@cursor/july 0.1.95 → 0.1.97

package/dist/internal/mcp-host.js

@@ -25,6 +25,34 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
 import { createHostMcpOAuthProvider } from "./mcp-oauth.js";
+export class McpNeedsAuthError extends Error {
+    constructor(connection, cause) {
+        super(`MCP connection "${connection}" needs authorization. Run \`${CLI} mcp oauth ${connection}\`.`);
+        this.name = "McpNeedsAuthError";
+        this.connection = connection;
+        if (cause !== undefined) {
+            this.cause = cause;
+        }
+    }
+}
+export function isMcpNeedsAuthError(error) {
+    return error instanceof McpNeedsAuthError;
+}
+export function hostMcpCallNeedsAuth(result) {
+    if (result.isError !== true) {
+        return false;
+    }
+    const text = result.content
+        .map((part) => (part.type === "text" ? part.text : ""))
+        .join("\n");
+    return text.includes("needsAuth") || text.includes("needs authorization");
+}
+function throwIfCallNeedsAuth(connection, result) {
+    if (hostMcpCallNeedsAuth(result)) {
+        throw new McpNeedsAuthError(connection);
+    }
+    return result;
+}
 export class McpHost {
     constructor(connections) {
         this.byName = new Map();
@@ -33,6 +61,10 @@ export class McpHost {
             this.byName.set(connection.name, connection);
         }
     }
+    /** Public serve callback for host OAuth (not the CLI loopback port on pods). */
+    setOAuthRedirectUrl(url) {
+        this.oauthRedirectUrl = url;
+    }
     /**
      * Register a connection after construction (serve-time resolved peers).
      * Clients open lazily on first use, so adding before first call is safe.
@@ -61,8 +93,9 @@ export class McpHost {
      * mapping as registry calls.
      */
     oneOff(connection) {
+        const redirectUrl = this.oauthRedirectUrl;
         const withFreshClient = (run) => __awaiter(this, void 0, void 0, function* () {
-            const opened = yield openConnection(connection);
+            const opened = yield openConnection(connection, redirectUrl);
             try {
                 return yield run(opened.client);
             }
@@ -80,7 +113,7 @@ export class McpHost {
                     name: toolName,
                     arguments: args,
                 });
-                return normalizeCallResult(result);
+                return throwIfCallNeedsAuth(connection.name, normalizeCallResult(result));
             })),
         };
     }
@@ -91,10 +124,25 @@ export class McpHost {
                     name: toolName,
                     arguments: args,
                 });
-                return normalizeCallResult(result);
+                return throwIfCallNeedsAuth(connectionName, normalizeCallResult(result));
             }));
         });
     }
+    dropClient(name) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const pending = this.clients.get(name);
+            this.clients.delete(name);
+            if (pending === undefined) {
+                return;
+            }
+            try {
+                yield (yield pending).close();
+            }
+            catch (_a) {
+                // Best-effort teardown.
+            }
+        });
+    }
     close() {
         return __awaiter(this, void 0, void 0, function* () {
             const opened = yield Promise.allSettled([...this.clients.values()]);
@@ -165,7 +213,7 @@ export class McpHost {
                 const known = this.names().join(", ") || "(none)";
                 throw new Error(`Unknown MCP connection "${name}". Authored MCP connections: ${known}.`);
             }
-            return openConnection(connection);
+            return openConnection(connection, this.oauthRedirectUrl);
         });
     }
 }
@@ -229,20 +277,20 @@ function toToolInfo(tool) {
         ? {}
         : { outputSchema: tool.outputSchema })), (annotations === undefined ? {} : { annotations }));
 }
-function openConnection(connection) {
+function openConnection(connection, oauthRedirectUrl) {
     return __awaiter(this, void 0, void 0, function* () {
         const client = new Client({
             name: "agent-serve",
             version: "0.1.0",
         });
-        const transport = yield createTransport(connection);
+        const transport = yield createTransport(connection, oauthRedirectUrl);
         try {
             yield client.connect(transport);
         }
         catch (error) {
             if (error instanceof UnauthorizedError &&
                 isOauthHttpTransport(connection.transport)) {
-                throw new Error(`MCP connection "${connection.name}" needs authorization. Run \`${CLI} mcp oauth ${connection.name}\`.`, { cause: error });
+                throw new McpNeedsAuthError(connection.name, error);
             }
             throw error;
         }
@@ -266,7 +314,7 @@ function openConnection(connection) {
         };
     });
 }
-function createTransport(connection) {
+function createTransport(connection, oauthRedirectUrl) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const transport = connection.transport;
@@ -292,6 +340,7 @@ function createTransport(connection) {
             ? yield createHostMcpOAuthProvider({
                 identifier: connection.name,
                 resourceUrl: transport.url,
+                redirectUrl: oauthRedirectUrl,
             })
             : undefined;
         if (transport.type === "sse") {

