@forumone/throughline 2.2.0 → 2.3.0-pr-315-e1a501e

package/dist/mcp-oauth/store.js

@@ -0,0 +1,408 @@
+import { findAuditWriter } from '../audit/plugin.js';
+import { fetchClientMetadata, isMetadataDocumentUrl } from './cimd.js';
+import { classifyRedirects, MCP_CLIENT_RULES } from './clients.js';
+import { hashToken, newClientId, newToken, TOKEN_PREFIX, verifyPkce } from './crypto.js';
+import { keys, MCP_OAUTH_CLIENTS_SLUG, MCP_OAUTH_GRANTS_SLUG, } from './runtime.js';
+const CIMD_REFRESH_MS = 24 * 60 * 60 * 1000;
+function asClient(doc) {
+    return {
+        id: doc['id'],
+        clientId: String(doc['clientId']),
+        ...(typeof doc['name'] === 'string' ? { name: doc['name'] } : {}),
+        kind: doc['kind'],
+        method: doc['method'],
+        redirectUris: Array.isArray(doc['redirectUris']) ? doc['redirectUris'] : [],
+    };
+}
+async function findOne(payload, collection, where) {
+    const { docs } = await payload.find({
+        collection: collection,
+        where: where,
+        limit: 1,
+        depth: 0,
+        overrideAccess: true,
+        pagination: false,
+    });
+    return docs[0];
+}
+/**
+ * A registration request's client, registered — or the one already registered
+ * with the same name and redirects. Registering is unauthenticated by design
+ * (RFC 7591), so identical requests share a row rather than each adding one.
+ */
+export async function registerClient(payload, policy, request) {
+    const classified = classifyRedirects(request.redirectUris, (kind) => policy.clients[kind]);
+    if ('error' in classified)
+        return classified;
+    const redirectUris = [...request.redirectUris].sort();
+    const name = request.name?.slice(0, 200);
+    const existing = await payload.find({
+        collection: MCP_OAUTH_CLIENTS_SLUG,
+        where: {
+            and: [
+                { method: { equals: 'dcr' } },
+                { kind: { equals: classified.kind } },
+                name ? { name: { equals: name } } : { name: { exists: false } },
+            ],
+        },
+        limit: 20,
+        depth: 0,
+        overrideAccess: true,
+        pagination: false,
+    });
+    for (const doc of existing.docs) {
+        const client = asClient(doc);
+        if (JSON.stringify([...client.redirectUris].sort()) === JSON.stringify(redirectUris))
+            return client;
+    }
+    const created = await payload.create({
+        collection: MCP_OAUTH_CLIENTS_SLUG,
+        data: {
+            clientId: newClientId(),
+            ...(name ? { name } : {}),
+            kind: classified.kind,
+            method: 'dcr',
+            redirectUris,
+        },
+        overrideAccess: true,
+    });
+    return asClient(created);
+}
+/**
+ * The client a `client_id` names: a registered one, or a metadata document,
+ * fetched (and cached for a day) and held to the same allowlist.
+ */
+export async function resolveClient(payload, policy, clientId, fetchImpl) {
+    if (typeof clientId !== 'string' || clientId === '')
+        return { error: 'client_id is required.' };
+    const found = await findOne(payload, MCP_OAUTH_CLIENTS_SLUG, { clientId: { equals: clientId } });
+    if (!isMetadataDocumentUrl(clientId)) {
+        if (!found)
+            return { error: 'This app is not registered here. Remove the connector and add it again.' };
+        const client = asClient(found);
+        if (!policy.clients[client.kind]) {
+            return {
+                error: `${MCP_CLIENT_RULES[client.kind].label} connections are turned off on this site.`,
+            };
+        }
+        return client;
+    }
+    const fresh = found && typeof found['fetchedAt'] === 'string'
+        ? Date.now() - Date.parse(found['fetchedAt']) < CIMD_REFRESH_MS
+        : false;
+    if (found && fresh) {
+        const client = asClient(found);
+        if (!policy.clients[client.kind]) {
+            return {
+                error: `${MCP_CLIENT_RULES[client.kind].label} connections are turned off on this site.`,
+            };
+        }
+        return client;
+    }
+    const doc = await fetchClientMetadata(clientId, fetchImpl);
+    if ('error' in doc)
+        return doc;
+    const classified = classifyRedirects(doc.redirect_uris, (kind) => policy.clients[kind]);
+    if ('error' in classified)
+        return classified;
+    const data = {
+        clientId,
+        ...(doc.client_name ? { name: doc.client_name.slice(0, 200) } : {}),
+        kind: classified.kind,
+        method: 'cimd',
+        redirectUris: doc.redirect_uris,
+        fetchedAt: new Date().toISOString(),
+    };
+    const saved = found
+        ? await payload.update({
+            collection: MCP_OAUTH_CLIENTS_SLUG,
+            id: found['id'],
+            data: data,
+            overrideAccess: true,
+        })
+        : await payload.create({
+            collection: MCP_OAUTH_CLIENTS_SLUG,
+            data: data,
+            overrideAccess: true,
+        });
+    return asClient(saved);
+}
+/** Consent: a pending grant and the code that completes it. */
+export async function createPendingGrant(payload, user, client, request) {
+    const { token: key } = keys(payload);
+    const code = newToken(TOKEN_PREFIX.code);
+    const now = Date.now();
+    // Codes nobody exchanged, from anyone, are swept here rather than by a job.
+    await payload.delete({
+        collection: MCP_OAUTH_GRANTS_SLUG,
+        where: {
+            and: [
+                { status: { equals: 'pending' } },
+                { codeExpiresAt: { less_than: new Date(now - 60 * 60 * 1000).toISOString() } },
+            ],
+        },
+        overrideAccess: true,
+    });
+    await payload.create({
+        collection: MCP_OAUTH_GRANTS_SLUG,
+        data: {
+            user: user['id'],
+            client: client.id,
+            clientName: MCP_CLIENT_RULES[client.kind].label,
+            kind: client.kind,
+            status: 'pending',
+            redirectHost: new URL(request.redirectUri).host,
+            codeHash: hashToken(key, code),
+            codeChallenge: request.codeChallenge,
+            codeRedirectUri: request.redirectUri,
+            codeExpiresAt: new Date(now + 60 * 1000).toISOString(),
+        },
+        overrideAccess: true,
+    });
+    return code;
+}
+async function issue(payload, runtime, grantId, extra) {
+    const { token: key } = keys(payload);
+    const access = newToken(TOKEN_PREFIX.access);
+    const refresh = newToken(TOKEN_PREFIX.refresh);
+    const now = Date.now();
+    await payload.update({
+        collection: MCP_OAUTH_GRANTS_SLUG,
+        id: grantId,
+        data: {
+            ...extra,
+            status: 'active',
+            accessHash: hashToken(key, access),
+            accessExpiresAt: new Date(now + runtime.accessTokenTtl * 1000).toISOString(),
+            refreshHash: hashToken(key, refresh),
+            refreshExpiresAt: new Date(now + runtime.refreshTokenTtl * 1000).toISOString(),
+            lastUsedAt: new Date(now).toISOString(),
+        },
+        overrideAccess: true,
+    });
+    return {
+        access_token: access,
+        token_type: 'Bearer',
+        expires_in: runtime.accessTokenTtl,
+        refresh_token: refresh,
+        scope: 'mcp',
+    };
+}
+/** Ends a grant: its tokens stop working at once. */
+export async function revokeGrant(payload, grant, reason) {
+    await payload.update({
+        collection: MCP_OAUTH_GRANTS_SLUG,
+        id: grant['id'],
+        data: {
+            status: 'revoked',
+            revokedAt: new Date().toISOString(),
+            revokedReason: reason,
+            accessHash: null,
+            refreshHash: null,
+        },
+        overrideAccess: true,
+    });
+    if (grant['status'] === 'active')
+        await record(payload, grant, 'mcp.disconnected', reason);
+}
+async function record(payload, grant, action, reason) {
+    const audit = findAuditWriter(payload);
+    if (!audit)
+        return;
+    const userId = typeof grant['user'] === 'object' && grant['user']
+        ? grant['user']['id']
+        : grant['user'];
+    await audit({
+        actor: { type: 'user', userId: String(userId) },
+        action,
+        mcpServer: 'payload',
+        mcpTool: 'oauth',
+        targetCollection: MCP_OAUTH_GRANTS_SLUG,
+        targetId: String(grant['id']),
+        targetTitle: String(grant['clientName'] ?? ''),
+        summary: action === 'mcp.connected'
+            ? `Connected ${String(grant['clientName'])} over MCP`
+            : `Disconnected ${String(grant['clientName'])}${reason ? `: ${reason}` : ''}`,
+    });
+}
+async function stillAllowed(payload, runtime, policy, grant) {
+    if (!policy.clients[grant['kind']]) {
+        return { reason: `${String(grant['clientName'])} connections were turned off` };
+    }
+    const user = (await payload.findByID({
+        collection: runtime.users,
+        id: (typeof grant['user'] === 'object' && grant['user']
+            ? grant['user']['id']
+            : grant['user']),
+        depth: 0,
+        overrideAccess: true,
+        disableErrors: true,
+    }));
+    if (!user)
+        return { reason: 'the account no longer exists' };
+    const verdict = runtime.eligible(user);
+    if (verdict !== true)
+        return { reason: verdict };
+    return { user };
+}
+/** `grant_type=authorization_code`. */
+export async function exchangeCode(payload, runtime, policy, params) {
+    const { token: key } = keys(payload);
+    if (!params.code || !params.clientId) {
+        return { error: 'invalid_request', error_description: 'code and client_id are required.' };
+    }
+    const grant = await findOne(payload, MCP_OAUTH_GRANTS_SLUG, {
+        codeHash: { equals: hashToken(key, params.code) },
+    });
+    if (!grant)
+        return { error: 'invalid_grant', error_description: 'The authorization code is not valid.' };
+    /*
+    A code presented twice is a code somebody else has: RFC 6749 §4.1.2 says to
+    revoke what it already issued, so the legitimate app is signed out too and
+    the person reconnects, rather than an attacker keeping a session.
+    */
+    if (grant['status'] !== 'pending') {
+        await revokeGrant(payload, grant, 'its authorization code was used twice');
+        return {
+            error: 'invalid_grant',
+            error_description: 'The authorization code has already been used.',
+        };
+    }
+    if (Date.parse(String(grant['codeExpiresAt'])) < Date.now()) {
+        return { error: 'invalid_grant', error_description: 'The authorization code has expired.' };
+    }
+    const client = await findOne(payload, MCP_OAUTH_CLIENTS_SLUG, { id: { equals: grant['client'] } });
+    if (!client || client['clientId'] !== params.clientId) {
+        return {
+            error: 'invalid_grant',
+            error_description: 'The code was issued to a different client.',
+        };
+    }
+    if (params.redirectUri !== undefined && params.redirectUri !== grant['codeRedirectUri']) {
+        return {
+            error: 'invalid_grant',
+            error_description: 'redirect_uri does not match the authorization request.',
+        };
+    }
+    if (!verifyPkce(params.codeVerifier, String(grant['codeChallenge']))) {
+        return {
+            error: 'invalid_grant',
+            error_description: 'code_verifier does not match the code challenge.',
+        };
+    }
+    const allowed = await stillAllowed(payload, runtime, policy, grant);
+    if ('reason' in allowed) {
+        await revokeGrant(payload, grant, allowed.reason);
+        return { error: 'invalid_grant', error_description: `Not connected: ${allowed.reason}.` };
+    }
+    const tokens = await issue(payload, runtime, grant['id'], {
+        connectedAt: new Date().toISOString(),
+        codeExpiresAt: new Date(0).toISOString(),
+    });
+    await payload.update({
+        collection: MCP_OAUTH_CLIENTS_SLUG,
+        id: client['id'],
+        data: { lastUsedAt: new Date().toISOString() },
+        overrideAccess: true,
+    });
+    await record(payload, grant, 'mcp.connected');
+    return tokens;
+}
+/*
+How long an already-rotated refresh token is forgiven. Clients refresh
+concurrently — a proactive refresh racing a 401-driven one — and the loser
+presents the token the winner just rotated. Inside this window that is a race,
+answered `invalid_grant` and nothing more; outside it, it is reuse of a stolen
+token, and the whole grant is revoked (OAuth 2.1 §4.3.1).
+*/
+const ROTATION_GRACE_MS = 60 * 1000;
+/** `grant_type=refresh_token`. */
+export async function refresh(payload, runtime, policy, params) {
+    const { token: key } = keys(payload);
+    if (!params.refreshToken) {
+        return { error: 'invalid_request', error_description: 'refresh_token is required.' };
+    }
+    const hash = hashToken(key, params.refreshToken);
+    const grant = await findOne(payload, MCP_OAUTH_GRANTS_SLUG, { refreshHash: { equals: hash } });
+    if (!grant) {
+        const rotated = await findOne(payload, MCP_OAUTH_GRANTS_SLUG, {
+            previousRefreshHash: { equals: hash },
+        });
+        if (rotated && rotated['status'] === 'active') {
+            const since = Date.now() - Date.parse(String(rotated['rotatedAt'] ?? 0));
+            if (since > ROTATION_GRACE_MS) {
+                await revokeGrant(payload, rotated, 'a refresh token was used after it had been replaced');
+            }
+        }
+        return { error: 'invalid_grant', error_description: 'The refresh token is not valid.' };
+    }
+    if (grant['status'] !== 'active') {
+        return { error: 'invalid_grant', error_description: 'This connection has been revoked.' };
+    }
+    if (Date.parse(String(grant['refreshExpiresAt'])) < Date.now()) {
+        return {
+            error: 'invalid_grant',
+            error_description: 'The refresh token has expired. Connect again.',
+        };
+    }
+    if (params.clientId) {
+        const client = await findOne(payload, MCP_OAUTH_CLIENTS_SLUG, {
+            id: { equals: grant['client'] },
+        });
+        if (!client || client['clientId'] !== params.clientId) {
+            return {
+                error: 'invalid_grant',
+                error_description: 'The refresh token was issued to a different client.',
+            };
+        }
+    }
+    const allowed = await stillAllowed(payload, runtime, policy, grant);
+    if ('reason' in allowed) {
+        await revokeGrant(payload, grant, allowed.reason);
+        return { error: 'invalid_grant', error_description: `Disconnected: ${allowed.reason}.` };
+    }
+    return issue(payload, runtime, grant['id'], {
+        previousRefreshHash: hash,
+        rotatedAt: new Date().toISOString(),
+    });
+}
+/** RFC 7009. Unknown tokens are not an error. */
+export async function revokeToken(payload, token) {
+    if (typeof token !== 'string' || token === '')
+        return;
+    const { token: key } = keys(payload);
+    const hash = hashToken(key, token);
+    const grant = (await findOne(payload, MCP_OAUTH_GRANTS_SLUG, { accessHash: { equals: hash } })) ??
+        (await findOne(payload, MCP_OAUTH_GRANTS_SLUG, { refreshHash: { equals: hash } }));
+    if (grant && grant['status'] !== 'revoked')
+        await revokeGrant(payload, grant, 'the app disconnected');
+}
+/** An access token's grant and person, if it is live and still allowed. */
+export async function authenticateAccessToken(payload, runtime, policy, token) {
+    const { token: key } = keys(payload);
+    const grant = await findOne(payload, MCP_OAUTH_GRANTS_SLUG, {
+        accessHash: { equals: hashToken(key, token) },
+    });
+    if (!grant || grant['status'] !== 'active')
+        return { reason: 'The access token is not valid.' };
+    if (Date.parse(String(grant['accessExpiresAt'])) < Date.now()) {
+        return { reason: 'The access token has expired.' };
+    }
+    const allowed = await stillAllowed(payload, runtime, policy, grant);
+    if ('reason' in allowed) {
+        await revokeGrant(payload, grant, allowed.reason);
+        return { reason: `Disconnected: ${allowed.reason}.` };
+    }
+    // At most one write every five minutes per connection, for "last used".
+    const last = Date.parse(String(grant['lastUsedAt'] ?? 0));
+    if (!(last > Date.now() - 5 * 60 * 1000)) {
+        await payload.update({
+            collection: MCP_OAUTH_GRANTS_SLUG,
+            id: grant['id'],
+            data: { lastUsedAt: new Date().toISOString() },
+            overrideAccess: true,
+        });
+    }
+    return { user: allowed.user, grant };
+}
+//# sourceMappingURL=store.js.map

package/dist/mcp-oauth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/mcp-oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAkB,MAAM,WAAW,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAsB,MAAM,cAAc,CAAA;AACtF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxF,OAAO,EACL,IAAI,EACJ,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,cAAc,CAAA;AAsBrB,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3C,SAAS,QAAQ,CAAC,GAAQ;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAoB;QAChC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAkB;QAClC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAmB;QACvC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,cAAc,CAAc,CAAC,CAAC,CAAC,EAAE;KAC1F,CAAA;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,UAAkB,EAAE,KAA8B;IACzF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,UAAmB;QAC/B,KAAK,EAAE,KAAc;QACrB,KAAK,EAAE,CAAC;QACR,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAA+B,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,MAAuB,EACvB,OAAmD;IAEnD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,IAAI,OAAO,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IAC5C,MAAM,YAAY,GAAG,CAAC,GAAI,OAAO,CAAC,YAAyB,CAAC,CAAC,IAAI,EAAE,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAExC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,sBAA+B;QAC3C,KAAK,EAAE;YACL,GAAG,EAAE;gBACH,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;gBAC7B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE;gBACrC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;aAChE;SACO;QACV,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAA;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAwB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAClF,OAAO,MAAM,CAAA;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACnC,UAAU,EAAE,sBAA+B;QAC3C,IAAI,EAAE;YACJ,QAAQ,EAAE,WAAW,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,KAAK;YACb,YAAY;SACJ;QACV,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,OAAyB,CAAC,CAAA;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,MAAuB,EACvB,QAAiB,EACjB,SAAqB;IAErB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAA;IAC/F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEhG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK;YACR,OAAO,EAAE,KAAK,EAAE,yEAAyE,EAAE,CAAA;QAC7F,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,2CAA2C;aACzF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ;QAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,eAAe;QAC/D,CAAC,CAAC,KAAK,CAAA;IACX,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,2CAA2C;aACzF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC1D,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,GAAG,CAAA;IAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACvF,IAAI,OAAO,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IAE5C,MAAM,IAAI,GAAG;QACX,QAAQ;QACR,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK;QACjB,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,UAAU,EAAE,sBAA+B;YAC3C,EAAE,EAAE,KAAK,CAAC,IAAI,CAAU;YACxB,IAAI,EAAE,IAAa;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC;QACJ,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,UAAU,EAAE,sBAA+B;YAC3C,IAAI,EAAE,IAAa;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;IACN,OAAO,QAAQ,CAAC,KAAuB,CAAC,CAAA;AAC1C,CAAC;AASD,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,IAAS,EACT,MAAoB,EACpB,OAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEtB,4EAA4E;IAC5E,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,qBAA8B;QAC1C,KAAK,EAAE;YACL,GAAG,EAAE;gBACH,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;gBACjC,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;aAC/E;SACO;QACV,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IAEF,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,qBAA8B;QAC1C,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;YAC/C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI;YAC/C,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,eAAe,EAAE,OAAO,CAAC,WAAW;YACpC,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SAC9C;QACV,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAeD,KAAK,UAAU,KAAK,CAClB,OAAgB,EAChB,OAAwB,EACxB,OAAgB,EAChB,KAA8B;IAE9B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,qBAA8B;QAC1C,EAAE,EAAE,OAAgB;QACpB,IAAI,EAAE;YACJ,GAAG,KAAK;YACR,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC;YAClC,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5E,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC;YACpC,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC9E,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;SAC/B;QACV,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO,CAAC,cAAc;QAClC,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE,KAAK;KACb,CAAA;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,KAAU,EAAE,MAAc;IAC5E,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,qBAA8B;QAC1C,EAAE,EAAE,KAAK,CAAC,IAAI,CAAU;QACxB,IAAI,EAAE;YACJ,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;SACT;QACV,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAA;AAC5F,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,OAAgB,EAChB,KAAU,EACV,MAA4C,EAC5C,MAAe;IAEf,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,OAAM;IAClB,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;QAChD,CAAC,CAAE,KAAK,CAAC,MAAM,CAAS,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnB,MAAM,KAAK,CAAC;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QAC/C,MAAM;QACN,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,OAAO;QAChB,gBAAgB,EAAE,qBAAqB;QACvC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,EACL,MAAM,KAAK,eAAe;YACxB,CAAC,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW;YACrD,CAAC,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;KAClF,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,OAAwB,EACxB,MAAuB,EACvB,KAAU;IAEV,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,8BAA8B,EAAE,CAAA;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;QACnC,UAAU,EAAE,OAAO,CAAC,KAAc;QAClC,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,CAAC,CAAE,KAAK,CAAC,MAAM,CAAS,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAU;QAC3B,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB,CAAC,CAA0B,CAAA;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAChD,OAAO,EAAE,IAAI,EAAE,CAAA;AACjB,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,OAAwB,EACxB,MAAuB,EACvB,MAAyF;IAEzF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAA;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE;QAC1D,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;KAClD,CAAC,CAAA;IACF,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,sCAAsC,EAAE,CAAA;IAE9F;;;;MAIE;IACF,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,uCAAuC,CAAC,CAAA;QAC1E,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,+CAA+C;SACnE,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,CAAA;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAClG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,4CAA4C;SAChE,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxF,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,wDAAwD;SAC5E,CAAA;IACH,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,kDAAkD;SACtE,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACnE,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAA;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACxD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,aAAa,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACzC,CAAC,CAAA;IACF,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,sBAA+B;QAC3C,EAAE,EAAE,MAAM,CAAC,IAAI,CAAU;QACzB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAW;QACvD,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;EAME;AACF,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEnC,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAgB,EAChB,OAAwB,EACxB,MAAuB,EACvB,MAAoD;IAEpD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAA;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAE9F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE;YAC5D,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACtC,CAAC,CAAA;QACF,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACxE,IAAI,KAAK,GAAG,iBAAiB,EAAE,CAAC;gBAC9B,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,qDAAqD,CAAC,CAAA;YAC5F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iCAAiC,EAAE,CAAA;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,CAAA;IAC3F,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,+CAA+C;SACnE,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE;YAC5D,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;SAChC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO;gBACL,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,qDAAqD;aACzE,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACnE,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAA;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QAC1C,mBAAmB,EAAE,IAAI;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAA;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,KAAc;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAM;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAClC,MAAM,KAAK,GACT,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IACpF,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;QACxC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAA;AAC7D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,OAAwB,EACxB,MAAuB,EACvB,KAAa;IAEb,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE;QAC1D,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;KAC9C,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;IAC/F,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACnE,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,EAAE,MAAM,EAAE,iBAAiB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAA;IACvD,CAAC;IAED,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,UAAU,EAAE,qBAA8B;YAC1C,EAAE,EAAE,KAAK,CAAC,IAAI,CAAU;YACxB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAW;YACvD,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AACtC,CAAC"}

package/dist/migrate/exports.json

@@ -55,6 +55,7 @@
         "CHARACTER_COUNT_TEXTAREA_PATH": ["@forumone/throughline/fields"],
         "CHARACTER_COUNT_TEXT_PATH": ["@forumone/throughline/fields"],
         "COMMAND_PALETTE_PATH": ["@forumone/throughline/editorial"],
+        "CONNECT_MCP_VIEW_PATH": ["@forumone/throughline/mcp-oauth"],
         "CONTENT_BLOCK_TOOLS": ["@forumone/throughline/content"],
         "CONTENT_BLOCK_TOOL_DESCRIPTORS": ["@forumone/throughline/content"],
         "CONTENT_CALENDAR_VIEW_PATH": ["@forumone/throughline/editorial"],
@@ -86,6 +87,7 @@
         "ComposedSectionShape": ["@forumone/throughline/media"],
         "CompositionIssue": ["@forumone/throughline/content"],
         "ConfigInput": ["@forumone/throughline/testing"],
+        "ConnectMcpView": ["@forumone/throughline/rsc"],
         "ContentCalendarReport": ["@forumone/throughline/rsc"],
         "ContentCalendarView": ["@forumone/throughline/rsc"],
         "ContentCollectionOptions": ["@forumone/throughline/content"],
@@ -212,13 +214,28 @@
         "LockHolder": ["@forumone/throughline/content"],
         "Logger": ["@forumone/throughline"],
         "MANUAL_SYNC_EVENT": ["@forumone/throughline/integrations"],
+        "MCP_ACCESS_SLUG": ["@forumone/throughline/mcp-oauth"],
         "MCP_API_KEYS_SLUG": ["@forumone/throughline"],
+        "MCP_AUTHORIZE_VIEW_PATH": ["@forumone/throughline/mcp-oauth"],
+        "MCP_CLIENT_KINDS": ["@forumone/throughline/mcp-oauth"],
+        "MCP_CLIENT_RULES": ["@forumone/throughline/mcp-oauth"],
+        "MCP_OAUTH_CLIENTS_SLUG": ["@forumone/throughline/mcp-oauth"],
+        "MCP_OAUTH_GRANTS_SLUG": ["@forumone/throughline/mcp-oauth"],
+        "MCP_OAUTH_STRATEGY": ["@forumone/throughline/mcp-oauth"],
         "ManifestSource": ["@forumone/throughline/components"],
         "ManualSyncRefusal": ["@forumone/throughline/integrations"],
         "MatchingConfig": ["@forumone/throughline/components"],
+        "McpAccessPolicy": ["@forumone/throughline/mcp-oauth"],
+        "McpAccessSettings": ["@forumone/throughline/mcp-oauth"],
         "McpApiKeyAccessOptions": ["@forumone/throughline"],
+        "McpAuthorizeView": ["@forumone/throughline/rsc"],
+        "McpClientKind": ["@forumone/throughline/mcp-oauth"],
+        "McpClientRule": ["@forumone/throughline/mcp-oauth"],
         "McpMeta": ["@forumone/throughline"],
         "McpMetaSchema": ["@forumone/throughline"],
+        "McpOAuth": ["@forumone/throughline/mcp-oauth"],
+        "McpOAuthOptions": ["@forumone/throughline/mcp-oauth"],
+        "McpOAuthRuntime": ["@forumone/throughline/mcp-oauth"],
         "McpToolCollector": ["@forumone/throughline"],
         "McpToolContext": ["@forumone/throughline"],
         "McpToolDefinition": ["@forumone/throughline"],
@@ -232,6 +249,7 @@
         "OBSERVABILITY_TOOLS": ["@forumone/throughline/observability"],
         "OBSERVABILITY_TOOL_DESCRIPTORS": ["@forumone/throughline/observability"],
         "OPS_TOOL_NAMES": ["@forumone/throughline"],
+        "OverrideAuth": ["@forumone/throughline/mcp-oauth"],
         "PALETTE_TOOLS": ["@forumone/throughline/editorial"],
         "PALETTE_TOOL_DESCRIPTORS": ["@forumone/throughline/editorial"],
         "PER_SOURCE": ["@forumone/throughline/editorial"],
@@ -357,6 +375,7 @@
         "auditEventEchoJob": ["@forumone/throughline/audit"],
         "auditPlugin": ["@forumone/throughline/audit"],
         "auditQueryPlugin": ["@forumone/throughline/audit"],
+        "authorizationServerMetadata": ["@forumone/throughline/mcp-oauth"],
         "blockFieldPaths": ["@forumone/throughline/content"],
         "blockRegistry": ["@forumone/throughline/media"],
         "buildActionUrl": ["@forumone/throughline/approvals"],
@@ -370,6 +389,8 @@
         "checkAnonymousAccess": ["@forumone/throughline/testing"],
         "checkEnvValue": ["@forumone/throughline"],
         "checkSlug": ["@forumone/throughline/fields"],
+        "classifyRedirects": ["@forumone/throughline/mcp-oauth"],
+        "clientKindFor": ["@forumone/throughline/mcp-oauth"],
         "clientPrefix": ["@forumone/throughline/observability"],
         "clockFor": ["@forumone/throughline/editorial"],
         "componentsPlugin": ["@forumone/throughline/components"],
@@ -416,6 +437,7 @@
         "createManifestReachableCheck": ["@forumone/throughline/integrations"],
         "createMoveBlockTool": ["@forumone/throughline/content"],
         "createNamedLogger": ["@forumone/throughline"],
+        "createOverrideAuth": ["@forumone/throughline/mcp-oauth"],
         "createPayloadReachableCheck": ["@forumone/throughline/integrations"],
         "createQueryAuditTool": ["@forumone/throughline/audit"],
         "createRemoveBlockTool": ["@forumone/throughline/content"],
@@ -512,6 +534,8 @@
         "matchCommands": ["@forumone/throughline/editorial"],
         "matchRank": ["@forumone/throughline/editorial"],
         "mcpApiKeyAccess": ["@forumone/throughline"],
+        "mcpOAuth": ["@forumone/throughline/mcp-oauth"],
+        "mcpOAuthRewrites": ["@forumone/throughline/mcp-oauth"],
         "mergePatch": ["@forumone/throughline/content"],
         "mergeTokens": ["@forumone/throughline/email"],
         "missingAltCheck": ["@forumone/throughline/editorial"],
@@ -529,6 +553,8 @@
         "payloadJobs": ["@forumone/throughline/jobs/payload"],
         "pointsAt": ["@forumone/throughline/media"],
         "problemReport": ["@forumone/throughline/integrations"],
+        "protectedResourceMetadata": ["@forumone/throughline/mcp-oauth"],
+        "protectedResourceMetadataUrl": ["@forumone/throughline/mcp-oauth"],
         "publishAtScheduledTimeJob": ["@forumone/throughline/publishing"],
         "publishDocument": ["@forumone/throughline/publishing"],
         "publishScheduledThroughPipeline": ["@forumone/throughline"],
@@ -538,9 +564,11 @@
         "pushRecent": ["@forumone/throughline/editorial"],
         "queryRange": ["@forumone/throughline/editorial"],
         "readCalendarMonth": ["@forumone/throughline/editorial"],
+        "readPolicy": ["@forumone/throughline/mcp-oauth"],
         "readRecent": ["@forumone/throughline/editorial"],
         "readYourWork": ["@forumone/throughline/editorial"],
         "recordStoredFacts": ["@forumone/throughline/media"],
+        "redirectRegistered": ["@forumone/throughline/mcp-oauth"],
         "referenceRefusal": ["@forumone/throughline/media"],
         "referencesIn": ["@forumone/throughline/media"],
         "referencesPlugin": ["@forumone/throughline/media"],
@@ -584,6 +612,7 @@
         "toolCalendar": ["@forumone/throughline/editorial"],
         "toolReport": ["@forumone/throughline/editorial"],
         "toolWork": ["@forumone/throughline/editorial"],
+        "toolsFor": ["@forumone/throughline/mcp-oauth"],
         "topLevelFields": ["@forumone/throughline/content"],
         "triggerSync": ["@forumone/throughline/client"],
         "uniqueUploadPrefix": ["@forumone/throughline/media"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline",
-  "version": "2.2.0",
+  "version": "2.3.0-pr-315-e1a501e",
   "description": "Throughline: an editorial platform for Payload CMS. Publishing, approvals, audit, integrations, email and jobs, with every feature reachable over MCP.",
   "type": "module",
   "main": "./dist/index.js",
@@ -66,6 +66,10 @@
       "types": "./dist/content/index.d.ts",
       "default": "./dist/content/index.js"
     },
+    "./mcp-oauth": {
+      "types": "./dist/mcp-oauth/index.d.ts",
+      "default": "./dist/mcp-oauth/index.js"
+    },
     "./observability": {
       "types": "./dist/observability/index.d.ts",
       "default": "./dist/observability/index.js"
@@ -170,7 +174,7 @@
   "dependencies": {
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2",
-    "@forumone/throughline-design-system": "2.2.0"
+    "@forumone/throughline-design-system": "2.3.0-pr-315-e1a501e"
   },
   "devDependencies": {
     "@payloadcms/db-sqlite": "^3.83.0",
@@ -194,7 +198,7 @@
     "typescript": "^5.6.0",
     "vitest": "^4.1.10",
     "@forumone/throughline-eslint-config": "0.0.1",
-    "@forumone/throughline-reference-ds": "0.3.22",
+    "@forumone/throughline-reference-ds": "0.3.23-pr-315-e1a501e",
     "@forumone/throughline-tsconfig": "0.0.1"
   },
   "scripts": {