@fastybird/smart-panel-backend 1.0.0-beta.3 → 1.1.0-alpha.0

package/dist/modules/mcp/services/mcp-oauth-management.service.js

@@ -0,0 +1,381 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthManagementService = void 0;
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const typeorm_2 = require("@nestjs/typeorm");
+const config_service_1 = require("../../config/services/config.service");
+const mcp_oauth_entity_1 = require("../entities/mcp-oauth.entity");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_client_model_1 = require("../models/mcp-oauth-client.model");
+const mcp_oauth_management_model_1 = require("../models/mcp-oauth-management.model");
+const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_oauth_client_service_1 = require("./mcp-oauth-client.service");
+const mcp_oauth_global_invalidation_service_1 = require("./mcp-oauth-global-invalidation.service");
+const mcp_subscription_registry_service_1 = require("./mcp-subscription-registry.service");
+let McpOAuthManagementService = class McpOAuthManagementService {
+    constructor(grants, artifacts, dataSource, configService, clientsService, subscriptions, globalInvalidation, auditService) {
+        this.grants = grants;
+        this.artifacts = artifacts;
+        this.dataSource = dataSource;
+        this.configService = configService;
+        this.clientsService = clientsService;
+        this.subscriptions = subscriptions;
+        this.globalInvalidation = globalInvalidation;
+        this.auditService = auditService;
+    }
+    async findGrants() {
+        const grants = await this.grants.find({
+            relations: { approvedBy: true, client: true },
+            order: { createdAt: 'DESC' },
+        });
+        const providerRevocations = await this.getProviderRevocations(grants);
+        const moduleEnabled = this.isModuleEnabled();
+        return grants.map((grant) => mcp_oauth_management_model_1.McpOAuthGrantModel.fromEntity(grant, grant.providerGrantIdHash ? (providerRevocations.get(grant.providerGrantIdHash) ?? null) : null, moduleEnabled));
+    }
+    async getGrant(id) {
+        const grant = await this.getGrantEntity(id);
+        return this.mapGrant(grant);
+    }
+    async findAccessTokens() {
+        const artifacts = await this.artifacts.find({
+            where: { model: 'AccessToken', expiresAt: (0, typeorm_1.MoreThan)(Date.now()) },
+            order: { expiresAt: 'ASC' },
+        });
+        return this.mapAccessTokens(artifacts);
+    }
+    async getAccessToken(id) {
+        const artifact = await this.artifacts.findOneBy({
+            model: 'AccessToken',
+            managementId: id,
+            expiresAt: (0, typeorm_1.MoreThan)(Date.now()),
+        });
+        if (!artifact)
+            throw new common_1.NotFoundException('Requested MCP OAuth access token does not exist');
+        const [model] = await this.mapAccessTokens([artifact]);
+        if (!model)
+            throw new common_1.NotFoundException('Requested MCP OAuth access token is not linked to an active grant');
+        return model;
+    }
+    async findRefreshFamilies() {
+        const artifacts = await this.artifacts.find({
+            where: {
+                model: 'RefreshToken',
+                refreshFamilyId: (0, typeorm_1.Not)((0, typeorm_1.IsNull)()),
+                expiresAt: (0, typeorm_1.MoreThan)(Date.now()),
+            },
+            order: { expiresAt: 'ASC' },
+        });
+        return this.mapRefreshFamilies(artifacts);
+    }
+    async getRefreshFamily(id) {
+        const artifacts = await this.artifacts.find({
+            where: {
+                model: 'RefreshToken',
+                refreshFamilyId: id,
+                expiresAt: (0, typeorm_1.MoreThan)(Date.now()),
+            },
+        });
+        const [model] = await this.mapRefreshFamilies(artifacts);
+        if (!model)
+            throw new common_1.NotFoundException('Requested MCP OAuth refresh family does not exist');
+        return model;
+    }
+    async updateClient(id, dto, actorId) {
+        if (dto.enabled === false)
+            return this.disableClient(id, actorId, dto);
+        const updatesAuthorization = dto.redirectUris !== undefined || dto.maximumScopes !== undefined || dto.enabled !== undefined;
+        if (!updatesAuthorization)
+            return this.clientsService.update(id, dto);
+        let updated;
+        await this.subscriptions.closeOAuthClient(id, async () => {
+            updated = await this.clientsService.update(id, dto);
+        });
+        if (!updated)
+            throw new common_1.ConflictException('The MCP OAuth client changed during authorization update');