package/dist/internal/mcp-oauth-on-demand.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Mid-run host MCP OAuth: mint an authUrl, finish on the public serve
+ * callback (file tokens). Deployment secrets persist from the
+ * authenticated park, not from that callback.
+ *
+ * CLI `mcp oauth` still uses the loopback callback. This path is recovery
+ * and first-use without a separate `--store` step.
+ */
+import { FileMcpOAuthStore } from "./mcp-oauth.js";
+import { type McpOauthSecretsTarget, type ResolveHostedMcpOauthSecretsArgs } from "./mcp-oauth-persist.js";
+export declare function mcpOauthServeCallbackPath(basePath?: string): string;
+export declare function mcpOauthServeCallbackUrl(origin: string, basePath?: string): string;
+export type BeginHostMcpOauthResult = {
+    status: "authorized";
+} | {
+    status: "needs_auth";
+    authUrl: string;
+    state: string;
+    finish: (code: string) => Promise<void>;
+    abort: () => Promise<void>;
+};
+export declare function beginHostMcpOauth(args: {
+    connection: string;
+    url: string;
+    type?: "http" | "sse";
+    headers?: Record<string, string>;
+    redirectUrl: string;
+    store?: FileMcpOAuthStore;
+}): Promise<BeginHostMcpOauthResult>;
+export type McpOauthCompleteResult = {
+    connection: string;
+    sessionId?: string;
+    callId?: string;
+};
+export declare class McpOauthOnDemandHub {
+    private readonly attempts;
+    private readonly completed;
+    private readonly finishing;
+    private readonly aborted;
+    callbackUrl: string | undefined;
+    secrets?: McpOauthSecretsTarget;
+    secretsBind?: ResolveHostedMcpOauthSecretsArgs;
+    logger?: (line: string) => void;
+    private store?;
+    mint(args: {
+        connection: string;
+        url: string;
+        type?: "http" | "sse";
+        headers?: Record<string, string>;
+        sessionId?: string;
+    }): Promise<{
+        authUrl: string;
+        state: string;
+    } | {
+        authorized: true;
+    }>;
+    abortCall(sessionId: string, callId: string): Promise<void>;
+    abortSession(sessionId: string): Promise<void>;
+    close(): Promise<void>;
+    private dropWhere;
+    bind(state: string, sessionId: string, callId: string): "pending" | "already_done" | "unknown";
+    complete(state: string, code: string): Promise<McpOauthCompleteResult>;
+    private finishAttempt;
+    private fileStore;
+    persistFor(connection: string, resourceUrl: string): Promise<void>;
+    handleCallback(request: Request): Promise<Response>;
+}
+//# sourceMappingURL=mcp-oauth-on-demand.d.ts.map

package/dist/internal/mcp-oauth-on-demand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-on-demand.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth-on-demand.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAEL,iBAAiB,EAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EAGtC,MAAM,wBAAwB,CAAC;AAEhC,wBAAgB,yBAAyB,CAAC,QAAQ,SAAK,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,SAAK,GACZ,MAAM,CAER;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEN,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoEnC;AAWD,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IACJ,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAEhC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAoB;IAE5B,IAAI,CAAC,IAAI,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAsBrE;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;IAEK,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnD;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;YAEa,SAAS;IAyBvB,IAAI,CACF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,cAAc,GAAG,SAAS,CAcxC;IAEK,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAe3E;YAEa,aAAa;IAqB3B,OAAO,CAAC,SAAS;IAKX,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;IAEK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyBxD;CACF"}

