@forestadmin/workflow-executor 1.12.0 → 1.14.0

package/dist/oauth/token-endpoint-url.js

@@ -0,0 +1,103 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = assertSafeTokenEndpoint;
+const net_1 = __importDefault(require("net"));
+const errors_1 = require("../errors");
+// The token endpoint comes from the deposit body, and the executor POSTs the refresh grant (with
+// client credentials) to it — so an unconstrained value is an SSRF vector. The guard rejects hosts
+// that are never a legitimate endpoint but are prime SSRF targets (loopback, link-local /
+// cloud-metadata) and requires TLS, while deliberately allowing private (RFC1918) hosts: a private
+// OAuth provider reached over the internal network is a supported deployment, so blocking it would
+// break a real use case. http and loopback are relaxed only when NODE_ENV explicitly opts in
+// (development/test) — see isRelaxedEnv. Only IP literals are inspected — resolving a hostname here
+// would be racy (it can resolve to a different address at fetch time), not safer.
+// Fail closed: the strict rules (https + no loopback) apply everywhere UNLESS NODE_ENV explicitly
+// opts into the local-dev relaxation. An unset or misspelled NODE_ENV stays strict, so a
+// misconfigured deploy can't silently allow loopback targets or cleartext http.
+function isRelaxedEnv() {
+    return process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test';
+}
+function unbracket(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+function classifyIpv4(host) {
+    const [a, b] = host.split('.').map(Number);
+    return {
+        loopback: a === 127, // 127.0.0.0/8
+        linkLocal: a === 169 && b === 254, // 169.254.0.0/16
+        unspecified: a === 0, // 0.0.0.0/8 — "this host"; connects to loopback on Linux
+    };
+}
+// Returns the embedded IPv4 of an IPv4-mapped IPv6 address (otherwise null). The WHATWG URL parser
+// normalizes `::ffff:127.0.0.1` to the hex form `::ffff:7f00:1`, which would otherwise dodge the
+// IPv4 loopback/link-local checks and still reach the executor's loopback / metadata interface.
+function embeddedIpv4(host) {
+    const tail = host.toLowerCase().match(/^::ffff:(.+)$/)?.[1];
+    if (!tail)
+        return null;
+    if (net_1.default.isIPv4(tail))
+        return tail;
+    const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (!hex)
+        return null;
+    const hi = parseInt(hex[1], 16); // high 16 bits → first two octets
+    const lo = parseInt(hex[2], 16); // low 16 bits → last two octets
+    return `${Math.floor(hi / 256)}.${hi % 256}.${Math.floor(lo / 256)}.${lo % 256}`;
+}
+function classify(host) {
+    const kind = net_1.default.isIP(host);
+    if (kind === 4)
+        return classifyIpv4(host);
+    if (kind === 6) {
+        const mapped = embeddedIpv4(host);
+        if (mapped)
+            return classifyIpv4(mapped);
+        const normalized = host.toLowerCase().split('%')[0]; // drop any zone id
+        const firstHextet = normalized.split(':')[0];
+        return {
+            loopback: normalized === '::1' || normalized === '0:0:0:0:0:0:0:1',
+            linkLocal: /^fe[89ab]/.test(firstHextet), // fe80::/10
+            unspecified: normalized === '::' || normalized === '0:0:0:0:0:0:0:0',
+        };
+    }
+    // Not an IP literal. Reject the reserved loopback names — bare `localhost`, the `.localhost` TLD
+    // (RFC 6761), and their trailing-dot FQDN forms — since they resolve to loopback. Other hostnames
+    // are left to the scheme rule; their DNS is not resolved here (a hostname pointed at an internal
+    // IP is the filtering-agent's job, not this string check).
+    return {
+        loopback: /^localhost\.?$|\.localhost\.?$/.test(host.toLowerCase()),
+        linkLocal: false,
+        unspecified: false,
+    };
+}
+function assertSafeTokenEndpoint(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new errors_1.InvalidTokenEndpointError('it is not a valid absolute URL');
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw new errors_1.InvalidTokenEndpointError('it must use http or https');
+    }
+    const { loopback, linkLocal, unspecified } = classify(unbracket(url.hostname));
+    if (unspecified) {
+        throw new errors_1.InvalidTokenEndpointError('it points at the unspecified address (0.0.0.0 / ::)');
+    }
+    if (linkLocal) {
+        throw new errors_1.InvalidTokenEndpointError('it points at a link-local / metadata address');
+    }
+    if (!isRelaxedEnv()) {
+        if (url.protocol !== 'https:') {
+            throw new errors_1.InvalidTokenEndpointError('it must use https');
+        }
+        if (loopback) {
+            throw new errors_1.InvalidTokenEndpointError('it points at the executor host (loopback)');
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4tZW5kcG9pbnQtdXJsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL3Rva2VuLWVuZHBvaW50LXVybC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQW9GQSwwQ0FnQ0M7QUFwSEQsOENBQXNCO0FBRXRCLHNDQUFzRDtBQUV0RCxpR0FBaUc7QUFDakcsbUdBQW1HO0FBQ25HLDBGQUEwRjtBQUMxRixtR0FBbUc7QUFDbkcsbUdBQW1HO0FBQ25HLDZGQUE2RjtBQUM3RixvR0FBb0c7QUFDcEcsa0ZBQWtGO0FBRWxGLGtHQUFrRztBQUNsRyx5RkFBeUY7QUFDekYsZ0ZBQWdGO0FBQ2hGLFNBQVMsWUFBWTtJQUNuQixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLGFBQWEsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUM7QUFDbkYsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLFFBQWdCO0lBQ2pDLE9BQU8sUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUM7QUFDL0YsQ0FBQztBQUlELFNBQVMsWUFBWSxDQUFDLElBQVk7SUFDaEMsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUUzQyxPQUFPO1FBQ0wsUUFBUSxFQUFFLENBQUMsS0FBSyxHQUFHLEVBQUUsY0FBYztRQUNuQyxTQUFTLEVBQUUsQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxFQUFFLGlCQUFpQjtRQUNwRCxXQUFXLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSx5REFBeUQ7S0FDaEYsQ0FBQztBQUNKLENBQUM7QUFFRCxtR0FBbUc7QUFDbkcsaUdBQWlHO0FBQ2pHLGdHQUFnRztBQUNoRyxTQUFTLFlBQVksQ0FBQyxJQUFZO0lBQ2hDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RCxJQUFJLENBQUMsSUFBSTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXZCLElBQUksYUFBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUVsQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDLEdBQUc7UUFBRSxPQUFPLElBQUksQ0FBQztJQUV0QixNQUFNLEVBQUUsR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsa0NBQWtDO0lBQ25FLE1BQU0sRUFBRSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxnQ0FBZ0M7SUFFakUsT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxHQUFHLEdBQUcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxHQUFHLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLEdBQUcsR0FBRyxDQUFDLElBQUksRUFBRSxHQUFHLEdBQUcsRUFBRSxDQUFDO0FBQ25GLENBQUM7QUFFRCxTQUFTLFFBQVEsQ0FBQyxJQUFZO0lBQzVCLE1BQU0sSUFBSSxHQUFHLGFBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFNUIsSUFBSSxJQUFJLEtBQUssQ0FBQztRQUFFLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRTFDLElBQUksSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2YsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2xDLElBQUksTUFBTTtZQUFFLE9BQU8sWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRXhDLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxtQkFBbUI7UUFDeEUsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUU3QyxPQUFPO1lBQ0wsUUFBUSxFQUFFLFVBQVUsS0FBSyxLQUFLLElBQUksVUFBVSxLQUFLLGlCQUFpQjtZQUNsRSxTQUFTLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxZQUFZO1lBQ3RELFdBQVcsRUFBRSxVQUFVLEtBQUssSUFBSSxJQUFJLFVBQVUsS0FBSyxpQkFBaUI7U0FDckUsQ0FBQztJQUNKLENBQUM7SUFFRCxpR0FBaUc7SUFDakcsa0dBQWtHO0lBQ2xHLGlHQUFpRztJQUNqRywyREFBMkQ7SUFDM0QsT0FBTztRQUNMLFFBQVEsRUFBRSxnQ0FBZ0MsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ25FLFNBQVMsRUFBRSxLQUFLO1FBQ2hCLFdBQVcsRUFBRSxLQUFLO0tBQ25CLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBd0IsdUJBQXVCLENBQUMsR0FBVztJQUN6RCxJQUFJLEdBQVEsQ0FBQztJQUViLElBQUksQ0FBQztRQUNILEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNyQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsTUFBTSxJQUFJLGtDQUF5QixDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVELElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksa0NBQXlCLENBQUMsMkJBQTJCLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRUQsTUFBTSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUUvRSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sSUFBSSxrQ0FBeUIsQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFFRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ2QsTUFBTSxJQUFJLGtDQUF5QixDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUVELElBQUksQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDO1FBQ3BCLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksa0NBQXlCLENBQUMsbUJBQW1CLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxrQ0FBeUIsQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO1FBQ25GLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist/oauth/token-service.d.ts