+        return updated;
+    }
+    async disableClient(id, actorId, dto = {}) {
+        const client = await this.clientsService.getOneOrThrow(id);
+        if (dto.maximumScopes !== undefined) {
+            this.clientsService.assertScopesAllowed(dto.maximumScopes);
+        }
+        await this.subscriptions.closeOAuthClient(id, async () => {
+            await this.dataSource.transaction(async (manager) => {
+                const clientResult = await manager.getRepository(mcp_oauth_entity_1.McpOAuthClientEntity).update({ id: client.id, generation: client.generation }, {
+                    ...(dto.name !== undefined ? { name: dto.name } : {}),
+                    ...(dto.redirectUris !== undefined ? { redirectUris: [...dto.redirectUris] } : {}),
+                    ...(dto.maximumScopes !== undefined ? { maximumScopes: [...dto.maximumScopes] } : {}),
+                    enabled: false,
+                    generation: () => 'generation + 1',
+                });
+                if (!clientResult.affected) {
+                    throw new common_1.ConflictException('The MCP OAuth client changed during disable');
+                }
+                const grantRepository = manager.getRepository(mcp_oauth_entity_1.McpOAuthGrantEntity);
+                const clientGrants = await grantRepository.findBy({ clientId: client.id });
+                const activeGrants = clientGrants.filter((grant) => grant.revokedAt === null);
+                const grantHashes = activeGrants
+                    .map((grant) => grant.providerGrantIdHash)
+                    .filter((hash) => hash !== null);
+                const revokedAt = new Date();
+                if (activeGrants.length > 0) {
+                    await grantRepository.update({ id: (0, typeorm_1.In)(activeGrants.map((grant) => grant.id)), revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt, generation: () => 'generation + 1' });
+                }
+                if (grantHashes.length > 0) {
+                    await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity).upsert(grantHashes.map((grantIdHash) => ({ grantIdHash, revokedAt: revokedAt.getTime() })), ['grantIdHash']);
+                    const artifacts = manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity);
+                    await artifacts.delete({ grantIdHash: (0, typeorm_1.In)(grantHashes) });
+                    await artifacts.delete({ model: 'Grant', idHash: (0, typeorm_1.In)(grantHashes) });
+                }
+            });
+        });
+        this.auditService.recordOAuthManagementAction(actorId, 'client', id, 'disabled');
+        return mcp_oauth_client_model_1.McpOAuthClientModel.fromEntity(await this.clientsService.getOneOrThrow(id));
+    }
+    async updateGrant(id, dto, actorId) {
+        let current = null;
+        let changed = false;
+        await this.subscriptions.closeOAuthGrantScopeContractions(id, dto.approvedScopes, async () => {
+            const grant = await this.getGrantEntity(id);
+            const liveGrant = await this.mapGrant(grant);
+            current = liveGrant;
+            if (!liveGrant.active)
+                throw new common_1.ConflictException('Only an active MCP OAuth grant can be updated');
+            const addedScopes = dto.approvedScopes.filter((scope) => !liveGrant.approvedScopes.includes(scope));
+            if (addedScopes.length > 0) {
+                throw new common_1.BadRequestException(`Approved grant scopes can only be reduced: ${addedScopes.join(', ')}`);
+            }
+            if (liveGrant.approvedScopes.includes(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS) !==
+                dto.approvedScopes.includes(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS)) {
+                throw new common_1.BadRequestException('offline_access can only be removed by revoking the MCP OAuth grant');
+            }
+            if (this.sameScopes(liveGrant.approvedScopes, dto.approvedScopes))
+                return;
+            const result = await this.grants.update({ id, generation: grant.generation, revokedAt: (0, typeorm_1.IsNull)(), expiresAt: (0, typeorm_1.MoreThan)(new Date()) }, { approvedScopes: [...dto.approvedScopes], generation: () => 'generation + 1' });
+            if (!result.affected)
+                throw new common_1.ConflictException('The MCP OAuth grant changed during scope update');
+            changed = true;
+        });
+        if (!current)
+            throw new common_1.ConflictException('The MCP OAuth grant could not be updated');
+        if (!changed)