package/dist/internal/mcp-oauth-on-demand.js

@@ -0,0 +1,287 @@
+/**
+ * Mid-run host MCP OAuth: mint an authUrl, finish on the public serve
+ * callback (file tokens). Deployment secrets persist from the
+ * authenticated park, not from that callback.
+ *
+ * CLI `mcp oauth` still uses the loopback callback. This path is recovery
+ * and first-use without a separate `--store` step.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { describeError } from "./describe-error.js";
+import { LOG_PREFIX } from "./distribution.js";
+import { createHostMcpOAuthProvider, FileMcpOAuthStore, MCP_OAUTH_CALLBACK_URL, } from "./mcp-oauth.js";
+import { resolveHostedMcpOauthSecretsTarget, upsertHostMcpOauthSecrets, } from "./mcp-oauth-persist.js";
+export function mcpOauthServeCallbackPath(basePath = "") {
+    return `${basePath}/v1/mcp-oauth/callback`;
+}
+export function mcpOauthServeCallbackUrl(origin, basePath = "") {
+    return `${origin.replace(/\/$/, "")}${mcpOauthServeCallbackPath(basePath)}`;
+}
+export function beginHostMcpOauth(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        let authorizationUrl;
+        const provider = yield createHostMcpOAuthProvider({
+            identifier: args.connection,
+            resourceUrl: args.url,
+            store: args.store,
+            redirectUrl: args.redirectUrl,
+            onRedirect: (url) => {
+                authorizationUrl = url;
+            },
+        });
+        const client = new Client({ name: "agent-sdk-mcp-oauth", version: "0.1.0" });
+        const url = new URL(args.url);
+        const requestInit = args.headers === undefined ? undefined : { headers: args.headers };
+        const makeTransport = () => {
+            if (args.type === "sse") {
+                return new SSEClientTransport(url, {
+                    authProvider: provider,
+                    requestInit,
+                });
+            }
+            return new StreamableHTTPClientTransport(url, {
+                authProvider: provider,
+                requestInit,
+            });
+        };
+        const transport = makeTransport();
+        try {
+            yield client.connect(transport);
+            yield client.close().catch(() => undefined);
+            return { status: "authorized" };
+        }
+        catch (error) {
+            if (!(error instanceof UnauthorizedError)) {
+                throw error;
+            }
+        }
+        const redirect = authorizationUrl !== null && authorizationUrl !== void 0 ? authorizationUrl : provider.lastRedirectUrl;
+        if (redirect === undefined) {
+            throw new Error(`Auth required for "${args.connection}" but no authorization URL was provided.`);
+        }
+        const state = (_a = redirect.searchParams.get("state")) !== null && _a !== void 0 ? _a : "";
+        if (state === "") {
+            throw new Error(`Auth required for "${args.connection}" but the authorization URL had no state.`);
+        }
+        return {
+            status: "needs_auth",
+            authUrl: redirect.toString(),
+            state,
+            finish: (code) => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                yield transport.finishAuth(code);
+                yield (_a = transport.close) === null || _a === void 0 ? void 0 : _a.call(transport).catch(() => undefined);
+            }),
+            abort: () => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                yield (_a = transport.close) === null || _a === void 0 ? void 0 : _a.call(transport).catch(() => undefined);
+            }),
+        };
+    });
+}
+export class McpOauthOnDemandHub {
+    constructor() {
+        this.attempts = new Map();
+        this.completed = new Map();
+        this.finishing = new Map();
+        this.aborted = new Set();
+    }
+    mint(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const redirectUrl = (_a = this.callbackUrl) !== null && _a !== void 0 ? _a : MCP_OAUTH_CALLBACK_URL;
+            const store = this.fileStore();
+            const started = yield beginHostMcpOauth({
+                connection: args.connection,
+                url: args.url,
+                type: args.type,
+                headers: args.headers,
+                redirectUrl,
+                store,
+            });
+            if (started.status === "authorized") {
+                return { authorized: true };
+            }
+            this.attempts.set(started.state, {
+                connection: args.connection,
+                resourceUrl: args.url,
+                finish: started.finish,
+                abort: started.abort,
+                sessionId: args.sessionId,
+            });
+            return { authUrl: started.authUrl, state: started.state };
+        });
+    }
+    abortCall(sessionId, callId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dropWhere((attempt) => attempt.sessionId === sessionId && attempt.callId === callId, true);
+        });
+    }
+    abortSession(sessionId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dropWhere((attempt) => attempt.sessionId === sessionId, false);
+        });
+    }
+    close() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dropWhere(() => true, true);
+        });
+    }
+    dropWhere(match, includeCompleted) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const jobs = [];
+            for (const [state, attempt] of this.attempts) {