@@ -0,0 +1,34 @@
+import type { RefreshGrantParams, RefreshGrantResult } from './refresh-grant';
+import type CredentialEncryption from '../crypto/credential-encryption';
+import type { Logger } from '../ports/logger-port';
+import type { McpOAuthCredentialsStore } from '../ports/mcp-oauth-credentials-store';
+export interface OAuthTokenServiceOptions {
+    store: McpOAuthCredentialsStore;
+    encryption: CredentialEncryption;
+    logger?: Logger;
+    expirySkewS?: number;
+    refreshAccessToken?: (params: RefreshGrantParams) => Promise<RefreshGrantResult>;
+    now?: () => number;
+}
+export default class OAuthTokenService {
+    private readonly store;
+    private readonly encryption;
+    private readonly logger?;
+    private readonly expirySkewMs;
+    private readonly refreshAccessToken;
+    private readonly now;
+    private readonly cache;
+    private readonly mutex;
+    private readonly evictionEpoch;
+    constructor(options: OAuthTokenServiceOptions);
+    getAccessToken(userId: number, mcpServerId: string, options?: {
+        forceRefresh?: boolean;
+    }): Promise<string>;
+    evict(userId: number, mcpServerId: string): void;
+    private readCache;
+    private refreshAndCache;
+    private runGrantWithRotationRetry;
+    private toGrantParams;
+    private persistRotatedRefreshToken;
+}
+//# sourceMappingURL=token-service.d.ts.map

package/dist/oauth/token-service.js

@@ -0,0 +1,172 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const defaults_1 = require("../defaults");
+const errors_1 = require("../errors");
+const keyed_mutex_1 = __importDefault(require("./keyed-mutex"));
+const refresh_grant_1 = __importDefault(require("./refresh-grant"));
+// Acquires an MCP OAuth access token for a (user, server): serves a cached token until it nears
+// expiry, otherwise runs the refresh-token grant under a per-key mutex (one in-flight refresh per
+// user+server in this process) and recovers from a concurrent refresh-token rotation via a single
+// re-read + retry. A missing credential or a genuinely rejected refresh raises
+// OAuthReauthRequiredError so the step pauses for re-authentication.
+class OAuthTokenService {
+    constructor(options) {
+        this.cache = new Map();
+        this.mutex = new keyed_mutex_1.default();
+        // Bumped on evict() so a refresh already in flight for a key can detect a disconnect that landed
+        // mid-refresh and skip repopulating the cache for the now-deleted credential.
+        this.evictionEpoch = new Map();
+        this.store = options.store;
+        this.encryption = options.encryption;
+        this.logger = options.logger;
+        this.expirySkewMs = (options.expirySkewS ?? defaults_1.DEFAULT_OAUTH_EXPIRY_SKEW_S) * 1000;
+        this.refreshAccessToken = options.refreshAccessToken ?? refresh_grant_1.default;
+        this.now = options.now ?? Date.now;
+    }
+    async getAccessToken(userId, mcpServerId, options) {
+        const key = `${userId}:${mcpServerId}`;
+        const forceRefresh = options?.forceRefresh ?? false;
+        if (!forceRefresh) {
+            const cached = this.readCache(key);
+            if (cached)
+                return cached;
+        }
+        return this.mutex.runExclusive(key, async () => {
+            // Re-check inside the lock: a concurrent caller may have just refreshed for this key.
+            if (!forceRefresh) {
+                const cached = this.readCache(key);
+                if (cached)
+                    return cached;
+            }
+            return this.refreshAndCache(userId, mcpServerId, key);
+        });
+    }
+    // Drop the cached access token for a (user, server). Called on credential delete so a disconnect
+    // takes effect immediately, instead of the executor serving the cached token until it expires.
+    evict(userId, mcpServerId) {
+        const key = `${userId}:${mcpServerId}`;
+        this.cache.delete(key);
+        this.evictionEpoch.set(key, (this.evictionEpoch.get(key) ?? 0) + 1);
+    }
+    readCache(key) {
+        const entry = this.cache.get(key);
+        if (!entry)
+            return undefined;
+        if (this.now() >= entry.expiresAtMs - this.expirySkewMs) {
+            // Drop expired entries on read so the cache can't grow without bound across many keys.
+            this.cache.delete(key);
+            return undefined;
+        }
+        return entry.accessToken;
+    }
+    async refreshAndCache(userId, mcpServerId, key) {
+        const epochAtStart = this.evictionEpoch.get(key) ?? 0;
+        const credential = await this.store.get(userId, mcpServerId);
+        if (!credential)
+            throw new errors_1.OAuthReauthRequiredError(mcpServerId);
+        const { result, credential: grantedCredential } = await this.runGrantWithRotationRetry(credential, userId, mcpServerId);
+        const evictedDuringRefresh = (this.evictionEpoch.get(key) ?? 0) !== epochAtStart;
+        // Skip caching if the credential was disconnected mid-refresh (would serve a token for a deleted
+        // credential) or the grant carried no expiry (never servable); the in-flight caller still gets it.
+        if (!evictedDuringRefresh && result.expiresInS !== undefined) {
+            this.cache.set(key, {
+                accessToken: result.accessToken,
+                expiresAtMs: this.now() + result.expiresInS * 1000,
+            });
+        }
+        else {
+            this.cache.delete(key);
+        }
+        if (result.refreshToken) {
+            await this.persistRotatedRefreshToken(grantedCredential, result.refreshToken);
+        }
+        return result.accessToken;
+    }
+    // On invalid_grant a peer instance likely rotated the refresh token out from under us: re-read the
+    // row and retry once with the current token; a second invalid_grant (or an unchanged token) is a
+    // genuine revocation and forces re-auth. Returns the credential whose token produced the grant so
+    // the caller writes the rotated token back onto that (current) row, not the stale one.
+    async runGrantWithRotationRetry(credential, userId, mcpServerId) {
+        try {
+            const result = await this.refreshAccessToken(this.toGrantParams(credential));
+            return { result, credential };
+        }
+        catch (error) {
+            if (!(error instanceof errors_1.OAuthInvalidGrantError))
+                throw error;
+            // A peer rotated the refresh token iff the stored value changed since we read it.
+            const latest = await this.store.get(userId, mcpServerId);
+            const wasRotated = latest !== null &&
+                latest.refreshTokenEnc.toString('base64') !== credential.refreshTokenEnc.toString('base64');
+            if (!latest || !wasRotated) {
+                throw new errors_1.OAuthReauthRequiredError(mcpServerId);
+            }
+            try {
+                const result = await this.refreshAccessToken(this.toGrantParams(latest));
+                return { result, credential: latest };
+            }
+            catch (retryError) {
+                if (retryError instanceof errors_1.OAuthInvalidGrantError) {
+                    throw new errors_1.OAuthReauthRequiredError(mcpServerId);
+                }
+                throw retryError;
+            }
+        }
+    }
+    // Decrypt happens here. A decrypt failure with the key PRESENT (auth-tag mismatch — the row was
+    // encrypted under a since-rotated/hard-swapped key, or is corrupt) is recoverable: re-consent
+    // re-deposits under the current key, so surface it as needs-oauth-reauth. A missing key
+    // (ExecutorEncryptionKeyMissingError) is an operator misconfig, not re-consent-resolvable, so it
+    // propagates as a terminal error (a re-deposit would just 503 at the deposit endpoint).
+    toGrantParams(credential) {
+        try {
+            return {
+                tokenEndpoint: credential.tokenEndpoint,
+                refreshToken: this.encryption.decrypt(credential.refreshTokenEnc),
+                clientId: credential.clientId,
+                clientSecret: credential.clientSecretEnc
+                    ? this.encryption.decrypt(credential.clientSecretEnc)
+                    : null,
+                tokenEndpointAuthMethod: credential.tokenEndpointAuthMethod,
+                scopes: credential.scopes,
+            };
+        }
+        catch (error) {
+            if (error instanceof errors_1.ExecutorEncryptionKeyMissingError)
+                throw error;
