable");
+        }
+        if (!response.ok)
+            throw new HostedOAuthError("Provider token exchange failed", response.status >= 500 ? 503 : 401, "invalid_grant");
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch {
+            throw new HostedOAuthError("Invalid provider token response", 503, "temporarily_unavailable");
+        }
+        if (!data || typeof data.access_token !== "string" || !data.access_token ||
+            (data.token_type && data.token_type.toLowerCase() !== "bearer"))
+            throw new HostedOAuthError("Invalid provider token response", 503);
+        return data;
+    }
+    async profile(access) {
+        let response;
+        try {
+            response = await fetch(this.config.profileUrl, { headers: { Authorization: `Bearer ${access}` },
+                redirect: "error", signal: AbortSignal.timeout(10000) });
+        }
+        catch {
+            throw new HostedOAuthError("Provider profile unavailable", 503, "temporarily_unavailable");
+        }
+        if (!response.ok)
+            throw new HostedOAuthError("Provider profile unavailable", response.status === 401 || response.status === 403 ? 401 : 503, response.status === 401 || response.status === 403 ? "invalid_token" : "temporarily_unavailable");
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch {
+            throw new HostedOAuthError("Invalid provider profile", 503, "temporarily_unavailable");
+        }
+        const rawSubject = field(data, this.config.subjectField);
+        const subject = typeof rawSubject === "string" ? rawSubject
+            : typeof rawSubject === "number" && Number.isSafeInteger(rawSubject) ? String(rawSubject) : "";
+        if (!subject || subject.length > 256)
+            throw new HostedOAuthError("Provider profile has no stable subject", 403, "access_denied");
+        let allowed = true;
+        if (this.config.requiredField) {
+            const actual = field(data, this.config.requiredField);
+            const configured = this.config.requiredValue;
+            let expected = configured;
+            try {
+                const parsed = JSON.parse(configured);
+                if (parsed === null || ["string", "number", "boolean"].includes(typeof parsed))
+                    expected = parsed;
+            }
+            catch { /* Unquoted string values are valid configuration. */ }
+            allowed = actual === expected;
+        }
+        return { subject, allowed };
+    }
+    callbackUrl() { return new URL("/oauth/upstream/callback", this.config.resource).toString(); }
+    issuerUrl() { return this.config.resource.origin; }
+    metadataUrl() {
+        return new URL(`/.well-known/oauth-protected-resource${this.config.resource.pathname}`, this.config.resource).toString();
+    }
+    challenge(res) {
+        json(res, 401, { error: "unauthorized" }, { "WWW-Authenticate": `Bearer resource_metadata="${this.metadataUrl()}", scope="modlens"` });
+    }
+    async authenticate(req) {
+        for (const name of Object.keys(req.headers))
+            if (name.startsWith("x-modlens-"))
+                throw new HostedOAuthError("Gateway headers are not accepted in OAuth mode", 401, "invalid_token");
+        const value = req.headers.authorization;
+        if (typeof value !== "string" || !/^Bearer m[a-z]+_[A-Za-z0-9_-]{43}$/.test(value))
+            throw new HostedOAuthError("Bearer token required", 401, "invalid_token");
+        const raw = value.slice(7);
+        const db = await this.db();
+        const rows = await db.$queryRawUnsafe(`SELECT g.*, a.expires AS access_expires FROM hosted_oauth_access a
+             JOIN hosted_oauth_grants g ON g.id=a.grant_id WHERE a.token_hash=$1 AND a.expires>$2`, sha(raw), now());
+        if (rows.length !== 1 || rows[0].resource !== this.config.resource.toString())
+            throw new HostedOAuthError("Invalid access token", 401, "invalid_token");
+        const grant = rows[0];
+        if (Number(grant.upstream_expires) <= now())
+            throw new HostedOAuthError("Access token expired", 401, "invalid_token");
+        try {
+            const profile = await this.profile(this.open(grant.upstream_access));
+            if (!profile.allowed || profile.subject !== grant.subject) {
+                await this.revoke(grant.id);
+                throw new HostedOAuthError("Account access denied", 403, "access_denied");
+            }
+        }
+        catch (error) {
+            if (error instanceof HostedOAuthError && error.status === 401)
+                await this.revoke(grant.id);
+            throw error;
+        }
+        return sha(this.config.issuer + "\0" + grant.subject);
+    }
+    async revoke(id) {
+        const db = await this.db();
+        await db.$executeRawUnsafe(`DELETE FROM hosted_oauth_access WHERE grant_id=$1`, id);
+        await db.$executeRawUnsafe(`DELETE FROM hosted_oauth_grants WHERE id=$1`, id);
+    }
+    async issue(grant) {
+        const rawAccess = token("mla_");
+        const expires = Math.max(1, Math.min(300, Number(grant.upstream_expires) - now() - 5));
+        const db = await this.db();
+        await db.$executeRawUnsafe(`INSERT INTO hosted_oauth_access (token_hash,grant_id,expires) VALUES ($1,$2,$3)`, sha(rawAccess), grant.id, now() + expires);