+                if (!match(attempt)) {
+                    continue;
+                }
+                this.aborted.add(state);
+                this.attempts.delete(state);
+                jobs.push(attempt.abort().catch(() => undefined));
+            }
+            if (includeCompleted) {
+                for (const [state, attempt] of this.completed) {
+                    if (!match(attempt)) {
+                        continue;
+                    }
+                    this.aborted.add(state);
+                    this.completed.delete(state);
+                }
+            }
+            yield Promise.all(jobs);
+        });
+    }
+    bind(state, sessionId, callId) {
+        const live = this.attempts.get(state);
+        if (live !== undefined) {
+            live.sessionId = sessionId;
+            live.callId = callId;
+            return "pending";
+        }
+        const done = this.completed.get(state);
+        if (done !== undefined) {
+            done.sessionId = sessionId;
+            done.callId = callId;
+            return "already_done";
+        }
+        return "unknown";
+    }
+    complete(state, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.aborted.has(state)) {
+                throw new Error("Unknown OAuth state.");
+            }
+            const pending = this.finishing.get(state);
+            if (pending !== undefined) {
+                return yield pending;
+            }
+            const attempt = this.attempts.get(state);
+            if (attempt === undefined) {
+                throw new Error("Unknown OAuth state.");
+            }
+            const run = this.finishAttempt(state, attempt, code);
+            this.finishing.set(state, run);
+            return yield run;
+        });
+    }
+    finishAttempt(state, attempt, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield attempt.finish(code);
+                this.attempts.delete(state);
+                if (!this.aborted.has(state)) {
+                    this.completed.set(state, attempt);
+                }
+                return {
+                    connection: attempt.connection,
+                    sessionId: attempt.sessionId,
+                    callId: attempt.callId,
+                };
+            }
+            finally {
+                this.finishing.delete(state);
+            }
+        });
+    }
+    fileStore() {
+        var _a;
+        (_a = this.store) !== null && _a !== void 0 ? _a : (this.store = new FileMcpOAuthStore());
+        return this.store;
+    }
+    persistFor(connection, resourceUrl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            var _c, _d;
+            const target = (_c = this.secrets) !== null && _c !== void 0 ? _c : resolveHostedMcpOauthSecretsTarget((_d = this.secretsBind) !== null && _d !== void 0 ? _d : {});
+            if (target === undefined) {
+                return;
+            }
+            const store = this.fileStore();
+            const tokens = yield store.loadTokens(connection, resourceUrl);
+            if (tokens === undefined || tokens.access_token.trim() === "") {
+                return;
+            }
+            const client = yield store.loadClientInformation(connection, resourceUrl);
+            try {
+                const names = yield upsertHostMcpOauthSecrets({
+                    connection,
+                    tokens,
+                    clientId: client === null || client === void 0 ? void 0 : client.client_id,
+                    target,
+                });
+                (_a = this.logger) === null || _a === void 0 ? void 0 : _a.call(this, `${LOG_PREFIX} MCP OAuth tokens stored on the deployment (${names.join(", ")}).`);
+            }
+            catch (error) {
+                (_b = this.logger) === null || _b === void 0 ? void 0 : _b.call(this, `${LOG_PREFIX} MCP OAuth persist failed for "${connection}": ${describeError(error)}`);
+            }
+        });
+    }
+    handleCallback(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const url = new URL(request.url);
+            const code = url.searchParams.get("code");
+            const state = (_a = url.searchParams.get("state")) !== null && _a !== void 0 ? _a : "";
+            if (this.aborted.has(state)) {
+                return oauthHtml(404, "<h1>Not found</h1>");
+            }
+            if (this.completed.has(state)) {
+                return oauthHtml(200, "<h1>Authorized</h1><p>Return to the agent.</p>");
+            }
+            if (!this.attempts.has(state)) {
+                return oauthHtml(404, "<h1>Not found</h1>");
+            }
+            if (code !== null && code !== "") {
+                try {
+                    yield this.complete(state, code);
+                }
+                catch (_b) {
+                    return oauthHtml(400, "<h1>Authorization failed</h1>");
+                }
+                if (this.aborted.has(state)) {
+                    return oauthHtml(404, "<h1>Not found</h1>");
+                }
+                return oauthHtml(200, "<h1>Authorized</h1><p>Return to the agent.</p>");
+            }
+            return oauthHtml(400, "<h1>Authorization failed</h1>");
+        });
+    }
+}
+function oauthHtml(status, body) {
+    return new Response(`<!doctype html><html><body>${body}</body></html>`, {
+        status,
+        headers: { "content-type": "text/html; charset=utf-8" },
+    });
+}

