@forestadmin/workflow-executor 1.13.0 → 1.15.0

package/README.md

@@ -128,6 +128,20 @@ npx @forestadmin/workflow-executor
 
 ---
 
+## OAuth-protected MCP connectors
+
+When your workflows use OAuth-protected MCP connectors, the executor stores each user's OAuth credentials in its database, encrypted at rest. Provide the encryption key the same way as the other secrets (in `.env`, or with `-e` on `docker run`):
+
+| Variable | Description |
+| --- | --- |
+| `FOREST_EXECUTOR_ENCRYPTION_KEY` | At-rest encryption key (AES-256-GCM) for the OAuth credentials the executor stores. Generate with `openssl rand -hex 32`. Use a **separate** secret from `FOREST_AUTH_SECRET`. The value isn't validated, so use a genuinely random secret. |
+
+- **Required only for OAuth-protected MCP connectors**, and read lazily — an executor that stores no such credentials boots and runs fine without it.
+- **Use the same value on every instance that shares a database.** Otherwise an instance cannot decrypt credentials stored by another.
+- **Treat it as permanent: there is no managed rotation.** Changing it forces every affected user to reconnect their OAuth-protected MCP connectors.
+
+---
+
 ## Testing only
 
 The following modes skip the database requirement but are **not suitable for production** — state is lost on restart.
@@ -152,3 +166,7 @@ FOREST_AUTH_SECRET="your-auth-secret" \
 AGENT_URL="https://your-agent-url" \
 npx @forestadmin/workflow-executor --in-memory
 ```
+
+### OAuth2-protected MCP
+
+To exercise the executor's OAuth2-protected MCP path end-to-end, point it at [mcp-oauth-test-server](https://github.com/hercemer42/mcp-oauth-test-server) — a standalone OAuth2 + MCP server that can simulate refresh-token revocation/rotation, consent denial, and upstream 403s.

package/dist/adapters/ai-client-adapter.d.ts

@@ -1,10 +1,14 @@
 import type { AiModelPort, GetModelOptions } from '../ports/ai-model-port';
-import type { AiConfiguration, BaseChatModel, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
+import type { AiConfiguration, BaseChatModel, McpServerLoadFailure, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
 export default class AiClientAdapter implements AiModelPort {
     private readonly aiClient;
     constructor(aiConfigurations: AiConfiguration[]);
     getModel({ aiConfigName }?: GetModelOptions): BaseChatModel;
     loadRemoteTools(configs: Record<string, ToolConfig>): Promise<RemoteTool[]>;
+    loadRemoteToolsWithFailures(configs: Record<string, ToolConfig>): Promise<{
+        tools: RemoteTool[];
+        failures: McpServerLoadFailure[];
+    }>;
     closeConnections(): Promise<void>;
     private callPort;
 }

package/dist/adapters/ai-client-adapter.js

@@ -20,6 +20,9 @@ class AiClientAdapter {
     loadRemoteTools(configs) {
         return this.callPort('loadRemoteTools', () => this.aiClient.loadRemoteTools(configs));
     }
+    loadRemoteToolsWithFailures(configs) {
+        return this.callPort('loadRemoteToolsWithFailures', () => this.aiClient.loadRemoteToolsWithFailures(configs));
+    }
     closeConnections() {
         return this.callPort('closeConnections', () => this.aiClient.closeConnections());
     }
@@ -35,4 +38,4 @@ class AiClientAdapter {
     }
 }
 exports.default = AiClientAdapter;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWktY2xpZW50LWFkYXB0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWRhcHRlcnMvYWktY2xpZW50LWFkYXB0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFHQSxvREFBaUQ7QUFFakQsc0NBQW9FO0FBRXBFLE1BQXFCLGVBQWU7SUFHbEMsWUFBWSxnQkFBbUM7UUFDN0MsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekUsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLG1CQUFRLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxXQUFnQyxFQUFFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBRUQsUUFBUSxDQUFDLEVBQUUsWUFBWSxLQUFzQixFQUFFO1FBQzdDLElBQUksQ0FBQztZQUNILE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSw4QkFBcUI7Z0JBQUUsTUFBTSxLQUFLLENBQUM7WUFDeEQsTUFBTSxJQUFJLHlCQUFnQixDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNoRCxDQUFDO0lBQ0gsQ0FBQztJQUVELGVBQWUsQ0FBQyxPQUFtQztRQUNqRCxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRUQsZ0JBQWdCO1FBQ2QsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLGtCQUFrQixFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFTyxLQUFLLENBQUMsUUFBUSxDQUFJLFNBQWlCLEVBQUUsRUFBb0I7UUFDL0QsSUFBSSxDQUFDO1lBQ0gsT0FBTyxNQUFNLEVBQUUsRUFBRSxDQUFDO1FBQ3BCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksOEJBQXFCO2dCQUFFLE1BQU0sS0FBSyxDQUFDO1lBQ3hELE1BQU0sSUFBSSx5QkFBZ0IsQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDL0MsQ0FBQztJQUNILENBQUM7Q0FDRjtBQWpDRCxrQ0FpQ0MifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWktY2xpZW50LWFkYXB0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWRhcHRlcnMvYWktY2xpZW50LWFkYXB0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFTQSxvREFBaUQ7QUFFakQsc0NBQW9FO0FBRXBFLE1BQXFCLGVBQWU7SUFHbEMsWUFBWSxnQkFBbUM7UUFDN0MsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekUsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLG1CQUFRLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxXQUFnQyxFQUFFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBRUQsUUFBUSxDQUFDLEVBQUUsWUFBWSxLQUFzQixFQUFFO1FBQzdDLElBQUksQ0FBQztZQUNILE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSw4QkFBcUI7Z0JBQUUsTUFBTSxLQUFLLENBQUM7WUFDeEQsTUFBTSxJQUFJLHlCQUFnQixDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNoRCxDQUFDO0lBQ0gsQ0FBQztJQUVELGVBQWUsQ0FBQyxPQUFtQztRQUNqRCxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRUQsMkJBQTJCLENBQ3pCLE9BQW1DO1FBRW5DLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsRUFBRSxHQUFHLEVBQUUsQ0FDdkQsSUFBSSxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxPQUFPLENBQUMsQ0FDbkQsQ0FBQztJQUNKLENBQUM7SUFFRCxnQkFBZ0I7UUFDZCxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUVPLEtBQUssQ0FBQyxRQUFRLENBQUksU0FBaUIsRUFBRSxFQUFvQjtRQUMvRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sRUFBRSxFQUFFLENBQUM7UUFDcEIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSw4QkFBcUI7Z0JBQUUsTUFBTSxLQUFLLENBQUM7WUFDeEQsTUFBTSxJQUFJLHlCQUFnQixDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQyxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBekNELGtDQXlDQyJ9

package/dist/adapters/always-error-ai-model-port.d.ts

@@ -1,8 +1,12 @@
 import type { AiModelPort } from '../ports/ai-model-port';
-import type { BaseChatModel, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
+import type { BaseChatModel, McpServerLoadFailure, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
 export default class AlwaysErrorAiModelPort implements AiModelPort {
     getModel(): BaseChatModel;
     loadRemoteTools(_configs: Record<string, ToolConfig>): Promise<RemoteTool[]>;
+    loadRemoteToolsWithFailures(_configs: Record<string, ToolConfig>): Promise<{
+        tools: RemoteTool[];
+        failures: McpServerLoadFailure[];
+    }>;
     closeConnections(): Promise<void>;
 }
 //# sourceMappingURL=always-error-ai-model-port.d.ts.map

package/dist/adapters/always-error-ai-model-port.js

@@ -15,9 +15,14 @@ class AlwaysErrorAiModelPort {
     loadRemoteTools(_configs) {
         return Promise.resolve([]);
     }
+    loadRemoteToolsWithFailures(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _configs) {
+        return Promise.resolve({ tools: [], failures: [] });
+    }
     closeConnections() {
         return Promise.resolve();
     }
 }