+        return { access_token: rawAccess, token_type: "Bearer", expires_in: expires, scope: "modlens" };
+    }
+    limit(req, route, maximum) {
+        const minute = Math.floor(now() / 60);
+        const key = `${route}:${req.socket.remoteAddress ?? "unknown"}`;
+        const entry = this.requestCounts.get(key);
+        const count = entry?.minute === minute ? entry.count + 1 : 1;
+        this.requestCounts.set(key, { minute, count });
+        if (this.requestCounts.size > 10000) {
+            for (const [id, value] of this.requestCounts)
+                if (value.minute !== minute)
+                    this.requestCounts.delete(id);
+        }
+        if (count > maximum)
+            throw new HostedOAuthError("Too many authorization requests", 429, "slow_down");
+    }
+    async handle(req, res, url) {
+        const route = url.pathname;
+        if (route === this.metadataUrlPath() || route === "/.well-known/oauth-protected-resource") {
+            if (req.method !== "GET")
+                throw new HostedOAuthError("Method not allowed", 405);
+            json(res, 200, { resource: this.config.resource.toString(), authorization_servers: [this.issuerUrl()],
+                scopes_supported: ["modlens"], bearer_methods_supported: ["header"] });
+            return true;
+        }
+        if (route === "/.well-known/oauth-authorization-server") {
+            if (req.method !== "GET")
+                throw new HostedOAuthError("Method not allowed", 405);
+            json(res, 200, { issuer: this.issuerUrl(), authorization_endpoint: this.issuerUrl() + "/oauth/authorize",
+                token_endpoint: this.issuerUrl() + "/oauth/token", registration_endpoint: this.issuerUrl() + "/oauth/register",
+                revocation_endpoint: this.issuerUrl() + "/oauth/revoke", response_types_supported: ["code"],
+                grant_types_supported: ["authorization_code", "refresh_token"], code_challenge_methods_supported: ["S256"],
+                token_endpoint_auth_methods_supported: ["none"], scopes_supported: ["modlens"],
+                authorization_response_iss_parameter_supported: true });
+            return true;
+        }
+        if (route === "/oauth/register" && req.method === "POST") {
+            this.limit(req, route, 120);
+            let registration;
+            try {
+                registration = JSON.parse(await body(req));
+            }
+            catch {
+                throw new HostedOAuthError("Invalid client registration");
+            }
+            const redirects = registration.redirect_uris;
+            if (!Array.isArray(redirects) || redirects.length < 1 || redirects.length > 10 ||
+                !redirects.every(value => typeof value === "string" && callbackSafe(value)) ||
+                (registration.token_endpoint_auth_method && registration.token_endpoint_auth_method !== "none"))
+                throw new HostedOAuthError("Invalid client registration");
+            const id = token("mlc_");
+            const db = await this.db();
+            await db.$executeRawUnsafe(`INSERT INTO hosted_oauth_clients (id,redirect_uris,created) VALUES ($1,$2,$3)`, id, JSON.stringify(redirects), now());
+            json(res, 201, { client_id: id, redirect_uris: redirects, grant_types: ["authorization_code", "refresh_token"],
+                response_types: ["code"], token_endpoint_auth_method: "none" });
+            return true;
+        }
+        if (route === "/oauth/authorize" && req.method === "GET") {
+            this.limit(req, route, 600);
+            const params = url.searchParams;
+            uniqueQuery(params);
+            const clientId = required(params, "client_id");
+            const redirects = await this.client(clientId);
+            const callback = required(params, "redirect_uri");
+            if (!redirects.includes(callback))
+                throw new HostedOAuthError("Unregistered redirect URI");
+            if (params.get("response_type") !== "code" || params.get("code_challenge_method") !== "S256" ||
+                !/^[A-Za-z0-9_-]{43}$/.test(required(params, "code_challenge")))
+                throw new HostedOAuthError("Authorization code with S256 PKCE required");
+            const resource = params.get("resource") ?? this.config.resource.toString();
+            if (resource !== this.config.resource.toString())
+                throw new HostedOAuthError("Invalid resource");
+            const scope = params.get("scope") ?? "modlens";
+            if (scope !== "modlens")
+                throw new HostedOAuthError("Unsupported scope", 400, "invalid_scope");
+            const verifier = randomBytes(32).toString("base64url");
+            const state = await this.putObject("state", { clientId, callback, resource,
+                challenge: params.get("code_challenge"), clientState: params.get("state") ?? "", verifier }, 600);
+            const upstream = new URL(this.config.authorizeUrl);
+            upstream.searchParams.set("response_type", "code");
+            upstream.searchParams.set("client_id", this.config.clientId);
+            upstream.searchParams.set("redirect_uri", this.callbackUrl());
+            upstream.searchParams.set("scope", this.config.scopes);
+            upstream.searchParams.set("state", state);
+            upstream.searchParams.set("code_challenge", challenge(verifier));
