@fastybird/smart-panel-backend 1.0.0-beta.2 → 1.1.0-alpha.0

package/dist/modules/mcp/models/mcp-oauth-management.model.js

@@ -0,0 +1,189 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var McpOAuthGrantModel_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthGlobalRevocationModel = exports.McpOAuthRefreshFamilyModel = exports.McpOAuthAccessTokenModel = exports.McpOAuthGrantModel = void 0;
+const class_transformer_1 = require("class-transformer");
+const swagger_1 = require("@nestjs/swagger");
+const users_constants_1 = require("../../users/users.constants");
+const mcp_constants_1 = require("../mcp.constants");
+const toIsoString = ({ value }) => value instanceof Date ? value.toISOString() : value;
+let McpOAuthGrantModel = McpOAuthGrantModel_1 = class McpOAuthGrantModel {
+    static fromEntity(entity, providerRevokedAt = null, moduleEnabled = true) {
+        const revokedAt = entity.revokedAt ?? (providerRevokedAt === null ? null : new Date(providerRevokedAt));
+        return Object.assign(new McpOAuthGrantModel_1(), {
+            id: entity.id,
+            clientId: entity.clientId,
+            clientName: entity.client?.name ?? 'Unknown client',
+            approvedById: entity.approvedById,
+            approvedScopes: [...entity.approvedScopes],
+            expiresAt: entity.expiresAt,
+            revokedAt,
+            active: McpOAuthGrantModel_1.isActive(entity, providerRevokedAt !== null, moduleEnabled),
+            createdAt: entity.createdAt,
+        });
+    }
+    static isActive(entity, providerRevoked = false, moduleEnabled = true) {
+        return (moduleEnabled &&
+            !providerRevoked &&
+            entity.revokedAt === null &&
+            entity.expiresAt > new Date() &&
+            entity.client?.enabled === true &&
+            entity.approvedBy !== undefined &&
+            entity.approvedBy !== null &&
+            [users_constants_1.UserRole.OWNER, users_constants_1.UserRole.ADMIN].includes(entity.approvedBy.role));
+    }
+};
+exports.McpOAuthGrantModel = McpOAuthGrantModel;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'OAuth grant management identifier', type: 'string', format: 'uuid' }),
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], McpOAuthGrantModel.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'client_id', description: 'Internal OAuth client record identifier', format: 'uuid' }),
+    (0, class_transformer_1.Expose)({ name: 'client_id' }),
+    __metadata("design:type", String)
+], McpOAuthGrantModel.prototype, "clientId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'client_name', description: 'Human-readable OAuth client name' }),
+    (0, class_transformer_1.Expose)({ name: 'client_name' }),
+    __metadata("design:type", String)
+], McpOAuthGrantModel.prototype, "clientName", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ name: 'approved_by_id', type: 'string', format: 'uuid', nullable: true }),
+    (0, class_transformer_1.Expose)({ name: 'approved_by_id' }),
+    __metadata("design:type", String)
+], McpOAuthGrantModel.prototype, "approvedById", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        name: 'approved_scopes',
+        type: 'array',
+        items: { type: 'string', enum: Object.values(mcp_constants_1.McpOAuthScope) },
+    }),
+    (0, class_transformer_1.Expose)({ name: 'approved_scopes' }),
+    __metadata("design:type", Array)
+], McpOAuthGrantModel.prototype, "approvedScopes", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'expires_at', type: 'string', format: 'date-time' }),
+    (0, class_transformer_1.Expose)({ name: 'expires_at' }),
+    (0, class_transformer_1.Transform)(toIsoString, { toPlainOnly: true }),
+    __metadata("design:type", Object)
+], McpOAuthGrantModel.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ name: 'revoked_at', type: 'string', format: 'date-time', nullable: true }),
+    (0, class_transformer_1.Expose)({ name: 'revoked_at' }),
+    (0, class_transformer_1.Transform)(toIsoString, { toPlainOnly: true }),
+    __metadata("design:type", Object)
+], McpOAuthGrantModel.prototype, "revokedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Whether the grant is currently usable', type: 'boolean' }),
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Boolean)
+], McpOAuthGrantModel.prototype, "active", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'created_at', type: 'string', format: 'date-time' }),
+    (0, class_transformer_1.Expose)({ name: 'created_at' }),
+    (0, class_transformer_1.Transform)(toIsoString, { toPlainOnly: true }),
+    __metadata("design:type", Object)
+], McpOAuthGrantModel.prototype, "createdAt", void 0);
+exports.McpOAuthGrantModel = McpOAuthGrantModel = McpOAuthGrantModel_1 = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleDataOAuthGrant' })
+], McpOAuthGrantModel);
+let McpOAuthAccessTokenModel = class McpOAuthAccessTokenModel {
+};
+exports.McpOAuthAccessTokenModel = McpOAuthAccessTokenModel;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Non-secret access-token management identifier', type: 'string', format: 'uuid' }),
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], McpOAuthAccessTokenModel.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'client_id', description: 'Internal OAuth client record identifier', format: 'uuid' }),
+    (0, class_transformer_1.Expose)({ name: 'client_id' }),
+    __metadata("design:type", String)
+], McpOAuthAccessTokenModel.prototype, "clientId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'client_name', description: 'Human-readable OAuth client name' }),
+    (0, class_transformer_1.Expose)({ name: 'client_name' }),
+    __metadata("design:type", String)
+], McpOAuthAccessTokenModel.prototype, "clientName", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'grant_id', description: 'OAuth grant management identifier', format: 'uuid' }),
+    (0, class_transformer_1.Expose)({ name: 'grant_id' }),