 exports.default = AlwaysErrorAiModelPort;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWx3YXlzLWVycm9yLWFpLW1vZGVsLXBvcnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWRhcHRlcnMvYWx3YXlzLWVycm9yLWFpLW1vZGVsLXBvcnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFHQSxzQ0FBNkM7QUFFN0MsMEZBQTBGO0FBQzFGLGdFQUFnRTtBQUNoRSxNQUFxQixzQkFBc0I7SUFDekMsUUFBUTtRQUNOLE9BQU87WUFDTCxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztnQkFDaEIsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUNYLE9BQU8sQ0FBQyxNQUFNLENBQ1osSUFBSSx5QkFBZ0IsQ0FBQyxRQUFRLEVBQUUsSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsQ0FBQyxDQUM3RTthQUNKLENBQUM7U0FDeUIsQ0FBQztJQUNoQyxDQUFDO0lBRUQsNkRBQTZEO0lBQzdELGVBQWUsQ0FBQyxRQUFvQztRQUNsRCxPQUFPLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUVELGdCQUFnQjtRQUNkLE9BQU8sT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQzNCLENBQUM7Q0FDRjtBQXBCRCx5Q0FvQkMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWx3YXlzLWVycm9yLWFpLW1vZGVsLXBvcnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWRhcHRlcnMvYWx3YXlzLWVycm9yLWFpLW1vZGVsLXBvcnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFRQSxzQ0FBNkM7QUFFN0MsMEZBQTBGO0FBQzFGLGdFQUFnRTtBQUNoRSxNQUFxQixzQkFBc0I7SUFDekMsUUFBUTtRQUNOLE9BQU87WUFDTCxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztnQkFDaEIsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUNYLE9BQU8sQ0FBQyxNQUFNLENBQ1osSUFBSSx5QkFBZ0IsQ0FBQyxRQUFRLEVBQUUsSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsQ0FBQyxDQUM3RTthQUNKLENBQUM7U0FDeUIsQ0FBQztJQUNoQyxDQUFDO0lBRUQsNkRBQTZEO0lBQzdELGVBQWUsQ0FBQyxRQUFvQztRQUNsRCxPQUFPLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUVELDJCQUEyQjtJQUN6Qiw2REFBNkQ7SUFDN0QsUUFBb0M7UUFFcEMsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBRUQsZ0JBQWdCO1FBQ2QsT0FBTyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7SUFDM0IsQ0FBQztDQUNGO0FBM0JELHlDQTJCQyJ9

package/dist/adapters/server-ai-adapter.d.ts

@@ -1,5 +1,5 @@
 import type { AiModelPort, GetModelOptions } from '../ports/ai-model-port';
-import type { BaseChatModel, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
+import type { BaseChatModel, McpServerLoadFailure, RemoteTool, ToolConfig } from '@forestadmin/ai-proxy';
 export interface ServerAiAdapterOptions {
     forestServerUrl: string;
     envSecret: string;
@@ -10,6 +10,10 @@ export default class ServerAiAdapter implements AiModelPort {
     constructor(options: ServerAiAdapterOptions);
     getModel({ userId }?: GetModelOptions): BaseChatModel;
     loadRemoteTools(configs: Record<string, ToolConfig>): Promise<RemoteTool[]>;
+    loadRemoteToolsWithFailures(configs: Record<string, ToolConfig>): Promise<{
+        tools: RemoteTool[];
+        failures: McpServerLoadFailure[];
+    }>;
     closeConnections(): Promise<void>;
     private static buildProxyConfiguration;
     private callPort;

package/dist/adapters/server-ai-adapter.js

@@ -25,6 +25,9 @@ class ServerAiAdapter {
     loadRemoteTools(configs) {
         return this.callPort('loadRemoteTools', () => this.aiClient.loadRemoteTools(configs));
     }
+    loadRemoteToolsWithFailures(configs) {
+        return this.callPort('loadRemoteToolsWithFailures', () => this.aiClient.loadRemoteToolsWithFailures(configs));
+    }
     closeConnections() {
         return this.callPort('closeConnections', () => this.aiClient.closeConnections());
     }
@@ -64,4 +67,4 @@ class ServerAiAdapter {
     }
 }
 exports.default = ServerAiAdapter;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLWFpLWFkYXB0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWRhcHRlcnMvc2VydmVyLWFpLWFkYXB0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFHQSxvREFBaUQ7QUFFakQsc0NBQW9FO0FBT3BFLE1BQXFCLGVBQWU7SUFJbEMsWUFBWSxPQUErQjtRQUN6QyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksbUJBQVEsQ0FBQztZQUMzQixnQkFBZ0IsRUFBRSxDQUFDLGVBQWUsQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztTQUNyRSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsUUFBUSxDQUFDLEVBQUUsTUFBTSxLQUFzQixFQUFFO1FBQ3ZDLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFHLElBQUksbUJBQVEsQ0FBQztnQkFDMUIsZ0JBQWdCLEVBQUUsQ0FBQyxlQUFlLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQzthQUNsRixDQUFDLENBQUM7WUFFSCxPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUMzQixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLDhCQUFxQjtnQkFBRSxNQUFNLEtBQUssQ0FBQztZQUN4RCxNQUFNLElBQUkseUJBQWdCLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hELENBQUM7SUFDSCxDQUFDO0lBRUQsZUFBZSxDQUFDLE9BQW1DO1FBQ2pELE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFFRCxnQkFBZ0I7UUFDZCxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsa0JBQWtCLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUVELDZGQUE2RjtJQUM3Riw4RkFBOEY7SUFDOUYsd0RBQXdEO0lBQ2hELE1BQU0sQ0FBQyx1QkFBdUIsQ0FDcEMsRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUEwQixFQUN0RCxNQUFlO1FBRWYsTUFBTSxVQUFVLEdBQUcsR0FBRyxlQUFlLG9CQUFvQixDQUFDO1FBRTFELE9BQU87WUFDTCxJQUFJLEVBQUUsZUFBZTtZQUNyQixRQUFRLEVBQUUsUUFBUTtZQUNsQixLQUFLLEVBQUUsU0FBUztZQUNoQixVQUFVLEVBQUUsQ0FBQztZQUNiLGFBQWEsRUFBRTtnQkFDYixNQUFNLEVBQUUsUUFBUTtnQkFDaEIsS0FBSyxFQUFFLENBQUMsSUFBdUIsRUFBRSxJQUFrQixFQUFFLEVBQUU7b0JBQ3JELE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztvQkFDM0MsT0FBTyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQztvQkFDaEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsRUFBRSxTQUFTLENBQUMsQ0FBQztvQkFDNUMsZ0ZBQWdGO29CQUNoRixJQUFJLE1BQU0sS0FBSyxTQUFTO3dCQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO29CQUVqRSxPQUFPLEtBQUssQ0FBQyxVQUFVLEVBQUUsRUFBRSxHQUFHLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2FBQ0Y7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxRQUFRLENBQUksU0FBaUIsRUFBRSxFQUFvQjtRQUMvRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sRUFBRSxFQUFFLENBQUM7UUFDcEIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSw4QkFBcUI7Z0JBQUUsTUFBTSxLQUFLLENBQUM7WUFDeEQsTUFBTSxJQUFJLHlCQUFnQixDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQyxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBckVELGtDQXFFQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLWFpLWFkYXB0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYWRhcHRlcnMvc2VydmVyLWFpLWFkYXB0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFTQSxvREFBaUQ7QUFFakQsc0NBQW9FO0FBT3BFLE1BQXFCLGVBQWU7SUFJbEMsWUFBWSxPQUErQjtRQUN6QyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksbUJBQVEsQ0FBQztZQUMzQixnQkFBZ0IsRUFBRSxDQUFDLGVBQWUsQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztTQUNyRSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsUUFBUSxDQUFDLEVBQUUsTUFBTSxLQUFzQixFQUFFO1FBQ3ZDLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFHLElBQUksbUJBQVEsQ0FBQztnQkFDMUIsZ0JBQWdCLEVBQUUsQ0FBQyxlQUFlLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQzthQUNsRixDQUFDLENBQUM7WUFFSCxPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUMzQixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLDhCQUFxQjtnQkFBRSxNQUFNLEtBQUssQ0FBQztZQUN4RCxNQUFNLElBQUkseUJBQWdCLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hELENBQUM7SUFDSCxDQUFDO0lBRUQsZUFBZSxDQUFDLE9BQW1DO1FBQ2pELE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFFRCwyQkFBMkIsQ0FDekIsT0FBbUM7UUFFbkMsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLDZCQUE2QixFQUFFLEdBQUcsRUFBRSxDQUN2RCxJQUFJLENBQUMsUUFBUSxDQUFDLDJCQUEyQixDQUFDLE9BQU8sQ0FBQyxDQUNuRCxDQUFDO0lBQ0osQ0FBQztJQUVELGdCQUFnQjtRQUNkLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGdCQUFnQixFQUFFLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBRUQsNkZBQTZGO0lBQzdGLDhGQUE4RjtJQUM5Rix3REFBd0Q7SUFDaEQsTUFBTSxDQUFDLHVCQUF1QixDQUNwQyxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQTBCLEVBQ3RELE1BQWU7UUFFZixNQUFNLFVBQVUsR0FBRyxHQUFHLGVBQWUsb0JBQW9CLENBQUM7UUFFMUQsT0FBTztZQUNMLElBQUksRUFBRSxlQUFlO1lBQ3JCLFFBQVEsRUFBRSxRQUFRO1lBQ2xCLEtBQUssRUFBRSxTQUFTO1lBQ2hCLFVBQVUsRUFBRSxDQUFDO1lBQ2IsYUFBYSxFQUFFO2dCQUNiLE1BQU0sRUFBRSxRQUFRO2dCQUNoQixLQUFLLEVBQUUsQ0FBQyxJQUF1QixFQUFFLElBQWtCLEVBQUUsRUFBRTtvQkFDckQsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDO29CQUMzQyxPQUFPLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxDQUFDO29CQUNoQyxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQixFQUFFLFNBQVMsQ0FBQyxDQUFDO29CQUM1QyxnRkFBZ0Y7b0JBQ2hGLElBQUksTUFBTSxLQUFLLFNBQVM7d0JBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7b0JBRWpFLE9BQU8sS0FBSyxDQUFDLFVBQVUsRUFBRSxFQUFFLEdBQUcsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7Z0JBQ2pELENBQUM7YUFDRjtTQUNGLENBQUM7SUFDSixDQUFDO0lBRU8sS0FBSyxDQUFDLFFBQVEsQ0FBSSxTQUFpQixFQUFFLEVBQW9CO1FBQy9ELElBQUksQ0FBQztZQUNILE9BQU8sTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUNwQixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLDhCQUFxQjtnQkFBRSxNQUFNLEtBQUssQ0FBQztZQUN4RCxNQUFNLElBQUkseUJBQWdCLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQy9DLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUE3RUQsa0NBNkVDIn0=

package/dist/adapters/step-outcome-to-update-step-mapper.js

@@ -24,6 +24,9 @@ function toUpdateStepRequest(runId, outcome) {
     if (outcome.type === 'record' && outcome.approvalRequest !== undefined) {
         context.approvalRequest = outcome.approvalRequest;
     }
+    if (outcome.type === 'mcp' && outcome.awaitingInputReason !== undefined) {
+        context.awaitingInputReason = outcome.awaitingInputReason;
+    }
     const attributes = {
         done: outcome.status !== 'awaiting-input',
         context,
@@ -34,4 +37,4 @@ function toUpdateStepRequest(runId, outcome) {
         executionStatus: toExecutionStatus(outcome),
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RlcC1vdXRjb21lLXRvLXVwZGF0ZS1zdGVwLW1hcHBlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hZGFwdGVycy9zdGVwLW91dGNvbWUtdG8tdXBkYXRlLXN0ZXAtbWFwcGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBdUJBLHNDQXlCQztBQXpDRCxTQUFTLGlCQUFpQixDQUFDLE9BQW9CO0lBQzdDLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUMvQiwwRUFBMEU7UUFDMUUsaUZBQWlGO1FBQ2pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxJQUFJLGVBQWUsRUFBRSxDQUFDO0lBQ3RFLENBQUM7SUFFRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssZ0JBQWdCLEVBQUUsQ0FBQztRQUN4QyxPQUFPLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUVELE9BQU8sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7QUFDN0IsQ0FBQztBQUVELG1HQUFtRztBQUNuRyxxRUFBcUU7QUFDckUsU0FBd0IsbUJBQW1CLENBQ3pDLEtBQWEsRUFDYixPQUFvQjtJQUVwQixNQUFNLE9BQU8sR0FBNEIsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3BFLElBQUksT0FBTyxDQUFDLEtBQUssS0FBSyxTQUFTO1FBQUUsT0FBTyxDQUFDLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBRS9ELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN6RSxPQUFPLENBQUMsY0FBYyxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUM7SUFDbEQsQ0FBQztJQUVELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLGVBQWUsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN2RSxPQUFPLENBQUMsZUFBZSxHQUFHLE9BQU8sQ0FBQyxlQUFlLENBQUM7SUFDcEQsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUE0QjtRQUMxQyxJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sS0FBSyxnQkFBZ0I7UUFDekMsT0FBTztLQUNSLENBQUM7SUFFRixPQUFPO1FBQ0wsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFDcEIsVUFBVSxFQUFFLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFO1FBQ3hELGVBQWUsRUFBRSxpQkFBaUIsQ0FBQyxPQUFPLENBQUM7S0FDNUMsQ0FBQztBQUNKLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RlcC1vdXRjb21lLXRvLXVwZGF0ZS1zdGVwLW1hcHBlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hZGFwdGVycy9zdGVwLW91dGNvbWUtdG8tdXBkYXRlLXN0ZXAtbWFwcGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBdUJBLHNDQTZCQztBQTdDRCxTQUFTLGlCQUFpQixDQUFDLE9BQW9CO0lBQzdDLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUMvQiwwRUFBMEU7UUFDMUUsaUZBQWlGO1FBQ2pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxJQUFJLGVBQWUsRUFBRSxDQUFDO0lBQ3RFLENBQUM7SUFFRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssZ0JBQWdCLEVBQUUsQ0FBQztRQUN4QyxPQUFPLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUVELE9BQU8sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7QUFDN0IsQ0FBQztBQUVELG1HQUFtRztBQUNuRyxxRUFBcUU7QUFDckUsU0FBd0IsbUJBQW1CLENBQ3pDLEtBQWEsRUFDYixPQUFvQjtJQUVwQixNQUFNLE9BQU8sR0FBNEIsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3BFLElBQUksT0FBTyxDQUFDLEtBQUssS0FBSyxTQUFTO1FBQUUsT0FBTyxDQUFDLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBRS9ELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN6RSxPQUFPLENBQUMsY0FBYyxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUM7SUFDbEQsQ0FBQztJQUVELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLGVBQWUsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN2RSxPQUFPLENBQUMsZUFBZSxHQUFHLE9BQU8sQ0FBQyxlQUFlLENBQUM7SUFDcEQsQ0FBQztJQUVELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksT0FBTyxDQUFDLG1CQUFtQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3hFLE9BQU8sQ0FBQyxtQkFBbUIsR0FBRyxPQUFPLENBQUMsbUJBQW1CLENBQUM7SUFDNUQsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUE0QjtRQUMxQyxJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sS0FBSyxnQkFBZ0I7UUFDekMsT0FBTztLQUNSLENBQUM7SUFFRixPQUFPO1FBQ0wsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFDcEIsVUFBVSxFQUFFLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFO1FBQ3hELGVBQWUsRUFBRSxpQkFBaUIsQ0FBQyxPQUFPLENBQUM7S0FDNUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist/build-workflow-executor.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -14,11 +47,16 @@ const console_logger_1 = __importDefault(require("./adapters/console-logger"));
 const forest_server_workflow_port_1 = __importDefault(require("./adapters/forest-server-workflow-port"));
 const forestadmin_client_activity_log_port_factory_1 = __importDefault(require("./adapters/forestadmin-client-activity-log-port-factory"));
 const server_ai_adapter_1 = __importDefault(require("./adapters/server-ai-adapter"));
+const credential_encryption_1 = __importStar(require("./crypto/credential-encryption"));
 const defaults_1 = require("./defaults");
 const executor_http_server_1 = __importDefault(require("./http/executor-http-server"));
+const token_service_1 = __importDefault(require("./oauth/token-service"));
+const remote_tool_fetcher_1 = __importDefault(require("./remote-tool-fetcher"));
 const runner_1 = __importDefault(require("./runner"));
 const schema_cache_1 = __importDefault(require("./schema-cache"));
+const database_mcp_oauth_credentials_store_1 = __importDefault(require("./stores/database-mcp-oauth-credentials-store"));
 const database_store_1 = __importDefault(require("./stores/database-store"));
+const in_memory_mcp_oauth_credentials_store_1 = __importDefault(require("./stores/in-memory-mcp-oauth-credentials-store"));
 const in_memory_store_1 = __importDefault(require("./stores/in-memory-store"));
 const FORCE_EXIT_DELAY_S = 5;
 // A bad timeout config (0, negative, non-finite) must fall back to the default rather than
@@ -29,6 +67,11 @@ function positiveOrDefault(value, fallback) {
 function buildCommonDependencies(options) {
     const forestServerUrl = options.forestServerUrl ?? defaults_1.DEFAULT_FOREST_SERVER_URL;
     const logger = options.logger ?? (0, console_logger_1.default)(options.loggerLevel ?? defaults_1.DEFAULT_LOGGER_LEVEL);
+    // Lazy key by design (OAuth-less executors boot without it), but surface a security-relevant
+    // heads-up so a missing key isn't discovered only when a deposit 503s.