+            return current;
+        this.auditService.recordOAuthManagementAction(actorId, 'grant', id, 'scopes_updated');
+        return this.getGrant(id);
+    }
+    async revokeGrant(id, actorId) {
+        const grant = await this.getGrantEntity(id);
+        await this.subscriptions.closeOAuthGrant(id, async () => {
+            if (grant.revokedAt !== null)
+                return;
+            const revokedAt = new Date();
+            await this.dataSource.transaction(async (manager) => {
+                const result = await manager
+                    .getRepository(mcp_oauth_entity_1.McpOAuthGrantEntity)
+                    .update({ id, generation: grant.generation, revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt, generation: () => 'generation + 1' });
+                if (!result.affected)
+                    throw new common_1.ConflictException('The MCP OAuth grant changed during revocation');
+                if (grant.providerGrantIdHash) {
+                    await manager
+                        .getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity)
+                        .upsert({ grantIdHash: grant.providerGrantIdHash, revokedAt: revokedAt.getTime() }, ['grantIdHash']);
+                    const artifacts = manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity);
+                    await artifacts.delete({ grantIdHash: grant.providerGrantIdHash });
+                    await artifacts.delete({ model: 'Grant', idHash: grant.providerGrantIdHash });
+                }
+            });
+        });
+        this.auditService.recordOAuthManagementAction(actorId, 'grant', id, 'revoked');
+        return this.getGrant(id);
+    }
+    async revokeAccessToken(id, actorId) {
+        await this.getAccessToken(id);
+        await this.subscriptions.closeOAuthAccessToken(id, async () => {
+            const result = await this.artifacts.delete({ model: 'AccessToken', managementId: id });
+            if (!result.affected)
+                throw new common_1.ConflictException('The MCP OAuth access token changed during revocation');
+        });
+        this.auditService.recordOAuthManagementAction(actorId, 'access_token', id, 'revoked');
+    }
+    async revokeRefreshFamily(id, actorId) {
+        await this.getRefreshFamily(id);
+        await this.subscriptions.closeOAuthRefreshFamily(id, async () => {
+            await this.dataSource.transaction(async (manager) => {
+                await manager
+                    .getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedRefreshFamilyEntity)
+                    .upsert({ refreshFamilyId: id, revokedAt: Date.now() }, ['refreshFamilyId']);
+                const result = await manager.getRepository(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity).delete({ refreshFamilyId: id });
+                if (!result.affected)
+                    throw new common_1.ConflictException('The MCP OAuth refresh family changed during revocation');
+            });
+        });
+        this.auditService.recordOAuthManagementAction(actorId, 'refresh_family', id, 'revoked');
+    }
+    async revokeAll(actorId) {
+        await this.globalInvalidation.invalidate(['serverSecretVersion'], () => Promise.resolve());
+        this.auditService.recordOAuthGlobalRevocation(actorId);
+    }
+    async getGrantEntity(id) {
+        const grant = await this.grants.findOne({
+            where: { id },
+            relations: { approvedBy: true, client: true },
+        });
+        if (!grant)
+            throw new common_1.NotFoundException('Requested MCP OAuth grant does not exist');
+        return grant;
+    }
+    async mapGrant(grant) {
+        const providerRevocations = await this.getProviderRevocations([grant]);
+        return mcp_oauth_management_model_1.McpOAuthGrantModel.fromEntity(grant, grant.providerGrantIdHash ? (providerRevocations.get(grant.providerGrantIdHash) ?? null) : null, this.isModuleEnabled());
+    }
+    sameScopes(first, second) {
+        return first.length === second.length && first.every((scope) => second.includes(scope));
+    }
+    async mapAccessTokens(artifacts) {
+        const [grants, revokedRefreshFamilies] = await Promise.all([
+            this.getGrantsByProviderHash(artifacts),
+            this.getRevokedRefreshFamilies(artifacts),
+        ]);
+        return artifacts.flatMap((artifact) => {
+            const grant = artifact.grantIdHash ? grants.get(artifact.grantIdHash) : undefined;
+            if (!grant ||
+                artifact.expiresAt === null ||
+                (artifact.refreshFamilyId !== null && revokedRefreshFamilies.has(artifact.refreshFamilyId))) {