+    __metadata("design:type", String)
+], McpOAuthAccessTokenModel.prototype, "grantId", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ name: 'refresh_family_id', type: 'string', format: 'uuid', nullable: true }),
+    (0, class_transformer_1.Expose)({ name: 'refresh_family_id' }),
+    __metadata("design:type", String)
+], McpOAuthAccessTokenModel.prototype, "refreshFamilyId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: 'array', items: { type: 'string', enum: Object.values(mcp_constants_1.McpOAuthScope) } }),
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Array)
+], McpOAuthAccessTokenModel.prototype, "scopes", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'expires_at', type: 'string', format: 'date-time' }),
+    (0, class_transformer_1.Expose)({ name: 'expires_at' }),
+    __metadata("design:type", String)
+], McpOAuthAccessTokenModel.prototype, "expiresAt", void 0);
+exports.McpOAuthAccessTokenModel = McpOAuthAccessTokenModel = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleDataOAuthAccessToken' })
+], McpOAuthAccessTokenModel);
+let McpOAuthRefreshFamilyModel = class McpOAuthRefreshFamilyModel {
+};
+exports.McpOAuthRefreshFamilyModel = McpOAuthRefreshFamilyModel;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Non-secret refresh-family management identifier', type: 'string', format: 'uuid' }),
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", String)
+], McpOAuthRefreshFamilyModel.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'client_id', description: 'Internal OAuth client record identifier', format: 'uuid' }),
+    (0, class_transformer_1.Expose)({ name: 'client_id' }),
+    __metadata("design:type", String)
+], McpOAuthRefreshFamilyModel.prototype, "clientId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'client_name', description: 'Human-readable OAuth client name' }),
+    (0, class_transformer_1.Expose)({ name: 'client_name' }),
+    __metadata("design:type", String)
+], McpOAuthRefreshFamilyModel.prototype, "clientName", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'grant_id', description: 'OAuth grant management identifier', format: 'uuid' }),
+    (0, class_transformer_1.Expose)({ name: 'grant_id' }),
+    __metadata("design:type", String)
+], McpOAuthRefreshFamilyModel.prototype, "grantId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'expires_at', type: 'string', format: 'date-time' }),
+    (0, class_transformer_1.Expose)({ name: 'expires_at' }),
+    __metadata("design:type", String)
+], McpOAuthRefreshFamilyModel.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ name: 'active_token_count', type: 'integer', minimum: 0 }),
+    (0, class_transformer_1.Expose)({ name: 'active_token_count' }),
+    __metadata("design:type", Number)
+], McpOAuthRefreshFamilyModel.prototype, "activeTokenCount", void 0);
+exports.McpOAuthRefreshFamilyModel = McpOAuthRefreshFamilyModel = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleDataOAuthRefreshFamily' })
+], McpOAuthRefreshFamilyModel);
+let McpOAuthGlobalRevocationModel = class McpOAuthGlobalRevocationModel {
+};
+exports.McpOAuthGlobalRevocationModel = McpOAuthGlobalRevocationModel;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Whether all MCP OAuth authorization was revoked', type: 'boolean', example: true }),
+    (0, class_transformer_1.Expose)(),
+    __metadata("design:type", Boolean)
+], McpOAuthGlobalRevocationModel.prototype, "revoked", void 0);
+exports.McpOAuthGlobalRevocationModel = McpOAuthGlobalRevocationModel = __decorate([
+    (0, swagger_1.ApiSchema)({ name: 'McpModuleDataOAuthGlobalRevocation' })
+], McpOAuthGlobalRevocationModel);
+//# sourceMappingURL=mcp-oauth-management.model.js.map

package/dist/modules/mcp/models/mcp-oauth-management.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-management.model.js","sourceRoot":"","sources":["../../../../src/modules/mcp/models/mcp-oauth-management.model.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,yDAAsD;AAEtD,6CAA8E;AAE9E,iEAAuD;AAEvD,oDAAiD;AAEjD,MAAM,WAAW,GAAG,CAAC,EAAE,KAAK,EAAmC,EAAiB,EAAE,CACjF,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAG9C,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IA4C9B,MAAM,CAAC,UAAU,CAChB,MAA2B,EAC3B,oBAAmC,IAAI,EACvC,aAAa,GAAG,IAAI;QAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAExG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,oBAAkB,EAAE,EAAE;YAC9C,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,gBAAgB;YACnD,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS;YACT,MAAM,EAAE,oBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,EAAE,aAAa,CAAC;YACtF,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,MAA2B,EAAE,eAAe,GAAG,KAAK,EAAE,aAAa,GAAG,IAAI;QACzF,OAAO,CACN,aAAa;YACb,CAAC,eAAe;YAChB,MAAM,CAAC,SAAS,KAAK,IAAI;YACzB,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;YAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YAC/B,MAAM,CAAC,UAAU,KAAK,SAAS;YAC/B,MAAM,CAAC,UAAU,KAAK,IAAI;YAC1B,CAAC,0BAAQ,CAAC,KAAK,EAAE,0BAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CACjE,CAAC;IACH,CAAC;CACD,CAAA;AA5EY,gDAAkB;AAG9B;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjG,IAAA,0BAAM,GAAE;;8CACE;AAIX;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,yCAAyC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;oDACb;AAIjB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IACrF,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;sDACb;AAInB;IAFC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/F,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;;wDACP;AAQ5B;IANC,IAAA,qBAAW,EAAC;QACZ,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,EAAE;KAC7D,CAAC;IACD,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;0DACJ;AAKhC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9B,IAAA,6BAAS,EAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;;qDACrB;AAKzB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChG,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9B,IAAA,6BAAS,EAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;;qDACd;AAIhC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,uCAAuC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtF,IAAA,0BAAM,GAAE;;kDACO;AAKhB;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9B,IAAA,6BAAS,EAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;;qDACrB;6BA1Cb,kBAAkB;IAD9B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;GAClC,kBAAkB,CA4E9B;AAGM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;CA4BpC,CAAA;AA5BY,4DAAwB;AAGpC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC7G,IAAA,0BAAM,GAAE;;oDACE;AAIX;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,yCAAyC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;0DACb;AAIjB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IACrF,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;4DACb;AAInB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnG,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;;yDACb;AAIhB;IAFC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClG,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;;iEACP;AAI/B;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,EAAE,EAAE,CAAC;IAC7F,IAAA,0BAAM,GAAE;;wDACe;AAIxB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;2DACb;mCA3BN,wBAAwB;IADpC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;GACxC,wBAAwB,CA4BpC;AAGM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;CAwBtC,CAAA;AAxBY,gEAA0B;AAGtC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,iDAAiD,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/G,IAAA,0BAAM,GAAE;;sDACE;AAIX;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,yCAAyC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;4DACb;AAIjB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IACrF,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;8DACb;AAInB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnG,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;;2DACb;AAIhB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;6DACb;AAIlB;IAFC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACxE,IAAA,0BAAM,EAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;;oEACd;qCAvBb,0BAA0B;IADtC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;GAC1C,0BAA0B,CAwBtC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAIzC,CAAA;AAJY,sEAA6B;AAGzC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,iDAAiD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/G,IAAA,0BAAM,GAAE;;8DACQ;wCAHL,6BAA6B;IADzC,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC;GAC7C,6BAA6B,CAIzC"}

package/dist/modules/mcp/oauth/mcp-oauth-metadata.d.ts

@@ -0,0 +1,15 @@
+import { AuthorizationServerMetadata } from '@modelcontextprotocol/server';
+import { McpOAuthPublicUrls } from './mcp-oauth.types';
+export type McpOAuthAuthorizationServerMetadata = AuthorizationServerMetadata & {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    revocation_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    scopes_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    authorization_response_iss_parameter_supported: boolean;
+};
+export declare const buildMcpOAuthAuthorizationServerMetadata: (urls: McpOAuthPublicUrls) => McpOAuthAuthorizationServerMetadata;

package/dist/modules/mcp/oauth/mcp-oauth-metadata.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildMcpOAuthAuthorizationServerMetadata = void 0;
+const mcp_constants_1 = require("../mcp.constants");
+const buildMcpOAuthAuthorizationServerMetadata = (urls) => ({
+    issuer: urls.issuer,
+    authorization_endpoint: urls.authorizationEndpoint,
+    token_endpoint: urls.tokenEndpoint,
+    revocation_endpoint: urls.revocationEndpoint,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    code_challenge_methods_supported: ['S256'],
+    scopes_supported: Object.values(mcp_constants_1.McpOAuthScope),
+    token_endpoint_auth_methods_supported: ['none'],
+    authorization_response_iss_parameter_supported: true,
+});
+exports.buildMcpOAuthAuthorizationServerMetadata = buildMcpOAuthAuthorizationServerMetadata;
+//# sourceMappingURL=mcp-oauth-metadata.js.map

package/dist/modules/mcp/oauth/mcp-oauth-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-metadata.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth-metadata.ts"],"names":[],"mappings":";;;AAEA,oDAAiD;AAiB1C,MAAM,wCAAwC,GAAG,CACvD,IAAwB,EACc,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,sBAAsB,EAAE,IAAI,CAAC,qBAAqB;IAClD,cAAc,EAAE,IAAI,CAAC,aAAa;IAClC,mBAAmB,EAAE,IAAI,CAAC,kBAAkB;IAC5C,wBAAwB,EAAE,CAAC,MAAM,CAAC;IAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;IAC1C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC;IAC9C,qCAAqC,EAAE,CAAC,MAAM,CAAC;IAC/C,8CAA8C,EAAE,IAAI;CACpD,CAAC,CAAC;AAbU,QAAA,wCAAwC,4CAalD"}

package/dist/modules/mcp/oauth/mcp-oauth-provider.adapter.d.ts

@@ -0,0 +1,21 @@
+import type { AdapterConstructor } from 'oidc-provider';
+import { DataSource } from 'typeorm';
+import { McpOAuthClientService } from '../services/mcp-oauth-client.service';
+export interface McpOAuthProviderAdapterOptions {
+    allowTestInMemory?: boolean;
+    artifactReuseError?: () => Error;
+    artifactLifecycleHook?: (context: McpOAuthProviderArtifactLifecycleContext) => Promise<void>;
+    beforeArtifactUpsert?: (context: {
+        model: string;
+        refreshFamilyId: string | null;
+    }) => Promise<void>;
+}
+export type McpOAuthProviderArtifactLifecycleContext = {
+    phase: 'before-consume' | 'before-consume-transaction';
+    model: string;
+} | {
+    phase: 'after-upsert';
+    model: string;
+    refreshFamilyId: string | null;
+};
+export declare const createMcpOAuthProviderAdapter: (dataSource: DataSource, clientsService: McpOAuthClientService, options?: McpOAuthProviderAdapterOptions) => AdapterConstructor;

package/dist/modules/mcp/oauth/mcp-oauth-provider.adapter.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpOAuthProviderAdapter = void 0;
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const token_utils_1 = require("../../auth/utils/token.utils");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const isInMemoryDataSource = (dataSource) => 'database' in dataSource.options && dataSource.options.database === ':memory:';
+const HASH_ONLY_BEARER_MODELS = new Set(['AuthorizationCode', 'AccessToken', 'RefreshToken']);
+const EMPTY_AUTHORIZATION_SNAPSHOT = {
+    oauthEnabledGeneration: null,
+    serverSecretVersion: null,
+    publicIdentityGeneration: null,
+    clientGeneration: null,
+    grantGeneration: null,
+    modulePolicyGeneration: null,
+    approverAuthorityGeneration: null,
+};
+const serializePayload = (model, payload) => {
+    if (!HASH_ONLY_BEARER_MODELS.has(model))
+        return JSON.stringify(payload);
+    const safePayload = { ...payload };
+    delete safePayload.jti;
+    return JSON.stringify(safePayload);
+};
+const readPayload = (record, presentedId) => ({
+    ...JSON.parse(record.payload),
+    ...(presentedId === undefined ? {} : { jti: presentedId }),
+    ...(record.consumedAt === null ? {} : { consumed: record.consumedAt }),
+});
+const createMcpOAuthProviderAdapter = (dataSource, clientsService, options = {}) => {
+    if (isInMemoryDataSource(dataSource) && (process.env.NODE_ENV !== 'test' || options.allowTestInMemory !== true)) {
+        throw new Error('The MCP OAuth provider adapter permits in-memory persistence only in explicit test setups');
+    }
+    let consumeQueue = Promise.resolve();
+    return class McpOAuthTypeOrmAdapter {
+        constructor(model) {
+            this.model = model;
+        }
+        async upsert(id, payload, expiresIn) {
+            if (this.model === 'Client') {
+                throw new Error('MCP OAuth clients may be created only through the owner/admin pre-registration API');
+            }
+            const grantIdHash = typeof payload.grantId === 'string' ? (0, token_utils_1.hashToken)(payload.grantId) : null;
+            if (grantIdHash !== null && (await this.isGrantRevoked(grantIdHash))) {
+                throw this.artifactReuseError();
+            }
+            const repository = dataSource.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity);
+            const idHash = (0, token_utils_1.hashToken)(id);
+            const existing = await repository.findOneBy({ model: this.model, idHash });
+            const refreshFamilyId = await this.resolveRefreshFamilyId(repository, existing, grantIdHash, payload);
+            const authorizationSnapshot = HASH_ONLY_BEARER_MODELS.has(this.model)
+                ? await this.resolveAuthorizationSnapshot(grantIdHash)
+                : EMPTY_AUTHORIZATION_SNAPSHOT;
+            if ((HASH_ONLY_BEARER_MODELS.has(this.model) && authorizationSnapshot === null) ||
+                (refreshFamilyId !== null && (await this.isRefreshFamilyRevoked(refreshFamilyId)))) {
+                throw this.artifactReuseError();
+            }
+            await options.beforeArtifactUpsert?.({ model: this.model, refreshFamilyId });
+            await repository.upsert({
+                model: this.model,
+                idHash,
+                managementId: existing?.managementId ?? (0, node_crypto_1.randomUUID)(),
+                payload: serializePayload(this.model, payload),
+                grantIdHash,
+                refreshFamilyId,
+                userCodeHash: typeof payload.userCode === 'string' ? (0, token_utils_1.hashToken)(payload.userCode) : null,
+                uidHash: typeof payload.uid === 'string' ? (0, token_utils_1.hashToken)(payload.uid) : null,
+                consumedAt: null,
+                expiresAt: expiresIn === undefined ? null : Date.now() + expiresIn * 1_000,
+                ...(authorizationSnapshot ?? EMPTY_AUTHORIZATION_SNAPSHOT),
+            }, ['model', 'idHash']);
+            await options.artifactLifecycleHook?.({ phase: 'after-upsert', model: this.model, refreshFamilyId });
+            if (this.model === 'RefreshToken' && grantIdHash && refreshFamilyId) {
+                await repository.update({ model: 'AccessToken', grantIdHash, refreshFamilyId: (0, typeorm_1.IsNull)() }, { refreshFamilyId });
+            }
+            const [grantRevoked, refreshFamilyRevoked] = await Promise.all([
+                grantIdHash === null ? false : this.isGrantRevoked(grantIdHash),
+                refreshFamilyId === null ? false : this.isRefreshFamilyRevoked(refreshFamilyId),
+            ]);
+            if (grantRevoked || refreshFamilyRevoked) {
+                await repository.delete(refreshFamilyRevoked && refreshFamilyId !== null
+                    ? { refreshFamilyId }
+                    : { model: this.model, idHash: (0, token_utils_1.hashToken)(id) });
+                throw this.artifactReuseError();
+            }
+        }
+        async find(id) {
+            if (this.model === 'Client') {
+                return this.findClient(id);
+            }
+            await this.removeExpired();
+            const record = await dataSource
+                .getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)
+                .findOneBy({ model: this.model, idHash: (0, token_utils_1.hashToken)(id) });
+            return this.readActiveRecord(record, id);
+        }
+        async findByUserCode(userCode) {
+            await this.removeExpired();
+            const record = await dataSource
+                .getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)
+                .findOneBy({ model: this.model, userCodeHash: (0, token_utils_1.hashToken)(userCode) });
+            return this.readActiveRecord(record);
+        }
+        async findByUid(uid) {
+            await this.removeExpired();
+            const record = await dataSource
+                .getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)