+    if (!(0, credential_encryption_1.isExecutorEncryptionKeyConfigured)()) {
+        logger('Warn', 'FOREST_EXECUTOR_ENCRYPTION_KEY is not set — OAuth-protected MCP servers are unavailable (credential deposits return 503) until it is configured.');
+    }
     const workflowPort = new forest_server_workflow_port_1.default({
         envSecret: options.envSecret,
         forestServerUrl,
@@ -120,7 +163,15 @@ function createWorkflowExecutor(runner, server, logger, manageProcessSignals) {
         },
         async start() {
             await runner.start();
-            await server.start();
+            // server.start() runs the OAuth-store migration; if it fails, don't leave the runner polling
+            // in the background — stop it so start() is all-or-nothing.
+            try {
+                await server.start();
+            }
+            catch (err) {
+                await runner.stop().catch(() => { });
+                throw err;
+            }
             // Only own the host's signals when explicitly allowed (the standalone CLI). When embedded,
             // the host process must keep control of SIGTERM/SIGINT and its own exit.
             if (manageProcessSignals) {
@@ -141,9 +192,21 @@ function createWorkflowExecutor(runner, server, logger, manageProcessSignals) {
 }
 function buildInMemoryExecutor(options) {
     const deps = buildCommonDependencies(options);
+    const mcpOAuthCredentialsStore = new in_memory_mcp_oauth_credentials_store_1.default();
+    const credentialEncryption = new credential_encryption_1.default();
+    // Shares the store + encryption with the deposit endpoint so runtime reads and writes (rotation)
+    // go through the same instance the HTTP server exposes. In-memory is dev-only: credentials live
+    // only for the process lifetime, but oauth2 steps work end-to-end just like the database executor.
+    const mcpOAuthTokenService = new token_service_1.default({
+        store: mcpOAuthCredentialsStore,
+        encryption: credentialEncryption,
+        logger: deps.logger,
+    });
+    const remoteToolFetcher = new remote_tool_fetcher_1.default(deps.workflowPort, deps.aiModelPort, deps.logger, mcpOAuthTokenService);
     const runner = new runner_1.default({
         ...deps,
         runStore: new in_memory_store_1.default(),
+        mcpOAuthTokenService,
     });
     const server = new executor_http_server_1.default({
         port: options.httpPort,
@@ -151,6 +214,10 @@ function buildInMemoryExecutor(options) {
         authSecret: options.authSecret,
         workflowPort: deps.workflowPort,
         logger: deps.logger,
+        mcpOAuthCredentialsStore,
+        credentialEncryption,
+        remoteToolFetcher,
+        oauthTokenService: mcpOAuthTokenService,
     });
     return createWorkflowExecutor(runner, server, deps.logger, options.manageProcessSignals ?? true);
 }
@@ -166,9 +233,23 @@ function buildDatabaseExecutor(options) {
     if (mergedOptions.logging === undefined)
         mergedOptions.logging = false;
     const sequelize = uri ? new sequelize_1.Sequelize(uri, mergedOptions) : new sequelize_1.Sequelize(mergedOptions);
+    const mcpOAuthCredentialsStore = new database_mcp_oauth_credentials_store_1.default({
+        sequelize,
+        schema: mergedOptions.schema,
+    });
+    const credentialEncryption = new credential_encryption_1.default();
+    // Shares the store + encryption with the deposit endpoint so runtime reads and writes (rotation)
+    // go through the same instance the HTTP server migrates on start.
+    const mcpOAuthTokenService = new token_service_1.default({
+        store: mcpOAuthCredentialsStore,
+        encryption: credentialEncryption,
+        logger: deps.logger,
+    });
+    const remoteToolFetcher = new remote_tool_fetcher_1.default(deps.workflowPort, deps.aiModelPort, deps.logger, mcpOAuthTokenService);
     const runner = new runner_1.default({
         ...deps,
         runStore: new database_store_1.default({ sequelize, schema: mergedOptions.schema }),
+        mcpOAuthTokenService,
     });
     const server = new executor_http_server_1.default({
         port: options.httpPort,
@@ -176,7 +257,11 @@ function buildDatabaseExecutor(options) {
         authSecret: options.authSecret,
         workflowPort: deps.workflowPort,
         logger: deps.logger,
+        mcpOAuthCredentialsStore,
+        credentialEncryption,
+        remoteToolFetcher,
+        oauthTokenService: mcpOAuthTokenService,
     });
     return createWorkflowExecutor(runner, server, deps.logger, options.manageProcessSignals ?? true);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQtd29ya2Zsb3ctZXhlY3V0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvYnVpbGQtd29ya2Zsb3ctZXhlY3V0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFvTkEsc0RBaUJDO0FBRUQsc0RBMEJDO0FBNVBELHdFQUFxRjtBQUNyRix5Q0FBc0M7QUFFdEMsaUdBQXNFO0FBQ3RFLHFGQUEyRDtBQUMzRCx1R0FBMkU7QUFDM0UsK0VBQTREO0FBQzVELHlHQUE4RTtBQUM5RSwySUFBOEc7QUFDOUcscUZBQTJEO0FBQzNELHlDQU9vQjtBQUNwQix1RkFBNkQ7QUFDN0Qsc0RBQThCO0FBQzlCLGtFQUF5QztBQUN6Qyw2RUFBb0Q7QUFDcEQsK0VBQXFEO0FBRXJELE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxDQUFDO0FBcUM3QiwyRkFBMkY7QUFDM0YsNkZBQTZGO0FBQzdGLFNBQVMsaUJBQWlCLENBQUMsS0FBeUIsRUFBRSxRQUFnQjtJQUNwRSxPQUFPLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO0FBQzdGLENBQUM7QUFFRCxTQUFTLHVCQUF1QixDQUFDLE9BQXdCO0lBQ3ZELE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQyxlQUFlLElBQUksb0NBQXlCLENBQUM7SUFDN0UsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFBLHdCQUFtQixFQUFDLE9BQU8sQ0FBQyxXQUFXLElBQUksK0JBQW9CLENBQUMsQ0FBQztJQUVsRyxNQUFNLFlBQVksR0FBRyxJQUFJLHFDQUF3QixDQUFDO1FBQ2hELFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztRQUM1QixlQUFlO1FBQ2YsTUFBTTtLQUNQLENBQUMsQ0FBQztJQUVILE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEtBQUssWUFBWSxDQUFDO0lBRW5GLElBQUksWUFBWSxFQUFFLENBQUM7UUFDakIsTUFBTSxDQUNKLE1BQU0sRUFDTixrRkFBa0YsQ0FDbkYsQ0FBQztJQUNKLENBQUM7U0FBTSxJQUFJLE9BQU8sQ0FBQyxZQUFZLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLE1BQU0sRUFBRSxrREFBa0QsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFFRCxJQUFJLFdBQVcsQ0FBQztJQUVoQixJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ2pCLFdBQVcsR0FBRyxJQUFJLG9DQUFzQixFQUFFLENBQUM7SUFDN0MsQ0FBQztTQUFNLElBQUksT0FBTyxDQUFDLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxDQUFDO1FBQzVDLFdBQVcsR0FBRyxJQUFJLDJCQUFlLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDOUQsQ0FBQztTQUFNLENBQUM7UUFDTixXQUFXLEdBQUcsSUFBSSwyQkFBZSxDQUFDLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBRUQsMkZBQTJGO0lBQzNGLE1BQU0sV0FBVyxHQUFHLElBQUksc0JBQVcsQ0FDakMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLGVBQWUsRUFBRSxxQ0FBMEIsQ0FBQyxDQUN2RSxDQUFDO0lBRUYsTUFBTSxTQUFTLEdBQUcsSUFBSSxpQ0FBb0IsQ0FBQztRQUN6QyxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7UUFDMUIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1FBQzlCLFdBQVc7UUFDWCxlQUFlO0tBQ2hCLENBQUMsQ0FBQztJQUVILE1BQU0sbUJBQW1CLEdBQUcsSUFBSSx3Q0FBbUIsQ0FBQyxJQUFJLGtDQUFhLEVBQUUsRUFBRTtRQUN2RSxlQUFlO1FBQ2YsT0FBTyxFQUFFLEVBQUUsMkJBQTJCLEVBQUUsa0JBQWtCLEVBQUU7S0FDN0QsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLHNEQUF1QyxDQUN4RSxtQkFBbUIsRUFDbkIsTUFBTSxDQUNQLENBQUM7SUFFRixPQUFPO1FBQ0wsU0FBUztRQUNULFdBQVc7UUFDWCxZQUFZO1FBQ1osV0FBVztRQUNYLHNCQUFzQjtRQUN0QixNQUFNO1FBQ04sZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLGdCQUFnQixJQUFJLHFDQUEwQjtRQUN4RSxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7UUFDNUIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1FBQzlCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtRQUNsQyxZQUFZLEVBQUUsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxpQ0FBc0IsQ0FBQztRQUM3RSxnQkFBZ0IsRUFBRSxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLEVBQUUsc0NBQTJCLENBQUM7UUFDMUYsYUFBYSxFQUFFLE9BQU8sQ0FBQyxhQUFhO0tBQ3JDLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxzQkFBc0IsQ0FDN0IsTUFBYyxFQUNkLE1BQTBCLEVBQzFCLE1BQWMsRUFDZCxvQkFBNkI7SUFFN0IsSUFBSSxlQUFlLEdBQXlCLElBQUksQ0FBQztJQUVqRCxNQUFNLFFBQVEsR0FBRyxLQUFLLElBQUksRUFBRTtRQUMxQixJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN0QixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMENBQTBDLEVBQUU7Z0JBQzFELEtBQUssRUFBRSxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDO2FBQ3hELENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0QixDQUFDLENBQUM7SUFFRixNQUFNLFFBQVEsR0FBRyxLQUFLLElBQUksRUFBRTtRQUMxQixNQUFNLENBQUMsTUFBTSxFQUFFLGtEQUFrRCxDQUFDLENBQUM7UUFFbkUsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLGVBQWU7Z0JBQUUsZUFBZSxHQUFHLFFBQVEsRUFBRSxDQUFDO1lBQ25ELE1BQU0sZUFBZSxDQUFDO1lBQ3RCLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRTtnQkFDMUMsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7YUFDOUQsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUM7UUFDdkIsQ0FBQztRQUVELHlEQUF5RDtRQUN6RCxzQ0FBc0M7UUFDdEMsVUFBVSxDQUFDLEdBQUcsRUFBRTtZQUNkLE1BQU0sQ0FBQyxPQUFPLEVBQUUsb0RBQW9ELENBQUMsQ0FBQztZQUN0RSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDdEMsQ0FBQyxFQUFFLGtCQUFrQixHQUFHLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3hDLENBQUMsQ0FBQztJQUVGLE9BQU87UUFDTCxJQUFJLEtBQUs7WUFDUCxPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFDdEIsQ0FBQztRQUVELEtBQUssQ0FBQyxLQUFLO1lBQ1QsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDckIsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7WUFFckIsMkZBQTJGO1lBQzNGLHlFQUF5RTtZQUN6RSxJQUFJLG9CQUFvQixFQUFFLENBQUM7Z0JBQ3pCLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUNoQyxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQztZQUNqQyxDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxJQUFJO1lBQ1IsSUFBSSxvQkFBb0IsRUFBRSxDQUFDO2dCQUN6QixPQUFPLENBQUMsY0FBYyxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDNUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDN0MsQ0FBQztZQUVELElBQUksQ0FBQyxlQUFlO2dCQUFFLGVBQWUsR0FBRyxRQUFRLEVBQUUsQ0FBQztZQUNuRCxNQUFNLGVBQWUsQ0FBQztRQUN4QixDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFnQixxQkFBcUIsQ0FBQyxPQUF3QjtJQUM1RCxNQUFNLElBQUksR0FBRyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUU5QyxNQUFNLE1BQU0sR0FBRyxJQUFJLGdCQUFNLENBQUM7UUFDeEIsR0FBRyxJQUFJO1FBQ1AsUUFBUSxFQUFFLElBQUkseUJBQWEsRUFBRTtLQUM5QixDQUFDLENBQUM7SUFFSCxNQUFNLE1BQU0sR0FBRyxJQUFJLDhCQUFrQixDQUFDO1FBQ3BDLElBQUksRUFBRSxPQUFPLENBQUMsUUFBUTtRQUN0QixNQUFNO1FBQ04sVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1FBQzlCLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUMvQixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07S0FDcEIsQ0FBQyxDQUFDO0lBRUgsT0FBTyxzQkFBc0IsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLG9CQUFvQixJQUFJLElBQUksQ0FBQyxDQUFDO0FBQ25HLENBQUM7QUFFRCxTQUFnQixxQkFBcUIsQ0FBQyxPQUFnQztJQUNwRSxNQUFNLElBQUksR0FBRyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM5QyxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsZ0JBQWdCLEVBQUUsR0FBRyxPQUFPLENBQUMsUUFBK0MsQ0FBQztJQUM3RiwyRUFBMkU7SUFDM0UsdUVBQXVFO0lBQ3ZFLDJFQUEyRTtJQUMzRSw4RUFBOEU7SUFDOUUsTUFBTSxpQkFBaUIsR0FBcUIsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7SUFDL0QsTUFBTSxhQUFhLEdBQXFCLEVBQUUsR0FBRyxpQkFBaUIsRUFBRSxHQUFHLGdCQUFnQixFQUFFLENBQUM7SUFDdEYsSUFBSSxhQUFhLENBQUMsT0FBTyxLQUFLLFNBQVM7UUFBRSxhQUFhLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztJQUN2RSxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUkscUJBQVMsQ0FBQyxHQUFHLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUkscUJBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUV6RixNQUFNLE1BQU0sR0FBRyxJQUFJLGdCQUFNLENBQUM7UUFDeEIsR0FBRyxJQUFJO1FBQ1AsUUFBUSxFQUFFLElBQUksd0JBQWEsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUFDO0tBQ3pFLENBQUMsQ0FBQztJQUVILE1BQU0sTUFBTSxHQUFHLElBQUksOEJBQWtCLENBQUM7UUFDcEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1FBQ3RCLE1BQU07UUFDTixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7UUFDOUIsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQy9CLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtLQUNwQixDQUFDLENBQUM7SUFFSCxPQUFPLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsb0JBQW9CLElBQUksSUFBSSxDQUFDLENBQUM7QUFDbkcsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQtd29ya2Zsb3ctZXhlY3V0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvYnVpbGQtd29ya2Zsb3ctZXhlY3V0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUE0T0Esc0RBd0NDO0FBRUQsc0RBbURDO0FBcFVELHdFQUFxRjtBQUNyRix5Q0FBc0M7QUFFdEMsaUdBQXNFO0FBQ3RFLHFGQUEyRDtBQUMzRCx1R0FBMkU7QUFDM0UsK0VBQTREO0FBQzVELHlHQUE4RTtBQUM5RSwySUFBOEc7QUFDOUcscUZBQTJEO0FBQzNELHdGQUV3QztBQUN4Qyx5Q0FPb0I7QUFDcEIsdUZBQTZEO0FBQzdELDBFQUFzRDtBQUN0RCxnRkFBc0Q7QUFDdEQsc0RBQThCO0FBQzlCLGtFQUF5QztBQUN6Qyx5SEFBNkY7QUFDN0YsNkVBQW9EO0FBQ3BELDJIQUE4RjtBQUM5RiwrRUFBcUQ7QUFFckQsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLENBQUM7QUFxQzdCLDJGQUEyRjtBQUMzRiw2RkFBNkY7QUFDN0YsU0FBUyxpQkFBaUIsQ0FBQyxLQUF5QixFQUFFLFFBQWdCO0lBQ3BFLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUM7QUFDN0YsQ0FBQztBQUVELFNBQVMsdUJBQXVCLENBQUMsT0FBd0I7SUFDdkQsTUFBTSxlQUFlLEdBQUcsT0FBTyxDQUFDLGVBQWUsSUFBSSxvQ0FBeUIsQ0FBQztJQUM3RSxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxJQUFJLElBQUEsd0JBQW1CLEVBQUMsT0FBTyxDQUFDLFdBQVcsSUFBSSwrQkFBb0IsQ0FBQyxDQUFDO0lBRWxHLDZGQUE2RjtJQUM3Rix1RUFBdUU7SUFDdkUsSUFBSSxDQUFDLElBQUEseURBQWlDLEdBQUUsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sQ0FDSixNQUFNLEVBQ04sa0pBQWtKLENBQ25KLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsSUFBSSxxQ0FBd0IsQ0FBQztRQUNoRCxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7UUFDNUIsZUFBZTtRQUNmLE1BQU07S0FDUCxDQUFDLENBQUM7SUFFSCxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFlBQVksQ0FBQztJQUVuRixJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ2pCLE1BQU0sQ0FDSixNQUFNLEVBQ04sa0ZBQWtGLENBQ25GLENBQUM7SUFDSixDQUFDO1NBQU0sSUFBSSxPQUFPLENBQUMsWUFBWSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ3pFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsa0RBQWtELENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQsSUFBSSxXQUFXLENBQUM7SUFFaEIsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUNqQixXQUFXLEdBQUcsSUFBSSxvQ0FBc0IsRUFBRSxDQUFDO0lBQzdDLENBQUM7U0FBTSxJQUFJLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUM1QyxXQUFXLEdBQUcsSUFBSSwyQkFBZSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzlELENBQUM7U0FBTSxDQUFDO1FBQ04sV0FBVyxHQUFHLElBQUksMkJBQWUsQ0FBQyxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUVELDJGQUEyRjtJQUMzRixNQUFNLFdBQVcsR0FBRyxJQUFJLHNCQUFXLENBQ2pDLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxlQUFlLEVBQUUscUNBQTBCLENBQUMsQ0FDdkUsQ0FBQztJQUVGLE1BQU0sU0FBUyxHQUFHLElBQUksaUNBQW9CLENBQUM7UUFDekMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1FBQzFCLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtRQUM5QixXQUFXO1FBQ1gsZUFBZTtLQUNoQixDQUFDLENBQUM7SUFFSCxNQUFNLG1CQUFtQixHQUFHLElBQUksd0NBQW1CLENBQUMsSUFBSSxrQ0FBYSxFQUFFLEVBQUU7UUFDdkUsZUFBZTtRQUNmLE9BQU8sRUFBRSxFQUFFLDJCQUEyQixFQUFFLGtCQUFrQixFQUFFO0tBQzdELENBQUMsQ0FBQztJQUNILE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxzREFBdUMsQ0FDeEUsbUJBQW1CLEVBQ25CLE1BQU0sQ0FDUCxDQUFDO0lBRUYsT0FBTztRQUNMLFNBQVM7UUFDVCxXQUFXO1FBQ1gsWUFBWTtRQUNaLFdBQVc7UUFDWCxzQkFBc0I7UUFDdEIsTUFBTTtRQUNOLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSxxQ0FBMEI7UUFDeEUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1FBQzVCLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtRQUM5QixZQUFZLEVBQUUsT0FBTyxDQUFDLFlBQVk7UUFDbEMsWUFBWSxFQUFFLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxZQUFZLEVBQUUsaUNBQXNCLENBQUM7UUFDN0UsZ0JBQWdCLEVBQUUsaUJBQWlCLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLHNDQUEyQixDQUFDO1FBQzFGLGFBQWEsRUFBRSxPQUFPLENBQUMsYUFBYTtLQUNyQyxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsc0JBQXNCLENBQzdCLE1BQWMsRUFDZCxNQUEwQixFQUMxQixNQUFjLEVBQ2Qsb0JBQTZCO0lBRTdCLElBQUksZUFBZSxHQUF5QixJQUFJLENBQUM7SUFFakQsTUFBTSxRQUFRLEdBQUcsS0FBSyxJQUFJLEVBQUU7UUFDMUIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDdEIsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixNQUFNLENBQUMsT0FBTyxFQUFFLDBDQUEwQyxFQUFFO2dCQUMxRCxLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQzthQUN4RCxDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsTUFBTSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxRQUFRLEdBQUcsS0FBSyxJQUFJLEVBQUU7UUFDMUIsTUFBTSxDQUFDLE1BQU0sRUFBRSxrREFBa0QsQ0FBQyxDQUFDO1FBRW5FLElBQUksQ0FBQztZQUNILElBQUksQ0FBQyxlQUFlO2dCQUFFLGVBQWUsR0FBRyxRQUFRLEVBQUUsQ0FBQztZQUNuRCxNQUFNLGVBQWUsQ0FBQztZQUN0QixPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztRQUN2QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sQ0FBQyxPQUFPLEVBQUUsMEJBQTBCLEVBQUU7Z0JBQzFDLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2FBQzlELENBQUMsQ0FBQztZQUNILE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7UUFFRCx5REFBeUQ7UUFDekQsc0NBQXNDO1FBQ3RDLFVBQVUsQ0FBQyxHQUFHLEVBQUU7WUFDZCxNQUFNLENBQUMsT0FBTyxFQUFFLG9EQUFvRCxDQUFDLENBQUM7WUFDdEUsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ3RDLENBQUMsRUFBRSxrQkFBa0IsR0FBRyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN4QyxDQUFDLENBQUM7SUFFRixPQUFPO1FBQ0wsSUFBSSxLQUFLO1lBQ1AsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDO1FBQ3RCLENBQUM7UUFFRCxLQUFLLENBQUMsS0FBSztZQUNULE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBRXJCLDZGQUE2RjtZQUM3Riw0REFBNEQ7WUFDNUQsSUFBSSxDQUFDO2dCQUNILE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3ZCLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLE1BQU0sTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztnQkFDcEMsTUFBTSxHQUFHLENBQUM7WUFDWixDQUFDO1lBRUQsMkZBQTJGO1lBQzNGLHlFQUF5RTtZQUN6RSxJQUFJLG9CQUFvQixFQUFFLENBQUM7Z0JBQ3pCLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUNoQyxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQztZQUNqQyxDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxJQUFJO1lBQ1IsSUFBSSxvQkFBb0IsRUFBRSxDQUFDO2dCQUN6QixPQUFPLENBQUMsY0FBYyxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDNUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDN0MsQ0FBQztZQUVELElBQUksQ0FBQyxlQUFlO2dCQUFFLGVBQWUsR0FBRyxRQUFRLEVBQUUsQ0FBQztZQUNuRCxNQUFNLGVBQWUsQ0FBQztRQUN4QixDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFnQixxQkFBcUIsQ0FBQyxPQUF3QjtJQUM1RCxNQUFNLElBQUksR0FBRyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUU5QyxNQUFNLHdCQUF3QixHQUFHLElBQUksK0NBQWdDLEVBQUUsQ0FBQztJQUN4RSxNQUFNLG9CQUFvQixHQUFHLElBQUksK0JBQW9CLEVBQUUsQ0FBQztJQUN4RCxpR0FBaUc7SUFDakcsZ0dBQWdHO0lBQ2hHLG1HQUFtRztJQUNuRyxNQUFNLG9CQUFvQixHQUFHLElBQUksdUJBQWlCLENBQUM7UUFDakQsS0FBSyxFQUFFLHdCQUF3QjtRQUMvQixVQUFVLEVBQUUsb0JBQW9CO1FBQ2hDLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtLQUNwQixDQUFDLENBQUM7SUFFSCxNQUFNLGlCQUFpQixHQUFHLElBQUksNkJBQWlCLENBQzdDLElBQUksQ0FBQyxZQUFZLEVBQ2pCLElBQUksQ0FBQyxXQUFXLEVBQ2hCLElBQUksQ0FBQyxNQUFNLEVBQ1gsb0JBQW9CLENBQ3JCLENBQUM7SUFFRixNQUFNLE1BQU0sR0FBRyxJQUFJLGdCQUFNLENBQUM7UUFDeEIsR0FBRyxJQUFJO1FBQ1AsUUFBUSxFQUFFLElBQUkseUJBQWEsRUFBRTtRQUM3QixvQkFBb0I7S0FDckIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxNQUFNLEdBQUcsSUFBSSw4QkFBa0IsQ0FBQztRQUNwQyxJQUFJLEVBQUUsT0FBTyxDQUFDLFFBQVE7UUFDdEIsTUFBTTtRQUNOLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtRQUM5QixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