+            throw new errors_1.OAuthReauthRequiredError(credential.mcpServerId);
+        }
+    }
+    async persistRotatedRefreshToken(credential, refreshToken) {
+        try {
+            const encrypted = this.encryption.encrypt(refreshToken);
+            // Id-scoped so a disconnect (or disconnect + re-authorize) after the grant read leaves an
+            // absent or different row — the rotated-token write-back then can't resurrect or clobber it.
+            await this.store.updateIfPresent(credential.id, {
+                userId: credential.userId,
+                mcpServerId: credential.mcpServerId,
+                refreshTokenEnc: encrypted.ciphertext,
+                clientId: credential.clientId,
+                clientSecretEnc: credential.clientSecretEnc,
+                clientSecretExpiresAt: credential.clientSecretExpiresAt,
+                tokenEndpoint: credential.tokenEndpoint,
+                tokenEndpointAuthMethod: credential.tokenEndpointAuthMethod,
+                scopes: credential.scopes,
+            });
+        }
+        catch (error) {
+            // A failed write-back is not fatal: the access token just obtained is valid for this call.
+            // The rotated refresh token is lost, so a later refresh forces re-authentication — the safe
+            // fallback, and better than failing the current operation over a transient write error.
+            this.logger?.('Error', 'Failed to persist rotated MCP OAuth refresh token', {
+                mcpServerId: credential.mcpServerId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+}
+exports.default = OAuthTokenService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4tc2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9vYXV0aC90b2tlbi1zZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBUUEsMENBQTBEO0FBQzFELHNDQUltQjtBQUNuQixnRUFBdUM7QUFDdkMsb0VBQXdEO0FBZ0J4RCxnR0FBZ0c7QUFDaEcsa0dBQWtHO0FBQ2xHLGtHQUFrRztBQUNsRywrRUFBK0U7QUFDL0UscUVBQXFFO0FBQ3JFLE1BQXFCLGlCQUFpQjtJQWFwQyxZQUFZLE9BQWlDO1FBTjVCLFVBQUssR0FBRyxJQUFJLEdBQUcsRUFBdUIsQ0FBQztRQUN2QyxVQUFLLEdBQUcsSUFBSSxxQkFBVSxFQUFFLENBQUM7UUFDMUMsaUdBQWlHO1FBQ2pHLDhFQUE4RTtRQUM3RCxrQkFBYSxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO1FBR3pELElBQUksQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUMzQixJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUM7UUFDckMsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzdCLElBQUksQ0FBQyxZQUFZLEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxJQUFJLHNDQUEyQixDQUFDLEdBQUcsSUFBSSxDQUFDO1FBQ2hGLElBQUksQ0FBQyxrQkFBa0IsR0FBRyxPQUFPLENBQUMsa0JBQWtCLElBQUksdUJBQXlCLENBQUM7UUFDbEYsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUM7SUFDckMsQ0FBQztJQUVELEtBQUssQ0FBQyxjQUFjLENBQ2xCLE1BQWMsRUFDZCxXQUFtQixFQUNuQixPQUFvQztRQUVwQyxNQUFNLEdBQUcsR0FBRyxHQUFHLE1BQU0sSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUN2QyxNQUFNLFlBQVksR0FBRyxPQUFPLEVBQUUsWUFBWSxJQUFJLEtBQUssQ0FBQztRQUVwRCxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDbEIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNuQyxJQUFJLE1BQU07Z0JBQUUsT0FBTyxNQUFNLENBQUM7UUFDNUIsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFLEtBQUssSUFBSSxFQUFFO1lBQzdDLHNGQUFzRjtZQUN0RixJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQ2xCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ25DLElBQUksTUFBTTtvQkFBRSxPQUFPLE1BQU0sQ0FBQztZQUM1QixDQUFDO1lBRUQsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sRUFBRSxXQUFXLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDeEQsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsaUdBQWlHO0lBQ2pHLCtGQUErRjtJQUMvRixLQUFLLENBQUMsTUFBYyxFQUFFLFdBQW1CO1FBQ3ZDLE1BQU0sR0FBRyxHQUFHLEdBQUcsTUFBTSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFTyxTQUFTLENBQUMsR0FBVztRQUMzQixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsS0FBSztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBRTdCLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxJQUFJLEtBQUssQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3hELHVGQUF1RjtZQUN2RixJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUV2QixPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBRUQsT0FBTyxLQUFLLENBQUMsV0FBVyxDQUFDO0lBQzNCLENBQUM7SUFFTyxLQUFLLENBQUMsZUFBZSxDQUFDLE1BQWMsRUFBRSxXQUFtQixFQUFFLEdBQVc7UUFDNUUsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3RELE1BQU0sVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQzdELElBQUksQ0FBQyxVQUFVO1lBQUUsTUFBTSxJQUFJLGlDQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRWpFLE1BQU0sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLGlCQUFpQixFQUFFLEdBQUcsTUFBTSxJQUFJLENBQUMseUJBQXlCLENBQ3BGLFVBQVUsRUFDVixNQUFNLEVBQ04sV0FBVyxDQUNaLENBQUM7UUFFRixNQUFNLG9CQUFvQixHQUFHLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssWUFBWSxDQUFDO1FBRWpGLGlHQUFpRztRQUNqRyxtR0FBbUc7UUFDbkcsSUFBSSxDQUFDLG9CQUFvQixJQUFJLE1BQU0sQ0FBQyxVQUFVLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDN0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFO2dCQUNsQixXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7Z0JBQy9CLFdBQVcsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsTUFBTSxDQUFDLFVBQVUsR0FBRyxJQUFJO2FBQ25ELENBQUMsQ0FBQztRQUNMLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDekIsQ0FBQztRQUVELElBQUksTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3hCLE1BQU0sSUFBSSxDQUFDLDBCQUEwQixDQUFDLGlCQUFpQixFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNoRixDQUFDO1FBRUQsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUFDO0lBQzVCLENBQUM7SUFFRCxtR0FBbUc7SUFDbkcsaUdBQWlHO0lBQ2pHLGtHQUFrRztJQUNsRyx1RkFBdUY7SUFDL0UsS0FBSyxDQUFDLHlCQUF5QixDQUNyQyxVQUFvQyxFQUNwQyxNQUFjLEVBQ2QsV0FBbUI7UUFFbkIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBRTdFLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDaEMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLENBQUMsQ0FBQyxLQUFLLFlBQVksK0JBQXNCLENBQUM7Z0JBQUUsTUFBTSxLQUFLLENBQUM7WUFFNUQsa0ZBQWtGO1lBQ2xGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1lBQ3pELE1BQU0sVUFBVSxHQUNkLE1BQU0sS0FBSyxJQUFJO2dCQUNmLE1BQU0sQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLFVBQVUsQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBRTlGLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztnQkFDM0IsTUFBTSxJQUFJLGlDQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFFRCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO2dCQUV6RSxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUN4QyxDQUFDO1lBQUMsT0FBTyxVQUFVLEVBQUUsQ0FBQztnQkFDcEIsSUFBSSxVQUFVLFlBQVksK0JBQXNCLEVBQUUsQ0FBQztvQkFDakQsTUFBTSxJQUFJLGlDQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUNsRCxDQUFDO2dCQUVELE1BQU0sVUFBVSxDQUFDO1lBQ25CLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVELGdHQUFnRztJQUNoRyw4RkFBOEY7SUFDOUYsd0ZBQXdGO0lBQ3hGLGlHQUFpRztJQUNqRyx3RkFBd0Y7SUFDaEYsYUFBYSxDQUFDLFVBQW9DO1FBQ3hELElBQUksQ0FBQztZQUNILE9BQU87Z0JBQ0wsYUFBYSxFQUFFLFVBQVUsQ0FBQyxhQUFhO2dCQUN2QyxZQUFZLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQztnQkFDakUsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO2dCQUM3QixZQUFZLEVBQUUsVUFBVSxDQUFDLGVBQWU7b0JBQ3RDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsZUFBZSxDQUFDO29CQUNyRCxDQUFDLENBQUMsSUFBSTtnQkFDUix1QkFBdUIsRUFBRSxVQUFVLENBQUMsdUJBQXVCO2dCQUMzRCxNQUFNLEVBQUUsVUFBVSxDQUFDLE1BQU07YUFDMUIsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksMENBQWlDO2dCQUFFLE1BQU0sS0FBSyxDQUFDO1lBRXBFLE1BQU0sSUFBSSxpQ0FBd0IsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDN0QsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsMEJBQTBCLENBQ3RDLFVBQW9DLEVBQ3BDLFlBQW9CO1FBRXBCLElBQUksQ0FBQztZQUNILE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBRXhELDBGQUEwRjtZQUMxRiw2RkFBNkY7WUFDN0YsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsRUFBRSxFQUFFO2dCQUM5QyxNQUFNLEVBQUUsVUFBVSxDQUFDLE1BQU07Z0JBQ3pCLFdBQVcsRUFBRSxVQUFVLENBQUMsV0FBVztnQkFDbkMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxVQUFVO2dCQUNyQyxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVE7Z0JBQzdCLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZTtnQkFDM0MscUJBQXFCLEVBQUUsVUFBVSxDQUFDLHFCQUFxQjtnQkFDdkQsYUFBYSxFQUFFLFVBQVUsQ0FBQyxhQUFhO2dCQUN2Qyx1QkFBdUIsRUFBRSxVQUFVLENBQUMsdUJBQXVCO2dCQUMzRCxNQUFNLEVBQUUsVUFBVSxDQUFDLE1BQU07YUFDMUIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZiwyRkFBMkY7WUFDM0YsNEZBQTRGO1lBQzVGLHdGQUF3RjtZQUN4RixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsT0FBTyxFQUFFLG1EQUFtRCxFQUFFO2dCQUMxRSxXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVc7Z0JBQ25DLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2FBQzlELENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFqTUQsb0NBaU1DIn0=