+                return [];
+            }
+            return [
+                Object.assign(new mcp_oauth_management_model_1.McpOAuthAccessTokenModel(), {
+                    id: artifact.managementId,
+                    clientId: grant.clientId,
+                    clientName: grant.client?.name ?? 'Unknown client',
+                    grantId: grant.id,
+                    refreshFamilyId: artifact.refreshFamilyId,
+                    scopes: this.parseScopes(artifact.payload),
+                    expiresAt: new Date(artifact.expiresAt).toISOString(),
+                }),
+            ];
+        });
+    }
+    async mapRefreshFamilies(artifacts) {
+        const [grants, revokedRefreshFamilies] = await Promise.all([
+            this.getGrantsByProviderHash(artifacts),
+            this.getRevokedRefreshFamilies(artifacts),
+        ]);
+        const families = new Map();
+        for (const artifact of artifacts) {
+            if (!artifact.refreshFamilyId)
+                continue;
+            families.set(artifact.refreshFamilyId, [...(families.get(artifact.refreshFamilyId) ?? []), artifact]);
+        }
+        return [...families].flatMap(([id, familyArtifacts]) => {
+            if (revokedRefreshFamilies.has(id))
+                return [];
+            const linked = familyArtifacts.find((artifact) => artifact.grantIdHash && grants.has(artifact.grantIdHash));
+            const grant = linked?.grantIdHash ? grants.get(linked.grantIdHash) : undefined;
+            const expiresAt = Math.max(...familyArtifacts.map((artifact) => artifact.expiresAt ?? 0));
+            if (!grant || expiresAt <= Date.now())
+                return [];
+            return [
+                Object.assign(new mcp_oauth_management_model_1.McpOAuthRefreshFamilyModel(), {
+                    id,
+                    clientId: grant.clientId,
+                    clientName: grant.client?.name ?? 'Unknown client',
+                    grantId: grant.id,
+                    expiresAt: new Date(expiresAt).toISOString(),
+                    activeTokenCount: familyArtifacts.filter((artifact) => artifact.consumedAt === null && (artifact.expiresAt ?? 0) > Date.now()).length,
+                }),
+            ];
+        });
+    }
+    async getGrantsByProviderHash(artifacts) {
+        const hashes = [
+            ...new Set(artifacts.map((artifact) => artifact.grantIdHash).filter((hash) => hash !== null)),
+        ];
+        if (hashes.length === 0)
+            return new Map();
+        if (!this.isModuleEnabled())
+            return new Map();
+        const grants = await this.grants.find({
+            where: {
+                providerGrantIdHash: (0, typeorm_1.In)(hashes),
+                revokedAt: (0, typeorm_1.IsNull)(),
+                expiresAt: (0, typeorm_1.MoreThan)(new Date()),
+            },
+            relations: { approvedBy: true, client: true },
+        });
+        const providerRevocations = await this.getProviderRevocations(grants);
+        return new Map(grants.flatMap((grant) => grant.providerGrantIdHash &&
+            !providerRevocations.has(grant.providerGrantIdHash) &&
+            mcp_oauth_management_model_1.McpOAuthGrantModel.isActive(grant)
+            ? [[grant.providerGrantIdHash, grant]]
+            : []));
+    }
+    async getProviderRevocations(grants) {
+        const hashes = [
+            ...new Set(grants.map((grant) => grant.providerGrantIdHash).filter((hash) => hash !== null)),
+        ];
+        if (hashes.length === 0)
+            return new Map();
+        const revocations = await this.dataSource
+            .getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedGrantEntity)
+            .findBy({ grantIdHash: (0, typeorm_1.In)(hashes) });
+        return new Map(revocations.map((revocation) => [revocation.grantIdHash, revocation.revokedAt]));
+    }
+    async getRevokedRefreshFamilies(artifacts) {
+        const ids = [
+            ...new Set(artifacts
+                .map((artifact) => artifact.refreshFamilyId)
+                .filter((refreshFamilyId) => refreshFamilyId !== null)),
+        ];
+        if (ids.length === 0)
+            return new Set();
+        const revocations = await this.dataSource
+            .getRepository(mcp_oauth_entity_1.McpOAuthProviderRevokedRefreshFamilyEntity)
+            .findBy({ refreshFamilyId: (0, typeorm_1.In)(ids) });
+        return new Set(revocations.map((revocation) => revocation.refreshFamilyId));
+    }
+    isModuleEnabled() {
+        return this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME).enabled;