+                .findOneBy({ model: this.model, uidHash: (0, token_utils_1.hashToken)(uid) });
+            return this.readActiveRecord(record);
+        }
+        async consume(id) {
+            await options.artifactLifecycleHook?.({ phase: 'before-consume', model: this.model });
+            const release = await this.acquireConsumeQueue();
+            try {
+                await options.artifactLifecycleHook?.({ phase: 'before-consume-transaction', model: this.model });
+                let reuseDetected = false;
+                await dataSource.transaction(async (manager) => {
+                    const repository = manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity);
+                    const idHash = (0, token_utils_1.hashToken)(id);
+                    const result = await repository.update({ model: this.model, idHash, consumedAt: (0, typeorm_1.IsNull)() }, { consumedAt: Date.now() });
+                    if (result.affected === 1) {
+                        return;
+                    }
+                    const reused = await repository.findOneBy({ model: this.model, idHash });
+                    if (this.model === 'RefreshToken' && reused?.grantIdHash) {
+                        await this.revokeGrant(reused.grantIdHash, manager);
+                    }
+                    reuseDetected = true;
+                });
+                if (reuseDetected)
+                    throw this.artifactReuseError();
+            }
+            finally {
+                release();
+            }
+        }
+        async destroy(id) {
+            if (this.model === 'Client')
+                return;
+            await dataSource
+                .getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)
+                .delete({ model: this.model, idHash: (0, token_utils_1.hashToken)(id) });
+        }
+        async revokeByGrantId(grantId) {
+            const grantIdHash = (0, token_utils_1.hashToken)(grantId);
+            if (this.model === 'RefreshToken') {
+                await dataSource.transaction((manager) => this.revokeGrant(grantIdHash, manager));
+                return;
+            }
+            await dataSource.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity).delete({ model: this.model, grantIdHash });
+        }
+        async findClient(clientIdentifier) {
+            const client = await clientsService.findActiveByIdentifier(clientIdentifier);
+            if (!client)
+                return undefined;
+            return {
+                client_id: client.clientIdentifier,
+                client_name: client.name,
+                application_type: 'native',
+                redirect_uris: [...client.redirectUris],
+                response_types: ['code'],
+                grant_types: ['authorization_code', 'refresh_token'],
+                token_endpoint_auth_method: 'none',
+            };
+        }
+        artifactReuseError() {
+            return options.artifactReuseError?.() ?? new Error(`OAuth artifact ${this.model} was already consumed`);
+        }
+        async resolveRefreshFamilyId(repository, existing, grantIdHash, payload) {
+            if (existing?.refreshFamilyId)
+                return existing.refreshFamilyId;
+            if (!grantIdHash || (this.model !== 'AccessToken' && this.model !== 'RefreshToken'))
+                return null;
+            const lineageRepository = repository.manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderRefreshFamilyLineageEntity);
+            const lineage = await lineageRepository.findOneBy({ grantIdHash });
+            if (this.model === 'AccessToken' && !this.isRefreshTokenGrant(payload))
+                return null;
+            if (this.model === 'RefreshToken' && !this.isRefreshTokenRotation(payload)) {
+                const refreshFamilyId = (0, node_crypto_1.randomUUID)();
+                await lineageRepository.upsert({ grantIdHash, refreshFamilyId }, ['grantIdHash']);
+                return refreshFamilyId;
+            }
+            const refreshFamilyId = lineage?.refreshFamilyId ?? (await this.findPersistedRefreshFamilyId(repository, grantIdHash));
+            if (!refreshFamilyId)
+                throw this.artifactReuseError();
+            if (!lineage) {
+                await lineageRepository.upsert({ grantIdHash, refreshFamilyId }, ['grantIdHash']);
+            }
+            return refreshFamilyId;
+        }
+        async findPersistedRefreshFamilyId(repository, grantIdHash) {
+            const familyArtifact = await repository.findOne({
+                where: { model: 'RefreshToken', grantIdHash, refreshFamilyId: (0, typeorm_1.Not)((0, typeorm_1.IsNull)()) },
+            });
+            return familyArtifact?.refreshFamilyId ?? null;
+        }
+        isRefreshTokenGrant(payload) {
+            return typeof payload.gty === 'string' && payload.gty.split(' ').includes('refresh_token');
+        }
+        isRefreshTokenRotation(payload) {
+            return typeof payload.rotations === 'number' && payload.rotations > 0;
+        }
+        async readActiveRecord(record, presentedId) {
+            if (!record)
+                return undefined;
+            if (HASH_ONLY_BEARER_MODELS.has(record.model)) {
+                const snapshot = await this.resolveAuthorizationSnapshot(record.grantIdHash);
+                if (!snapshot || !this.sameAuthorizationSnapshot(record, snapshot))
+                    return undefined;
+            }
+            const [grantRevoked, refreshFamilyRevoked] = await Promise.all([
+                record.grantIdHash === null ? false : this.isGrantRevoked(record.grantIdHash),
+                record.refreshFamilyId === null ? false : this.isRefreshFamilyRevoked(record.refreshFamilyId),
+            ]);
+            if (grantRevoked || refreshFamilyRevoked) {
+                await dataSource
+                    .getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)