+            upstream.searchParams.set("code_challenge_method", "S256");
+            redirect(res, upstream);
+            return true;
+        }
+        if (route === "/oauth/upstream/callback" && req.method === "GET") {
+            uniqueQuery(url.searchParams);
+            const state = await this.takeObject(required(url.searchParams, "state"), "state");
+            const callback = new URL(state.callback);
+            if (url.searchParams.has("error")) {
+                callback.searchParams.set("error", url.searchParams.get("error") ?? "access_denied");
+            }
+            else {
+                const reportedIssuer = url.searchParams.get("iss");
+                if ((this.config.requiresIss && !reportedIssuer) ||
+                    (reportedIssuer && reportedIssuer !== this.config.issuer))
+                    throw new HostedOAuthError("Provider issuer mismatch", 400, "invalid_grant");
+                const values = new URLSearchParams({ grant_type: "authorization_code", code: required(url.searchParams, "code"),
+                    redirect_uri: this.callbackUrl(), code_verifier: state.verifier });
+                const upstream = await this.upstreamToken(values);
+                const profile = await this.profile(upstream.access_token);
+                if (!profile.allowed)
+                    throw new HostedOAuthError("Account access denied", 403, "access_denied");
+                const approval = await this.putObject("approval", { ...state, upstream, subject: profile.subject }, 600);
+                const destination = callback.origin.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;");
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store",
+                    "Referrer-Policy": "no-referrer", "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'" });
+                res.end(`<!doctype html><html><meta charset="utf-8"><title>Connect to ModLens</title><body><h1>Connect to ModLens</h1><p>Allow the application at <strong>${destination}</strong> to use your hosted ModLens access?</p><form method="post" action="/oauth/approve"><input type="hidden" name="approval" value="${approval}"><button name="decision" value="allow">Allow</button><button name="decision" value="deny">Deny</button></form></body></html>`);
+                return true;
+            }
+            if (state.clientState)
+                callback.searchParams.set("state", state.clientState);
+            callback.searchParams.set("iss", this.issuerUrl());
+            redirect(res, callback);
+            return true;
+        }
+        if (route === "/oauth/approve" && req.method === "POST") {
+            const params = form(await body(req));
+            const approval = await this.takeObject(required(params, "approval"), "approval");
+            const callback = new URL(approval.callback);
+            if (params.get("decision") === "allow") {
+                const code = await this.putObject("code", approval, 60);
+                callback.searchParams.set("code", code);
+            }
+            else
+                callback.searchParams.set("error", "access_denied");
+            if (approval.clientState)
+                callback.searchParams.set("state", approval.clientState);
+            callback.searchParams.set("iss", this.issuerUrl());
+            redirect(res, callback);
+            return true;
+        }
+        if (route === "/oauth/token" && req.method === "POST") {
+            const params = form(await body(req));
+            const clientId = required(params, "client_id");
+            await this.client(clientId);
+            const grantType = required(params, "grant_type");
+            if (grantType === "authorization_code") {
+                const code = await this.takeObject(required(params, "code"), "code");
+                if (code.clientId !== clientId || code.callback !== required(params, "redirect_uri") ||
+                    challenge(required(params, "code_verifier")) !== code.challenge ||
+                    (params.has("resource") && params.get("resource") !== code.resource))
+                    throw new HostedOAuthError("Authorization code binding failed", 400, "invalid_grant");
+                const grantId = token("mlg_");
+                const refresh = code.upstream.refresh_token ? token("mlr_") : undefined;
+                const grant = { id: grantId, client_id: clientId, subject: code.subject, resource: code.resource,
+                    upstream_access: this.seal(code.upstream.access_token),
+                    upstream_refresh: code.upstream.refresh_token ? this.seal(code.upstream.refresh_token) : null,
+                    upstream_expires: now() + Math.max(1, Math.min(86400, Number(code.upstream.expires_in) || 300)),
+                    refresh_hash: refresh ? sha(refresh) : null, refresh_expires: now() + 30 * 86400 };
+                const db = await this.db();
+                await db.$executeRawUnsafe(`INSERT INTO hosted_oauth_grants (id,client_id,subject,resource,upstream_access,upstream_refresh,
+                    upstream_expires,refresh_hash,refresh_expires) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`, grant.id, grant.client_id, grant.subject, grant.resource, grant.upstream_access, grant.upstream_refresh, grant.upstream_expires, grant.refresh_hash, grant.refresh_expires);