+    }
+    parseScopes(payload) {
+        try {
+            const value = JSON.parse(payload);
+            if (typeof value.scope !== 'string')
+                return [];
+            return value.scope
+                .split(' ')
+                .filter((scope) => Object.values(mcp_constants_1.McpOAuthScope).includes(scope));
+        }
+        catch {
+            return [];
+        }
+    }
+};
+exports.McpOAuthManagementService = McpOAuthManagementService;
+exports.McpOAuthManagementService = McpOAuthManagementService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthGrantEntity)),
+    __param(1, (0, typeorm_2.InjectRepository)(mcp_oauth_entity_1.McpOAuthProviderArtifactEntity)),
+    __metadata("design:paramtypes", [typeorm_1.Repository,
+        typeorm_1.Repository,
+        typeorm_1.DataSource,
+        config_service_1.ConfigService,
+        mcp_oauth_client_service_1.McpOAuthClientService,
+        mcp_subscription_registry_service_1.McpSubscriptionRegistryService,
+        mcp_oauth_global_invalidation_service_1.McpOAuthGlobalInvalidationService,
+        mcp_audit_service_1.McpAuditService])
+], McpOAuthManagementService);
+//# sourceMappingURL=mcp-oauth-management.service.js.map

package/dist/modules/mcp/services/mcp-oauth-management.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-management.service.js","sourceRoot":"","sources":["../../../../src/modules/mcp/services/mcp-oauth-management.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,qCAA4E;AAE5E,2CAAuG;AACvG,6CAAmD;AAEnD,yEAAqE;AAGrE,mEAMsC;AACtC,oDAAkE;AAElE,6EAAuE;AACvE,qFAI8C;AAE9C,2DAAsD;AACtD,yEAAmE;AACnE,mGAA4F;AAC5F,2FAAqF;AAO9E,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACrC,YAEkB,MAAuC,EAEvC,SAAqD,EACrD,UAAsB,EACtB,aAA4B,EAC5B,cAAqC,EACrC,aAA6C,EAC7C,kBAAqD,EACrD,YAA6B;QAR7B,WAAM,GAAN,MAAM,CAAiC;QAEvC,cAAS,GAAT,SAAS,CAA4C;QACrD,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAuB;QACrC,kBAAa,GAAb,aAAa,CAAgC;QAC7C,uBAAkB,GAAlB,kBAAkB,CAAmC;QACrD,iBAAY,GAAZ,YAAY,CAAiB;IAC5C,CAAC;IAEJ,KAAK,CAAC,UAAU;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;YAC7C,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,+CAAkB,CAAC,UAAU,CAC5B,KAAK,EACL,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/F,aAAa,CACb,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,0BAAiB,CAAC,iDAAiD,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAAiB,CAAC,mEAAmE,CAAC,CAAC;QAE7G,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB;QACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE;gBACN,KAAK,EAAE,cAAc;gBACrB,eAAe,EAAE,IAAA,aAAG,EAAC,IAAA,gBAAM,GAAE,CAAC;gBAC9B,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/B;YACD,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE;gBACN,KAAK,EAAE,cAAc;gBACrB,eAAe,EAAE,EAAE;gBACnB,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/B;SACD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAAiB,CAAC,mDAAmD,CAAC,CAAC;QAE7F,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,GAA4B,EAAE,OAAe;QAC3E,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAEvE,MAAM,oBAAoB,GACzB,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;QAEhG,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEtE,IAAI,OAAwC,CAAC;QAE7C,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACxD,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAAiB,CAAC,0DAA0D,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,OAAe,EAAE,MAA+B,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAE3D,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,uCAAoB,CAAC,CAAC,MAAM,CAC5E,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAChD;oBACC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrF,OAAO,EAAE,KAAK;oBACd,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB;iBAClC,CACD,CAAC;gBAEF,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;oBAC5B,MAAM,IAAI,0BAAiB,CAAC,6CAA6C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,sCAAmB,CAAC,CAAC;gBACnE,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3E,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;gBAC9E,MAAM,WAAW,GAAG,YAAY;qBAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;qBACzC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBAClD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;gBAE7B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,eAAe,CAAC,MAAM,CAC3B,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtE,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CACjD,CAAC;gBACH,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,OAAO,CAAC,aAAa,CAAC,qDAAkC,CAAC,CAAC,MAAM,CACrE,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACnF,CAAC,aAAa