+                    .delete(refreshFamilyRevoked && record.refreshFamilyId !== null
+                    ? { refreshFamilyId: record.refreshFamilyId }
+                    : { model: record.model, idHash: record.idHash });
+                return undefined;
+            }
+            return readPayload(record, presentedId);
+        }
+        async resolveAuthorizationSnapshot(grantIdHash) {
+            if (!grantIdHash)
+                return null;
+            const [grant, serverState] = await Promise.all([
+                dataSource.getRepository(mcp_oauth_entity_1.McpOAuthGrantEntity).findOne({
+                    where: { providerGrantIdHash: grantIdHash },
+                    relations: { client: true },
+                }),
+                dataSource.getRepository(mcp_oauth_entity_1.McpOAuthServerStateEntity).findOneBy({ key: mcp_constants_1.MCP_OAUTH_SERVER_STATE_KEY }),
+            ]);
+            if (!grant?.client || !grant.approvedById || !serverState)
+                return null;
+            const approverAuthority = await dataSource
+                .getRepository(mcp_oauth_entity_1.McpOAuthApproverAuthorityEntity)
+                .findOneBy({ approverId: grant.approvedById });
+            const approverAuthorityGeneration = approverAuthority?.generation ?? 0;
+            if (!grant.client.enabled ||
+                grant.revokedAt !== null ||
+                grant.expiresAt <= new Date() ||
+                grant.oauthEnabledGeneration !== serverState.oauthEnabledGeneration ||
+                grant.serverSecretVersion !== serverState.serverSecretVersion ||
+                grant.publicIdentityGeneration !== serverState.publicIdentityGeneration ||
+                grant.clientGeneration !== grant.client.generation ||
+                grant.modulePolicyGeneration !== serverState.modulePolicyGeneration ||
+                grant.approverAuthorityGeneration !== approverAuthorityGeneration) {
+                return null;
+            }
+            return {
+                oauthEnabledGeneration: serverState.oauthEnabledGeneration,
+                serverSecretVersion: serverState.serverSecretVersion,
+                publicIdentityGeneration: serverState.publicIdentityGeneration,
+                clientGeneration: grant.client.generation,
+                grantGeneration: grant.generation,
+                modulePolicyGeneration: serverState.modulePolicyGeneration,
+                approverAuthorityGeneration,
+            };
+        }
+        sameAuthorizationSnapshot(record, snapshot) {
+            return Object.keys(snapshot).every((key) => record[key] === snapshot[key]);
+        }
+        async isGrantRevoked(grantIdHash) {
+            return dataSource.getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity).existsBy({ grantIdHash });
+        }
+        async isRefreshFamilyRevoked(refreshFamilyId) {
+            return dataSource.getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedRefreshFamilyEntity).existsBy({ refreshFamilyId });
+        }
+        async revokeGrant(grantIdHash, manager = dataSource.manager) {
+            await manager
+                .getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity)
+                .upsert({ grantIdHash, revokedAt: Date.now() }, ['grantIdHash']);
+            await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity).delete({ grantIdHash });
+        }
+        async removeExpired() {
+            await dataSource.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity).delete({
+                model: this.model,
+                expiresAt: (0, typeorm_1.LessThanOrEqual)(Date.now()),
+            });
+        }
+        async acquireConsumeQueue() {
+            let release;
+            const previous = consumeQueue;
+            consumeQueue = new Promise((resolve) => {
+                release = resolve;
+            });
+            await previous;
+            return release;
+        }
+    };
+};
+exports.createMcpOAuthProviderAdapter = createMcpOAuthProviderAdapter;
+//# sourceMappingURL=mcp-oauth-provider.adapter.js.map

package/dist/modules/mcp/oauth/mcp-oauth-provider.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-provider.adapter.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth-provider.adapter.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAEzC,qCAA+E;AAE/E,8DAAyD;AACzD,mEAQsC;AACtC,oDAA8D;AAc9D,MAAM,oBAAoB,GAAG,CAAC,UAAsB,EAAW,EAAE,CAChE,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAEhF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAa9F,MAAM,4BAA4B,GAAkC;IACnE,sBAAsB,EAAE,IAAI;IAC5B,mBAAmB,EAAE,IAAI;IACzB,wBAAwB,EAAE,IAAI;IAC9B,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,sBAAsB,EAAE,IAAI;IAC5B,2BAA2B,EAAE,IAAI;CACjC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,OAAuB,EAAU,EAAE;IAC3E,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAExE,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACnC,OAAO,WAAW,CAAC,GAAG,CAAC;IAEvB,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAsC,EAAE,WAAoB,EAAkB,EAAE,CAAC,CAAC;IACtG,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAoB;IACjD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC1D,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;CACtE,CAAC,CAAC;AAEI,MAAM,6BAA6B,GAAG,CAC5C,UAAsB,EACtB,cAAqC,EACrC,UAA0C,EAAE,EACvB,EAAE;IACvB,IAAI,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC9G,CAAC;IAED,IAAI,YAAY,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEpD,OAAO,MAAM,sBAAsB;QAClC,YAA6B,KAAa;YAAb,UAAK,GAAL,KAAK,CAAQ;QAAG,CAAC;QAE9C,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAkB;YACnE,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACvG,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,uBAAS,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE5F,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,CAAC;YAED,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACtG,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpE,CAAC,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,CAAC;gBACtD,CAAC,CAAC,4BAA4B,CAAC;YAEhC,IACC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,qBAAqB,KAAK,IAAI,CAAC;gBAC3E,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC,EACjF,CAAC;gBACF,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,CAAC;YAED,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC7E,MAAM,UAAU,CAAC,MAAM,CACtB;gBACC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAA,wBAAU,GAAE;gBACpD,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;gBAC9C,WAAW;gBACX,eAAe;gBACf,YAAY,EAAE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,uBAAS,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACvF,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,uBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;gBACxE,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK;gBAC1E,GAAG,CAAC,qBAAqB,IAAI,4BAA4B,CAAC;aAC1D,EACD,CAAC,OAAO,EAAE,QAAQ,CAAC,CACnB,CAAC;YACF,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAErG,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9D,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;gBAC/D,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC;aAC/E,CAAC,CAAC;YAEH,IAAI,YAAY,IAAI,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,MAAM,CACtB,oBAAoB,IAAI,eAAe,KAAK,IAAI;oBAC/C,CAAC,CAAC,EAAE,eAAe,EAAE;oBACrB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAA,uBAAS,EAAC,EAAE,CAAC,EAAE,CAC/C,CAAC;gBACF,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACF,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAU;YACpB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;YAED,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU;iBAC7B,aAAa,CAAC,iDAA8B,CAAC;iBAC7C,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAA,uBAAS,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAE1D,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAgB;YACpC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU;iBAC7B,aAAa,CAAC,iDAA8B,CAAC;iBAC7C,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAA,uBAAS,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAEtE,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAW;YAC1B,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,UAAU;iBAC7B,aAAa,CAAC,iDAA8B,CAAC;iBAC7C,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAA,uBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAE5D,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAU;YACvB,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAEjD,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClG,IAAI,aAAa,GAAG,KAAK,CAAC;gBAE1B,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;oBAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC;oBACzE,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,EAAE,CAAC,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACrC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EACnD,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAC1B,CAAC;oBAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;wBAC3B,OAAO;oBACR,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAEzE,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;wBAC1D,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;oBACrD,CAAC;oBACD,aAAa,GAAG,IAAI,CAAC;gBACtB,CAAC,CAAC,CAAC;gBAEH,IAAI,aAAa;oBAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACpD,CAAC;oBAAS,CAAC;gBACV,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAU;YACvB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO;YAEpC,MAAM,UAAU;iBACd,aAAa,CAAC,iDAA8B,CAAC;iBAC7C,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAA,uBAAS,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,OAAe;YACpC,MAAM,WAAW,GAAG,IAAA,uBAAS,EAAC,OAAO,CAAC,CAAC;YAEvC,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;gBACnC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClF,OAAO;YACR,CAAC;YAED,MAAM,UAAU,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3G,CAAC;QAEO,KAAK,CAAC,UAAU,CAAC,gBAAwB;YAChD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;YAE7E,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAE9B,OAAO;gBACN,SAAS,EAAE,MAAM,CAAC,gBAAgB;gBAClC,WAAW,EAAE,MAAM,CAAC,IAAI;gBACxB,gBAAgB,EAAE,QAAQ;gBAC1B,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;gBACvC,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,0BAA0B,EAAE,MAAM;aAClC,CAAC;QACH,CAAC;QAEO,kBAAkB;YACzB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,IAAI,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAEO,KAAK,CAAC,sBAAsB,CACnC,UAAsD,EACtD,QAA+C,EAC/C,WAA0B,EAC1B,OAAuB;YAEvB,IAAI,QAAQ,EAAE,eAAe;gBAAE,OAAO,QAAQ,CAAC,eAAe,CAAC;YAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEjG,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,6DAA0C,CAAC,CAAC;YACvG,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;YAEnE,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEpF,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5E,MAAM,eAAe,GAAG,IAAA,wBAAU,GAAE,CAAC;gBACrC,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;gBAElF,OAAO,eAAe,CAAC;YACxB,CAAC;YAED,MAAM,eAAe,GACpB,OAAO,EAAE,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;YAEhG,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAEtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,eAAe,CAAC;QACxB,CAAC;QAEO,KAAK,CAAC,4BAA4B,CACzC,UAAsD,EACtD,WAAmB;YAEnB,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,IAAA,aAAG,EAAC,IAAA,gBAAM,GAAE,CAAC,EAAE;aAC7E,CAAC,CAAC;YAEH,OAAO,cAAc,EAAE,eAAe,IAAI,IAAI,CAAC;QAChD,CAAC;QAEO,mBAAmB,CAAC,OAAuB;YAClD,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC5F,CAAC;QAEO,sBAAsB,CAAC,OAAuB;YACrD,OAAO,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACvE,CAAC;QAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA6C,EAC7C,WAAoB;YAEpB,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAE7E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAAE,OAAO,SAAS,CAAC;YACtF,CAAC;YAED,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