7UUFDL0IsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO1FBQ25CLHdCQUF3QjtRQUN4QixvQkFBb0I7UUFDcEIsaUJBQWlCO1FBQ2pCLGlCQUFpQixFQUFFLG9CQUFvQjtLQUN4QyxDQUFDLENBQUM7SUFFSCxPQUFPLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsb0JBQW9CLElBQUksSUFBSSxDQUFDLENBQUM7QUFDbkcsQ0FBQztBQUVELFNBQWdCLHFCQUFxQixDQUFDLE9BQWdDO0lBQ3BFLE1BQU0sSUFBSSxHQUFHLHVCQUF1QixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlDLE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxnQkFBZ0IsRUFBRSxHQUFHLE9BQU8sQ0FBQyxRQUErQyxDQUFDO0lBQzdGLDJFQUEyRTtJQUMzRSx1RUFBdUU7SUFDdkUsMkVBQTJFO0lBQzNFLDhFQUE4RTtJQUM5RSxNQUFNLGlCQUFpQixHQUFxQixFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUMvRCxNQUFNLGFBQWEsR0FBcUIsRUFBRSxHQUFHLGlCQUFpQixFQUFFLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQztJQUN0RixJQUFJLGFBQWEsQ0FBQyxPQUFPLEtBQUssU0FBUztRQUFFLGFBQWEsQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO0lBQ3ZFLE1BQU0sU0FBUyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxxQkFBUyxDQUFDLEdBQUcsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxxQkFBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBRXpGLE1BQU0sd0JBQXdCLEdBQUcsSUFBSSw4Q0FBZ0MsQ0FBQztRQUNwRSxTQUFTO1FBQ1QsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNO0tBQzdCLENBQUMsQ0FBQztJQUNILE1BQU0sb0JBQW9CLEdBQUcsSUFBSSwrQkFBb0IsRUFBRSxDQUFDO0lBQ3hELGlHQUFpRztJQUNqRyxrRUFBa0U7SUFDbEUsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLHVCQUFpQixDQUFDO1FBQ2pELEtBQUssRUFBRSx3QkFBd0I7UUFDL0IsVUFBVSxFQUFFLG9CQUFvQjtRQUNoQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07S0FDcEIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLDZCQUFpQixDQUM3QyxJQUFJLENBQUMsWUFBWSxFQUNqQixJQUFJLENBQUMsV0FBVyxFQUNoQixJQUFJLENBQUMsTUFBTSxFQUNYLG9CQUFvQixDQUNyQixDQUFDO0lBRUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxnQkFBTSxDQUFDO1FBQ3hCLEdBQUcsSUFBSTtRQUNQLFFBQVEsRUFBRSxJQUFJLHdCQUFhLENBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN4RSxvQkFBb0I7S0FDckIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxNQUFNLEdBQUcsSUFBSSw4QkFBa0IsQ0FBQztRQUNwQyxJQUFJLEVBQUUsT0FBTyxDQUFDLFFBQVE7UUFDdEIsTUFBTTtRQUNOLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtRQUM5QixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7UUFDL0IsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO1FBQ25CLHdCQUF3QjtRQUN4QixvQkFBb0I7UUFDcEIsaUJBQWlCO1FBQ2pCLGlCQUFpQixFQUFFLG9CQUFvQjtLQUN4QyxDQUFDLENBQUM7SUFFSCxPQUFPLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsb0JBQW9CLElBQUksSUFBSSxDQUFDLENBQUM7QUFDbkcsQ0FBQyJ9

package/dist/crypto/credential-encryption.d.ts

@@ -0,0 +1,10 @@
+export declare function isExecutorEncryptionKeyConfigured(): boolean;
+export interface EncryptedValue {
+    ciphertext: Buffer;
+}
+export default class CredentialEncryption {
+    encrypt(plaintext: string): EncryptedValue;
+    decrypt(value: Buffer): string;
+    private deriveKey;
+}
+//# sourceMappingURL=credential-encryption.d.ts.map

package/dist/crypto/credential-encryption.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isExecutorEncryptionKeyConfigured = isExecutorEncryptionKeyConfigured;
+const crypto_1 = require("crypto");
+const errors_1 = require("../errors");
+const ENV_KEY = 'FOREST_EXECUTOR_ENCRYPTION_KEY';
+// Fixed context label bound into the HKDF derivation — domain-separates this key from any other
+// use of the same secret. Changing it would make every existing row undecryptable.
+const HKDF_INFO = 'forest-executor:mcp-oauth-credentials';
+const HKDF_DIGEST = 'sha256';
+const KEY_BYTES = 32; // AES-256
+const IV_BYTES = 12; // GCM standard nonce length
+const AUTH_TAG_BYTES = 16;
+const ALGORITHM = 'aes-256-gcm';
+// Boot-time check (no derivation, no throw): is the at-rest key configured? Lets startup emit a
+// warning that OAuth-protected MCP servers are unavailable until it is set. There is deliberately no
+// default key — a hardcoded one would be public in this open-source package and defeat the at-rest
+// encryption (a DB dump would be decryptable with the shipped key).
+function isExecutorEncryptionKeyConfigured() {
+    return Boolean(process.env[ENV_KEY]);
+}
+// Concatenate byte arrays without going through Buffer.concat — keeps everything in the concrete
+// Uint8Array<ArrayBuffer> domain the Node crypto types expect.
+function concatBytes(parts) {
+    const total = parts.reduce((length, part) => length + part.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+// At-rest encryption for secrets the executor stores. The HKDF key (from
+// FOREST_EXECUTOR_ENCRYPTION_KEY) is read lazily — an executor that stores no such secrets boots
+// without it — and fails closed: a missing key throws rather than persisting or returning an
+// unprotected value.
+class CredentialEncryption {
+    encrypt(plaintext) {
+        const iv = (0, crypto_1.randomFillSync)(new Uint8Array(IV_BYTES));
+        const cipher = (0, crypto_1.createCipheriv)(ALGORITHM, this.deriveKey(), iv);
+        const encrypted = concatBytes([
+            new Uint8Array(cipher.update(plaintext, 'utf8')),
+            new Uint8Array(cipher.final()),
+        ]);
+        const authTag = new Uint8Array(cipher.getAuthTag());
+        return {
+            ciphertext: Buffer.from(concatBytes([iv, authTag, encrypted])),
+        };
+    }
+    decrypt(value) {
+        const bytes = new Uint8Array(value);
+        const iv = bytes.subarray(0, IV_BYTES);
+        const authTag = bytes.subarray(IV_BYTES, IV_BYTES + AUTH_TAG_BYTES);
+        const encrypted = bytes.subarray(IV_BYTES + AUTH_TAG_BYTES);
+        const decipher = (0, crypto_1.createDecipheriv)(ALGORITHM, this.deriveKey(), iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = concatBytes([
+            new Uint8Array(decipher.update(encrypted)),
+            new Uint8Array(decipher.final()),
+        ]);
+        return Buffer.from(decrypted).toString('utf8');
+    }
+    deriveKey() {
+        const secret = process.env[ENV_KEY];
+        if (!secret)
+            throw new errors_1.ExecutorEncryptionKeyMissingError();
+        // Empty salt is intentional: the fixed HKDF_INFO label gives domain separation and the
+        // single high-entropy secret needs no salt. Wrap hkdfSync's ArrayBuffer as a concrete
+        // Uint8Array<ArrayBuffer> to satisfy CipherKey (Buffer's ArrayBufferLike backing does not).