package/dist/internal/mcp-oauth-persist.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Deployment-secret upsert for host MCP OAuth (`mcp oauth --store` and
+ * hosted Connect). File writes stay on FileMcpOAuthStore / the OAuth
+ * provider. Resolve the `--store` client at persist time so v2 freeze
+ * bind can drop the key after listen.
+ */
+import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+export type McpOauthSecretsClient = {
+    setSecrets(args: {
+        teamId: number;
+        slug: string;
+        secrets: Array<{
+            name: string;
+            value: string;
+        }>;
+    }): Promise<string[]>;
+};
+export type McpOauthSecretsTarget = {
+    client: McpOauthSecretsClient;
+    teamId: number;
+    slug: string;
+};
+export declare function upsertHostMcpOauthSecrets(args: {
+    connection: string;
+    tokens: OAuthTokens;
+    clientId?: string;
+    target: McpOauthSecretsTarget;
+}): Promise<string[]>;
+export type ResolveHostedMcpOauthSecretsArgs = {
+    slug?: string;
+    team?: string;
+    apiKey?: string;
+    cloudToolsUrl?: string;
+    env?: NodeJS.ProcessEnv;
+};
+/**
+ * Bind the CLI `--store` client when this process is a hosted engine
+ * (`AGENT_SERVE_DEPLOYMENT_ID`) and a live API key is present.
+ * Self-hosted / no deployment / unsigned: undefined.
+ */
+export declare function resolveHostedMcpOauthSecretsTarget(args?: ResolveHostedMcpOauthSecretsArgs): McpOauthSecretsTarget | undefined;
+//# sourceMappingURL=mcp-oauth-persist.d.ts.map

package/dist/internal/mcp-oauth-persist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-persist.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth-persist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAY5E,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,CAAC,IAAI,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAsBF,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUpB;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,GAAE,gCAAqC,GAC1C,qBAAqB,GAAG,SAAS,CA8BnC"}

package/dist/internal/mcp-oauth-persist.js

@@ -0,0 +1,92 @@
+/**
+ * Deployment-secret upsert for host MCP OAuth (`mcp oauth --store` and
+ * hosted Connect). File writes stay on FileMcpOAuthStore / the OAuth
+ * provider. Resolve the `--store` client at persist time so v2 freeze
+ * bind can drop the key after listen.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AGENT_SERVE_DEPLOYMENT_ID_ENV_VAR } from "../storage-backends/cursor-hosted.js";
+import { cursorExternalApiUrl, resolveApiKeySync, } from "./cursor/credentials.js";
+import { AgentServeDeployClient, parseAgentServeMcpGatewayUrl, } from "./deploy-client.js";
+import { mcpOauthSecretNames } from "./mcp-oauth.js";
+function mcpOauthSecretsPayload(args) {
+    var _a, _b;
+    const names = mcpOauthSecretNames(args.connection);
+    const secrets = [
+        { name: names.accessToken, value: args.tokens.access_token },
+    ];
+    const refresh = (_a = args.tokens.refresh_token) === null || _a === void 0 ? void 0 : _a.trim();
+    if (refresh !== undefined && refresh !== "") {
+        secrets.push({ name: names.refreshToken, value: refresh });
+    }
+    const clientId = (_b = args.clientId) === null || _b === void 0 ? void 0 : _b.trim();
+    if (clientId !== undefined && clientId !== "") {
+        secrets.push({ name: names.clientId, value: clientId });
+    }
+    return secrets;
+}
+export function upsertHostMcpOauthSecrets(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const payload = mcpOauthSecretsPayload(args);
+        if (payload.length === 0) {
+            return [];
+        }
+        return yield args.target.client.setSecrets({
+            teamId: args.target.teamId,
+            slug: args.target.slug,
+            secrets: payload,
+        });
+    });
+}
+/**
+ * Bind the CLI `--store` client when this process is a hosted engine
+ * (`AGENT_SERVE_DEPLOYMENT_ID`) and a live API key is present.
+ * Self-hosted / no deployment / unsigned: undefined.
+ */
+export function resolveHostedMcpOauthSecretsTarget(args = {}) {
+    var _a;
+    var _b, _c;
+    const env = (_b = args.env) !== null && _b !== void 0 ? _b : process.env;
+    const deploymentId = (_a = env[AGENT_SERVE_DEPLOYMENT_ID_ENV_VAR]) === null || _a === void 0 ? void 0 : _a.trim();
+    if (deploymentId === undefined || deploymentId === "") {
+        return undefined;
+    }
+    const resolved = resolveApiKeySync(args.apiKey === undefined ? undefined : { apiKey: args.apiKey });
+    if (resolved === undefined) {
+        return undefined;
+    }
+    const fromUrl = args.cloudToolsUrl === undefined
+        ? undefined
+        : parseAgentServeMcpGatewayUrl(args.cloudToolsUrl);
+    const slug = args.slug !== undefined && args.slug !== "" ? args.slug : fromUrl === null || fromUrl === void 0 ? void 0 : fromUrl.slug;
+    const teamId = (_c = parseTeamId(args.team)) !== null && _c !== void 0 ? _c : fromUrl === null || fromUrl === void 0 ? void 0 : fromUrl.teamId;
+    if (slug === undefined || teamId === undefined) {
+        return undefined;
+    }
+    return {
+        client: new AgentServeDeployClient({
+            backendUrl: cursorExternalApiUrl(),
+            apiKey: resolved.apiKey,
+        }),
+        teamId,
+        slug,
+    };
+}
+function parseTeamId(team) {
+    if (team === undefined || team === "") {
+        return undefined;
+    }
+    const teamId = Number.parseInt(team, 10);
+    if (!Number.isInteger(teamId) || teamId <= 0) {
+        return undefined;
+    }
+    return teamId;
+}

package/dist/internal/mcp-oauth.d.ts

@@ -95,6 +95,7 @@ export declare function createHostMcpOAuthProvider(args: {
     resourceUrl: string;
     store?: FileMcpOAuthStore;
     onRedirect?: (url: URL) => void;
+    redirectUrl?: string;
 }): Promise<HostMcpOAuthProvider>;
 export type OAuthCallbackResult = {
     code: string;

package/dist/internal/mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAE3E,YAAY,IAAI,EAAE,YAAY,EAc7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgBhC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAE3E,YAAY,IAAI,EAAE,YAAY,EAc7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAYD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqBhC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}