,CAAC,CACf,CAAC;oBACF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC;oBACxE,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAA,YAAE,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC;oBACzD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAA,YAAE,EAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAEjF,OAAO,4CAAmB,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,GAA2B,EAAE,OAAe;QACzE,IAAI,OAAO,GAA8B,IAAI,CAAC;QAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,GAAG,SAAS,CAAC;YAEpB,IAAI,CAAC,SAAS,CAAC,MAAM;gBAAE,MAAM,IAAI,0BAAiB,CAAC,+CAA+C,CAAC,CAAC;YAEpG,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpG,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,4BAAmB,CAAC,8CAA8C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YAED,IACC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,6BAAa,CAAC,cAAc,CAAC;gBAC/D,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,6BAAa,CAAC,cAAc,CAAC,EACxD,CAAC;gBACF,MAAM,IAAI,4BAAmB,CAAC,oEAAoE,CAAC,CAAC;YACrG,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC;gBAAE,OAAO;YAE1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CACtC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,IAAI,EAAE,CAAC,EAAE,EAC1F,EAAE,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAC/E,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,0BAAiB,CAAC,iDAAiD,CAAC,CAAC;YACrG,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAAiB,CAAC,0CAA0C,CAAC,CAAC;QACtF,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAE7B,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAEtF,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,OAAe;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACvD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO;YAErC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnD,MAAM,MAAM,GAAG,MAAM,OAAO;qBAC1B,aAAa,CAAC,sCAAmB,CAAC;qBAClC,MAAM,CACN,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EACzD,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CACjD,CAAC;gBAEH,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,0BAAiB,CAAC,+CAA+C,CAAC,CAAC;gBAEnG,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,MAAM,OAAO;yBACX,aAAa,CAAC,qDAAkC,CAAC;yBACjD,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;oBACtG,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC;oBACxE,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC;oBACnE,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAE/E,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,OAAe;QAClD,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAEvF,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,0BAAiB,CAAC,sDAAsD,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EAAU,EAAE,OAAe;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnD,MAAM,OAAO;qBACX,aAAa,CAAC,6DAA0C,CAAC;qBACzD,MAAM,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,iDAA8B,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;gBAE3G,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,0BAAiB,CAAC,wDAAwD,CAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe;QAC9B,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,EAAU;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACvC,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAAiB,CAAC,0CAA0C,CAAC,CAAC;QAEpF,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAA0B;QAChD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAEvE,OAAO,+CAAkB,CAAC,UAAU,CACnC,KAAK,EACL,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/F,IAAI,CAAC,eAAe,EAAE,CACtB,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,KAAsB,EAAE,MAAuB;QACjE,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,SAA2C;QACxE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1D,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YACvC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAElF,IACC,CAAC,KAAK;gBACN,QAAQ,CAAC,SAAS,KAAK,IAAI;gBAC3B,CAAC,QAAQ,CAAC,eAAe,KAAK,IAAI,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAC1F,CAAC;gBACF,OAAO,EAAE,CAAC;YACX,CAAC;YAED,OAAO;gBACN,MAAM,CAAC,MAAM,CAAC,IAAI,qDAAwB,EAAE,EAAE;oBAC7C,EAAE,EAAE,QAAQ,CAAC,YAAY;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,gBAAgB;oBAClD,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;iBACrD,CAAC;aACF,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,SAA2C;QAC3E,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1D,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;YACvC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;QAErE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAAE,SAAS;YACxC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvG,CAAC;QAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE;YACtD,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,EAAE,CAAC;YAE9C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC5G,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;YAE1F,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,EAAE,CAAC;YAEjD,OAAO;gBACN,MAAM,CAAC,MAAM,CAAC,IAAI,uDAA0B,EAAE,EAAE;oBAC/C,EAAE;oBACF,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,gBAAgB;oBAClD,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;oBAC5C,gBAAgB,EAAE,eAAe,CAAC,MAAM,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CACpF,CAAC,MAAM;iBACR,CAAC;aACF,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACpC,SAA2C;QAE3C,MAAM,MAAM,GAAG;YACd,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;SAC7G,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE;gBACN,mBAAmB,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;gBAC/B,SAAS,EAAE,IAAA,gBAAM,GAAE;gBACnB,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,IAAI,EAAE,CAAC;aAC/B;YACD,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC;QACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEtE,OAAO,IAAI,GAAG,CACb,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,mBAAmB;YACzB,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;YACnD,+CAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAU,CAAC;YAC/C,CAAC,CAAC,EAAE,CACL,CACD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,MAA6B;QACjE,MAAM,MAAM,GAAG;YACd,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;SAC5G,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE1C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU;aACvC,aAAa,CAAC,qDAAkC,CAAC;aACjD,MAAM,CAAC,EAAE,WAAW,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEtC,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,SAA2C;QAClF,MAAM,GAAG,GAAG;YACX,GAAG,IAAI,GAAG,CACT,SAAS;iBACP,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;iBAC3C,MAAM,CAAC,CAAC,eAAe,EAA6B,EAAE,CAAC,eAAe,KAAK,IAAI,CAAC,CAClF;SACD,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU;aACvC,aAAa,CAAC,6DAA0C,CAAC;aACzD,MAAM,CAAC,EAAE,eAAe,EAAE,IAAA,YAAE,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEvC,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC,OAAO,CAAC;IACpF,CAAC;IAEO,WAAW,CAAC,OAAe;QAClC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;YAE7D,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAE/C,OAAO,KAAK,CAAC,KAAK;iBAChB,KAAK,CAAC,GAAG,CAAC;iBACV,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,6BAAa,CAAC,CAAC,QAAQ,CAAC,KAAsB,CAAC,CAAC,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;CACD,CAAA;AAzbY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAGV,WAAA,IAAA,0BAAgB,EAAC,sCAAmB,CAAC,CAAA;IAErC,WAAA,IAAA,0BAAgB,EAAC,iDAA8B,CAAC,CAAA;qCADxB,oBAAU;QAEP,oBAAU;QACT,oBAAU;QACP,8BAAa;QACZ,gDAAqB;QACtB,kEAA8B;QACzB,yEAAiC;QACvC,mCAAe;GAXnC,yBAAyB,CAybrC"}

package/dist/modules/mcp/services/mcp-oauth-module-config-mutation.service.d.ts

@@ -0,0 +1,28 @@
+import { Repository } from 'typeorm';
+import { ConfigService } from '../../config/services/config.service';
+import { ModuleConfigCommit } from '../../config/services/module-config-mutation-registry.service';
+import { UpdateMcpConfigDto } from '../dto/update-config.dto';
+import { McpOAuthServerStateEntity } from '../entities/mcp-oauth.entity';
+import { McpAuditService } from './mcp-audit.service';
+import { McpOAuthGlobalInvalidationService } from './mcp-oauth-global-invalidation.service';
+import { McpOAuthLifecycleService } from './mcp-oauth-lifecycle.service';
+import { McpOAuthRouteGateService } from './mcp-oauth-route-gate.service';
+import { McpOAuthSwitchOffService } from './mcp-oauth-switch-off.service';
+import { McpSubscriptionRegistryService } from './mcp-subscription-registry.service';
+export declare class McpOAuthModuleConfigMutationService {
+    private readonly configService;
+    private readonly serverState;
+    private readonly subscriptions;
+    private readonly globalInvalidation;
+    private readonly auditService;
+    private readonly routeGate;
+    private readonly lifecycle;
+    private readonly switchOff;
+    private mutationTail;
+    constructor(configService: ConfigService, serverState: Repository<McpOAuthServerStateEntity>, subscriptions: McpSubscriptionRegistryService, globalInvalidation: McpOAuthGlobalInvalidationService, auditService: McpAuditService, routeGate: McpOAuthRouteGateService, lifecycle: McpOAuthLifecycleService, switchOff: McpOAuthSwitchOffService);
+    update(update: UpdateMcpConfigDto, commit: ModuleConfigCommit): Promise<void>;
+    private updateInternal;
+    private runSwitchOff;
+    private runGlobalInvalidation;
+    private sameCapabilities;
+}