+        return new Uint8Array((0, crypto_1.hkdfSync)(HKDF_DIGEST, secret, new Uint8Array(0), HKDF_INFO, KEY_BYTES));
+    }
+}
+exports.default = CredentialEncryption;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbC1lbmNyeXB0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NyeXB0by9jcmVkZW50aWFsLWVuY3J5cHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFrQkEsOEVBRUM7QUFwQkQsbUNBQW9GO0FBRXBGLHNDQUE4RDtBQUU5RCxNQUFNLE9BQU8sR0FBRyxnQ0FBZ0MsQ0FBQztBQUNqRCxnR0FBZ0c7QUFDaEcsbUZBQW1GO0FBQ25GLE1BQU0sU0FBUyxHQUFHLHVDQUF1QyxDQUFDO0FBQzFELE1BQU0sV0FBVyxHQUFHLFFBQVEsQ0FBQztBQUM3QixNQUFNLFNBQVMsR0FBRyxFQUFFLENBQUMsQ0FBQyxVQUFVO0FBQ2hDLE1BQU0sUUFBUSxHQUFHLEVBQUUsQ0FBQyxDQUFDLDRCQUE0QjtBQUNqRCxNQUFNLGNBQWMsR0FBRyxFQUFFLENBQUM7QUFDMUIsTUFBTSxTQUFTLEdBQUcsYUFBYSxDQUFDO0FBRWhDLGdHQUFnRztBQUNoRyxxR0FBcUc7QUFDckcsbUdBQW1HO0FBQ25HLG9FQUFvRTtBQUNwRSxTQUFnQixpQ0FBaUM7SUFDL0MsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBQ3ZDLENBQUM7QUFPRCxpR0FBaUc7QUFDakcsK0RBQStEO0FBQy9ELFNBQVMsV0FBVyxDQUFDLEtBQW1CO0lBQ3RDLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN0RSxNQUFNLEdBQUcsR0FBRyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNsQyxJQUFJLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFFZixLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ3pCLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDO0lBQ3hCLENBQUM7SUFFRCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRCx5RUFBeUU7QUFDekUsaUdBQWlHO0FBQ2pHLDZGQUE2RjtBQUM3RixxQkFBcUI7QUFDckIsTUFBcUIsb0JBQW9CO0lBQ3ZDLE9BQU8sQ0FBQyxTQUFpQjtRQUN2QixNQUFNLEVBQUUsR0FBRyxJQUFBLHVCQUFjLEVBQUMsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUNwRCxNQUFNLE1BQU0sR0FBRyxJQUFBLHVCQUFjLEVBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUM7WUFDNUIsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDaEQsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1NBQy9CLENBQUMsQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBRXBELE9BQU87WUFDTCxVQUFVLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7U0FDL0QsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPLENBQUMsS0FBYTtRQUNuQixNQUFNLEtBQUssR0FBRyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNwQyxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUN2QyxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxRQUFRLEdBQUcsY0FBYyxDQUFDLENBQUM7UUFDcEUsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEdBQUcsY0FBYyxDQUFDLENBQUM7UUFFNUQsTUFBTSxRQUFRLEdBQUcsSUFBQSx5QkFBZ0IsRUFBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLFFBQVEsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFN0IsTUFBTSxTQUFTLEdBQUcsV0FBVyxDQUFDO1lBQzVCLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDMUMsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDO1NBQ2pDLENBQUMsQ0FBQztRQUVILE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUVPLFNBQVM7UUFDZixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRXBDLElBQUksQ0FBQyxNQUFNO1lBQUUsTUFBTSxJQUFJLDBDQUFpQyxFQUFFLENBQUM7UUFFM0QsdUZBQXVGO1FBQ3ZGLHNGQUFzRjtRQUN0Riw0RkFBNEY7UUFDNUYsT0FBTyxJQUFJLFVBQVUsQ0FBQyxJQUFBLGlCQUFRLEVBQUMsV0FBVyxFQUFFLE1BQU0sRUFBRSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNoRyxDQUFDO0NBQ0Y7QUExQ0QsdUNBMENDIn0=

package/dist/defaults.d.ts

@@ -8,4 +8,5 @@ export declare const DEFAULT_STOP_TIMEOUT_S = 30;
 export declare const DEFAULT_MAX_CHAIN_DEPTH = 50;
 export declare const DEFAULT_SCHEMA_CACHE_TTL_S: number;
 export declare const DEFAULT_LOGGER_LEVEL: LoggerLevel;
+export declare const DEFAULT_OAUTH_EXPIRY_SKEW_S = 60;
 //# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_LOGGER_LEVEL = exports.DEFAULT_SCHEMA_CACHE_TTL_S = exports.DEFAULT_MAX_CHAIN_DEPTH = exports.DEFAULT_STOP_TIMEOUT_S = exports.DEFAULT_AI_INVOKE_TIMEOUT_S = exports.DEFAULT_STEP_TIMEOUT_S = exports.DEFAULT_POLLING_INTERVAL_S = exports.DEFAULT_FOREST_SERVER_URL = exports.DEFAULT_HTTP_PORT = void 0;
+exports.DEFAULT_OAUTH_EXPIRY_SKEW_S = exports.DEFAULT_LOGGER_LEVEL = exports.DEFAULT_SCHEMA_CACHE_TTL_S = exports.DEFAULT_MAX_CHAIN_DEPTH = exports.DEFAULT_STOP_TIMEOUT_S = exports.DEFAULT_AI_INVOKE_TIMEOUT_S = exports.DEFAULT_STEP_TIMEOUT_S = exports.DEFAULT_POLLING_INTERVAL_S = exports.DEFAULT_FOREST_SERVER_URL = exports.DEFAULT_HTTP_PORT = void 0;
 exports.DEFAULT_HTTP_PORT = 3400;
 exports.DEFAULT_FOREST_SERVER_URL = 'https://api.forestadmin.com';
 exports.DEFAULT_POLLING_INTERVAL_S = 30;
@@ -10,4 +10,7 @@ exports.DEFAULT_STOP_TIMEOUT_S = 30;
 exports.DEFAULT_MAX_CHAIN_DEPTH = 50;
 exports.DEFAULT_SCHEMA_CACHE_TTL_S = 10 * 60;
 exports.DEFAULT_LOGGER_LEVEL = 'Info';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVmYXVsdHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZGVmYXVsdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBRWEsUUFBQSxpQkFBaUIsR0FBRyxJQUFJLENBQUM7QUFDekIsUUFBQSx5QkFBeUIsR0FBRyw2QkFBNkIsQ0FBQztBQUMxRCxRQUFBLDBCQUEwQixHQUFHLEVBQUUsQ0FBQztBQUNoQyxRQUFBLHNCQUFzQixHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDaEMsUUFBQSwyQkFBMkIsR0FBRyxFQUFFLENBQUM7QUFDakMsUUFBQSxzQkFBc0IsR0FBRyxFQUFFLENBQUM7QUFDNUIsUUFBQSx1QkFBdUIsR0FBRyxFQUFFLENBQUM7QUFDN0IsUUFBQSwwQkFBMEIsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDO0FBQ3JDLFFBQUEsb0JBQW9CLEdBQWdCLE1BQU0sQ0FBQyJ9
+// Refresh an OAuth access token this many seconds before it actually expires, so a token never
+// goes stale mid-request between the skew check and the downstream MCP call.
+exports.DEFAULT_OAUTH_EXPIRY_SKEW_S = 60;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVmYXVsdHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZGVmYXVsdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBRWEsUUFBQSxpQkFBaUIsR0FBRyxJQUFJLENBQUM7QUFDekIsUUFBQSx5QkFBeUIsR0FBRyw2QkFBNkIsQ0FBQztBQUMxRCxRQUFBLDBCQUEwQixHQUFHLEVBQUUsQ0FBQztBQUNoQyxRQUFBLHNCQUFzQixHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDaEMsUUFBQSwyQkFBMkIsR0FBRyxFQUFFLENBQUM7QUFDakMsUUFBQSxzQkFBc0IsR0FBRyxFQUFFLENBQUM7QUFDNUIsUUFBQSx1QkFBdUIsR0FBRyxFQUFFLENBQUM7QUFDN0IsUUFBQSwwQkFBMEIsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDO0FBQ3JDLFFBQUEsb0JBQW9CLEdBQWdCLE1BQU0sQ0FBQztBQUN4RCwrRkFBK0Y7QUFDL0YsNkVBQTZFO0FBQ2hFLFFBQUEsMkJBQTJCLEdBQUcsRUFBRSxDQUFDIn0=

package/dist/errors.d.ts

@@ -1,5 +1,6 @@
 import type { MalformedRunInfo } from './ports/workflow-port';
 import type { RecordId } from './types/validated/collection';
+import type { AwaitingInputReason } from './types/validated/step-outcome';
 import type { z } from 'zod';
 export declare function causeMessage(error: unknown): string | undefined;
 export declare function extractErrorMessage(err?: unknown): string | undefined;
@@ -91,6 +92,10 @@ export declare class StepTimeoutError extends WorkflowExecutorError {
 export declare class AiInvokeTimeoutError extends WorkflowExecutorError {
     constructor(timeoutS: number);
 }
+export declare class AiAssistUnavailableError extends WorkflowExecutorError {
+    readonly reason: unknown;
+    constructor(reason: unknown);
+}
 export declare class NoMcpToolsError extends WorkflowExecutorError {
     constructor(requestedMcpServerId: string);
 }
@@ -115,6 +120,23 @@ export declare class McpToolInvocationError extends WorkflowExecutorError {
 export declare class ConfigurationError extends Error {
     constructor(message: string);
 }
+export declare class OAuthReauthRequiredError extends WorkflowExecutorError {
+    readonly awaitingInputReason: AwaitingInputReason;
+    constructor(mcpServerId: string, awaitingInputReason?: AwaitingInputReason);
+}
+export declare class OAuthRefreshError extends WorkflowExecutorError {
+    constructor(message: string, cause?: unknown);
+}
+export declare class OAuthInvalidGrantError extends WorkflowExecutorError {
+    constructor(detail?: string);
+}
+export declare class InvalidTokenEndpointError extends WorkflowExecutorError {
+    constructor(reason: string);
+}
+export declare class ExecutorEncryptionKeyMissingError extends Error {
+    readonly code = "executor_encryption_key_missing";
+    constructor();
+}
 export declare class RunNotFoundError extends NotFoundError {
     constructor(runId: string, cause?: unknown);
 }