package/dist/ports/agent-port.d.ts

@@ -36,6 +36,7 @@ export type ExecuteActionQuery = {
     action: string;
     id?: Id[];
     values?: Record<string, unknown>;
+    approvalMessage?: string;
 };
 export type GetActionFormQuery = {
     collection: string;

package/dist/ports/ai-model-port.d.ts

@@ -1,4 +1,4 @@
-import type { BaseChatModel, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
+import type { BaseChatModel, McpServerLoadFailure, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
 export interface GetModelOptions {
     aiConfigName?: string;
     userId?: number;
@@ -6,6 +6,10 @@ export interface GetModelOptions {
 export interface AiModelPort {
     getModel(options?: GetModelOptions): BaseChatModel;
     loadRemoteTools(configs: Record<string, ToolConfig>): Promise<RemoteTool[]>;
+    loadRemoteToolsWithFailures(configs: Record<string, ToolConfig>): Promise<{
+        tools: RemoteTool[];
+        failures: McpServerLoadFailure[];
+    }>;
     closeConnections(): Promise<void>;
 }
 //# sourceMappingURL=ai-model-port.d.ts.map

package/dist/ports/mcp-oauth-credentials-store.d.ts

@@ -0,0 +1,24 @@
+import type { Logger } from './logger-port';
+export interface McpOAuthCredentialInput {
+    userId: number;
+    mcpServerId: string;
+    refreshTokenEnc: Buffer;
+    clientId?: string | null;
+    clientSecretEnc?: Buffer | null;
+    clientSecretExpiresAt?: Date | null;
+    tokenEndpoint: string;
+    tokenEndpointAuthMethod?: string | null;
+    scopes?: string | null;
+}
+export interface StoredMcpOAuthCredential extends McpOAuthCredentialInput {
+    id: number;
+}
+export interface McpOAuthCredentialsStore {
+    init(logger?: Logger): Promise<void>;
+    close(logger?: Logger): Promise<void>;
+    get(userId: number, mcpServerId: string): Promise<StoredMcpOAuthCredential | null>;
+    upsert(credential: McpOAuthCredentialInput): Promise<void>;
+    updateIfPresent(id: number, credential: McpOAuthCredentialInput): Promise<void>;
+    delete(userId: number, mcpServerId: string): Promise<void>;
+}
+//# sourceMappingURL=mcp-oauth-credentials-store.d.ts.map

package/dist/ports/mcp-oauth-credentials-store.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWNwLW9hdXRoLWNyZWRlbnRpYWxzLXN0b3JlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3BvcnRzL21jcC1vYXV0aC1jcmVkZW50aWFscy1zdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/dist/ports/run-store.d.ts

