@forestadmin/workflow-executor 1.12.0 → 1.14.0

package/dist/http/executor-http-server.js

@@ -10,6 +10,7 @@ const koa_1 = __importDefault(require("koa"));
 const koa_jwt_1 = __importDefault(require("koa-jwt"));
 const bearer_claims_1 = require("./bearer-claims");
 const http_errors_1 = require("./http-errors");
+const mcp_oauth_credentials_1 = require("./mcp-oauth-credentials");
 const step_serializer_1 = __importDefault(require("./step-serializer"));
 const console_logger_1 = __importDefault(require("../adapters/console-logger"));
 const errors_1 = require("../errors");
@@ -20,6 +21,7 @@ class ExecutorHttpServer {
         this.server = null;
         this.options = options;
         this.logger = options.logger ?? (0, console_logger_1.default)();
+        this.mcpOAuthCredentialsStore = options.mcpOAuthCredentialsStore;
         this.app = new koa_1.default();
         this.app.use(async (ctx, next) => {
             ctx.set('X-Executor-Version', version);
@@ -97,10 +99,17 @@ class ExecutorHttpServer {
         // Trigger handles its own authz by comparing bearer user with step.user.
         router.get('/runs/:runId', this.hasRunAccessMiddleware.bind(this), this.handleGetRun.bind(this));
         router.post('/runs/:runId/trigger', this.handleTrigger.bind(this));
+        const { mcpOAuthCredentialsStore: credentialsStore, credentialEncryption, remoteToolFetcher, } = this.options;
+        // Design-time tool listing for the MCP-server details page: resolve the caller's vault
+        // credential, refresh, and list the oauth2 server's tools — no workflow run involved.
+        router.get('/list-mcp-tools', ctx => this.handleListMcpTools(ctx, remoteToolFetcher));
+        router.post('/mcp-oauth-credentials', ctx => this.handleDepositCredentials(ctx, credentialsStore, credentialEncryption));
+        router.delete('/mcp-oauth-credentials/:mcpServerId', ctx => this.handleDeleteCredentials(ctx, credentialsStore));
         this.app.use(router.routes());
         this.app.use(router.allowedMethods());
     }
     async start() {
+        await this.mcpOAuthCredentialsStore.init(this.logger);
         return new Promise((resolve, reject) => {
             this.server = http_1.default.createServer(this.app.callback());
             this.server.once('error', reject);
@@ -161,6 +170,86 @@ class ExecutorHttpServer {
         ctx.status = 200;
         ctx.body = { triggered: true };
     }
+    async handleDepositCredentials(ctx, store, encryption) {
+        const userId = ctx.state.user.id;
+        const parsed = mcp_oauth_credentials_1.depositCredentialsBodySchema.safeParse(ctx.request.body ?? {});
+        if (!parsed.success) {
+            const details = parsed.error.issues
+                .map(issue => `${issue.path.join('.') || 'body'}: ${issue.message}`)
+                .join('; ');
+            throw new http_errors_1.BadRequestHttpError(`Invalid request body — ${details}`);
+        }
+        try {
+            await store.upsert((0, mcp_oauth_credentials_1.buildMcpOAuthCredentialInput)({ body: parsed.data, userId, encryption }));
+        }
+        catch (err) {
+            // The frontend must tell this missing-key config error apart from a generic failure (to route
+            // the user to an admin rather than retry), so it returns a typed { code } the middleware won't.
+            if (err instanceof errors_1.ExecutorEncryptionKeyMissingError) {
+                ctx.status = 503;
+                ctx.body = { code: err.code };
+                return;
+            }
+            throw err;
+        }
+        // Evict any cached access token so a reconnect/re-deposit takes effect immediately, instead of
+        // serving the token minted from the previous credential until it expires (mirrors delete).
+        this.options.oauthTokenService?.evict(userId, parsed.data.mcpServerId);
+        ctx.status = 200;
+        ctx.body = { stored: true };
+    }
+    async handleDeleteCredentials(ctx, store) {
+        const userId = ctx.state.user.id;
+        await store.delete(userId, ctx.params.mcpServerId);
+        // Evict any in-process cached access token so the disconnect is immediate, not deferred until
+        // the cached token expires (the row is gone, but the runtime would otherwise still serve it).
+        this.options.oauthTokenService?.evict(userId, ctx.params.mcpServerId);
+        ctx.status = 204;
+    }
+    // Design-time tool listing: resolve the caller's vault credential for the target oauth2 server,
+    // refresh + inject the Bearer, and return the server's tool definitions. user_id comes from the
+    // validated JWT, so a caller only ever lists with their own stored credential. A missing/dead
+    // credential surfaces as a typed needs-oauth-reauth response (not a generic error or empty list)
+    // so the details page can prompt a reconnect — mirroring the run path's awaiting-input reason.
+    async handleListMcpTools(ctx, fetcher) {
+        const userId = ctx.state.user.id;
+        const { mcpServerId } = ctx.query;
+        if (typeof mcpServerId !== 'string' || mcpServerId.length === 0) {
+            throw new http_errors_1.BadRequestHttpError('Missing required query parameter "mcpServerId"');
+        }
+        try {
+            const { tools, mcpServerName, loadFailed } = await fetcher.fetch(mcpServerId, userId);
+            // A dead or misrouted server otherwise renders as an (indistinguishable) empty tool list, so
+            // surface it — mirroring the run path, which errors rather than executing against no tools.
+            if (!mcpServerName) {
+                throw new http_errors_1.NotFoundHttpError(`No MCP server is configured for id "${mcpServerId}"`);
+            }
+            if (loadFailed) {
+                throw new http_errors_1.ServiceUnavailableHttpError('The MCP server could not be reached to list its tools');
+            }
+            ctx.status = 200;
+            ctx.body = {
+                tools: tools.map(tool => ({ name: tool.base.name, description: tool.base.description })),
+            };
+        }
+        catch (err) {
+            // Set the body directly so the error middleware (which would map this to a generic 400 and
+            // drop the typed reason) doesn't touch it — the frontend needs the reason to prompt reconnect.
+            if (err instanceof errors_1.OAuthReauthRequiredError) {
+                ctx.status = 409;
+                ctx.body = { awaitingInputReason: err.awaitingInputReason, mcpServerId };
+                return;
+            }
+            // Key-missing is an operator misconfig, not re-consent-resolvable: return the same typed 503
+            // the deposit endpoint uses so the details page shows the admin message, not a generic error.
+            if (err instanceof errors_1.ExecutorEncryptionKeyMissingError) {
+                ctx.status = 503;
+                ctx.body = { code: err.code };
+                return;
+            }
+            throw err;
+        }
+    }
 }
 exports.default = ExecutorHttpServer;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhlY3V0b3ItaHR0cC1zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaHR0cC9leGVjdXRvci1odHRwLXNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUtBLGlFQUF5QztBQUN6Qyx5REFBaUM7QUFDakMsZ0RBQXdCO0FBQ3hCLDhDQUFzQjtBQUN0QixzREFBNkI7QUFFN0IsbURBQXdFO0FBQ3hFLCtDQUt1QjtBQUN2Qix3RUFBcUQ7QUFDckQsZ0ZBQTZEO0FBQzdELHNDQUFnRDtBQUVoRCx5R0FBeUc7QUFDekcsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBd0IsQ0FBQztBQVV6RSxNQUFxQixrQkFBa0I7SUFNckMsWUFBWSxPQUFrQztRQUZ0QyxXQUFNLEdBQWtCLElBQUksQ0FBQztRQUduQyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBQSx3QkFBbUIsR0FBRSxDQUFDO1FBQ3RELElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxhQUFHLEVBQUUsQ0FBQztRQUVyQixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLEdBQUcsQ0FBQyxHQUFHLENBQUMsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDdkMsTUFBTSxJQUFJLEVBQUUsQ0FBQztRQUNmLENBQUMsQ0FBQyxDQUFDO1FBRUgsdUZBQXVGO1FBQ3ZGLDRGQUE0RjtRQUM1RixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLElBQUksQ0FBQztnQkFDSCxNQUFNLElBQUksRUFBRSxDQUFDO1lBQ2YsQ0FBQztZQUFDLE9BQU8sR0FBWSxFQUFFLENBQUM7Z0JBQ3RCLE1BQU0sU0FBUyxHQUFHLElBQUEseUJBQVcsRUFBQyxHQUFHLENBQUMsQ0FBQztnQkFFbkMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLHNCQUFzQixFQUFFO3dCQUMzQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU07d0JBQ2xCLElBQUksRUFBRSxHQUFHLENBQUMsSUFBSTt3QkFDZCxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxHQUFHLENBQUM7d0JBQy9CLEtBQUssRUFBRSxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTO3FCQUNwRCxDQUFDLENBQUM7b0JBQ0gsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7b0JBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQztvQkFFOUMsT0FBTztnQkFDVCxDQUFDO2dCQUVELElBQUksU0FBUyxDQUFDLEdBQUcsRUFBRSxDQUFDO29CQUNsQixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsRUFBRTt3QkFDMUMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO3dCQUNsQixJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7d0JBQ2QsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNO3dCQUN4QixLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxTQUFTLENBQUMsS0FBSyxJQUFJLFNBQVMsQ0FBQzt3QkFDeEQsa0ZBQWtGO3dCQUNsRixtRkFBbUY7d0JBQ25GLEtBQUssRUFDSCxDQUFDLFNBQVMsQ0FBQyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDOzRCQUN0RSxTQUFTLENBQUMsS0FBSztxQkFDbEIsQ0FBQyxDQUFDO2dCQUNMLENBQUM7Z0JBRUQsR0FBRyxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDO2dCQUM5QixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUM5QyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7UUFFSCw0RkFBNEY7UUFDNUYsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUMvQixJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssS0FBSyxJQUFJLEdBQUcsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ25ELE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztnQkFDdEMsR0FBRyxDQUFDLE1BQU0sR0FBRyxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUNyRSxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLENBQUM7Z0JBRXJCLE9BQU87WUFDVCxDQUFDO1lBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztRQUNmLENBQUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBQSxvQkFBVSxHQUFFLENBQUMsQ0FBQztRQUUzQiwyREFBMkQ7UUFDM0QsNkZBQTZGO1FBQzdGLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUNWLElBQUEsaUJBQU0sRUFBQyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxzQkFBc0IsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FDN0YsQ0FBQztRQUVGLDJGQUEyRjtRQUMzRiwyRkFBMkY7UUFDM0YsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUMvQixNQUFNLE1BQU0sR0FBRyxrQ0FBa0IsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUU1RCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNwQix3RkFBd0Y7Z0JBQ3hGLDBGQUEwRjtnQkFDMUYscUZBQXFGO2dCQUNyRixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxpQ0FBaUMsRUFBRTtvQkFDckQsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO29CQUNsQixJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7b0JBQ2QsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7aUJBQ25GLENBQUMsQ0FBQztnQkFFSCxNQUFNLElBQUksbUNBQXFCLEVBQUUsQ0FBQztZQUNwQyxDQUFDO1lBRUQsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLEdBQUcsRUFBRSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1lBRXZELE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztRQUVILE1BQU0sTUFBTSxHQUFHLElBQUksZ0JBQU0sRUFBRSxDQUFDO1FBRTVCLDhEQUE4RDtRQUM5RCx5RUFBeUU7UUFDekUsTUFBTSxDQUFDLEdBQUcsQ0FDUixjQUFjLEVBQ2QsSUFBSSxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFDdEMsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQzdCLENBQUM7UUFDRixNQUFNLENBQUMsSUFBSSxDQUFDLHNCQUFzQixFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFFbkUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDOUIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELEtBQUssQ0FBQyxLQUFLO1FBQ1QsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3JELElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNqRCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSTtRQUNSLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDakIsT0FBTyxFQUFFLENBQUM7Z0JBRVYsT0FBTztZQUNULENBQUM7WUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtnQkFDdEIsSUFBSSxHQUFHLEVBQUUsQ0FBQztvQkFDUixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2QsQ0FBQztxQkFBTSxDQUFDO29CQUNOLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO29CQUNuQixPQUFPLEVBQUUsQ0FBQztnQkFDWixDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxJQUFJLFFBQVE7UUFDVixPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVPLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxHQUFnQixFQUFFLElBQWM7UUFDbkUsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFvQixDQUFDO1FBQzVDLElBQUksT0FBZ0IsQ0FBQztRQUVyQixJQUFJLENBQUM7WUFDSCxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSw0QkFBNEIsRUFBRTtnQkFDakQsS0FBSyxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDdkIsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO2dCQUNsQixJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7Z0JBQ2QsS0FBSyxFQUFFLElBQUEsNEJBQW1CLEVBQUMsR0FBRyxDQUFDO2dCQUMvQixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUzthQUNwRCxDQUFDLENBQUM7WUFFSCxrRUFBa0U7WUFDbEUsTUFBTSxJQUFJLHlDQUEyQixDQUFDLHFCQUFxQixFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUVELElBQUksQ0FBQyxPQUFPO1lBQUUsTUFBTSxJQUFJLGdDQUFrQixFQUFFLENBQUM7UUFFN0MsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUM7SUFFTyxLQUFLLENBQUMsWUFBWSxDQUFDLEdBQWdCO1FBQ3pDLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsb0JBQW9CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRSxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMseUJBQW9CLENBQUMsRUFBRSxDQUFDO0lBQ3hELENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUFDLEdBQWdCO1FBQzFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDO1FBQzdCLHVEQUF1RDtRQUN2RCxNQUFNLFlBQVksR0FBSSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQXFCLENBQUMsRUFBRSxDQUFDO1FBRXpELE1BQU0sV0FBVyxHQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBa0MsRUFBRSxXQUFXLENBQUM7UUFFakYsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUM7UUFFNUUsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNqQyxDQUFDO0NBQ0Y7QUEzTEQscUNBMkxDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhlY3V0b3ItaHR0cC1zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaHR0cC9leGVjdXRvci1odHRwLXNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQVNBLGlFQUF5QztBQUN6Qyx5REFBaUM7QUFDakMsZ0RBQXdCO0FBQ3hCLDhDQUFzQjtBQUN0QixzREFBNkI7QUFFN0IsbURBQXdFO0FBQ3hFLCtDQU91QjtBQUN2QixtRUFHaUM7QUFDakMsd0VBQXFEO0FBQ3JELGdGQUE2RDtBQUM3RCxzQ0FJbUI7QUFFbkIseUdBQXlHO0FBQ3pHLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLENBQUMsb0JBQW9CLENBQXdCLENBQUM7QUFnQnpFLE1BQXFCLGtCQUFrQjtJQU9yQyxZQUFZLE9BQWtDO1FBRnRDLFdBQU0sR0FBa0IsSUFBSSxDQUFDO1FBR25DLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFBLHdCQUFtQixHQUFFLENBQUM7UUFDdEQsSUFBSSxDQUFDLHdCQUF3QixHQUFHLE9BQU8sQ0FBQyx3QkFBd0IsQ0FBQztRQUNqRSxJQUFJLENBQUMsR0FBRyxHQUFHLElBQUksYUFBRyxFQUFFLENBQUM7UUFFckIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUMvQixHQUFHLENBQUMsR0FBRyxDQUFDLG9CQUFvQixFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQ3ZDLE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztRQUVILHVGQUF1RjtRQUN2Riw0RkFBNEY7UUFDNUYsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUMvQixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLEVBQUUsQ0FBQztZQUNmLENBQUM7WUFBQyxPQUFPLEdBQVksRUFBRSxDQUFDO2dCQUN0QixNQUFNLFNBQVMsR0FBRyxJQUFBLHlCQUFXLEVBQUMsR0FBRyxDQUFDLENBQUM7Z0JBRW5DLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztvQkFDZixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsRUFBRTt3QkFDM0MsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO3dCQUNsQixJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7d0JBQ2QsS0FBSyxFQUFFLElBQUEsNEJBQW1CLEVBQUMsR0FBRyxDQUFDO3dCQUMvQixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUztxQkFDcEQsQ0FBQyxDQUFDO29CQUNILEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO29CQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLHVCQUF1QixFQUFFLENBQUM7b0JBRTlDLE9BQU87Z0JBQ1QsQ0FBQztnQkFFRCxJQUFJLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQztvQkFDbEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUscUJBQXFCLEVBQUU7d0JBQzFDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTt3QkFDbEIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO3dCQUNkLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTTt3QkFDeEIsS0FBSyxFQUFFLElBQUEsNEJBQW1CLEVBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxTQUFTLENBQUM7d0JBQ3hELGtGQUFrRjt3QkFDbEYsbUZBQW1GO3dCQUNuRixLQUFLLEVBQ0gsQ0FBQyxTQUFTLENBQUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQzs0QkFDdEUsU0FBUyxDQUFDLEtBQUs7cUJBQ2xCLENBQUMsQ0FBQztnQkFDTCxDQUFDO2dCQUVELEdBQUcsQ0FBQyxNQUFNLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQztnQkFDOUIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEtBQUssRUFBRSxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDOUMsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO1FBRUgsNEZBQTRGO1FBQzVGLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUNuRCxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7Z0JBQ3RDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLEtBQUssVUFBVSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztnQkFDckUsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEtBQUssRUFBRSxDQUFDO2dCQUVyQixPQUFPO1lBQ1QsQ0FBQztZQUVELE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUEsb0JBQVUsR0FBRSxDQUFDLENBQUM7UUFFM0IsMkRBQTJEO1FBQzNELDZGQUE2RjtRQUM3RixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FDVixJQUFBLGlCQUFNLEVBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQzdGLENBQUM7UUFFRiwyRkFBMkY7UUFDM0YsMkZBQTJGO1FBQzNGLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsTUFBTSxNQUFNLEdBQUcsa0NBQWtCLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFNUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDcEIsd0ZBQXdGO2dCQUN4RiwwRkFBMEY7Z0JBQzFGLHFGQUFxRjtnQkFDckYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsaUNBQWlDLEVBQUU7b0JBQ3JELE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtvQkFDbEIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO29CQUNkLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO2lCQUNuRixDQUFDLENBQUM7Z0JBRUgsTUFBTSxJQUFJLG1DQUFxQixFQUFFLENBQUM7WUFDcEMsQ0FBQztZQUVELEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxHQUFHLEVBQUUsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUV2RCxNQUFNLElBQUksRUFBRSxDQUFDO1FBQ2YsQ0FBQyxDQUFDLENBQUM7UUFFSCxNQUFNLE1BQU0sR0FBRyxJQUFJLGdCQUFNLEVBQUUsQ0FBQztRQUU1Qiw4REFBOEQ7UUFDOUQseUVBQXlFO1FBQ3pFLE1BQU0sQ0FBQyxHQUFHLENBQ1IsY0FBYyxFQUNkLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQ3RDLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUM3QixDQUFDO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBRW5FLE1BQU0sRUFDSix3QkFBd0IsRUFBRSxnQkFBZ0IsRUFDMUMsb0JBQW9CLEVBQ3BCLGlCQUFpQixHQUNsQixHQUFHLElBQUksQ0FBQyxPQUFPLENBQUM7UUFFakIsdUZBQXVGO1FBQ3ZGLHNGQUFzRjtRQUN0RixNQUFNLENBQUMsR0FBRyxDQUFDLGlCQUFpQixFQUFFLEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7UUFFdEYsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUMxQyxJQUFJLENBQUMsd0JBQXdCLENBQUMsR0FBRyxFQUFFLGdCQUFnQixFQUFFLG9CQUFvQixDQUFDLENBQzNFLENBQUM7UUFDRixNQUFNLENBQUMsTUFBTSxDQUFDLHFDQUFxQyxFQUFFLEdBQUcsQ0FBQyxFQUFFLENBQ3pELElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxHQUFHLEVBQUUsZ0JBQWdCLENBQUMsQ0FDcEQsQ0FBQztRQUVGLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzlCLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCxLQUFLLENBQUMsS0FBSztRQUNULE1BQU0sSUFBSSxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFdEQsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxJQUFJLENBQUMsTUFBTSxHQUFHLGNBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3JELElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNqRCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSTtRQUNSLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDakIsT0FBTyxFQUFFLENBQUM7Z0JBRVYsT0FBTztZQUNULENBQUM7WUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtnQkFDdEIsSUFBSSxHQUFHLEVBQUUsQ0FBQztvQkFDUixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2QsQ0FBQztxQkFBTSxDQUFDO29CQUNOLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO29CQUNuQixPQUFPLEVBQUUsQ0FBQztnQkFDWixDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxJQUFJLFFBQVE7UUFDVixPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDN0IsQ0FBQztJQUVPLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxHQUFnQixFQUFFLElBQWM7UUFDbkUsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFvQixDQUFDO1FBQzVDLElBQUksT0FBZ0IsQ0FBQztRQUVyQixJQUFJLENBQUM7WUFDSCxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSw0QkFBNEIsRUFBRTtnQkFDakQsS0FBSyxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDdkIsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO2dCQUNsQixJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7Z0JBQ2QsS0FBSyxFQUFFLElBQUEsNEJBQW1CLEVBQUMsR0FBRyxDQUFDO2dCQUMvQixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUzthQUNwRCxDQUFDLENBQUM7WUFFSCxrRUFBa0U7WUFDbEUsTUFBTSxJQUFJLHlDQUEyQixDQUFDLHFCQUFxQixFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUVELElBQUksQ0FBQyxPQUFPO1lBQUUsTUFBTSxJQUFJLGdDQUFrQixFQUFFLENBQUM7UUFFN0MsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUM7SUFFTyxLQUFLLENBQUMsWUFBWSxDQUFDLEdBQWdCO1FBQ3pDLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsb0JBQW9CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRSxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMseUJBQW9CLENBQUMsRUFBRSxDQUFDO0lBQ3hELENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUFDLEdBQWdCO1FBQzFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDO1FBQzdCLHVEQUF1RDtRQUN2RCxNQUFNLFlBQVksR0FBSSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQXFCLENBQUMsRUFBRSxDQUFDO1FBRXpELE1BQU0sV0FBVyxHQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBa0MsRUFBRSxXQUFXLENBQUM7UUFFakYsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUM7UUFFNUUsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNqQyxDQUFDO0lBRU8sS0FBSyxDQUFDLHdCQUF3QixDQUNwQyxHQUFnQixFQUNoQixLQUErQixFQUMvQixVQUFnQztRQUVoQyxNQUFNLE1BQU0sR0FBSSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQXFCLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sTUFBTSxHQUFHLG9EQUE0QixDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztRQUU5RSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3BCLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTTtpQkFDaEMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxNQUFNLEtBQUssS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO2lCQUNuRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFZCxNQUFNLElBQUksaUNBQW1CLENBQUMsMEJBQTBCLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFBLG9EQUE0QixFQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLDhGQUE4RjtZQUM5RixnR0FBZ0c7WUFDaEcsSUFBSSxHQUFHLFlBQVksMENBQWlDLEVBQUUsQ0FBQztnQkFDckQsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7Z0JBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUU5QixPQUFPO1lBQ1QsQ0FBQztZQUVELE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztRQUVELCtGQUErRjtRQUMvRiwyRkFBMkY7UUFDM0YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdkUsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUM5QixDQUFDO0lBRU8sS0FBSyxDQUFDLHVCQUF1QixDQUNuQyxHQUFnQixFQUNoQixLQUErQjtRQUUvQixNQUFNLE1BQU0sR0FBSSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQXFCLENBQUMsRUFBRSxDQUFDO1FBRW5ELE1BQU0sS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuRCw4RkFBOEY7UUFDOUYsOEZBQThGO1FBQzlGLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3RFLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO0lBQ25CLENBQUM7SUFFRCxnR0FBZ0c7SUFDaEcsZ0dBQWdHO0lBQ2hHLDhGQUE4RjtJQUM5RixpR0FBaUc7SUFDakcsK0ZBQStGO0lBQ3ZGLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxHQUFnQixFQUFFLE9BQTBCO1FBQzNFLE1BQU0sTUFBTSxHQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBcUIsQ0FBQyxFQUFFLENBQUM7UUFDbkQsTUFBTSxFQUFFLFdBQVcsRUFBRSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUM7UUFFbEMsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxNQUFNLElBQUksaUNBQW1CLENBQUMsZ0RBQWdELENBQUMsQ0FBQztRQUNsRixDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUV0Riw2RkFBNkY7WUFDN0YsNEZBQTRGO1lBQzVGLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztnQkFDbkIsTUFBTSxJQUFJLCtCQUFpQixDQUFDLHVDQUF1QyxXQUFXLEdBQUcsQ0FBQyxDQUFDO1lBQ3JGLENBQUM7WUFFRCxJQUFJLFVBQVUsRUFBRSxDQUFDO2dCQUNmLE1BQU0sSUFBSSx5Q0FBMkIsQ0FDbkMsdURBQXVELENBQ3hELENBQUM7WUFDSixDQUFDO1lBRUQsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7WUFDakIsR0FBRyxDQUFDLElBQUksR0FBRztnQkFDVCxLQUFLLEVBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQzthQUN6RixDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYiwyRkFBMkY7WUFDM0YsK0ZBQStGO1lBQy9GLElBQUksR0FBRyxZQUFZLGlDQUF3QixFQUFFLENBQUM7Z0JBQzVDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO2dCQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsbUJBQW1CLEVBQUUsR0FBRyxDQUFDLG1CQUFtQixFQUFFLFdBQVcsRUFBRSxDQUFDO2dCQUV6RSxPQUFPO1lBQ1QsQ0FBQztZQUVELDZGQUE2RjtZQUM3Riw4RkFBOEY7WUFDOUYsSUFBSSxHQUFHLFlBQVksMENBQWlDLEVBQUUsQ0FBQztnQkFDckQsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7Z0JBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUU5QixPQUFPO1lBQ1QsQ0FBQztZQUVELE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztJQUNILENBQUM7Q0FDRjtBQTFURCxxQ0EwVEMifQ==

package/dist/http/mcp-oauth-credentials.d.ts

@@ -0,0 +1,24 @@
+import type CredentialEncryption from '../crypto/credential-encryption';
+import type { McpOAuthCredentialInput } from '../ports/mcp-oauth-credentials-store';
+import { z } from 'zod';
+export declare const depositCredentialsBodySchema: z.ZodObject<{
+    mcpServerId: z.ZodString;
+    refreshToken: z.ZodString;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    clientSecretExpiresAt: z.ZodOptional<z.ZodString>;
+    tokenEndpoint: z.ZodString;
+    tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<{
+        client_secret_post: "client_secret_post";
+        client_secret_basic: "client_secret_basic";
+        none: "none";
+    }>>;
+    scopes: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type DepositCredentialsBody = z.infer<typeof depositCredentialsBodySchema>;
+export declare function buildMcpOAuthCredentialInput({ body, userId, encryption, }: {
+    body: DepositCredentialsBody;
+    userId: number;
+    encryption: CredentialEncryption;
+}): McpOAuthCredentialInput;
+//# sourceMappingURL=mcp-oauth-credentials.d.ts.map

package/dist/http/mcp-oauth-credentials.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.depositCredentialsBodySchema = void 0;
+exports.buildMcpOAuthCredentialInput = buildMcpOAuthCredentialInput;
+const zod_1 = require("zod");
+const token_endpoint_url_1 = __importDefault(require("../oauth/token-endpoint-url"));
+// String lengths mirror the DB column limits, so oversized values are rejected here at the boundary
+// rather than at insert. .strict() matters for security: it blocks a body-supplied user id, since
+// identity comes only from the JWT.
+exports.depositCredentialsBodySchema = zod_1.z
+    .object({
+    mcpServerId: zod_1.z.string().min(1).max(255),
+    refreshToken: zod_1.z.string().min(1),
+    clientId: zod_1.z.string().min(1).max(255).optional(),
+    clientSecret: zod_1.z.string().min(1).optional(),
+    clientSecretExpiresAt: zod_1.z
+        .string()
+        .refine(value => !Number.isNaN(Date.parse(value)), { message: 'must be a parseable date' })
+        .optional(),
+    tokenEndpoint: zod_1.z
+        .string()
+        .min(1)
+        .max(2048)
+        .superRefine((value, ctx) => {
+        // The executor POSTs the refresh grant here, so reject SSRF-prone endpoints at deposit
+        // rather than discovering them at refresh time.
+        try {
+            (0, token_endpoint_url_1.default)(value);
+        }
+        catch (error) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: error instanceof Error ? error.message : 'invalid token endpoint',
+            });
+        }
+    }),
+    // Restrict to the methods the refresh grant implements, so an unsupported/typo'd one is rejected
+    // here rather than silently mis-authenticating at refresh time ('none' = public client).
+    tokenEndpointAuthMethod: zod_1.z
+        .enum(['client_secret_basic', 'client_secret_post', 'none'])
+        .optional(),
+    scopes: zod_1.z.string().max(2048).optional(),
+})
+    .strict()
+    .superRefine((body, ctx) => {
+    // RFC 6749 requires client_id alongside client_secret; a secret with no id can never
+    // authenticate, so reject it here instead of persisting an unusable credential.
+    if (body.clientSecret && !body.clientId) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['clientId'],
+            message: 'clientId is required when clientSecret is provided',
+        });
+    }
+});
+// Translates a validated deposit body into the at-rest record: encrypts the refresh token (and
+// client secret when present) and maps optional fields to their nullable columns. encrypt() throws
+// ExecutorEncryptionKeyMissingError when the key is unset; the caller maps that to a 503.
+function buildMcpOAuthCredentialInput({ body, userId, encryption, }) {
+    const refreshToken = encryption.encrypt(body.refreshToken);
+    const clientSecret = body.clientSecret ? encryption.encrypt(body.clientSecret) : null;
+    return {
+        userId,
+        mcpServerId: body.mcpServerId,
+        refreshTokenEnc: refreshToken.ciphertext,
+        clientId: body.clientId ?? null,
+        clientSecretEnc: clientSecret?.ciphertext ?? null,
+        clientSecretExpiresAt: body.clientSecretExpiresAt ? new Date(body.clientSecretExpiresAt) : null,
+        tokenEndpoint: body.tokenEndpoint,
+        tokenEndpointAuthMethod: body.tokenEndpointAuthMethod ?? null,
+        scopes: body.scopes ?? null,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWNwLW9hdXRoLWNyZWRlbnRpYWxzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2h0dHAvbWNwLW9hdXRoLWNyZWRlbnRpYWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQTZEQSxvRUF1QkM7QUFqRkQsNkJBQXdCO0FBRXhCLHFGQUFrRTtBQUVsRSxvR0FBb0c7QUFDcEcsa0dBQWtHO0FBQ2xHLG9DQUFvQztBQUN2QixRQUFBLDRCQUE0QixHQUFHLE9BQUM7S0FDMUMsTUFBTSxDQUFDO0lBQ04sV0FBVyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztJQUN2QyxZQUFZLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDL0IsUUFBUSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUMvQyxZQUFZLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDMUMscUJBQXFCLEVBQUUsT0FBQztTQUNyQixNQUFNLEVBQUU7U0FDUixNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLDBCQUEwQixFQUFFLENBQUM7U0FDMUYsUUFBUSxFQUFFO0lBQ2IsYUFBYSxFQUFFLE9BQUM7U0FDYixNQUFNLEVBQUU7U0FDUixHQUFHLENBQUMsQ0FBQyxDQUFDO1NBQ04sR0FBRyxDQUFDLElBQUksQ0FBQztTQUNULFdBQVcsQ0FBQyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRTtRQUMxQix1RkFBdUY7UUFDdkYsZ0RBQWdEO1FBQ2hELElBQUksQ0FBQztZQUNILElBQUEsNEJBQXVCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixHQUFHLENBQUMsUUFBUSxDQUFDO2dCQUNYLElBQUksRUFBRSxPQUFDLENBQUMsWUFBWSxDQUFDLE1BQU07Z0JBQzNCLE9BQU8sRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyx3QkFBd0I7YUFDM0UsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztJQUNILENBQUMsQ0FBQztJQUNKLGlHQUFpRztJQUNqRyx5RkFBeUY7SUFDekYsdUJBQXVCLEVBQUUsT0FBQztTQUN2QixJQUFJLENBQUMsQ0FBQyxxQkFBcUIsRUFBRSxvQkFBb0IsRUFBRSxNQUFNLENBQUMsQ0FBQztTQUMzRCxRQUFRLEVBQUU7SUFDYixNQUFNLEVBQUUsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUU7Q0FDeEMsQ0FBQztLQUNELE1BQU0sRUFBRTtLQUNSLFdBQVcsQ0FBQyxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsRUFBRTtJQUN6QixxRkFBcUY7SUFDckYsZ0ZBQWdGO0lBQ2hGLElBQUksSUFBSSxDQUFDLFlBQVksSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QyxHQUFHLENBQUMsUUFBUSxDQUFDO1lBQ1gsSUFBSSxFQUFFLE9BQUMsQ0FBQyxZQUFZLENBQUMsTUFBTTtZQUMzQixJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUM7WUFDbEIsT0FBTyxFQUFFLG9EQUFvRDtTQUM5RCxDQUFDLENBQUM7SUFDTCxDQUFDO0FBQ0gsQ0FBQyxDQUFDLENBQUM7QUFJTCwrRkFBK0Y7QUFDL0YsbUdBQW1HO0FBQ25HLDBGQUEwRjtBQUMxRixTQUFnQiw0QkFBNEIsQ0FBQyxFQUMzQyxJQUFJLEVBQ0osTUFBTSxFQUNOLFVBQVUsR0FLWDtJQUNDLE1BQU0sWUFBWSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQzNELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFFdEYsT0FBTztRQUNMLE1BQU07UUFDTixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7UUFDN0IsZUFBZSxFQUFFLFlBQVksQ0FBQyxVQUFVO1FBQ3hDLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxJQUFJLElBQUk7UUFDL0IsZUFBZSxFQUFFLFlBQVksRUFBRSxVQUFVLElBQUksSUFBSTtRQUNqRCxxQkFBcUIsRUFBRSxJQUFJLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJO1FBQy9GLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtRQUNqQyx1QkFBdUIsRUFBRSxJQUFJLENBQUMsdUJBQXVCLElBQUksSUFBSTtRQUM3RCxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sSUFBSSxJQUFJO0tBQzVCLENBQUM7QUFDSixDQUFDIn0=

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export type { WorkflowPort } from './ports/workflow-port';
 export type { RunStore } from './ports/run-store';
 export type { Logger } from './ports/logger-port';
 export { default as ConsoleLogger } from './adapters/console-logger';
-export { WorkflowExecutorError, MissingToolCallError, MalformedToolCallError, RecordNotFoundError, NoRecordsError, NoReadableFieldsError, NoResolvedFieldsError, NoWritableFieldsError, NoActionsError, NoRelationshipFieldsError, RelatedRecordNotFoundError, InvalidAIResponseError, InvalidAiRequestError, RelationNotFoundError, FieldNotFoundError, ActionNotFoundError, StepStateError, NoMcpToolsError, McpToolNotFoundError, McpToolInvocationError, AgentPortError, WorkflowPortError, RunStorePortError, AiModelPortError, AgentProbeError, ConfigurationError, InvalidPreRecordedArgsError, UnsupportedStepTypeError, UnsupportedActionFormError, InvalidStepDefinitionError, DomainValidationError, } from './errors';
+export { WorkflowExecutorError, MissingToolCallError, MalformedToolCallError, RecordNotFoundError, NoRecordsError, NoReadableFieldsError, NoResolvedFieldsError, NoWritableFieldsError, NoActionsError, NoRelationshipFieldsError, RelatedRecordNotFoundError, InvalidAIResponseError, InvalidAiRequestError, RelationNotFoundError, FieldNotFoundError, ActionNotFoundError, StepStateError, NoMcpToolsError, McpToolNotFoundError, McpToolInvocationError, AgentPortError, WorkflowPortError, RunStorePortError, AiModelPortError, AgentProbeError, ConfigurationError, ExecutorEncryptionKeyMissingError, InvalidPreRecordedArgsError, UnsupportedStepTypeError, UnsupportedActionFormError, InvalidStepDefinitionError, DomainValidationError, } from './errors';
 export { default as BaseStepExecutor } from './executors/base-step-executor';
 export { default as ConditionStepExecutor } from './executors/condition-step-executor';
 export { default as ReadRecordStepExecutor } from './executors/read-record-step-executor';
@@ -30,6 +30,12 @@ export { default as SchemaResolver } from './schema-resolver';
 export { default as InMemoryStore } from './stores/in-memory-store';
 export { default as DatabaseStore } from './stores/database-store';
 export type { DatabaseStoreOptions } from './stores/database-store';
+export { default as DatabaseMcpOAuthCredentialsStore } from './stores/database-mcp-oauth-credentials-store';
+export type { DatabaseMcpOAuthCredentialsStoreOptions } from './stores/database-mcp-oauth-credentials-store';
+export { default as InMemoryMcpOAuthCredentialsStore } from './stores/in-memory-mcp-oauth-credentials-store';
+export type { McpOAuthCredentialsStore, McpOAuthCredentialInput, StoredMcpOAuthCredential, } from './ports/mcp-oauth-credentials-store';
+export { default as CredentialEncryption } from './crypto/credential-encryption';
+export type { EncryptedValue } from './crypto/credential-encryption';
 export { buildDatabaseRunStore, buildInMemoryRunStore } from './stores/build-run-store';
 export { buildInMemoryExecutor, buildDatabaseExecutor } from './build-workflow-executor';
 export { runCli } from './cli-core';

package/dist/index.js

@@ -3,8 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DatabaseStore = exports.InMemoryStore = exports.SchemaResolver = exports.SchemaCache = exports.validateSecrets = exports.Runner = exports.ExecutorHttpServer = exports.ForestServerWorkflowPort = exports.AgentClientAgentPort = exports.GuidanceStepExecutor = exports.McpStepExecutor = exports.LoadRelatedRecordStepExecutor = exports.TriggerRecordActionStepExecutor = exports.UpdateRecordStepExecutor = exports.ReadRecordStepExecutor = exports.ConditionStepExecutor = exports.BaseStepExecutor = exports.DomainValidationError = exports.InvalidStepDefinitionError = exports.UnsupportedActionFormError = exports.UnsupportedStepTypeError = exports.InvalidPreRecordedArgsError = exports.ConfigurationError = exports.AgentProbeError = exports.AiModelPortError = exports.RunStorePortError = exports.WorkflowPortError = exports.AgentPortError = exports.McpToolInvocationError = exports.McpToolNotFoundError = exports.NoMcpToolsError = exports.StepStateError = exports.ActionNotFoundError = exports.FieldNotFoundError = exports.RelationNotFoundError = exports.InvalidAiRequestError = exports.InvalidAIResponseError = exports.RelatedRecordNotFoundError = exports.NoRelationshipFieldsError = exports.NoActionsError = exports.NoWritableFieldsError = exports.NoResolvedFieldsError = exports.NoReadableFieldsError = exports.NoRecordsError = exports.RecordNotFoundError = exports.MalformedToolCallError = exports.MissingToolCallError = exports.WorkflowExecutorError = exports.ConsoleLogger = exports.StepType = void 0;
-exports.PrettyLogger = exports.runCli = exports.buildDatabaseExecutor = exports.buildInMemoryExecutor = exports.buildInMemoryRunStore = exports.buildDatabaseRunStore = void 0;
+exports.InMemoryStore = exports.SchemaResolver = exports.SchemaCache = exports.validateSecrets = exports.Runner = exports.ExecutorHttpServer = exports.ForestServerWorkflowPort = exports.AgentClientAgentPort = exports.GuidanceStepExecutor = exports.McpStepExecutor = exports.LoadRelatedRecordStepExecutor = exports.TriggerRecordActionStepExecutor = exports.UpdateRecordStepExecutor = exports.ReadRecordStepExecutor = exports.ConditionStepExecutor = exports.BaseStepExecutor = exports.DomainValidationError = exports.InvalidStepDefinitionError = exports.UnsupportedActionFormError = exports.UnsupportedStepTypeError = exports.InvalidPreRecordedArgsError = exports.ExecutorEncryptionKeyMissingError = exports.ConfigurationError = exports.AgentProbeError = exports.AiModelPortError = exports.RunStorePortError = exports.WorkflowPortError = exports.AgentPortError = exports.McpToolInvocationError = exports.McpToolNotFoundError = exports.NoMcpToolsError = exports.StepStateError = exports.ActionNotFoundError = exports.FieldNotFoundError = exports.RelationNotFoundError = exports.InvalidAiRequestError = exports.InvalidAIResponseError = exports.RelatedRecordNotFoundError = exports.NoRelationshipFieldsError = exports.NoActionsError = exports.NoWritableFieldsError = exports.NoResolvedFieldsError = exports.NoReadableFieldsError = exports.NoRecordsError = exports.RecordNotFoundError = exports.MalformedToolCallError = exports.MissingToolCallError = exports.WorkflowExecutorError = exports.ConsoleLogger = exports.StepType = void 0;
+exports.PrettyLogger = exports.runCli = exports.buildDatabaseExecutor = exports.buildInMemoryExecutor = exports.buildInMemoryRunStore = exports.buildDatabaseRunStore = exports.CredentialEncryption = exports.InMemoryMcpOAuthCredentialsStore = exports.DatabaseMcpOAuthCredentialsStore = exports.DatabaseStore = void 0;
 var step_definition_1 = require("./types/validated/step-definition");
 Object.defineProperty(exports, "StepType", { enumerable: true, get: function () { return step_definition_1.StepType; } });
 var console_logger_1 = require("./adapters/console-logger");
@@ -36,6 +36,7 @@ Object.defineProperty(exports, "RunStorePortError", { enumerable: true, get: fun
 Object.defineProperty(exports, "AiModelPortError", { enumerable: true, get: function () { return errors_1.AiModelPortError; } });
 Object.defineProperty(exports, "AgentProbeError", { enumerable: true, get: function () { return errors_1.AgentProbeError; } });
 Object.defineProperty(exports, "ConfigurationError", { enumerable: true, get: function () { return errors_1.ConfigurationError; } });
+Object.defineProperty(exports, "ExecutorEncryptionKeyMissingError", { enumerable: true, get: function () { return errors_1.ExecutorEncryptionKeyMissingError; } });
 Object.defineProperty(exports, "InvalidPreRecordedArgsError", { enumerable: true, get: function () { return errors_1.InvalidPreRecordedArgsError; } });
 Object.defineProperty(exports, "UnsupportedStepTypeError", { enumerable: true, get: function () { return errors_1.UnsupportedStepTypeError; } });
 Object.defineProperty(exports, "UnsupportedActionFormError", { enumerable: true, get: function () { return errors_1.UnsupportedActionFormError; } });
@@ -75,6 +76,12 @@ var in_memory_store_1 = require("./stores/in-memory-store");
 Object.defineProperty(exports, "InMemoryStore", { enumerable: true, get: function () { return __importDefault(in_memory_store_1).default; } });
 var database_store_1 = require("./stores/database-store");
 Object.defineProperty(exports, "DatabaseStore", { enumerable: true, get: function () { return __importDefault(database_store_1).default; } });
+var database_mcp_oauth_credentials_store_1 = require("./stores/database-mcp-oauth-credentials-store");
+Object.defineProperty(exports, "DatabaseMcpOAuthCredentialsStore", { enumerable: true, get: function () { return __importDefault(database_mcp_oauth_credentials_store_1).default; } });
+var in_memory_mcp_oauth_credentials_store_1 = require("./stores/in-memory-mcp-oauth-credentials-store");
+Object.defineProperty(exports, "InMemoryMcpOAuthCredentialsStore", { enumerable: true, get: function () { return __importDefault(in_memory_mcp_oauth_credentials_store_1).default; } });
+var credential_encryption_1 = require("./crypto/credential-encryption");
+Object.defineProperty(exports, "CredentialEncryption", { enumerable: true, get: function () { return __importDefault(credential_encryption_1).default; } });
 var build_run_store_1 = require("./stores/build-run-store");
 Object.defineProperty(exports, "buildDatabaseRunStore", { enumerable: true, get: function () { return build_run_store_1.buildDatabaseRunStore; } });
 Object.defineProperty(exports, "buildInMemoryRunStore", { enumerable: true, get: function () { return build_run_store_1.buildInMemoryRunStore; } });
@@ -85,4 +92,4 @@ var cli_core_1 = require("./cli-core");
 Object.defineProperty(exports, "runCli", { enumerable: true, get: function () { return cli_core_1.runCli; } });
 var pretty_logger_1 = require("./adapters/pretty-logger");
 Object.defineProperty(exports, "PrettyLogger", { enumerable: true, get: function () { return __importDefault(pretty_logger_1).default; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7OztBQUFBLHFFQUE2RDtBQUFwRCwyR0FBQSxRQUFRLE9BQUE7QUF5RWpCLDREQUFxRTtBQUE1RCxnSUFBQSxPQUFPLE9BQWlCO0FBRWpDLG1DQWdDa0I7QUEvQmhCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLDhHQUFBLG9CQUFvQixPQUFBO0FBQ3BCLGdIQUFBLHNCQUFzQixPQUFBO0FBQ3RCLDZHQUFBLG1CQUFtQixPQUFBO0FBQ25CLHdHQUFBLGNBQWMsT0FBQTtBQUNkLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLHdHQUFBLGNBQWMsT0FBQTtBQUNkLG1IQUFBLHlCQUF5QixPQUFBO0FBQ3pCLG9IQUFBLDBCQUEwQixPQUFBO0FBQzFCLGdIQUFBLHNCQUFzQixPQUFBO0FBQ3RCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLDRHQUFBLGtCQUFrQixPQUFBO0FBQ2xCLDZHQUFBLG1CQUFtQixPQUFBO0FBQ25CLHdHQUFBLGNBQWMsT0FBQTtBQUNkLHlHQUFBLGVBQWUsT0FBQTtBQUNmLDhHQUFBLG9CQUFvQixPQUFBO0FBQ3BCLGdIQUFBLHNCQUFzQixPQUFBO0FBQ3RCLHdHQUFBLGNBQWMsT0FBQTtBQUNkLDJHQUFBLGlCQUFpQixPQUFBO0FBQ2pCLDJHQUFBLGlCQUFpQixPQUFBO0FBQ2pCLDBHQUFBLGdCQUFnQixPQUFBO0FBQ2hCLHlHQUFBLGVBQWUsT0FBQTtBQUNmLDRHQUFBLGtCQUFrQixPQUFBO0FBQ2xCLHFIQUFBLDJCQUEyQixPQUFBO0FBQzNCLGtIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLG9IQUFBLDBCQUEwQixPQUFBO0FBQzFCLG9IQUFBLDBCQUEwQixPQUFBO0FBQzFCLCtHQUFBLHFCQUFxQixPQUFBO0FBRXZCLHFFQUE2RTtBQUFwRSx1SUFBQSxPQUFPLE9BQW9CO0FBQ3BDLCtFQUF1RjtBQUE5RSxpSkFBQSxPQUFPLE9BQXlCO0FBQ3pDLG1GQUEwRjtBQUFqRixvSkFBQSxPQUFPLE9BQTBCO0FBQzFDLHVGQUE4RjtBQUFyRix3SkFBQSxPQUFPLE9BQTRCO0FBQzVDLHVHQUE2RztBQUFwRyx1S0FBQSxPQUFPLE9BQW1DO0FBQ25ELG1HQUF5RztBQUFoRyxtS0FBQSxPQUFPLE9BQWlDO0FBQ2pELG1FQUEyRTtBQUFsRSxxSUFBQSxPQUFPLE9BQW1CO0FBQ25DLDZFQUFxRjtBQUE1RSwrSUFBQSxPQUFPLE9BQXdCO0FBQ3hDLDhFQUFxRjtBQUE1RSxnSkFBQSxPQUFPLE9BQXdCO0FBQ3hDLHNGQUE2RjtBQUFwRix3SkFBQSxPQUFPLE9BQTRCO0FBQzVDLG9FQUE0RTtBQUFuRSwySUFBQSxPQUFPLE9BQXNCO0FBRXRDLG1DQUE2QztBQUFwQyxpSEFBQSxPQUFPLE9BQVU7QUFFMUIsdURBQWdFO0FBQXZELG9JQUFBLE9BQU8sT0FBbUI7QUFDbkMsK0NBQXdEO0FBQS9DLDRIQUFBLE9BQU8sT0FBZTtBQUMvQixxREFBOEQ7QUFBckQsa0lBQUEsT0FBTyxPQUFrQjtBQUNsQyw0REFBb0U7QUFBM0QsaUlBQUEsT0FBTyxPQUFpQjtBQUNqQywwREFBbUU7QUFBMUQsZ0lBQUEsT0FBTyxPQUFpQjtBQUVqQyw0REFBd0Y7QUFBL0Usd0hBQUEscUJBQXFCLE9BQUE7QUFBRSx3SEFBQSxxQkFBcUIsT0FBQTtBQUNyRCxxRUFBeUY7QUFBaEYsZ0lBQUEscUJBQXFCLE9BQUE7QUFBRSxnSUFBQSxxQkFBcUIsT0FBQTtBQUNyRCx1Q0FBb0M7QUFBM0Isa0dBQUEsTUFBTSxPQUFBO0FBQ2YsMERBQW1FO0FBQTFELDhIQUFBLE9BQU8sT0FBZ0IifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7OztBQUFBLHFFQUE2RDtBQUFwRCwyR0FBQSxRQUFRLE9BQUE7QUF5RWpCLDREQUFxRTtBQUE1RCxnSUFBQSxPQUFPLE9BQWlCO0FBRWpDLG1DQWlDa0I7QUFoQ2hCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLDhHQUFBLG9CQUFvQixPQUFBO0FBQ3BCLGdIQUFBLHNCQUFzQixPQUFBO0FBQ3RCLDZHQUFBLG1CQUFtQixPQUFBO0FBQ25CLHdHQUFBLGNBQWMsT0FBQTtBQUNkLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLHdHQUFBLGNBQWMsT0FBQTtBQUNkLG1IQUFBLHlCQUF5QixPQUFBO0FBQ3pCLG9IQUFBLDBCQUEwQixPQUFBO0FBQzFCLGdIQUFBLHNCQUFzQixPQUFBO0FBQ3RCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLCtHQUFBLHFCQUFxQixPQUFBO0FBQ3JCLDRHQUFBLGtCQUFrQixPQUFBO0FBQ2xCLDZHQUFBLG1CQUFtQixPQUFBO0FBQ25CLHdHQUFBLGNBQWMsT0FBQTtBQUNkLHlHQUFBLGVBQWUsT0FBQTtBQUNmLDhHQUFBLG9CQUFvQixPQUFBO0FBQ3BCLGdIQUFBLHNCQUFzQixPQUFBO0FBQ3RCLHdHQUFBLGNBQWMsT0FBQTtBQUNkLDJHQUFBLGlCQUFpQixPQUFBO0FBQ2pCLDJHQUFBLGlCQUFpQixPQUFBO0FBQ2pCLDBHQUFBLGdCQUFnQixPQUFBO0FBQ2hCLHlHQUFBLGVBQWUsT0FBQTtBQUNmLDRHQUFBLGtCQUFrQixPQUFBO0FBQ2xCLDJIQUFBLGlDQUFpQyxPQUFBO0FBQ2pDLHFIQUFBLDJCQUEyQixPQUFBO0FBQzNCLGtIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLG9IQUFBLDBCQUEwQixPQUFBO0FBQzFCLG9IQUFBLDBCQUEwQixPQUFBO0FBQzFCLCtHQUFBLHFCQUFxQixPQUFBO0FBRXZCLHFFQUE2RTtBQUFwRSx1SUFBQSxPQUFPLE9BQW9CO0FBQ3BDLCtFQUF1RjtBQUE5RSxpSkFBQSxPQUFPLE9BQXlCO0FBQ3pDLG1GQUEwRjtBQUFqRixvSkFBQSxPQUFPLE9BQTBCO0FBQzFDLHVGQUE4RjtBQUFyRix3SkFBQSxPQUFPLE9BQTRCO0FBQzVDLHVHQUE2RztBQUFwRyx1S0FBQSxPQUFPLE9BQW1DO0FBQ25ELG1HQUF5RztBQUFoRyxtS0FBQSxPQUFPLE9BQWlDO0FBQ2pELG1FQUEyRTtBQUFsRSxxSUFBQSxPQUFPLE9BQW1CO0FBQ25DLDZFQUFxRjtBQUE1RSwrSUFBQSxPQUFPLE9BQXdCO0FBQ3hDLDhFQUFxRjtBQUE1RSxnSkFBQSxPQUFPLE9BQXdCO0FBQ3hDLHNGQUE2RjtBQUFwRix3SkFBQSxPQUFPLE9BQTRCO0FBQzVDLG9FQUE0RTtBQUFuRSwySUFBQSxPQUFPLE9BQXNCO0FBRXRDLG1DQUE2QztBQUFwQyxpSEFBQSxPQUFPLE9BQVU7QUFFMUIsdURBQWdFO0FBQXZELG9JQUFBLE9BQU8sT0FBbUI7QUFDbkMsK0NBQXdEO0FBQS9DLDRIQUFBLE9BQU8sT0FBZTtBQUMvQixxREFBOEQ7QUFBckQsa0lBQUEsT0FBTyxPQUFrQjtBQUNsQyw0REFBb0U7QUFBM0QsaUlBQUEsT0FBTyxPQUFpQjtBQUNqQywwREFBbUU7QUFBMUQsZ0lBQUEsT0FBTyxPQUFpQjtBQUVqQyxzR0FBNEc7QUFBbkcseUtBQUEsT0FBTyxPQUFvQztBQUVwRCx3R0FBNkc7QUFBcEcsMEtBQUEsT0FBTyxPQUFvQztBQU1wRCx3RUFBaUY7QUFBeEUsOElBQUEsT0FBTyxPQUF3QjtBQUV4Qyw0REFBd0Y7QUFBL0Usd0hBQUEscUJBQXFCLE9BQUE7QUFBRSx3SEFBQSxxQkFBcUIsT0FBQTtBQUNyRCxxRUFBeUY7QUFBaEYsZ0lBQUEscUJBQXFCLE9BQUE7QUFBRSxnSUFBQSxxQkFBcUIsT0FBQTtBQUNyRCx1Q0FBb0M7QUFBM0Isa0dBQUEsTUFBTSxPQUFBO0FBQ2YsMERBQW1FO0FBQTFELDhIQUFBLE9BQU8sT0FBZ0IifQ==

package/dist/oauth/keyed-mutex.d.ts

@@ -0,0 +1,5 @@
+export default class KeyedMutex {
+    private readonly tails;
+    runExclusive<T>(key: string, task: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=keyed-mutex.d.ts.map

package/dist/oauth/keyed-mutex.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// Serializes async work per key: callers sharing a key run one at a time (FIFO), while different
+// keys proceed in parallel. Used to collapse concurrent token refreshes for the same (user, server)
+// into a single in-flight refresh within one process.
+class KeyedMutex {
+    constructor() {
+        this.tails = new Map();
+    }
+    async runExclusive(key, task) {
+        const previous = this.tails.get(key) ?? Promise.resolve();
+        const result = previous.then(() => task());
+        // Store a non-rejecting tail so the next caller chains regardless of this task's outcome.
+        const tail = result.then(() => undefined, () => undefined);
+        this.tails.set(key, tail);
+        try {
+            return await result;
+        }
+        finally {
+            // Drop the entry once this was the last queued task for the key, so the map can't grow.
+            if (this.tails.get(key) === tail)
+                this.tails.delete(key);
+        }
+    }
+}
+exports.default = KeyedMutex;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5ZWQtbXV0ZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb2F1dGgva2V5ZWQtbXV0ZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxpR0FBaUc7QUFDakcsb0dBQW9HO0FBQ3BHLHNEQUFzRDtBQUN0RCxNQUFxQixVQUFVO0lBQS9CO1FBQ21CLFVBQUssR0FBRyxJQUFJLEdBQUcsRUFBNEIsQ0FBQztJQW1CL0QsQ0FBQztJQWpCQyxLQUFLLENBQUMsWUFBWSxDQUFJLEdBQVcsRUFBRSxJQUFzQjtRQUN2RCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDMUQsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzNDLDBGQUEwRjtRQUMxRixNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUN0QixHQUFHLEVBQUUsQ0FBQyxTQUFTLEVBQ2YsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUNoQixDQUFDO1FBQ0YsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRTFCLElBQUksQ0FBQztZQUNILE9BQU8sTUFBTSxNQUFNLENBQUM7UUFDdEIsQ0FBQztnQkFBUyxDQUFDO1lBQ1Qsd0ZBQXdGO1lBQ3hGLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssSUFBSTtnQkFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMzRCxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBcEJELDZCQW9CQyJ9

package/dist/oauth/refresh-grant.d.ts

@@ -0,0 +1,15 @@
+export interface RefreshGrantParams {
+    tokenEndpoint: string;
+    refreshToken: string;
+    clientId?: string | null;
+    clientSecret?: string | null;
+    tokenEndpointAuthMethod?: string | null;
+    scopes?: string | null;
+}
+export interface RefreshGrantResult {
+    accessToken: string;
+    expiresInS?: number;
+    refreshToken?: string;
+}
+export default function refreshAccessToken(params: RefreshGrantParams): Promise<RefreshGrantResult>;
+//# sourceMappingURL=refresh-grant.d.ts.map

package/dist/oauth/refresh-grant.js

@@ -0,0 +1,112 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = refreshAccessToken;
+const errors_1 = require("../errors");
+const token_endpoint_url_1 = __importDefault(require("./token-endpoint-url"));
+// RFC 6749 §2.3.1 form-url-encodes the client id/secret before base64 (space → '+', unlike
+// encodeURIComponent's '%20'); identical for the base64url/hex credentials providers actually issue.
+function formUrlEncode(value) {
+    const params = new URLSearchParams();
+    params.set('v', value);
+    return params.toString().slice('v='.length);
+}
+// Some providers return expires_in as a numeric string; coerce it so the token is still cached
+// (an unusable value leaves it uncached, forcing a full refresh — and rotation — on every call).
+function coerceExpiresInS(value) {
+    if (typeof value === 'number')
+        return value;
+    if (typeof value === 'string' && /^\d+$/.test(value))
+        return Number(value);
+    return undefined;
+}
+function buildRequest(params) {
+    const headers = {
+        'content-type': 'application/x-www-form-urlencoded',
+        accept: 'application/json',
+    };
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: params.refreshToken,
+    });
+    if (params.scopes)
+        body.set('scope', params.scopes);
+    const { clientId, clientSecret, tokenEndpointAuthMethod } = params;
+    if (clientSecret) {
+        if (tokenEndpointAuthMethod === 'client_secret_post') {
+            if (clientId)
+                body.set('client_id', clientId);
+            body.set('client_secret', clientSecret);
+        }
+        else {
+            const credentials = `${formUrlEncode(clientId ?? '')}:${formUrlEncode(clientSecret)}`;
+            headers.authorization = `Basic ${Buffer.from(credentials).toString('base64')}`;
+        }
+    }
+    else if (clientId) {
+        body.set('client_id', clientId);
+    }
+    return { headers, body };
+}
+// Runs the OAuth2 refresh-token grant (RFC 6749 §6) against the stored token endpoint. Distinguishes
+// a non-retryable invalid_grant (revoked / rotated) from a transient failure so the caller can decide
+// between forcing re-auth and retrying.
+async function refreshAccessToken(params) {
+    // Defense in depth: deposit validation rejects SSRF-prone endpoints, but a row predating that
+    // validation could still carry one — re-check before the outbound POST. Throws (terminal) rather
+    // than reaching the network.
+    (0, token_endpoint_url_1.default)(params.tokenEndpoint);
+    const { headers, body } = buildRequest(params);
+    let response;
+    try {
+        // Never follow redirects: a 3xx to an internal host would re-send the grant body (refresh
+        // token, plus the client secret in client_secret_post) there and parse its reply as a token —
+        // bypassing the endpoint validation above. Any redirect is treated as a failure.
+        response = await fetch(params.tokenEndpoint, {
+            method: 'POST',
+            headers,
+            body,
+            redirect: 'manual',
+        });
+    }
+    catch (cause) {
+        throw new errors_1.OAuthRefreshError('the token endpoint could not be reached', cause);
+    }
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new errors_1.OAuthRefreshError('the token endpoint attempted a redirect');
+    }
+    let payload = {};
+    try {
+        const parsed = await response.json();
+        // Ignore a non-object body (e.g. literal null), keeping the {} default so the status checks
+        // below still surface a typed OAuthRefreshError.
+        if (parsed && typeof parsed === 'object')
+            payload = parsed;
+    }
+    catch {
+        // Non-JSON body — handled by the status checks below.
+    }
+    if (!response.ok) {
+        // invalid_client / unauthorized_client mean the client credential itself is dead (e.g. an expired
+        // secret) — non-retryable like invalid_grant, so route to re-consent instead of a doomed retry.
+        if (payload.error === 'invalid_grant' ||
+            payload.error === 'invalid_client' ||
+            payload.error === 'unauthorized_client') {
+            throw new errors_1.OAuthInvalidGrantError(typeof payload.error_description === 'string' ? payload.error_description : undefined);
+        }
+        throw new errors_1.OAuthRefreshError(typeof payload.error === 'string'
+            ? payload.error
+            : `the token endpoint returned ${response.status}`);
+    }
+    if (typeof payload.access_token !== 'string' || !payload.access_token) {
+        throw new errors_1.OAuthRefreshError('the token endpoint response had no access_token');
+    }
+    return {
+        accessToken: payload.access_token,
+        expiresInS: coerceExpiresInS(payload.expires_in),
+        refreshToken: typeof payload.refresh_token === 'string' ? payload.refresh_token : undefined,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVmcmVzaC1ncmFudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9vYXV0aC9yZWZyZXNoLWdyYW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBZ0ZBLHFDQXNFQztBQXRKRCxzQ0FBc0U7QUFDdEUsOEVBQTJEO0FBMEIzRCwyRkFBMkY7QUFDM0YscUdBQXFHO0FBQ3JHLFNBQVMsYUFBYSxDQUFDLEtBQWE7SUFDbEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztJQUNyQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUV2QixPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQzlDLENBQUM7QUFFRCwrRkFBK0Y7QUFDL0YsaUdBQWlHO0FBQ2pHLFNBQVMsZ0JBQWdCLENBQUMsS0FBYztJQUN0QyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUM1QyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQztRQUFFLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBRTNFLE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FBQyxNQUEwQjtJQUk5QyxNQUFNLE9BQU8sR0FBMkI7UUFDdEMsY0FBYyxFQUFFLG1DQUFtQztRQUNuRCxNQUFNLEVBQUUsa0JBQWtCO0tBQzNCLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxJQUFJLGVBQWUsQ0FBQztRQUMvQixVQUFVLEVBQUUsZUFBZTtRQUMzQixhQUFhLEVBQUUsTUFBTSxDQUFDLFlBQVk7S0FDbkMsQ0FBQyxDQUFDO0lBRUgsSUFBSSxNQUFNLENBQUMsTUFBTTtRQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUVwRCxNQUFNLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSx1QkFBdUIsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUVuRSxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ2pCLElBQUksdUJBQXVCLEtBQUssb0JBQW9CLEVBQUUsQ0FBQztZQUNyRCxJQUFJLFFBQVE7Z0JBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDOUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDMUMsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLFdBQVcsR0FBRyxHQUFHLGFBQWEsQ0FBQyxRQUFRLElBQUksRUFBRSxDQUFDLElBQUksYUFBYSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDdEYsT0FBTyxDQUFDLGFBQWEsR0FBRyxTQUFTLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakYsQ0FBQztJQUNILENBQUM7U0FBTSxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ3BCLElBQUksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2xDLENBQUM7SUFFRCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQzNCLENBQUM7QUFFRCxxR0FBcUc7QUFDckcsc0dBQXNHO0FBQ3RHLHdDQUF3QztBQUN6QixLQUFLLFVBQVUsa0JBQWtCLENBQzlDLE1BQTBCO0lBRTFCLDhGQUE4RjtJQUM5RixpR0FBaUc7SUFDakcsNkJBQTZCO0lBQzdCLElBQUEsNEJBQXVCLEVBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBRTlDLE1BQU0sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEdBQUcsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRS9DLElBQUksUUFBMkMsQ0FBQztJQUVoRCxJQUFJLENBQUM7UUFDSCwwRkFBMEY7UUFDMUYsOEZBQThGO1FBQzlGLGlGQUFpRjtRQUNqRixRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsTUFBTSxDQUFDLGFBQWEsRUFBRTtZQUMzQyxNQUFNLEVBQUUsTUFBTTtZQUNkLE9BQU87WUFDUCxJQUFJO1lBQ0osUUFBUSxFQUFFLFFBQVE7U0FDbkIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLElBQUksMEJBQWlCLENBQUMseUNBQXlDLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUVELElBQUksUUFBUSxDQUFDLElBQUksS0FBSyxnQkFBZ0IsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLElBQUksR0FBRyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixNQUFNLElBQUksMEJBQWlCLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBRUQsSUFBSSxPQUFPLEdBQTBCLEVBQUUsQ0FBQztJQUV4QyxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBWSxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUM5Qyw0RkFBNEY7UUFDNUYsaURBQWlEO1FBQ2pELElBQUksTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVE7WUFBRSxPQUFPLEdBQUcsTUFBK0IsQ0FBQztJQUN0RixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1Asc0RBQXNEO0lBQ3hELENBQUM7SUFFRCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2pCLGtHQUFrRztRQUNsRyxnR0FBZ0c7UUFDaEcsSUFDRSxPQUFPLENBQUMsS0FBSyxLQUFLLGVBQWU7WUFDakMsT0FBTyxDQUFDLEtBQUssS0FBSyxnQkFBZ0I7WUFDbEMsT0FBTyxDQUFDLEtBQUssS0FBSyxxQkFBcUIsRUFDdkMsQ0FBQztZQUNELE1BQU0sSUFBSSwrQkFBc0IsQ0FDOUIsT0FBTyxPQUFPLENBQUMsaUJBQWlCLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDdEYsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLElBQUksMEJBQWlCLENBQ3pCLE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1lBQy9CLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSztZQUNmLENBQUMsQ0FBQywrQkFBK0IsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUNyRCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksT0FBTyxPQUFPLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUN0RSxNQUFNLElBQUksMEJBQWlCLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQsT0FBTztRQUNMLFdBQVcsRUFBRSxPQUFPLENBQUMsWUFBWTtRQUNqQyxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztRQUNoRCxZQUFZLEVBQUUsT0FBTyxPQUFPLENBQUMsYUFBYSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsU0FBUztLQUM1RixDQUFDO0FBQ0osQ0FBQyJ9

package/dist/oauth/token-endpoint-url.d.ts

@@ -0,0 +1,2 @@
+export default function assertSafeTokenEndpoint(raw: string): void;
+//# sourceMappingURL=token-endpoint-url.d.ts.map