9D,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC7E,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,eAAe,CAAC;aAC7F,CAAC,CAAC;YAEH,IAAI,YAAY,IAAI,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,UAAU;qBACd,aAAa,CAAC,iDAA8B,CAAC;qBAC7C,MAAM,CACN,oBAAoB,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI;oBACtD,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;oBAC7C,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CACjD,CAAC;gBACH,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,OAAO,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzC,CAAC;QAEO,KAAK,CAAC,4BAA4B,CACzC,WAA0B;YAE1B,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,UAAU,CAAC,aAAa,CAAC,sCAAmB,CAAC,CAAC,OAAO,CAAC;oBACrD,KAAK,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE;oBAC3C,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBAC3B,CAAC;gBACF,UAAU,CAAC,aAAa,CAAC,4CAAyB,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,0CAA0B,EAAE,CAAC;aAClG,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAEvE,MAAM,iBAAiB,GAAG,MAAM,UAAU;iBACxC,aAAa,CAAC,kDAA+B,CAAC;iBAC9C,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAChD,MAAM,2BAA2B,GAAG,iBAAiB,EAAE,UAAU,IAAI,CAAC,CAAC;YAEvE,IACC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gBACrB,KAAK,CAAC,SAAS,KAAK,IAAI;gBACxB,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE;gBAC7B,KAAK,CAAC,sBAAsB,KAAK,WAAW,CAAC,sBAAsB;gBACnE,KAAK,CAAC,mBAAmB,KAAK,WAAW,CAAC,mBAAmB;gBAC7D,KAAK,CAAC,wBAAwB,KAAK,WAAW,CAAC,wBAAwB;gBACvE,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU;gBAClD,KAAK,CAAC,sBAAsB,KAAK,WAAW,CAAC,sBAAsB;gBACnE,KAAK,CAAC,2BAA2B,KAAK,2BAA2B,EAChE,CAAC;gBACF,OAAO,IAAI,CAAC;YACb,CAAC;YAED,OAAO;gBACN,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;gBAC1D,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;gBACpD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;gBAC9D,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;gBACzC,eAAe,EAAE,KAAK,CAAC,UAAU;gBACjC,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;gBAC1D,2BAA2B;aAC3B,CAAC;QACH,CAAC;QAEO,yBAAyB,CAChC,MAAsC,EACtC,QAAuC;YAEvC,OAAQ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAgD,CAAC,KAAK,CACjF,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CACtC,CAAC;QACH,CAAC;QAEO,KAAK,CAAC,cAAc,CAAC,WAAmB;YAC/C,OAAO,UAAU,CAAC,aAAa,CAAC,qDAAkC,CAAC,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QAEO,KAAK,CAAC,sBAAsB,CAAC,eAAuB;YAC3D,OAAO,UAAU,CAAC,aAAa,CAAC,6DAA0C,CAAC,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3G,CAAC;QAEO,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,OAAO,GAAG,UAAU,CAAC,OAAO;YAC1E,MAAM,OAAO;iBACX,aAAa,CAAC,qDAAkC,CAAC;iBACjD,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,CAAC;QAEO,KAAK,CAAC,aAAa;YAC1B,MAAM,UAAU,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC,MAAM,CAAC;gBACrE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAA,yBAAe,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;QAEO,KAAK,CAAC,mBAAmB;YAChC,IAAI,OAAmB,CAAC;YACxB,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC9B,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5C,OAAO,GAAG,OAAO,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,MAAM,QAAQ,CAAC;YAEf,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;AACH,CAAC,CAAC;AA/VW,QAAA,6BAA6B,iCA+VxC"}

package/dist/modules/mcp/oauth/mcp-oauth-provider.factory.d.ts

@@ -0,0 +1,49 @@
+import { RequestListener } from 'node:http';
+import type Provider from 'oidc-provider';
+import type { JWK } from 'oidc-provider';
+import { DataSource } from 'typeorm';
+import { McpOAuthClientService } from '../services/mcp-oauth-client.service';
+import { McpOAuthEndpointRateLimitService } from '../services/mcp-oauth-endpoint-rate-limit.service';
+import { McpOAuthProviderMaterialService } from '../services/mcp-oauth-provider-material.service';
+import { McpOAuthPublicUrlService } from '../services/mcp-oauth-public-url.service';
+import { McpOAuthRouteGateService } from '../services/mcp-oauth-route-gate.service';
+import { McpSubscriptionRegistryService } from '../services/mcp-subscription-registry.service';
+import { McpOAuthAuthorizationServerMetadata } from './mcp-oauth-metadata';
+import { type McpOAuthProviderAdapterOptions } from './mcp-oauth-provider.adapter';
+import { McpOAuthPublicUrls } from './mcp-oauth.types';
+export interface McpOAuthProviderRuntime {
+    provider: Provider;
+    callback: RequestListener;
+    urls: McpOAuthPublicUrls;
+    metadata: McpOAuthAuthorizationServerMetadata;
+}
+export interface McpOAuthProviderFactoryOptions {
+    allowTestInMemory?: boolean;
+    allowInsecureTestCookies?: boolean;
+    artifactLifecycleHook?: McpOAuthProviderAdapterOptions['artifactLifecycleHook'];
+    beforeArtifactUpsert?: McpOAuthProviderAdapterOptions['beforeArtifactUpsert'];
+    cookieKeys?: string[];
+    interactionUrl?: (uid: string) => string;
+    jwks?: {
+        keys: JWK[];
+    };
+}
+export declare class McpOAuthProviderFactory {
+    private readonly dataSource;
+    private readonly clientsService;
+    private readonly publicUrlService;
+    private readonly providerMaterial;
+    private readonly subscriptions;
+    private readonly endpointRateLimit;
+    private readonly routeGate;
+    constructor(dataSource: DataSource, clientsService: McpOAuthClientService, publicUrlService: McpOAuthPublicUrlService, providerMaterial: McpOAuthProviderMaterialService, subscriptions: McpSubscriptionRegistryService, endpointRateLimit: McpOAuthEndpointRateLimitService, routeGate: McpOAuthRouteGateService);
+    create(options?: McpOAuthProviderFactoryOptions): Promise<McpOAuthProviderRuntime>;
+    assertTokenRequestResource(parameters: URLSearchParams): void;
+    private dispatchProviderRequest;
+    private ensureOfflineAccessConsentPrompt;
+    private isDisconnected;
+    private readRequestBody;
+    private writeBoundaryError;
+    private getRateLimitedEndpoint;
+    private writeRateLimitError;
+}