@@ -5,5 +5,6 @@ export interface RunStore {
     close(logger?: Logger): Promise<void>;
     getStepExecutions(runId: string): Promise<StepExecutionData[]>;
     saveStepExecution(runId: string, stepExecution: StepExecutionData): Promise<void>;
+    deleteStepExecution(runId: string, stepIndex: number): Promise<void>;
 }
 //# sourceMappingURL=run-store.d.ts.map

package/dist/remote-tool-fetcher.d.ts

@@ -1,3 +1,4 @@
+import type OAuthTokenService from './oauth/token-service';
 import type { AiModelPort } from './ports/ai-model-port';
 import type { Logger } from './ports/logger-port';
 import type { WorkflowPort } from './ports/workflow-port';
@@ -6,13 +7,17 @@ export declare function scopeConfigsToServer(configs: Record<string, ToolConfig>
 export interface FetchRemoteToolsResult {
     tools: RemoteTool[];
     mcpServerName?: string;
+    loadFailed?: boolean;
+    reloadWithFreshAuth?: () => Promise<RemoteTool[]>;
 }
 export default class RemoteToolFetcher {
     private readonly workflowPort;
     private readonly aiModelPort;
     private readonly logger;
-    constructor(workflowPort: WorkflowPort, aiModelPort: AiModelPort, logger: Logger);
-    fetch(mcpServerId: string): Promise<FetchRemoteToolsResult>;
+    private readonly oauthTokenService;
+    constructor(workflowPort: WorkflowPort, aiModelPort: AiModelPort, logger: Logger, oauthTokenService: OAuthTokenService);
+    fetch(mcpServerId: string, userId: number): Promise<FetchRemoteToolsResult>;
+    private fetchOAuthTools;
     private warnMissingTargetServer;
     private errorOnPartialLoadFailure;
 }

package/dist/remote-tool-fetcher.js

@@ -1,26 +1,72 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scopeConfigsToServer = scopeConfigsToServer;
+const ai_proxy_1 = require("@forestadmin/ai-proxy");
+const errors_1 = require("./errors");
+const OAUTH2_AUTH_TYPE = 'oauth2';
 // Match by config.id, not by Record key: server names can collide across configs.
 function scopeConfigsToServer(configs, mcpServerId) {
     return Object.fromEntries(Object.entries(configs).filter(([, cfg]) => cfg.id === mcpServerId));
 }
+function readAuthType(config) {
+    return config?.authType;
+}
 class RemoteToolFetcher {
-    constructor(workflowPort, aiModelPort, logger) {
+    constructor(workflowPort, aiModelPort, logger, oauthTokenService) {
+        // Fail loudly here instead of a cryptic undefined dereference at the first OAuth fetch —
+        // Runner/RunnerConfig are public API, so a JS caller can bypass the compile-time check.
+        if (!oauthTokenService) {
+            throw new Error('RemoteToolFetcher requires an OAuth token service (mcpOAuthTokenService)');
+        }
         this.workflowPort = workflowPort;
         this.aiModelPort = aiModelPort;
         this.logger = logger;
+        this.oauthTokenService = oauthTokenService;
     }
-    async fetch(mcpServerId) {
+    async fetch(mcpServerId, userId) {
         const configs = await this.workflowPort.getMcpServerConfigs();
         const scoped = scopeConfigsToServer(configs, mcpServerId);
         const [mcpServerName] = Object.keys(scoped);
         this.warnMissingTargetServer(configs, scoped, mcpServerId, mcpServerName);
         if (Object.keys(scoped).length === 0)
             return { tools: [], mcpServerName };
+        if (readAuthType(scoped[mcpServerName]) === OAUTH2_AUTH_TYPE) {
+            return this.fetchOAuthTools(scoped, mcpServerName, mcpServerId, userId);
+        }
         const tools = await this.aiModelPort.loadRemoteTools(scoped);
-        this.errorOnPartialLoadFailure(scoped, tools, mcpServerId, mcpServerName);
-        return { tools, mcpServerName };
+        const loadFailed = this.errorOnPartialLoadFailure(scoped, tools, mcpServerId, mcpServerName);
+        return { tools, mcpServerName, loadFailed };
+    }
+    // OAuth2 path: acquire a per-user access token, inject it as a Bearer header, then list tools.
+    // Tool listing is the first authenticated call, so an auth failure here forces one token refresh
+    // and a single retry; a still-failing load is a genuine re-auth case.
+    async fetchOAuthTools(scoped, mcpServerName, mcpServerId, userId) {
+        const tokenService = this.oauthTokenService;
+        const attemptLoad = async (forceRefresh) => {
+            const token = await tokenService.getAccessToken(userId, mcpServerId, { forceRefresh });
+            const bearer = `Bearer ${token}`;
+            // All scoped configs share this mcpServerId, so inject the token for every one — not just the
+            // first key — or extra same-id servers load unauthenticated and report spurious auth failures.
+            const injected = (0, ai_proxy_1.injectOauthTokens)({
+                configs: scoped,
+                tokensByMcpServerName: Object.fromEntries(Object.keys(scoped).map(name => [name, bearer])),
+            }) ?? scoped;
+            const { tools, failures } = await this.aiModelPort.loadRemoteToolsWithFailures(injected);
+            return { tools, hasAuthFailure: failures.some(failure => failure.kind === 'auth') };
+        };
+        const reloadWithFreshAuth = async () => {
+            const attempt = await attemptLoad(true);
+            if (attempt.hasAuthFailure)
+                throw new errors_1.OAuthReauthRequiredError(mcpServerId);
+            this.errorOnPartialLoadFailure(scoped, attempt.tools, mcpServerId, mcpServerName);
+            return attempt.tools;
+        };
+        const initial = await attemptLoad(false);
+        if (initial.hasAuthFailure) {
+            return { tools: await reloadWithFreshAuth(), mcpServerName, reloadWithFreshAuth };
+        }
+        const loadFailed = this.errorOnPartialLoadFailure(scoped, initial.tools, mcpServerId, mcpServerName);
+        return { tools: initial.tools, mcpServerName, reloadWithFreshAuth, loadFailed };
     }
     // Distinguish "no configs at all" (deployment misconfig) from "configs exist but none match"
     // (orchestrator/executor drift on server id) — both yield zero tools, but ops need to know
@@ -44,13 +90,14 @@ class RemoteToolFetcher {
             .filter(([, cfg]) => !loadedMcpServerIds.has(cfg.id))
             .map(([name]) => name);
         if (failedConfigNames.length === 0)
-            return;
+            return false;
         this.logger('Error', 'MCP servers failed to load tools', {
             requestedMcpServerId: mcpServerId,
             mcpServerName,
             failedConfigNames,
         });
+        return true;
     }
 }
 exports.default = RemoteToolFetcher;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLXRvb2wtZmV0Y2hlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yZW1vdGUtdG9vbC1mZXRjaGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBTUEsb0RBS0M7QUFORCxrRkFBa0Y7QUFDbEYsU0FBZ0Isb0JBQW9CLENBQ2xDLE9BQW1DLEVBQ25DLFdBQW1CO0lBRW5CLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBQ2pHLENBQUM7QUFPRCxNQUFxQixpQkFBaUI7SUFLcEMsWUFBWSxZQUEwQixFQUFFLFdBQXdCLEVBQUUsTUFBYztRQUM5RSxJQUFJLENBQUMsWUFBWSxHQUFHLFlBQVksQ0FBQztRQUNqQyxJQUFJLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztRQUMvQixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN2QixDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUssQ0FBQyxXQUFtQjtRQUM3QixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztRQUM5RCxNQUFNLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDMUQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFNUMsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBRTFFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLGFBQWEsRUFBRSxDQUFDO1FBRTFFLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFN0QsSUFBSSxDQUFDLHlCQUF5QixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBRTFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDbEMsQ0FBQztJQUVELDZGQUE2RjtJQUM3RiwyRkFBMkY7SUFDM0Ysb0JBQW9CO0lBQ1osdUJBQXVCLENBQzdCLE9BQW1DLEVBQ25DLE1BQWtDLEVBQ2xDLFdBQW1CLEVBQ25CLGFBQWlDO1FBRWpDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFFM0MsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQzthQUNqRCxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2FBQ2xCLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBZ0IsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTdDLElBQUksQ0FBQyxNQUFNLENBQ1QsTUFBTSxFQUNOLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7WUFDL0IsQ0FBQyxDQUFDLG9FQUFvRTtZQUN0RSxDQUFDLENBQUMsOERBQThELEVBQ2xFLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxDQUM1RSxDQUFDO0lBQ0osQ0FBQztJQUVELDRGQUE0RjtJQUM1Riw0RkFBNEY7SUFDNUYseUZBQXlGO0lBQ2pGLHlCQUF5QixDQUMvQixNQUFrQyxFQUNsQyxLQUFtQixFQUNuQixXQUFtQixFQUNuQixhQUFpQztRQUVqQyxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUNsRSxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2FBQzdDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2FBQ3BELEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXpCLElBQUksaUJBQWlCLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPO1FBRTNDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLGtDQUFrQyxFQUFFO1lBQ3ZELG9CQUFvQixFQUFFLFdBQVc7WUFDakMsYUFBYTtZQUNiLGlCQUFpQjtTQUNsQixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUF6RUQsb0NBeUVDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLXRvb2wtZmV0Y2hlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yZW1vdGUtdG9vbC1mZXRjaGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBYUEsb0RBS0M7QUFaRCxvREFBMEQ7QUFFMUQscUNBQW9EO0FBRXBELE1BQU0sZ0JBQWdCLEdBQUcsUUFBUSxDQUFDO0FBRWxDLGtGQUFrRjtBQUNsRixTQUFnQixvQkFBb0IsQ0FDbEMsT0FBbUMsRUFDbkMsV0FBbUI7SUFFbkIsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxLQUFLLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFDakcsQ0FBQztBQUVELFNBQVMsWUFBWSxDQUFDLE1BQThCO0lBQ2xELE9BQVEsTUFBNEMsRUFBRSxRQUFRLENBQUM7QUFDakUsQ0FBQztBQWNELE1BQXFCLGlCQUFpQjtJQU1wQyxZQUNFLFlBQTBCLEVBQzFCLFdBQXdCLEVBQ3hCLE1BQWMsRUFDZCxpQkFBb0M7UUFFcEMseUZBQXlGO1FBQ3pGLHdGQUF3RjtRQUN4RixJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLDBFQUEwRSxDQUFDLENBQUM7UUFDOUYsQ0FBQztRQUVELElBQUksQ0FBQyxZQUFZLEdBQUcsWUFBWSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxXQUFXLEdBQUcsV0FBVyxDQUFDO1FBQy9CLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxpQkFBaUIsQ0FBQztJQUM3QyxDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUssQ0FBQyxXQUFtQixFQUFFLE1BQWM7UUFDN0MsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDOUQsTUFBTSxNQUFNLEdBQUcsb0JBQW9CLENBQUMsT0FBTyxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQzFELE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRTVDLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUUxRSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxhQUFhLEVBQUUsQ0FBQztRQUUxRSxJQUFJLFlBQVksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsS0FBSyxnQkFBZ0IsRUFBRSxDQUFDO1lBQzdELE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM3RCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMseUJBQXlCLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFFN0YsT0FBTyxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDOUMsQ0FBQztJQUVELCtGQUErRjtJQUMvRixpR0FBaUc7SUFDakcsc0VBQXNFO0lBQzlELEtBQUssQ0FBQyxlQUFlLENBQzNCLE1BQWtDLEVBQ2xDLGFBQXFCLEVBQ3JCLFdBQW1CLEVBQ25CLE1BQWM7UUFFZCxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFFNUMsTUFBTSxXQUFXLEdBQUcsS0FBSyxFQUN2QixZQUFxQixFQUNzQyxFQUFFO1lBQzdELE1BQU0sS0FBSyxHQUFHLE1BQU0sWUFBWSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsV0FBVyxFQUFFLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztZQUN2RixNQUFNLE1BQU0sR0FBRyxVQUFVLEtBQUssRUFBRSxDQUFDO1lBQ2pDLDhGQUE4RjtZQUM5RiwrRkFBK0Y7WUFDL0YsTUFBTSxRQUFRLEdBQ1osSUFBQSw0QkFBaUIsRUFBQztnQkFDaEIsT0FBTyxFQUFFLE1BQU07Z0JBQ2YscUJBQXFCLEVBQUUsTUFBTSxDQUFDLFdBQVcsQ0FDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUNoRDthQUNGLENBQUMsSUFBSSxNQUFNLENBQUM7WUFDZixNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUV6RixPQUFPLEVBQUUsS0FBSyxFQUFFLGNBQWMsRUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3RGLENBQUMsQ0FBQztRQUVGLE1BQU0sbUJBQW1CLEdBQUcsS0FBSyxJQUEyQixFQUFFO1lBQzVELE1BQU0sT0FBTyxHQUFHLE1BQU0sV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3hDLElBQUksT0FBTyxDQUFDLGNBQWM7Z0JBQUUsTUFBTSxJQUFJLGlDQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQzVFLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxXQUFXLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFFbEYsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQztRQUVGLE1BQU0sT0FBTyxHQUFHLE1BQU0sV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRXpDLElBQUksT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzNCLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxtQkFBbUIsRUFBRSxFQUFFLGFBQWEsRUFBRSxtQkFBbUIsRUFBRSxDQUFDO1FBQ3BGLENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMseUJBQXlCLENBQy9DLE1BQU0sRUFDTixPQUFPLENBQUMsS0FBSyxFQUNiLFdBQVcsRUFDWCxhQUFhLENBQ2QsQ0FBQztRQUVGLE9BQU8sRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxhQUFhLEVBQUUsbUJBQW1CLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDbEYsQ0FBQztJQUVELDZGQUE2RjtJQUM3RiwyRkFBMkY7SUFDM0Ysb0JBQW9CO0lBQ1osdUJBQXVCLENBQzdCLE9BQW1DLEVBQ25DLE1BQWtDLEVBQ2xDLFdBQW1CLEVBQ25CLGFBQWlDO1FBRWpDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFFM0MsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQzthQUNqRCxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2FBQ2xCLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBZ0IsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTdDLElBQUksQ0FBQyxNQUFNLENBQ1QsTUFBTSxFQUNOLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7WUFDL0IsQ0FBQyxDQUFDLG9FQUFvRTtZQUN0RSxDQUFDLENBQUMsOERBQThELEVBQ2xFLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxDQUM1RSxDQUFDO0lBQ0osQ0FBQztJQUVELDRGQUE0RjtJQUM1Riw0RkFBNEY7SUFDNUYseUZBQXlGO0lBQ2pGLHlCQUF5QixDQUMvQixNQUFrQyxFQUNsQyxLQUFtQixFQUNuQixXQUFtQixFQUNuQixhQUFpQztRQUVqQyxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUNsRSxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2FBQzdDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2FBQ3BELEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXpCLElBQUksaUJBQWlCLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUVqRCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxrQ0FBa0MsRUFBRTtZQUN2RCxvQkFBb0IsRUFBRSxXQUFXO1lBQ2pDLGFBQWE7WUFDYixpQkFBaUI7U0FDbEIsQ0FBQyxDQUFDO1FBRUgsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0NBQ0Y7QUFqSkQsb0NBaUpDIn0=