+                json(res, 200, { ...await this.issue(grant), ...(refresh ? { refresh_token: refresh } : {}) });
+                return true;
+            }
+            if (grantType === "refresh_token") {
+                if (params.has("resource") && params.get("resource") !== this.config.resource.toString())
+                    throw new HostedOAuthError("Wrong resource", 400, "invalid_grant");
+                if (params.has("scope") && params.get("scope") !== "modlens")
+                    throw new HostedOAuthError("Unsupported scope", 400, "invalid_scope");
+                const raw = required(params, "refresh_token");
+                const db = await this.db();
+                const rows = await db.$queryRawUnsafe(`UPDATE hosted_oauth_grants SET refresh_hash=NULL
+                    WHERE refresh_hash=$1 AND client_id=$2 AND refresh_expires>$3 RETURNING *`, sha(raw), clientId, now());
+                if (rows.length !== 1 || !rows[0].upstream_refresh)
+                    throw new HostedOAuthError("Invalid refresh token", 400, "invalid_grant");
+                const grant = rows[0];
+                try {
+                    const oldUpstreamRefresh = grant.upstream_refresh;
+                    const upstream = await this.upstreamToken(new URLSearchParams({ grant_type: "refresh_token",
+                        refresh_token: this.open(oldUpstreamRefresh) }));
+                    grant.upstream_access = this.seal(upstream.access_token);
+                    grant.upstream_refresh = this.seal(upstream.refresh_token ?? this.open(oldUpstreamRefresh));
+                    grant.upstream_expires = now() + Math.max(1, Math.min(86400, Number(upstream.expires_in) || 300));
+                    await db.$executeRawUnsafe(`UPDATE hosted_oauth_grants SET upstream_access=$2,upstream_refresh=$3,
+                        upstream_expires=$4 WHERE id=$1`, grant.id, grant.upstream_access, grant.upstream_refresh, grant.upstream_expires);
+                    const profile = await this.profile(upstream.access_token);
+                    if (profile.subject !== grant.subject || !profile.allowed)
+                        throw new HostedOAuthError("Account access denied", 403, "access_denied");
+                    const next = token("mlr_");
+                    grant.refresh_hash = sha(next);
+                    await db.$executeRawUnsafe(`UPDATE hosted_oauth_grants SET refresh_hash=$2 WHERE id=$1`, grant.id, grant.refresh_hash);
+                    json(res, 200, { ...await this.issue(grant), refresh_token: next });
+                }
+                catch (error) {
+                    if (error instanceof HostedOAuthError && error.status === 503) {
+                        await db.$executeRawUnsafe(`UPDATE hosted_oauth_grants SET refresh_hash=$2 WHERE id=$1 AND refresh_hash IS NULL`, grant.id, sha(raw));
+                    }
+                    else
+                        await this.revoke(grant.id);
+                    throw error;
+                }
+                return true;
+            }
+            throw new HostedOAuthError("Unsupported grant type", 400, "unsupported_grant_type");
+        }
+        if (route === "/oauth/revoke" && req.method === "POST") {
+            const params = form(await body(req));
+            const clientId = required(params, "client_id");
+            await this.client(clientId);
+            const raw = required(params, "token");
+            const db = await this.db();
+            const rows = await db.$queryRawUnsafe(`SELECT id FROM hosted_oauth_grants WHERE client_id=$1 AND refresh_hash=$2`, clientId, sha(raw));
+            if (rows.length)
+                await this.revoke(rows[0].id);
+            else {
+                const access = await db.$queryRawUnsafe(`SELECT g.id FROM hosted_oauth_access a JOIN hosted_oauth_grants g ON g.id=a.grant_id
+                     WHERE g.client_id=$1 AND a.token_hash=$2`, clientId, sha(raw));
+                if (access.length)
+                    await this.revoke(access[0].id);
+            }
+            json(res, 200, {});
+            return true;
+        }
+        return false;
+    }
+    metadataUrlPath() { return new URL(this.metadataUrl()).pathname; }
+}
+//# sourceMappingURL=hosted-oauth.js.map

package/dist/hosted-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-oauth.js","sourceRoot":"","sources":["../src/hosted-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAgBhC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACH;IAAqB;IAAzD,YAAY,OAAe,EAAS,SAAS,GAAG,EAAS,OAAO,iBAAiB;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAhE,WAAM,GAAN,MAAM,CAAM;QAAS,SAAI,GAAJ,IAAI,CAAoB;IAAoB,CAAC;CACzG;AAED,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,IAAI,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAc,EAAE,UAAkC,EAAE,EAAE,EAAE;IACvG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAE,GAAQ,EAAE,EAAE;IAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9E,GAAG,CAAC,GAAG,EAAE,CAAC;AACd,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CACvG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAEvI,SAAS,SAAS,CAAC,GAAW,EAAE,KAAa,EAAE,QAAQ,GAAG,KAAK;IAC3D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;WACjE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM;QAC5G,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2EAA2E,CAAC,CAAC;IACzG,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC7B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI;YACpE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO;gBACnD,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAoB;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACrB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,MAAuB;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAuB,EAAE,GAAW;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IAC/B,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC3H,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,OAAO,WAAW;IAGQ;IAA4B;IAFhD,KAAK,CAAiB;IACtB,aAAa,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC7E,YAA4B,MAAkB,EAAU,QAAiC;QAA7D,WAAM,GAAN,MAAM,CAAY;QAAU,aAAQ,GAAR,QAAQ,CAAyB;IAAG,CAAC;IAE7F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,WAAoC,KAAK;QAC/F,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,GAAG,CAAC,uBAAuB,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACzG,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,IAAI,KAAK,CAAC;QAC9D,MAAM,aAAa,GAAG,GAAG,CAAC,4BAA4B,CAAC;QACvD,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC;YACvG,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,4BAA4B,KAAK,SAAS,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QACjH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,0CAA0C,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1G,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,GAAG,GAAG,CAAC,EACzG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,IAAI,EAAE,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzH,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrG,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,IAAI,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAClG,2BAA2B,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,2BAA2B;YACxG,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,CAAC,4BAA4B;YAChG,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,8CAA8C,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5H,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,EAAE,CAAC,iBAAiB,CAAC;2FACoD,CAAC,CAAC;gBACjF,MAAM,EAAE,CAAC,iBAAiB,CAAC;yGACkE,CAAC,CAAC;gBAC/F,MAAM,EAAE,CAAC,iBAAiB,CAAC;;;oEAG6B,CAAC,CAAC;gBAC1D,MAAM,EAAE,CAAC,iBAAiB,CAAC;8FACuD,CAAC,CAAC;YACxF,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,EAAE,CAAC;IACd,CAAC;IAEO,IAAI,CAAC,KAAa;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC;IAEO,IAAI,CAAC,KAAa;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnG,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAgB,EAAE,GAAW;QAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,iBAAiB,CAAC,mDAAmD,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,CAAC,iBAAiB,CAAC,iFAAiF,EACxG,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAY;QAC7C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAc;qFAC0B,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,QAAgB;QACjC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CACjC,4DAA4D,EAAE,QAAQ,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAuB;QAC/C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvJ,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM;gBACtF,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC/D,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAAC,CAAC;QAC5G,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACpI,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAoB,CAAC;QAAC,CAAC;QACvD,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAAC,CAAC;QACxG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;YACpE,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc;QAChC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;gBACjG,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC/D,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAAC,CAAC;QACrG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACvI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACtG,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAa,CAAC;QAAC,CAAC;QAChD,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU;YACvD,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;YAChC,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QAC/F,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC;YAC9C,IAAI,QAAQ,GAAY,UAAU,CAAC;YACnC,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;gBACjD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC;oBAAE,QAAQ,GAAG,MAAM,CAAC;YACtG,CAAC;YAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;YACjE,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAEO,WAAW,KAAa,OAAO,IAAI,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtG,SAAS,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,WAAW;QACf,OAAO,IAAI,GAAG,CAAC,wCAAwC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7H,CAAC;IAED,SAAS,CAAC,GAAmB;QACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,kBAAkB,EAAE,6BAA6B,IAAI,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3I,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAoB;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;gBAC1E,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QACvG,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9E,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CACjC;kGACsF,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACzE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;QACtH,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5B,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;YAC9E,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3F,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,EAAU;QAC3B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,iBAAiB,CAAC,mDAAmD,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,EAAE,CAAC,iBAAiB,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAe;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,iBAAiB,CAAC,iFAAiF,EACxG,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QAC/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACpG,CAAC;IAEO,KAAK,CAAC,GAAoB,EAAE,KAAa,EAAE,OAAe;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa;gBAAE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,KAAK,GAAG,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,EAAE,IAAI,KAAK,KAAK,uCAAuC,EAAE,CAAC;YACxF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjG,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,yCAAyC,EAAE,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,kBAAkB;gBACpG,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,cAAc,EAAE,qBAAqB,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,iBAAiB;gBAC9G,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,eAAe,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAC3F,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,gCAAgC,EAAE,CAAC,MAAM,CAAC;gBAC1G,qCAAqC,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC;gBAC9E,8CAA8C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5B,IAAI,YAAqC,CAAC;YAC1C,IAAI,CAAC;gBAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;YAAC,CAAC;YACxH,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE;gBAC1E,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC3E,CAAC,YAAY,CAAC,0BAA0B,IAAI,YAAY,CAAC,0BAA0B,KAAK,MAAM,CAAC;gBAC/F,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;YAC9D,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,iBAAiB,CAAC,+EAA+E,EACtG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBAC1G,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;YAChC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;YAC3F,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM;gBACxF,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBAC/D,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3E,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;YACjG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;YAC/F,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;gBACtE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YACtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YAC3D,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,0BAA0B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/D,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,OAAO,CAE/E,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACJ,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC;oBAC5C,CAAC,cAAc,IAAI,cAAc,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;oBACzD,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBACjF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC;oBAC3G,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC1D,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBAChG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;gBACzG,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC/G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU;oBACxF,iBAAiB,EAAE,aAAa,EAAE,yBAAyB,EAAE,4GAA4G,EAAE,CAAC,CAAC;gBACjL,GAAG,CAAC,GAAG,CAAC,oJAAoJ,WAAW,2IAA2I,QAAQ,+HAA+H,CAAC,CAAC;gBAC3b,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,KAAK,CAAC,WAAW;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7E,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACnD,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAG9E,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACxD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;;gBAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,WAAW;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACnD,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACjD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAElE,CAAC;gBACF,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;oBAChF,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS;oBAC/D,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;oBACpE,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxE,MAAM,KAAK,GAAa,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACtG,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACtD,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;oBAC7F,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;oBAC/F,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;gBACvF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,iBAAiB,CAAC;uGAC4D,EACnF,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,gBAAgB,EACvG,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;gBACvE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/F,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAChC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE;oBACpF,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBACvE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;oBACxD,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAC9C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAa;8FAC4B,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB;oBAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC9H,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC;oBACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,gBAAiB,CAAC;oBACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe;wBACvF,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;oBACrD,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBACzD,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBAC5F,KAAK,CAAC,gBAAgB,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;oBAClG,MAAM,EAAE,CAAC,iBAAiB,CAAC;wDACS,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,eAAe,EACjE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBAC1D,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;wBAAE,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBACrI,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC3B,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC/B,MAAM,EAAE,CAAC,iBAAiB,CAAC,4DAA4D,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;oBACvH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBAC5D,MAAM,EAAE,CAAC,iBAAiB,CAAC,qFAAqF,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1I,CAAC;;wBAAM,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CACjC,2EAA2E,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACrG,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC1C,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CACnC;8DAC0C,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,eAAe,KAAa,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;CACrF"}

package/dist/hosted-policy.d.ts

@@ -0,0 +1,36 @@
+import type { IncomingHttpHeaders } from "node:http";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+export interface HostedLimits {
+    lines: number;
+    responseBytes: number;
+    dailyBytes: number;
+    periodBytes: number;
+    dailyRequests: number;
+    minuteRequests: number;
+}
+export declare function hostedLimits(env?: NodeJS.ProcessEnv): HostedLimits;
+export declare class HostedPolicyError extends Error {
+}
+/** Only an authenticated gateway may choose the stable account identifier. */
+export declare function hostedPrincipal(headers: IncomingHttpHeaders, secret?: string): string;
+/** Team claims are accepted only from the authenticated gateway. */
+export declare function hostedMinecraftSourceTeams(env?: NodeJS.ProcessEnv, secret?: string): Set<string>;
+export declare function hostedMinecraftSourceAccess(headers: IncomingHttpHeaders, teams: ReadonlySet<string>): boolean;
+export declare const HOSTED_ACTIONS: Record<string, readonly string[]>;
+export declare function hostedActions(tool: string, allowMinecraftSource?: boolean): readonly string[] | undefined;
+export declare function prepareHostedArgs(tool: string, input: Record<string, unknown>, limits: HostedLimits, allowMinecraftSource?: boolean): Record<string, unknown>;
+export interface BudgetDatabase {
+    $executeRawUnsafe(query: string, ...values: any[]): Promise<number>;
+    $queryRawUnsafe<T>(query: string, ...values: any[]): Promise<T>;
+}
+/** Atomic shared-database accounting: session churn, parallel calls and restarts do not reset it. */
+export declare class HostedBudget {
+    private database;
+    private now;
+    private ready?;
+    constructor(database?: () => Promise<BudgetDatabase>, now?: () => number);
+    charge(subject: string, limits: HostedLimits, requests: number, bytes: number): Promise<void>;
+}
+export declare function boundHostedResult(tool: string, args: Record<string, unknown>, result: CallToolResult, limits: HostedLimits, allowMinecraftSource?: boolean): CallToolResult;
+export declare function runHostedTool(tool: string, input: Record<string, unknown>, subject: string, limits: HostedLimits, budget: HostedBudget, run: (args: Record<string, unknown>) => Promise<CallToolResult>, allowMinecraftSource?: boolean): Promise<CallToolResult>;
+//# sourceMappingURL=hosted-policy.d.ts.map

package/dist/hosted-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-policy.d.ts","sourceRoot":"","sources":["../src/hosted-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIzE,MAAM,WAAW,YAAY;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAiB/E;AAED,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAUrF;AAED,oEAAoE;AACpE,wBAAgB,0BAA0B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAQ7G;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAG7G;AAID,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CA2B5D,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,UAAQ,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAIvG;AAQD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6C3J;AAED,MAAM,WAAW,cAAc;IAC3B,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnE;AAED,qGAAqG;AACrG,qBAAa,YAAY;IAET,OAAO,CAAC,QAAQ;IAAyC,OAAO,CAAC,GAAG;IADhF,OAAO,CAAC,KAAK,CAAC,CAAgB;gBACV,QAAQ,GAAE,MAAM,OAAO,CAAC,cAAc,CAAS,EAAU,GAAG,eAAW;IAErF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6BtG;AAKD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EACvH,oBAAoB,UAAQ,GAAG,cAAc,CAuGhD;AAMD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAC7F,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,EAC3G,oBAAoB,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAoBzD"}