package/dist/runner.d.ts

@@ -1,3 +1,4 @@
+import type OAuthTokenService from './oauth/token-service';
 import type { ActivityLogPortFactory } from './ports/activity-log-port';
 import type { AgentPort } from './ports/agent-port';
 import type { AiModelPort } from './ports/ai-model-port';
@@ -22,6 +23,7 @@ export interface RunnerConfig {
     stepTimeoutS?: number;
     aiInvokeTimeoutS?: number;
     maxChainDepth?: number;
+    mcpOAuthTokenService: OAuthTokenService;
 }
 export default class Runner {
     private readonly config;

package/dist/runner.js

@@ -20,7 +20,7 @@ class Runner {
         this._state = 'idle';
         this.config = config;
         this.logger = config.logger ?? (0, console_logger_1.default)();
-        this.remoteToolFetcher = new remote_tool_fetcher_1.default(config.workflowPort, config.aiModelPort, this.logger);
+        this.remoteToolFetcher = new remote_tool_fetcher_1.default(config.workflowPort, config.aiModelPort, this.logger, config.mcpOAuthTokenService);
     }
     get state() {
         return this._state;
@@ -216,7 +216,7 @@ class Runner {
         while (true) {
             let result;
             try {
-                const executor = await step_executor_factory_1.default.create(currentStep, this.contextConfig, this.config.activityLogPortFactory.forRun(currentToken), mcpServerId => this.remoteToolFetcher.fetch(mcpServerId), currentIncomingData, currentToken);
+                const executor = await step_executor_factory_1.default.create(currentStep, this.contextConfig, this.config.activityLogPortFactory.forRun(currentToken), (mcpServerId, userId) => this.remoteToolFetcher.fetch(mcpServerId, userId), currentIncomingData, currentToken);
                 result = await executor.execute();
             }
             catch (error) {
@@ -333,4 +333,4 @@ class Runner {
     }
 }
 exports.default = Runner;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVubmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3J1bm5lci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQVlBLCtFQUE0RDtBQUM1RCx5Q0FBNkU7QUFDN0UscUNBT2tCO0FBQ2xCLDhGQUFvRTtBQUNwRSxzRkFBMkQ7QUFDM0QsZ0ZBQXNEO0FBQ3RELGlFQUF1RTtBQUN2RSwwRUFBaUQ7QUE0QmpELHlHQUF5RztBQUN6RyxNQUFNLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLEdBQUcsT0FBTyxDQUFDLGlCQUFpQixDQUF3QixDQUFDO0FBRXhGLE1BQXFCLE1BQU07SUFRekIsWUFBWSxNQUFvQjtRQU54QixpQkFBWSxHQUEwQixJQUFJLENBQUM7UUFDbEMsaUJBQVksR0FBRyxJQUFJLGdDQUFtQixFQUFFLENBQUM7UUFHbEQsV0FBTSxHQUFnQixNQUFNLENBQUM7UUFHbkMsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxJQUFJLElBQUEsd0JBQW1CLEdBQUUsQ0FBQztRQUNyRCxJQUFJLENBQUMsaUJBQWlCLEdBQUcsSUFBSSw2QkFBaUIsQ0FDNUMsTUFBTSxDQUFDLFlBQVksRUFDbkIsTUFBTSxDQUFDLFdBQVcsRUFDbEIsSUFBSSxDQUFDLE1BQU0sQ0FDWixDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksS0FBSztRQUNQLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztJQUNyQixDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUs7UUFDVCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDNUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUztZQUFFLE9BQU87UUFFdEMsSUFBQSwwQkFBZSxFQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFFMUYseUZBQXlGO1FBQ3pGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsb0JBQW9CLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDOUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRTdDLElBQUksQ0FBQyxNQUFNLEdBQUcsU0FBUyxDQUFDO1FBRXhCLElBQUksQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztJQUN0QixDQUFDO0lBRUQsS0FBSyxDQUFDLElBQUk7UUFDUixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssTUFBTSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVTtZQUFFLE9BQU87UUFFOUYsSUFBSSxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUM7UUFDekIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsNkJBQTZCLEVBQUUsRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBRTdGLElBQUksSUFBSSxDQUFDLFlBQVksS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUMvQixZQUFZLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ2hDLElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBQzNCLENBQUM7UUFFRCxJQUFJLENBQUM7WUFDSCxrRUFBa0U7WUFDbEUsSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDL0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUseUJBQXlCLEVBQUU7b0JBQzdDLEtBQUssRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUk7b0JBQzdCLElBQUksRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQztpQkFDcEMsQ0FBQyxDQUFDO2dCQUVILE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxJQUFJLGlDQUFzQixDQUFDO2dCQUNwRSxJQUFJLFVBQXNDLENBQUM7Z0JBQzNDLE1BQU0sV0FBVyxHQUFHLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQztvQkFDckMsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO3dCQUNsQyxJQUFJLFVBQVU7NEJBQUUsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO3dCQUV6QyxPQUFPLFNBQWtCLENBQUM7b0JBQzVCLENBQUMsQ0FBQztvQkFDRixJQUFJLE9BQU8sQ0FBWSxPQUFPLENBQUMsRUFBRTt3QkFDL0IsVUFBVSxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsUUFBUSxHQUFHLElBQUksQ0FBQyxDQUFDO29CQUNyRSxDQUFDLENBQUM7aUJBQ0gsQ0FBQyxDQUFDO2dCQUVILElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxzQ0FBc0MsRUFBRTt3QkFDM0QsYUFBYSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxDQUFDO3dCQUM1QyxRQUFRO3FCQUNULENBQUMsQ0FBQztnQkFDTCxDQUFDO3FCQUFNLENBQUM7b0JBQ04sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsNEJBQTRCLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ3hELENBQUM7WUFDSCxDQUFDO1lBRUQseUZBQXlGO1lBQ3pGLDJEQUEyRDtZQUMzRCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsc0JBQXNCLENBQUMsS0FBSyxFQUFFLENBQUM7WUFFakQsTUFBTSxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDO2dCQUN2QyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRTtnQkFDMUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7YUFDeEMsQ0FBQyxDQUFDO1lBRUgsS0FBSyxNQUFNLE1BQU0sSUFBSSxPQUFPLEVBQUUsQ0FBQztnQkFDN0IsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLFVBQVUsRUFBRSxDQUFDO29CQUNqQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSx5Q0FBeUMsRUFBRTt3QkFDOUQsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7cUJBQ3RGLENBQUMsQ0FBQztnQkFDTCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksQ0FBQyxNQUFNLEdBQUcsU0FBUyxDQUFDO1lBQ3hCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLDJCQUEyQixFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7SUFDSCxDQUFDO0lBRUQsS0FBSyxDQUFDLG9CQUFvQixDQUFDLEtBQWE7UUFDdEMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBRUQsS0FBSyxDQUFDLFdBQVcsQ0FDZixLQUFhLEVBQ2IsT0FBMEQ7UUFFMUQsMEZBQTBGO1FBQzFGLDhGQUE4RjtRQUM5Rix5RkFBeUY7UUFDekYsNEZBQTRGO1FBQzVGLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVqQyxJQUFJLFFBQXFDLENBQUM7UUFFMUMsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsSUFBSSxHQUFHLFlBQVksMEJBQWlCLEVBQUUsQ0FBQztnQkFDckMsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzFDLENBQUM7WUFFRCxNQUFNLEdBQUcsQ0FBQztRQUNaLENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUTtZQUFFLE1BQU0sSUFBSSx5QkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVqRCxNQUFNLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxHQUFHLFFBQVEsQ0FBQztRQUVoQyxJQUFJLE9BQU8sRUFBRSxZQUFZLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNqRixNQUFNLElBQUksMEJBQWlCLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBRUQsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFFTyxvQkFBb0IsQ0FBQyxLQUFhO1FBQ3hDLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNqQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSx5Q0FBeUMsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFFMUUsTUFBTSxJQUFJLGdDQUF1QixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzNDLENBQUM7SUFDSCxDQUFDO0lBRU8sWUFBWTtRQUNsQixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUztZQUFFLE9BQU87UUFDdEMsSUFBSSxDQUFDLFlBQVksR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVPLEtBQUssQ0FBQyxZQUFZO1FBQ3hCLElBQUksQ0FBQztZQUNILE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ2pGLDBGQUEwRjtZQUMxRixNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFFL0UsTUFBTSxZQUFZLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQy9FLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQztnQkFDekMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxNQUFNO2dCQUN2QixVQUFVLEVBQUUsWUFBWSxDQUFDLE1BQU07Z0JBQy9CLFNBQVMsRUFBRSxTQUFTLENBQUMsTUFBTTthQUM1QixDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxzQkFBc0IsRUFBRTtnQkFDNUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxNQUFNO2dCQUN2QixXQUFXLEVBQUUsWUFBWSxDQUFDLE1BQU07Z0JBQ2hDLFNBQVMsRUFBRSxTQUFTLENBQUMsTUFBTTthQUM1QixDQUFDLENBQUM7WUFDSCxNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQ3RCLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQzFFLENBQUM7UUFDSixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLG1CQUFtQixFQUFFO2dCQUN4QyxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxLQUFLLENBQUM7Z0JBQ2pDLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTO2FBQ3hELENBQUMsQ0FBQztRQUNMLENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUN0QixDQUFDO0lBQ0gsQ0FBQztJQUVELCtGQUErRjtJQUMvRiw4RkFBOEY7SUFDOUYsZ0NBQWdDO0lBQ3hCLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxJQUFzQjtRQUNyRCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssSUFBSSxJQUFJLElBQUksQ0FBQyxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsaUVBQWlFLEVBQUU7Z0JBQ3RGLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztnQkFDakIsS0FBSyxFQUFFLElBQUksQ0FBQyxnQkFBZ0I7YUFDN0IsQ0FBQyxDQUFDO1lBRUgsT0FBTztRQUNULENBQUM7UUFFRCxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUU7Z0JBQzdELElBQUksRUFBRSxRQUFRO2dCQUNkLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtnQkFDbkIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixNQUFNLEVBQUUsT0FBTztnQkFDZixLQUFLLEVBQUUsSUFBSSxDQUFDLFdBQVc7YUFDeEIsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsaUNBQWlDLEVBQUU7Z0JBQ3RELEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztnQkFDakIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGdCQUFnQjthQUM3QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztZQUNuQixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSx1Q0FBdUMsRUFBRTtnQkFDNUQsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO2dCQUNqQixZQUFZLEVBQUUsSUFBSSxDQUFDLGdCQUFnQjtnQkFDbkMsV0FBVyxFQUFFLElBQUEsNEJBQW1CLEVBQUMsU0FBUyxDQUFDO2FBQzVDLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO0lBRU8sV0FBVyxDQUNqQixJQUE0QixFQUM1QixpQkFBeUIsRUFDekIsbUJBQTZCO1FBRTdCLHVGQUF1RjtRQUN2Rix5RkFBeUY7UUFDekYsNEZBQTRGO1FBQzVGLDhCQUE4QjtRQUM5QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUM1QixJQUFJLENBQUMsS0FBSyxFQUNWLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLGlCQUFpQixFQUFFLG1CQUFtQixDQUFDLENBQ2pFLENBQUM7SUFDSixDQUFDO0lBRU8sS0FBSyxDQUFDLGFBQWEsQ0FDekIsSUFBNEIsRUFDNUIsaUJBQXlCLEVBQ3pCLG1CQUE2QjtRQUU3QixJQUFJLFdBQVcsR0FBRyxJQUFJLENBQUM7UUFDdkIsSUFBSSxZQUFZLEdBQUcsaUJBQWlCLENBQUM7UUFDckMsSUFBSSxtQkFBbUIsR0FBRyxtQkFBbUIsQ0FBQztRQUM5QyxJQUFJLFlBQVksR0FBRyxDQUFDLENBQUMsQ0FBQyxpREFBaUQ7UUFDdkUsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLElBQUksa0NBQXVCLENBQUM7UUFFdEUsMkZBQTJGO1FBQzNGLGdFQUFnRTtRQUNoRSw0REFBNEQ7UUFDNUQsT0FBTyxJQUFJLEVBQUUsQ0FBQztZQUNaLElBQUksTUFBMkIsQ0FBQztZQUVoQyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSwrQkFBbUIsQ0FBQyxNQUFNLENBQy9DLFdBQVcsRUFDWCxJQUFJLENBQUMsYUFBYSxFQUNsQixJQUFJLENBQUMsTUFBTSxDQUFDLHNCQUFzQixDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFDdkQsV0FBVyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUN4RCxtQkFBbUIsRUFDbkIsWUFBWSxDQUNiLENBQUM7Z0JBQ0YsTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3BDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksQ0FBQyxNQUFNLENBQ1QsT0FBTyxFQUNQLHVFQUF1RSxFQUN2RTtvQkFDRSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTTtvQkFDMUIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO29CQUNoQyxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxLQUFLLENBQUM7aUJBQ2xDLENBQ0YsQ0FBQztnQkFFRixzRkFBc0Y7Z0JBQ3RGLDRFQUE0RTtnQkFDNUUsTUFBTSxnQkFBZ0IsR0FBZ0I7b0JBQ3BDLElBQUksRUFBRSxJQUFBLG9DQUFxQixFQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDO29CQUM1RCxNQUFNLEVBQUUsV0FBVyxDQUFDLE1BQU07b0JBQzFCLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztvQkFDaEMsTUFBTSxFQUFFLE9BQU87b0JBQ2YsS0FBSyxFQUFFLCtCQUErQjtpQkFDdkMsQ0FBQztnQkFFRixJQUFJLENBQUM7b0JBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLENBQUM7Z0JBQzFGLENBQUM7Z0JBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztvQkFDbkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsc0RBQXNELEVBQUU7d0JBQzNFLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSzt3QkFDeEIsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNO3dCQUMxQixXQUFXLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxTQUFTLENBQUM7cUJBQzVDLENBQUMsQ0FBQztnQkFDTCxDQUFDO2dCQUVELE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxZQUF5QyxDQUFDO1lBRTlDLElBQUksQ0FBQztnQkFDSCxZQUFZLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxtQkFBbUIsQ0FDL0QsV0FBVyxDQUFDLEtBQUssRUFDakIsTUFBTSxDQUFDLFdBQVcsQ0FDbkIsQ0FBQztZQUNKLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLCtCQUErQixFQUFFO29CQUNwRCxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTTtvQkFDMUIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO29CQUNoQyxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxLQUFLLENBQUM7b0JBQ2pDLEtBQUssRUFBRSxJQUFBLHFCQUFZLEVBQUMsS0FBSyxDQUFDO29CQUMxQixLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUztpQkFDeEQsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxZQUFZLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQzFCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLHlEQUF5RCxFQUFFO29CQUM3RSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztpQkFDakMsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsNEZBQTRGO1lBQzVGLDBGQUEwRjtZQUMxRixzRkFBc0Y7WUFDdEYscUVBQXFFO1lBQ3JFLElBQ0UsWUFBWSxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssV0FBVyxDQUFDLEtBQUs7Z0JBQzdDLFlBQVksQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLFdBQVcsQ0FBQyxTQUFTLEVBQ3BELENBQUM7Z0JBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMkRBQTJELEVBQUU7b0JBQ2hGLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSztvQkFDeEIsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLFNBQVM7b0JBQ3ZDLGFBQWEsRUFBRSxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUs7b0JBQ3RDLGlCQUFpQixFQUFFLFlBQVksQ0FBQyxJQUFJLENBQUMsU0FBUztpQkFDL0MsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsMkZBQTJGO1lBQzNGLGdGQUFnRjtZQUNoRixJQUFJLFlBQVksSUFBSSxRQUFRLEVBQUUsQ0FBQztnQkFDN0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsaURBQWlELEVBQUU7b0JBQ3JFLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSztvQkFDeEIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO29CQUNoQyxRQUFRO2lCQUNULENBQUMsQ0FBQztnQkFFSCxPQUFPO1lBQ1QsQ0FBQztZQUVELGtGQUFrRjtZQUNsRixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQy9CLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLHdDQUF3QyxFQUFFO29CQUM1RCxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztpQkFDakMsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsWUFBWSxJQUFJLENBQUMsQ0FBQztZQUNsQixXQUFXLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQztZQUNoQyxZQUFZLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztZQUNuRCxtQkFBbUIsR0FBRyxTQUFTLENBQUMsQ0FBQyx5Q0FBeUM7UUFDNUUsQ0FBQztRQUNELDJEQUEyRDtJQUM3RCxDQUFDO0lBRUQsSUFBWSxhQUFhO1FBQ3ZCLE9BQU87WUFDTCxXQUFXLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXO1lBQ3BDLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVM7WUFDaEMsWUFBWSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWTtZQUN0QyxRQUFRLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRO1lBQzlCLFdBQVcsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVc7WUFDcEMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO1lBQ25CLFlBQVksRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVk7WUFDdEMsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0I7U0FDL0MsQ0FBQztJQUNKLENBQUM7SUFFTyxNQUFNLENBQUMsa0JBQWtCLENBQUMsRUFDaEMsT0FBTyxFQUNQLFVBQVUsRUFDVixTQUFTLEdBS1Y7UUFDQyxPQUFPLE9BQU8sS0FBSyxDQUFDLElBQUksVUFBVSxLQUFLLENBQUMsSUFBSSxTQUFTLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNqRixDQUFDO0lBRU8sMEJBQTBCO1FBQ2hDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUU7WUFDM0YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsbURBQW1ELEVBQUU7Z0JBQ3ZFLE9BQU8sRUFBRSxnQkFBZ0I7Z0JBQ3pCLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2FBQzlELENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBeFpELHlCQXdaQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVubmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3J1bm5lci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQWFBLCtFQUE0RDtBQUM1RCx5Q0FBNkU7QUFDN0UscUNBT2tCO0FBQ2xCLDhGQUFvRTtBQUNwRSxzRkFBMkQ7QUFDM0QsZ0ZBQXNEO0FBQ3RELGlFQUF1RTtBQUN2RSwwRUFBaUQ7QUErQmpELHlHQUF5RztBQUN6RyxNQUFNLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLEdBQUcsT0FBTyxDQUFDLGlCQUFpQixDQUF3QixDQUFDO0FBRXhGLE1BQXFCLE1BQU07SUFRekIsWUFBWSxNQUFvQjtRQU54QixpQkFBWSxHQUEwQixJQUFJLENBQUM7UUFDbEMsaUJBQVksR0FBRyxJQUFJLGdDQUFtQixFQUFFLENBQUM7UUFHbEQsV0FBTSxHQUFnQixNQUFNLENBQUM7UUFHbkMsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxJQUFJLElBQUEsd0JBQW1CLEdBQUUsQ0FBQztRQUNyRCxJQUFJLENBQUMsaUJBQWlCLEdBQUcsSUFBSSw2QkFBaUIsQ0FDNUMsTUFBTSxDQUFDLFlBQVksRUFDbkIsTUFBTSxDQUFDLFdBQVcsRUFDbEIsSUFBSSxDQUFDLE1BQU0sRUFDWCxNQUFNLENBQUMsb0JBQW9CLENBQzVCLENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxLQUFLO1FBQ1AsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxLQUFLLENBQUMsS0FBSztRQUNULElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUM1RCxNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTO1lBQUUsT0FBTztRQUV0QyxJQUFBLDBCQUFlLEVBQUMsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUUxRix5RkFBeUY7UUFDekYsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxvQkFBb0IsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5QyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFN0MsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7UUFFeEIsSUFBSSxDQUFDLDBCQUEwQixFQUFFLENBQUM7UUFDbEMsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ3RCLENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSTtRQUNSLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVO1lBQUUsT0FBTztRQUU5RixJQUFJLENBQUMsTUFBTSxHQUFHLFVBQVUsQ0FBQztRQUN6QixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSw2QkFBNkIsRUFBRSxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFFN0YsSUFBSSxJQUFJLENBQUMsWUFBWSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQy9CLFlBQVksQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDaEMsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUM7UUFDM0IsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILGtFQUFrRTtZQUNsRSxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUMvQixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSx5QkFBeUIsRUFBRTtvQkFDN0MsS0FBSyxFQUFFLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSTtvQkFDN0IsSUFBSSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxDQUFDO2lCQUNwQyxDQUFDLENBQUM7Z0JBRUgsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLElBQUksaUNBQXNCLENBQUM7Z0JBQ3BFLElBQUksVUFBc0MsQ0FBQztnQkFDM0MsTUFBTSxXQUFXLEdBQUcsTUFBTSxPQUFPLENBQUMsSUFBSSxDQUFDO29CQUNyQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7d0JBQ2xDLElBQUksVUFBVTs0QkFBRSxZQUFZLENBQUMsVUFBVSxDQUFDLENBQUM7d0JBRXpDLE9BQU8sU0FBa0IsQ0FBQztvQkFDNUIsQ0FBQyxDQUFDO29CQUNGLElBQUksT0FBTyxDQUFZLE9BQU8sQ0FBQyxFQUFFO3dCQUMvQixVQUFVLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxRQUFRLEdBQUcsSUFBSSxDQUFDLENBQUM7b0JBQ3JFLENBQUMsQ0FBQztpQkFDSCxDQUFDLENBQUM7Z0JBRUgsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7b0JBQzlCLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLHNDQUFzQyxFQUFFO3dCQUMzRCxhQUFhLEVBQUUsQ0FBQyxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUM7d0JBQzVDLFFBQVE7cUJBQ1QsQ0FBQyxDQUFDO2dCQUNMLENBQUM7cUJBQU0sQ0FBQztvQkFDTixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSw0QkFBNEIsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDeEQsQ0FBQztZQUNILENBQUM7WUFFRCx5RkFBeUY7WUFDekYsMkRBQTJEO1lBQzNELE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUVqRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUM7Z0JBQ3ZDLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLGdCQUFnQixFQUFFO2dCQUMxQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQzthQUN4QyxDQUFDLENBQUM7WUFFSCxLQUFLLE1BQU0sTUFBTSxJQUFJLE9BQU8sRUFBRSxDQUFDO2dCQUM3QixJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7b0JBQ2pDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLHlDQUF5QyxFQUFFO3dCQUM5RCxLQUFLLEVBQUUsTUFBTSxDQUFDLE1BQU0sWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztxQkFDdEYsQ0FBQyxDQUFDO2dCQUNMLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7WUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsMkJBQTJCLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdkQsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLENBQUMsb0JBQW9CLENBQUMsS0FBYTtRQUN0QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFRCxLQUFLLENBQUMsV0FBVyxDQUNmLEtBQWEsRUFDYixPQUEwRDtRQUUxRCwwRkFBMEY7UUFDMUYsOEZBQThGO1FBQzlGLHlGQUF5RjtRQUN6Riw0RkFBNEY7UUFDNUYsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRWpDLElBQUksUUFBcUMsQ0FBQztRQUUxQyxJQUFJLENBQUM7WUFDSCxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixJQUFJLEdBQUcsWUFBWSwwQkFBaUIsRUFBRSxDQUFDO2dCQUNyQyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDMUMsQ0FBQztZQUVELE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztRQUVELElBQUksQ0FBQyxRQUFRO1lBQUUsTUFBTSxJQUFJLHlCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRWpELE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEdBQUcsUUFBUSxDQUFDO1FBRWhDLElBQUksT0FBTyxFQUFFLFlBQVksS0FBSyxTQUFTLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ2pGLE1BQU0sSUFBSSwwQkFBaUIsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFFRCxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUVPLG9CQUFvQixDQUFDLEtBQWE7UUFDeEMsSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2pDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLHlDQUF5QyxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUUxRSxNQUFNLElBQUksZ0NBQXVCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0MsQ0FBQztJQUNILENBQUM7SUFFTyxZQUFZO1FBQ2xCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTO1lBQUUsT0FBTztRQUN0QyxJQUFJLENBQUMsWUFBWSxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBRU8sS0FBSyxDQUFDLFlBQVk7UUFDeEIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDakYsMEZBQTBGO1lBQzFGLE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUUvRSxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFDL0UsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLGtCQUFrQixDQUFDO2dCQUN6QyxPQUFPLEVBQUUsT0FBTyxDQUFDLE1BQU07Z0JBQ3ZCLFVBQVUsRUFBRSxZQUFZLENBQUMsTUFBTTtnQkFDL0IsU0FBUyxFQUFFLFNBQVMsQ0FBQyxNQUFNO2FBQzVCLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLHNCQUFzQixFQUFFO2dCQUM1QyxPQUFPLEVBQUUsT0FBTyxDQUFDLE1BQU07Z0JBQ3ZCLFdBQVcsRUFBRSxZQUFZLENBQUMsTUFBTTtnQkFDaEMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxNQUFNO2FBQzVCLENBQUMsQ0FBQztZQUNILE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FDdEIsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FDMUUsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsbUJBQW1CLEVBQUU7Z0JBQ3hDLEtBQUssRUFBRSxJQUFBLDRCQUFtQixFQUFDLEtBQUssQ0FBQztnQkFDakMsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVM7YUFDeEQsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3RCLENBQUM7SUFDSCxDQUFDO0lBRUQsK0ZBQStGO0lBQy9GLDhGQUE4RjtJQUM5RixnQ0FBZ0M7SUFDeEIsS0FBSyxDQUFDLGtCQUFrQixDQUFDLElBQXNCO1FBQ3JELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNwRCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxpRUFBaUUsRUFBRTtnQkFDdEYsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO2dCQUNqQixLQUFLLEVBQUUsSUFBSSxDQUFDLGdCQUFnQjthQUM3QixDQUFDLENBQUM7WUFFSCxPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRTtnQkFDN0QsSUFBSSxFQUFFLFFBQVE7Z0JBQ2QsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO2dCQUNuQixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7Z0JBQ3pCLE1BQU0sRUFBRSxPQUFPO2dCQUNmLEtBQUssRUFBRSxJQUFJLENBQUMsV0FBVzthQUN4QixDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxpQ0FBaUMsRUFBRTtnQkFDdEQsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO2dCQUNqQixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7Z0JBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsZ0JBQWdCO2FBQzdCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO1lBQ25CLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLHVDQUF1QyxFQUFFO2dCQUM1RCxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUs7Z0JBQ2pCLFlBQVksRUFBRSxJQUFJLENBQUMsZ0JBQWdCO2dCQUNuQyxXQUFXLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxTQUFTLENBQUM7YUFDNUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztJQUNILENBQUM7SUFFTyxXQUFXLENBQ2pCLElBQTRCLEVBQzVCLGlCQUF5QixFQUN6QixtQkFBNkI7UUFFN0IsdUZBQXVGO1FBQ3ZGLHlGQUF5RjtRQUN6Riw0RkFBNEY7UUFDNUYsOEJBQThCO1FBQzlCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQzVCLElBQUksQ0FBQyxLQUFLLEVBQ1YsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsbUJBQW1CLENBQUMsQ0FDakUsQ0FBQztJQUNKLENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUN6QixJQUE0QixFQUM1QixpQkFBeUIsRUFDekIsbUJBQTZCO1FBRTdCLElBQUksV0FBVyxHQUFHLElBQUksQ0FBQztRQUN2QixJQUFJLFlBQVksR0FBRyxpQkFBaUIsQ0FBQztRQUNyQyxJQUFJLG1CQUFtQixHQUFHLG1CQUFtQixDQUFDO1FBQzlDLElBQUksWUFBWSxHQUFHLENBQUMsQ0FBQyxDQUFDLGlEQUFpRDtRQUN2RSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsSUFBSSxrQ0FBdUIsQ0FBQztRQUV0RSwyRkFBMkY7UUFDM0YsZ0VBQWdFO1FBQ2hFLDREQUE0RDtRQUM1RCxPQUFPLElBQUksRUFBRSxDQUFDO1lBQ1osSUFBSSxNQUEyQixDQUFDO1lBRWhDLElBQUksQ0FBQztnQkFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLCtCQUFtQixDQUFDLE1BQU0sQ0FDL0MsV0FBVyxFQUNYLElBQUksQ0FBQyxhQUFhLEVBQ2xCLElBQUksQ0FBQyxNQUFNLENBQUMsc0JBQXNCLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxFQUN2RCxDQUFDLFdBQVcsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxFQUMxRSxtQkFBbUIsRUFDbkIsWUFBWSxDQUNiLENBQUM7Z0JBQ0YsTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3BDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksQ0FBQyxNQUFNLENBQ1QsT0FBTyxFQUNQLHVFQUF1RSxFQUN2RTtvQkFDRSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTTtvQkFDMUIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO29CQUNoQyxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxLQUFLLENBQUM7aUJBQ2xDLENBQ0YsQ0FBQztnQkFFRixzRkFBc0Y7Z0JBQ3RGLDRFQUE0RTtnQkFDNUUsTUFBTSxnQkFBZ0IsR0FBZ0I7b0JBQ3BDLElBQUksRUFBRSxJQUFBLG9DQUFxQixFQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDO29CQUM1RCxNQUFNLEVBQUUsV0FBVyxDQUFDLE1BQU07b0JBQzFCLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztvQkFDaEMsTUFBTSxFQUFFLE9BQU87b0JBQ2YsS0FBSyxFQUFFLCtCQUErQjtpQkFDdkMsQ0FBQztnQkFFRixJQUFJLENBQUM7b0JBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLENBQUM7Z0JBQzFGLENBQUM7Z0JBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztvQkFDbkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsc0RBQXNELEVBQUU7d0JBQzNFLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSzt3QkFDeEIsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNO3dCQUMxQixXQUFXLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxTQUFTLENBQUM7cUJBQzVDLENBQUMsQ0FBQztnQkFDTCxDQUFDO2dCQUVELE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxZQUF5QyxDQUFDO1lBRTlDLElBQUksQ0FBQztnQkFDSCxZQUFZLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxtQkFBbUIsQ0FDL0QsV0FBVyxDQUFDLEtBQUssRUFDakIsTUFBTSxDQUFDLFdBQVcsQ0FDbkIsQ0FBQztZQUNKLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLCtCQUErQixFQUFFO29CQUNwRCxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTTtvQkFDMUIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO29CQUNoQyxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxLQUFLLENBQUM7b0JBQ2pDLEtBQUssRUFBRSxJQUFBLHFCQUFZLEVBQUMsS0FBSyxDQUFDO29CQUMxQixLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUztpQkFDeEQsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxZQUFZLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQzFCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLHlEQUF5RCxFQUFFO29CQUM3RSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztpQkFDakMsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsNEZBQTRGO1lBQzVGLDBGQUEwRjtZQUMxRixzRkFBc0Y7WUFDdEYscUVBQXFFO1lBQ3JFLElBQ0UsWUFBWSxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssV0FBVyxDQUFDLEtBQUs7Z0JBQzdDLFlBQVksQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLFdBQVcsQ0FBQyxTQUFTLEVBQ3BELENBQUM7Z0JBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMkRBQTJELEVBQUU7b0JBQ2hGLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSztvQkFDeEIsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLFNBQVM7b0JBQ3ZDLGFBQWEsRUFBRSxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUs7b0JBQ3RDLGlCQUFpQixFQUFFLFlBQVksQ0FBQyxJQUFJLENBQUMsU0FBUztpQkFDL0MsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsMkZBQTJGO1lBQzNGLGdGQUFnRjtZQUNoRixJQUFJLFlBQVksSUFBSSxRQUFRLEVBQUUsQ0FBQztnQkFDN0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsaURBQWlELEVBQUU7b0JBQ3JFLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSztvQkFDeEIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO29CQUNoQyxRQUFRO2lCQUNULENBQUMsQ0FBQztnQkFFSCxPQUFPO1lBQ1QsQ0FBQztZQUVELGtGQUFrRjtZQUNsRixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQy9CLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLHdDQUF3QyxFQUFFO29CQUM1RCxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7b0JBQ3hCLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztpQkFDakMsQ0FBQyxDQUFDO2dCQUVILE9BQU87WUFDVCxDQUFDO1lBRUQsWUFBWSxJQUFJLENBQUMsQ0FBQztZQUNsQixXQUFXLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQztZQUNoQyxZQUFZLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztZQUNuRCxtQkFBbUIsR0FBRyxTQUFTLENBQUMsQ0FBQyx5Q0FBeUM7UUFDNUUsQ0FBQztRQUNELDJEQUEyRDtJQUM3RCxDQUFDO0lBRUQsSUFBWSxhQUFhO1FBQ3ZCLE9BQU87WUFDTCxXQUFXLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXO1lBQ3BDLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVM7WUFDaEMsWUFBWSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWTtZQUN0QyxRQUFRLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRO1lBQzlCLFdBQVcsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVc7WUFDcEMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO1lBQ25CLFlBQVksRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVk7WUFDdEMsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0I7U0FDL0MsQ0FBQztJQUNKLENBQUM7SUFFTyxNQUFNLENBQUMsa0JBQWtCLENBQUMsRUFDaEMsT0FBTyxFQUNQLFVBQVUsRUFDVixTQUFTLEdBS1Y7UUFDQyxPQUFPLE9BQU8sS0FBSyxDQUFDLElBQUksVUFBVSxLQUFLLENBQUMsSUFBSSxTQUFTLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNqRixDQUFDO0lBRU8sMEJBQTBCO1FBQ2hDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUU7WUFDM0YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsbURBQW1ELEVBQUU7Z0JBQ3ZFLE9BQU8sRUFBRSxnQkFBZ0I7Z0JBQ3pCLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2FBQzlELENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBelpELHlCQXlaQyJ9