@fragno-dev/mcp-fragment 0.0.0-stage → 0.0.3

package/dist/cli/cli.js

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+import { MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER } from "./mcp-types.js";
+import { createMcpFragment } from "./index.js";
+import { spawn } from "node:child_process";
+import { mkdir } from "node:fs/promises";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import path from "node:path";
+import { migrate } from "@fragno-dev/db";
+import { toNodeHandler } from "@fragno-dev/node";
+//#region src/cli/cli.ts
+const DEFAULT_PORT = 3927;
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_MOUNT_ROUTE = "/api/mcp-fragment";
+const USAGE = `fragno-mcp <command> [options]
+
+Commands:
+  serve                         Run the local MCP fragment server
+  add <slug> <endpoint-url>      Register a remote MCP server
+  oauth <slug>                  Start OAuth and open the authorization URL
+  status <slug>                 Show auth status
+  tools <slug>                  List remote MCP tools
+
+Options:
+  --base-url <url>              Local fragment base URL (default: http://127.0.0.1:3927)
+  --port <port>                 Server port for serve/oauth (default: 3927)
+  --host <host>                 Server host for serve (default: 127.0.0.1)
+  --data-dir <path>             SQLite data directory (default: ~/.fragno/mcp-fragment)
+  --mount-route <path>          Fragment mount route (default: /api/mcp-fragment)
+  --scope <scope>               OAuth scope
+  --client-id <id>              OAuth client id
+  --client-secret <secret>      OAuth client secret
+  --json                        Print JSON
+  --no-open                     Do not open the browser for oauth
+  -h, --help                    Show help`;
+function parse(argv) {
+	const args = [];
+	const options = {};
+	for (let i = 0; i < argv.length; i += 1) {
+		const arg = argv[i];
+		if (arg === "--") {
+			args.push(...argv.slice(i + 1));
+			break;
+		}
+		if (arg === "--help" || arg === "-h") {
+			options["help"] = true;
+			continue;
+		}
+		if (arg.startsWith("--")) {
+			const [rawKey, rawValue] = arg.split("=", 2);
+			const key = rawKey.slice(2);
+			if (key === "json" || key === "no-open") {
+				options[key] = rawValue === void 0 ? true : rawValue !== "false";
+				continue;
+			}
+			const value = rawValue ?? argv[i + 1];
+			if (rawValue === void 0) i += 1;
+			options[key] = value ?? "";
+			continue;
+		}
+		args.push(arg);
+	}
+	const [command, ...rest] = args;
+	return {
+		command,
+		args: rest,
+		options
+	};
+}
+function optionString(options, key) {
+	const value = options[key];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function optionBoolean(options, key) {
+	return options[key] === true;
+}
+function localBaseUrl(options) {
+	return optionString(options, "base-url") ?? `http://${DEFAULT_HOST}:${optionString(options, "port") ?? DEFAULT_PORT}`;
+}
+function mountRoute(options) {
+	return optionString(options, "mount-route") ?? DEFAULT_MOUNT_ROUTE;
+}
+function dataDir(options) {
+	return optionString(options, "data-dir") ?? path.join(homedir(), ".fragno", "mcp-fragment");
+}
+function fragmentUrl(options, route) {
+	return `${localBaseUrl(options).replace(/\/$/, "")}${mountRoute(options)}${route}`;
+}
+async function requestJson(method, url, body) {
+	const response = await fetch(url, {
+		method,
+		headers: body === void 0 ? void 0 : { "content-type": "application/json" },
+		body: body === void 0 ? void 0 : JSON.stringify(body)
+	});
+	const text = await response.text();
+	const payload = text ? JSON.parse(text) : void 0;
+	if (!response.ok) {
+		const message = payload && typeof payload === "object" && "message" in payload ? String(payload.message) : text || `HTTP ${response.status}`;
+		throw new Error(message);
+	}
+	return payload;
+}
+async function startServer(options, logger) {
+	const dir = dataDir(options);
+	await mkdir(dir, { recursive: true });
+	process.env["FRAGNO_DATA_DIR"] = dir;
+	const baseUrl = localBaseUrl(options).replace(/\/$/, "");
+	const fragmentMountRoute = mountRoute(options);
+	const oauthRedirectUri = `${baseUrl}${fragmentMountRoute}/oauth/callback`;
+	const fragment = createMcpFragment({ allowedOAuthRedirectUris: (url) => url.toString() === oauthRedirectUri }, {
+		mountRoute: fragmentMountRoute,
+		databaseNamespace: "mcp-fragment"
+	});
+	logger.log("migrating sqlite database if needed...");
+	await migrate(fragment);
+	const handler = toNodeHandler(fragment.handler.bind(fragment));
+	const server = createServer((req, res) => {
+		if (req.url?.startsWith(fragment.mountRoute)) {
+			handler(req, res);
+			return;
+		}
+		res.writeHead(404, { "content-type": "text/plain" }).end("Not found");
+	});
+	const port = Number(optionString(options, "port") ?? DEFAULT_PORT);
+	const host = optionString(options, "host") ?? DEFAULT_HOST;
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(port, host, () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	logger.log(`fragno-mcp listening at ${baseUrl}${fragment.mountRoute}`);
+	logger.log(`sqlite data dir: ${dir}`);
+	return server;
+}
+function openBrowser(url) {
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+	const args = process.platform === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : [url];
+	spawn(command, args, {
+		stdio: "ignore",
+		detached: true
+	}).unref();
+}
+function print(value, json, logger) {
+	if (json) {
+		logger.log(JSON.stringify(value, null, 2));
+		return;
+	}
+	if (value && typeof value === "object" && "tools" in value && Array.isArray(value.tools)) {
+		for (const tool of value.tools) {
+			const record = tool && typeof tool === "object" ? tool : {};
+			logger.log(`${String(record["name"] ?? "(unnamed)")}\t${String(record["description"] ?? "")}`);
+		}
+		return;
+	}
+	logger.log(JSON.stringify(value, null, 2));
+}
+async function run(argv, logger = console) {
+	const parsed = parse(argv.slice(2));
+	if (optionBoolean(parsed.options, "help") || !parsed.command) {
+		logger.log(USAGE);
+		return parsed.command ? 0 : 1;
+	}
+	try {
+		switch (parsed.command) {
+			case "serve":
+				await startServer(parsed.options, logger);
+				await new Promise(() => void 0);
+				return 0;
+			case "add": {
+				const [slug, endpointUrl] = parsed.args;
+				if (!slug || !endpointUrl) throw new Error("Usage: fragno-mcp add <slug> <endpoint-url>");
+				print(await requestJson("POST", fragmentUrl(parsed.options, "/servers"), {
+					slug,
+					endpointUrl,
+					auth: { type: "none" }
+				}), optionBoolean(parsed.options, "json"), logger);
+				return 0;
+			}
+			case "oauth": {
+				const [slug] = parsed.args;
+				if (!slug) throw new Error("Usage: fragno-mcp oauth <slug>");
+				const startUrl = new URL(fragmentUrl(parsed.options, `/servers/${encodeURIComponent(slug)}/auth/start`));
+				startUrl.searchParams.set(MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER, fragmentUrl(parsed.options, "/oauth/callback"));
+				const result = await requestJson("POST", startUrl.toString(), {
+					scope: optionString(parsed.options, "scope"),
+					clientId: optionString(parsed.options, "client-id"),
+					clientSecret: optionString(parsed.options, "client-secret")
+				});
+				logger.log(`Open this URL to authorize:\n${result.authorizationUrl}`);
+				if (!optionBoolean(parsed.options, "no-open")) openBrowser(result.authorizationUrl);
+				logger.log("Keep `fragno-mcp serve` running until the browser redirects back to the local callback.");
+				return 0;
+			}
+			case "status": {
+				const [slug] = parsed.args;
+				if (!slug) throw new Error("Usage: fragno-mcp status <slug>");
+				print(await requestJson("GET", fragmentUrl(parsed.options, `/servers/${encodeURIComponent(slug)}/auth/status`)), optionBoolean(parsed.options, "json"), logger);
+				return 0;
+			}
+			case "tools": {
+				const [slug] = parsed.args;
+				if (!slug) throw new Error("Usage: fragno-mcp tools <slug>");
+				print(await requestJson("GET", fragmentUrl(parsed.options, `/servers/${encodeURIComponent(slug)}/tools`)), optionBoolean(parsed.options, "json"), logger);
+				return 0;
+			}
+			default: throw new Error(`Unknown command: ${parsed.command}`);
+		}
+	} catch (error) {
+		logger.error(`${error instanceof Error ? error.message : String(error)}\n\n${USAGE}`);
+		return 1;
+	}
+}
+if (process.argv[1] ? import.meta.url === new URL(process.argv[1], "file:").href : false) {
+	const exitCode = await run(process.argv);
+	if (typeof exitCode === "number") process.exitCode = exitCode;
+}
+//#endregion
+export { run };
+
+//# sourceMappingURL=cli.js.map

package/dist/cli/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","names":[],"sources":["../../src/cli/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { spawn } from \"node:child_process\";\nimport { mkdir } from \"node:fs/promises\";\nimport { createServer, type Server } from \"node:http\";\nimport { homedir } from \"node:os\";\nimport path from \"node:path\";\n\nimport { migrate } from \"@fragno-dev/db\";\nimport { toNodeHandler } from \"@fragno-dev/node\";\n\nimport { createMcpFragment } from \"../index\";\nimport { MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER } from \"../mcp-types\";\n\nconst DEFAULT_PORT = 3927;\nconst DEFAULT_HOST = \"127.0.0.1\";\nconst DEFAULT_MOUNT_ROUTE = \"/api/mcp-fragment\";\n\nconst USAGE = `fragno-mcp <command> [options]\n\nCommands:\n  serve                         Run the local MCP fragment server\n  add <slug> <endpoint-url>      Register a remote MCP server\n  oauth <slug>                  Start OAuth and open the authorization URL\n  status <slug>                 Show auth status\n  tools <slug>                  List remote MCP tools\n\nOptions:\n  --base-url <url>              Local fragment base URL (default: http://127.0.0.1:3927)\n  --port <port>                 Server port for serve/oauth (default: 3927)\n  --host <host>                 Server host for serve (default: 127.0.0.1)\n  --data-dir <path>             SQLite data directory (default: ~/.fragno/mcp-fragment)\n  --mount-route <path>          Fragment mount route (default: /api/mcp-fragment)\n  --scope <scope>               OAuth scope\n  --client-id <id>              OAuth client id\n  --client-secret <secret>      OAuth client secret\n  --json                        Print JSON\n  --no-open                     Do not open the browser for oauth\n  -h, --help                    Show help`;\n\ntype Logger = Pick<Console, \"log\" | \"error\">;\n\ntype Parsed = {\n  command?: string;\n  args: string[];\n  options: Record<string, string | boolean>;\n};\n\nfunction parse(argv: string[]): Parsed {\n  const args: string[] = [];\n  const options: Record<string, string | boolean> = {};\n  for (let i = 0; i < argv.length; i += 1) {\n    const arg = argv[i];\n    if (arg === \"--\") {\n      args.push(...argv.slice(i + 1));\n      break;\n    }\n    if (arg === \"--help\" || arg === \"-h\") {\n      options[\"help\"] = true;\n      continue;\n    }\n    if (arg.startsWith(\"--\")) {\n      const [rawKey, rawValue] = arg.split(\"=\", 2);\n      const key = rawKey.slice(2);\n      if (key === \"json\" || key === \"no-open\") {\n        options[key] = rawValue === undefined ? true : rawValue !== \"false\";\n        continue;\n      }\n      const value = rawValue ?? argv[i + 1];\n      if (rawValue === undefined) {\n        i += 1;\n      }\n      options[key] = value ?? \"\";\n      continue;\n    }\n    args.push(arg);\n  }\n  const [command, ...rest] = args;\n  return { command, args: rest, options };\n}\n\nfunction optionString(options: Parsed[\"options\"], key: string): string | undefined {\n  const value = options[key];\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\nfunction optionBoolean(options: Parsed[\"options\"], key: string): boolean {\n  return options[key] === true;\n}\n\nfunction localBaseUrl(options: Parsed[\"options\"]): string {\n  return (\n    optionString(options, \"base-url\") ??\n    `http://${DEFAULT_HOST}:${optionString(options, \"port\") ?? DEFAULT_PORT}`\n  );\n}\n\nfunction mountRoute(options: Parsed[\"options\"]): string {\n  return optionString(options, \"mount-route\") ?? DEFAULT_MOUNT_ROUTE;\n}\n\nfunction dataDir(options: Parsed[\"options\"]): string {\n  return optionString(options, \"data-dir\") ?? path.join(homedir(), \".fragno\", \"mcp-fragment\");\n}\n\nfunction fragmentUrl(options: Parsed[\"options\"], route: string): string {\n  return `${localBaseUrl(options).replace(/\\/$/, \"\")}${mountRoute(options)}${route}`;\n}\n\nasync function requestJson(method: string, url: string, body?: unknown): Promise<unknown> {\n  const response = await fetch(url, {\n    method,\n    headers: body === undefined ? undefined : { \"content-type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const text = await response.text();\n  const payload = text ? JSON.parse(text) : undefined;\n  if (!response.ok) {\n    const message =\n      payload && typeof payload === \"object\" && \"message\" in payload\n        ? String((payload as { message: unknown }).message)\n        : text || `HTTP ${response.status}`;\n    throw new Error(message);\n  }\n  return payload;\n}\n\nasync function startServer(options: Parsed[\"options\"], logger: Logger): Promise<Server> {\n  const dir = dataDir(options);\n  await mkdir(dir, { recursive: true });\n  process.env[\"FRAGNO_DATA_DIR\"] = dir;\n\n  const baseUrl = localBaseUrl(options).replace(/\\/$/, \"\");\n  const fragmentMountRoute = mountRoute(options);\n  const oauthRedirectUri = `${baseUrl}${fragmentMountRoute}/oauth/callback`;\n  const fragment = createMcpFragment(\n    {\n      allowedOAuthRedirectUris: (url) => url.toString() === oauthRedirectUri,\n    },\n    { mountRoute: fragmentMountRoute, databaseNamespace: \"mcp-fragment\" },\n  );\n  logger.log(\"migrating sqlite database if needed...\");\n  await migrate(fragment);\n  const handler = toNodeHandler(fragment.handler.bind(fragment));\n  const server = createServer((req, res) => {\n    if (req.url?.startsWith(fragment.mountRoute)) {\n      handler(req, res);\n      return;\n    }\n    res.writeHead(404, { \"content-type\": \"text/plain\" }).end(\"Not found\");\n  });\n  const port = Number(optionString(options, \"port\") ?? DEFAULT_PORT);\n  const host = optionString(options, \"host\") ?? DEFAULT_HOST;\n  await new Promise<void>((resolve, reject) => {\n    server.once(\"error\", reject);\n    server.listen(port, host, () => {\n      server.off(\"error\", reject);\n      resolve();\n    });\n  });\n  logger.log(`fragno-mcp listening at ${baseUrl}${fragment.mountRoute}`);\n  logger.log(`sqlite data dir: ${dir}`);\n  return server;\n}\n\nfunction openBrowser(url: string) {\n  const command =\n    process.platform === \"darwin\" ? \"open\" : process.platform === \"win32\" ? \"cmd\" : \"xdg-open\";\n  const args = process.platform === \"win32\" ? [\"/c\", \"start\", \"\", url] : [url];\n  spawn(command, args, { stdio: \"ignore\", detached: true }).unref();\n}\n\nfunction print(value: unknown, json: boolean, logger: Logger) {\n  if (json) {\n    logger.log(JSON.stringify(value, null, 2));\n    return;\n  }\n  if (\n    value &&\n    typeof value === \"object\" &&\n    \"tools\" in value &&\n    Array.isArray((value as { tools: unknown[] }).tools)\n  ) {\n    for (const tool of (value as { tools: unknown[] }).tools) {\n      const record = tool && typeof tool === \"object\" ? (tool as Record<string, unknown>) : {};\n      logger.log(\n        `${String(record[\"name\"] ?? \"(unnamed)\")}\\t${String(record[\"description\"] ?? \"\")}`,\n      );\n    }\n    return;\n  }\n  logger.log(JSON.stringify(value, null, 2));\n}\n\nexport async function run(argv: string[], logger: Logger = console): Promise<number> {\n  const parsed = parse(argv.slice(2));\n  if (optionBoolean(parsed.options, \"help\") || !parsed.command) {\n    logger.log(USAGE);\n    return parsed.command ? 0 : 1;\n  }\n\n  try {\n    switch (parsed.command) {\n      case \"serve\": {\n        await startServer(parsed.options, logger);\n        await new Promise(() => undefined);\n        return 0;\n      }\n      case \"add\": {\n        const [slug, endpointUrl] = parsed.args;\n        if (!slug || !endpointUrl) {\n          throw new Error(\"Usage: fragno-mcp add <slug> <endpoint-url>\");\n        }\n        const result = await requestJson(\"POST\", fragmentUrl(parsed.options, \"/servers\"), {\n          slug,\n          endpointUrl,\n          auth: { type: \"none\" },\n        });\n        print(result, optionBoolean(parsed.options, \"json\"), logger);\n        return 0;\n      }\n      case \"oauth\": {\n        const [slug] = parsed.args;\n        if (!slug) {\n          throw new Error(\"Usage: fragno-mcp oauth <slug>\");\n        }\n        const startUrl = new URL(\n          fragmentUrl(parsed.options, `/servers/${encodeURIComponent(slug)}/auth/start`),\n        );\n        startUrl.searchParams.set(\n          MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER,\n          fragmentUrl(parsed.options, \"/oauth/callback\"),\n        );\n        const result = (await requestJson(\"POST\", startUrl.toString(), {\n          scope: optionString(parsed.options, \"scope\"),\n          clientId: optionString(parsed.options, \"client-id\"),\n          clientSecret: optionString(parsed.options, \"client-secret\"),\n        })) as { authorizationUrl: string };\n        logger.log(`Open this URL to authorize:\\n${result.authorizationUrl}`);\n        if (!optionBoolean(parsed.options, \"no-open\")) {\n          openBrowser(result.authorizationUrl);\n        }\n        logger.log(\n          \"Keep `fragno-mcp serve` running until the browser redirects back to the local callback.\",\n        );\n        return 0;\n      }\n      case \"status\": {\n        const [slug] = parsed.args;\n        if (!slug) {\n          throw new Error(\"Usage: fragno-mcp status <slug>\");\n        }\n        print(\n          await requestJson(\n            \"GET\",\n            fragmentUrl(parsed.options, `/servers/${encodeURIComponent(slug)}/auth/status`),\n          ),\n          optionBoolean(parsed.options, \"json\"),\n          logger,\n        );\n        return 0;\n      }\n      case \"tools\": {\n        const [slug] = parsed.args;\n        if (!slug) {\n          throw new Error(\"Usage: fragno-mcp tools <slug>\");\n        }\n        print(\n          await requestJson(\n            \"GET\",\n            fragmentUrl(parsed.options, `/servers/${encodeURIComponent(slug)}/tools`),\n          ),\n          optionBoolean(parsed.options, \"json\"),\n          logger,\n        );\n        return 0;\n      }\n      default:\n        throw new Error(`Unknown command: ${parsed.command}`);\n    }\n  } catch (error) {\n    logger.error(`${error instanceof Error ? error.message : String(error)}\\n\\n${USAGE}`);\n    return 1;\n  }\n}\n\nconst isDirectCliRun = process.argv[1]\n  ? import.meta.url === new URL(process.argv[1], \"file:\").href\n  : false;\n\nif (isDirectCliRun) {\n  const exitCode = await run(process.argv);\n  if (typeof exitCode === \"number\") {\n    process.exitCode = exitCode;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAcA,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,sBAAsB;AAE5B,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;AA8Bd,SAAS,MAAM,MAAwB;CACrC,MAAM,OAAiB,CAAC;CACxB,MAAM,UAA4C,CAAC;CACnD,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;EACvC,MAAM,MAAM,KAAK;EACjB,IAAI,QAAQ,MAAM;GAChB,KAAK,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC;GAC9B;EACF;EACA,IAAI,QAAQ,YAAY,QAAQ,MAAM;GACpC,QAAQ,UAAU;GAClB;EACF;EACA,IAAI,IAAI,WAAW,IAAI,GAAG;GACxB,MAAM,CAAC,QAAQ,YAAY,IAAI,MAAM,KAAK,CAAC;GAC3C,MAAM,MAAM,OAAO,MAAM,CAAC;GAC1B,IAAI,QAAQ,UAAU,QAAQ,WAAW;IACvC,QAAQ,OAAO,aAAa,KAAA,IAAY,OAAO,aAAa;IAC5D;GACF;GACA,MAAM,QAAQ,YAAY,KAAK,IAAI;GACnC,IAAI,aAAa,KAAA,GACf,KAAK;GAEP,QAAQ,OAAO,SAAS;GACxB;EACF;EACA,KAAK,KAAK,GAAG;CACf;CACA,MAAM,CAAC,SAAS,GAAG,QAAQ;CAC3B,OAAO;EAAE;EAAS,MAAM;EAAM;CAAQ;AACxC;AAEA,SAAS,aAAa,SAA4B,KAAiC;CACjF,MAAM,QAAQ,QAAQ;CACtB,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,cAAc,SAA4B,KAAsB;CACvE,OAAO,QAAQ,SAAS;AAC1B;AAEA,SAAS,aAAa,SAAoC;CACxD,OACE,aAAa,SAAS,UAAU,KAChC,UAAU,aAAa,GAAG,aAAa,SAAS,MAAM,KAAK;AAE/D;AAEA,SAAS,WAAW,SAAoC;CACtD,OAAO,aAAa,SAAS,aAAa,KAAK;AACjD;AAEA,SAAS,QAAQ,SAAoC;CACnD,OAAO,aAAa,SAAS,UAAU,KAAK,KAAK,KAAK,QAAQ,GAAG,WAAW,cAAc;AAC5F;AAEA,SAAS,YAAY,SAA4B,OAAuB;CACtE,OAAO,GAAG,aAAa,OAAO,CAAC,CAAC,QAAQ,OAAO,EAAE,IAAI,WAAW,OAAO,IAAI;AAC7E;AAEA,eAAe,YAAY,QAAgB,KAAa,MAAkC;CACxF,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC;EACA,SAAS,SAAS,KAAA,IAAY,KAAA,IAAY,EAAE,gBAAgB,mBAAmB;EAC/E,MAAM,SAAS,KAAA,IAAY,KAAA,IAAY,KAAK,UAAU,IAAI;CAC5D,CAAC;CACD,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,MAAM,UAAU,OAAO,KAAK,MAAM,IAAI,IAAI,KAAA;CAC1C,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,UACJ,WAAW,OAAO,YAAY,YAAY,aAAa,UACnD,OAAQ,QAAiC,OAAO,IAChD,QAAQ,QAAQ,SAAS;EAC/B,MAAM,IAAI,MAAM,OAAO;CACzB;CACA,OAAO;AACT;AAEA,eAAe,YAAY,SAA4B,QAAiC;CACtF,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;CACpC,QAAQ,IAAI,qBAAqB;CAEjC,MAAM,UAAU,aAAa,OAAO,CAAC,CAAC,QAAQ,OAAO,EAAE;CACvD,MAAM,qBAAqB,WAAW,OAAO;CAC7C,MAAM,mBAAmB,GAAG,UAAU,mBAAmB;CACzD,MAAM,WAAW,kBACf,EACE,2BAA2B,QAAQ,IAAI,SAAS,MAAM,iBACxD,GACA;EAAE,YAAY;EAAoB,mBAAmB;CAAe,CACtE;CACA,OAAO,IAAI,wCAAwC;CACnD,MAAM,QAAQ,QAAQ;CACtB,MAAM,UAAU,cAAc,SAAS,QAAQ,KAAK,QAAQ,CAAC;CAC7D,MAAM,SAAS,cAAc,KAAK,QAAQ;EACxC,IAAI,IAAI,KAAK,WAAW,SAAS,UAAU,GAAG;GAC5C,QAAQ,KAAK,GAAG;GAChB;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC,CAAC,CAAC,IAAI,WAAW;CACtE,CAAC;CACD,MAAM,OAAO,OAAO,aAAa,SAAS,MAAM,KAAK,YAAY;CACjE,MAAM,OAAO,aAAa,SAAS,MAAM,KAAK;CAC9C,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO,MAAM,YAAY;GAC9B,OAAO,IAAI,SAAS,MAAM;GAC1B,QAAQ;EACV,CAAC;CACH,CAAC;CACD,OAAO,IAAI,2BAA2B,UAAU,SAAS,YAAY;CACrE,OAAO,IAAI,oBAAoB,KAAK;CACpC,OAAO;AACT;AAEA,SAAS,YAAY,KAAa;CAChC,MAAM,UACJ,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,QAAQ;CAClF,MAAM,OAAO,QAAQ,aAAa,UAAU;EAAC;EAAM;EAAS;EAAI;CAAG,IAAI,CAAC,GAAG;CAC3E,MAAM,SAAS,MAAM;EAAE,OAAO;EAAU,UAAU;CAAK,CAAC,CAAC,CAAC,MAAM;AAClE;AAEA,SAAS,MAAM,OAAgB,MAAe,QAAgB;CAC5D,IAAI,MAAM;EACR,OAAO,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;EACzC;CACF;CACA,IACE,SACA,OAAO,UAAU,YACjB,WAAW,SACX,MAAM,QAAS,MAA+B,KAAK,GACnD;EACA,KAAK,MAAM,QAAS,MAA+B,OAAO;GACxD,MAAM,SAAS,QAAQ,OAAO,SAAS,WAAY,OAAmC,CAAC;GACvF,OAAO,IACL,GAAG,OAAO,OAAO,WAAW,WAAW,EAAE,IAAI,OAAO,OAAO,kBAAkB,EAAE,GACjF;EACF;EACA;CACF;CACA,OAAO,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAC3C;AAEA,eAAsB,IAAI,MAAgB,SAAiB,SAA0B;CACnF,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC;CAClC,IAAI,cAAc,OAAO,SAAS,MAAM,KAAK,CAAC,OAAO,SAAS;EAC5D,OAAO,IAAI,KAAK;EAChB,OAAO,OAAO,UAAU,IAAI;CAC9B;CAEA,IAAI;EACF,QAAQ,OAAO,SAAf;GACE,KAAK;IACH,MAAM,YAAY,OAAO,SAAS,MAAM;IACxC,MAAM,IAAI,cAAc,KAAA,CAAS;IACjC,OAAO;GAET,KAAK,OAAO;IACV,MAAM,CAAC,MAAM,eAAe,OAAO;IACnC,IAAI,CAAC,QAAQ,CAAC,aACZ,MAAM,IAAI,MAAM,6CAA6C;IAO/D,MAAM,MALe,YAAY,QAAQ,YAAY,OAAO,SAAS,UAAU,GAAG;KAChF;KACA;KACA,MAAM,EAAE,MAAM,OAAO;IACvB,CAAC,GACa,cAAc,OAAO,SAAS,MAAM,GAAG,MAAM;IAC3D,OAAO;GACT;GACA,KAAK,SAAS;IACZ,MAAM,CAAC,QAAQ,OAAO;IACtB,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,gCAAgC;IAElD,MAAM,WAAW,IAAI,IACnB,YAAY,OAAO,SAAS,YAAY,mBAAmB,IAAI,EAAE,YAAY,CAC/E;IACA,SAAS,aAAa,IACpB,wCACA,YAAY,OAAO,SAAS,iBAAiB,CAC/C;IACA,MAAM,SAAU,MAAM,YAAY,QAAQ,SAAS,SAAS,GAAG;KAC7D,OAAO,aAAa,OAAO,SAAS,OAAO;KAC3C,UAAU,aAAa,OAAO,SAAS,WAAW;KAClD,cAAc,aAAa,OAAO,SAAS,eAAe;IAC5D,CAAC;IACD,OAAO,IAAI,gCAAgC,OAAO,kBAAkB;IACpE,IAAI,CAAC,cAAc,OAAO,SAAS,SAAS,GAC1C,YAAY,OAAO,gBAAgB;IAErC,OAAO,IACL,yFACF;IACA,OAAO;GACT;GACA,KAAK,UAAU;IACb,MAAM,CAAC,QAAQ,OAAO;IACtB,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,iCAAiC;IAEnD,MACE,MAAM,YACJ,OACA,YAAY,OAAO,SAAS,YAAY,mBAAmB,IAAI,EAAE,aAAa,CAChF,GACA,cAAc,OAAO,SAAS,MAAM,GACpC,MACF;IACA,OAAO;GACT;GACA,KAAK,SAAS;IACZ,MAAM,CAAC,QAAQ,OAAO;IACtB,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,gCAAgC;IAElD,MACE,MAAM,YACJ,OACA,YAAY,OAAO,SAAS,YAAY,mBAAmB,IAAI,EAAE,OAAO,CAC1E,GACA,cAAc,OAAO,SAAS,MAAM,GACpC,MACF;IACA,OAAO;GACT;GACA,SACE,MAAM,IAAI,MAAM,oBAAoB,OAAO,SAAS;EACxD;CACF,SAAS,OAAO;EACd,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,MAAM,OAAO;EACpF,OAAO;CACT;AACF;AAMA,IAJuB,QAAQ,KAAK,KAChC,YAAY,QAAQ,IAAI,IAAI,QAAQ,KAAK,IAAI,OAAO,CAAC,CAAC,OACtD,OAEgB;CAClB,MAAM,WAAW,MAAM,IAAI,QAAQ,IAAI;CACvC,IAAI,OAAO,aAAa,UACtB,QAAQ,WAAW;AAEvB"}

package/dist/cli/definition.js

@@ -0,0 +1,330 @@
+import { listMcpTools } from "./mcp-api.js";
+import { mcpSchema } from "./schema.js";
+import { createMcpOperationAuth, createOAuthCallbackSnapshot, createOAuthStartSnapshot, isMcpAuthReady, mcpAuthReadyUntil, resolveMcpOperationAuth, resolveOAuthStartClient, withoutOAuthConsent, writeOAuthSecretChanges } from "./services.js";
+import { withDatabase } from "@fragno-dev/db";
+import { defineFragment } from "@fragno-dev/core";
+//#region src/definition.ts
+/** Expiry changes readiness without a write, so a write that starts the countdown schedules it. */
+function scheduleMcpAuthExpiry(uow, serverId, authMode, after) {
+	const readyUntil = mcpAuthReadyUntil(authMode, after);
+	if (readyUntil && after.expiresAt && isMcpAuthReady(authMode, after)) uow.triggerHook("internalAuthExpired", {
+		serverId,
+		expiresAt: after.expiresAt.toISOString()
+	}, { processAt: readyUntil });
+}
+const mcpFragmentDefinition = defineFragment("mcp-fragment").extend(withDatabase(mcpSchema)).provideHooks(({ defineHook, config }) => ({
+	internalRefreshServerConfiguration: defineHook(async function({ serverId }) {
+		let prepared;
+		const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", serverId))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId)))).afterRetrieve(async (_uow, [server, secrets]) => {
+			if (!server) return;
+			const auth = await createMcpOperationAuth({
+				config,
+				server,
+				secrets
+			});
+			const toolsOperation = await listMcpTools({
+				endpointUrl: server.endpointUrl,
+				auth,
+				fetchImplementation: config.fetch
+			});
+			prepared = {
+				authChanges: toolsOperation.authChanges,
+				toolsOperation
+			};
+		}).mutate(({ forSchema, retrieveResult: [server, secrets, cache] }) => {
+			if (!server) return { action: "missing" };
+			if (!prepared) throw new Error("MCP refresh operation was not prepared");
+			const preparedOperation = prepared;
+			const uow = forSchema(mcpSchema);
+			const upsertSecret = (kind, payload, expiresAt) => {
+				const existing = secrets.find((secret) => secret.kind === kind);
+				if (existing) {
+					uow.update("secret", existing.id, (b) => b.set({
+						payload,
+						expiresAt,
+						updatedAt: b.now()
+					}).check());
+					return;
+				}
+				uow.create("secret", {
+					id: `${serverId}:${kind}`,
+					serverId,
+					kind,
+					payload,
+					expiresAt
+				});
+			};
+			if (preparedOperation.authChanges) writeOAuthSecretChanges(preparedOperation.authChanges, {
+				upsert: (kind, payload) => {
+					upsertSecret(kind, payload, null);
+				},
+				remove: (kind) => {
+					const existing = secrets.find((secret) => secret.kind === kind);
+					if (existing) uow.delete("secret", existing.id);
+				}
+			});
+			if (preparedOperation.authChanges?.authPayload) {
+				const after = {
+					payload: preparedOperation.authChanges.authPayload,
+					expiresAt: preparedOperation.authChanges.authExpiresAt ?? null
+				};
+				upsertSecret("auth", after.payload, after.expiresAt);
+				const before = secrets.find((secret) => secret.kind === "auth");
+				const ready = isMcpAuthReady(server.authMode, after);
+				if (ready !== isMcpAuthReady(server.authMode, before)) uow.triggerHook("onServerReadinessChanged", {
+					serverId,
+					ready
+				});
+				scheduleMcpAuthExpiry(uow, serverId, server.authMode, after);
+			}
+			if (!preparedOperation.toolsOperation.ok) return {
+				action: "error",
+				error: preparedOperation.toolsOperation.error instanceof Error ? preparedOperation.toolsOperation.error.message : String(preparedOperation.toolsOperation.error)
+			};
+			const tools = Array.isArray(preparedOperation.toolsOperation.result.tools) ? preparedOperation.toolsOperation.result.tools : [];
+			const previousTools = Array.isArray(cache?.tools) ? cache.tools : null;
+			if (!previousTools || JSON.stringify(previousTools) !== JSON.stringify(tools)) uow.triggerHook("onServerConfigurationChanged", {
+				serverId,
+				current: { tools }
+			});
+			uow.delete("server_connection_cache", serverId);
+			uow.create("server_connection_cache", {
+				id: serverId,
+				serverId,
+				protocolVersion: preparedOperation.toolsOperation.metadata.protocolVersion ?? null,
+				serverInfo: preparedOperation.toolsOperation.metadata.serverInfo ?? null,
+				capabilities: preparedOperation.toolsOperation.metadata.capabilities ?? null,
+				tools
+			});
+			return { action: "refreshed" };
+		}).execute();
+		if (result.action === "error") throw new Error(result.error);
+	}),
+	onServerConfigurationChanged: defineHook(async function(payload) {
+		await config.onServerConfigurationChanged?.(payload, this);
+	}),
+	onServerConfigurationDeleted: defineHook(async function(payload) {
+		await config.onServerConfigurationDeleted?.(payload, this);
+	}),
+	onServerReadinessChanged: defineHook(async function(payload) {
+		const server = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", payload.serverId)))).transformRetrieve(([server]) => server && {
+			name: server.name,
+			authMode: server.authMode
+		}).execute();
+		await config.onServerReadinessChanged?.({
+			...payload,
+			server
+		}, this);
+	}),
+	internalAuthExpired: defineHook(async function({ serverId, expiresAt }) {
+		const expired = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId))).findFirst("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb.and(eb("serverId", "=", serverId), eb("kind", "=", "auth"))))).transformRetrieve(([server, secret]) => server !== null && secret !== null && secret.expiresAt?.getTime() === Date.parse(expiresAt) && mcpAuthReadyUntil(server.authMode, secret) !== null ? {
+			name: server.name,
+			authMode: server.authMode
+		} : null).execute();
+		if (expired) await config.onServerReadinessChanged?.({
+			serverId,
+			ready: false,
+			server: expired
+		}, this);
+	})
+})).providesBaseService(({ defineService, config }) => defineService({
+	startOAuth: function(input) {
+		return this.serviceTx(mcpSchema).retrieve((uow) => uow.findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", input.serverId)))).transformRetrieve(async ([server, secrets]) => {
+			if (!server) return { found: false };
+			const { authorizationUrl, changes } = await createOAuthStartSnapshot({
+				config,
+				server,
+				secrets,
+				stateId: input.stateId,
+				redirectUri: input.redirectUri,
+				...resolveOAuthStartClient(secrets, input)
+			});
+			return {
+				found: true,
+				authorizationUrl: authorizationUrl.toString(),
+				serverId: server.id.toString(),
+				authMode: server.authMode,
+				secrets,
+				changes
+			};
+		}).mutate(({ uow, retrieveResult }) => {
+			if (!retrieveResult.found) return { found: false };
+			const upsertSecret = (kind, payload, expiresAt) => {
+				const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+				if (existing) {
+					uow.update("secret", existing.id, (b) => b.set({
+						payload,
+						expiresAt,
+						updatedAt: b.now()
+					}).check());
+					return;
+				}
+				uow.create("secret", {
+					id: `${retrieveResult.serverId}:${kind}`,
+					serverId: retrieveResult.serverId,
+					kind,
+					payload,
+					expiresAt
+				});
+			};
+			writeOAuthSecretChanges(retrieveResult.changes, {
+				upsert: (kind, payload) => {
+					upsertSecret(kind, payload, null);
+				},
+				remove: (kind) => {
+					const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+					if (existing) uow.delete("secret", existing.id);
+				}
+			});
+			const authSecret = retrieveResult.secrets.find((secret) => secret.kind === "auth");
+			if (input.discardTokens && authSecret) {
+				const payload = withoutOAuthConsent(authSecret.payload);
+				uow.update("secret", authSecret.id, (b) => b.set({
+					payload,
+					expiresAt: null,
+					updatedAt: b.now()
+				}).check());
+				const { authMode } = retrieveResult;
+				const ready = isMcpAuthReady(authMode, {
+					payload,
+					expiresAt: null
+				});
+				if (ready !== isMcpAuthReady(authMode, authSecret)) uow.triggerHook("onServerReadinessChanged", {
+					serverId: retrieveResult.serverId,
+					ready
+				});
+			}
+			if (retrieveResult.changes.oauthState) uow.create("oauthState", {
+				id: retrieveResult.changes.oauthState.id,
+				serverId: retrieveResult.serverId,
+				authorizationUrl: retrieveResult.authorizationUrl,
+				codeVerifier: retrieveResult.changes.oauthState.codeVerifier,
+				redirectUri: retrieveResult.changes.oauthState.redirectUri,
+				scope: retrieveResult.changes.oauthState.scope ?? null,
+				expiresAt: retrieveResult.changes.oauthState.expiresAt,
+				consumedAt: null
+			});
+			return { found: true };
+		}).transform(({ retrieveResult }) => retrieveResult.found ? {
+			found: true,
+			authorizationUrl: retrieveResult.authorizationUrl
+		} : { found: false }).build();
+	},
+	completeOAuthCallback: function(input) {
+		const serverId = input.stateId.split(":")[0] ?? "";
+		return this.serviceTx(mcpSchema).retrieve((uow) => uow.findFirst("oauthState", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.stateId))).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", serverId))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId)))).transformRetrieve(async ([state, server, secrets, cache]) => {
+			if (!state || state.consumedAt || new Date(state.expiresAt).getTime() < Date.now()) return {
+				found: false,
+				reason: "invalid_state"
+			};
+			if (!server) return {
+				found: false,
+				reason: "server_not_found"
+			};
+			return {
+				found: true,
+				server,
+				secrets,
+				cache,
+				changes: await createOAuthCallbackSnapshot({
+					config,
+					stateId: input.stateId,
+					code: input.code,
+					iss: input.iss,
+					state,
+					server,
+					secrets
+				})
+			};
+		}).mutate(({ uow, retrieveResult }) => {
+			if (!retrieveResult.found) return {
+				found: false,
+				reason: retrieveResult.reason
+			};
+			const serverId = retrieveResult.server.id.toString();
+			const upsertSecret = (kind, payload, expiresAt) => {
+				const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+				if (existing) {
+					uow.update("secret", existing.id, (b) => b.set({
+						payload,
+						expiresAt,
+						updatedAt: b.now()
+					}).check());
+					return;
+				}
+				uow.create("secret", {
+					id: `${serverId}:${kind}`,
+					serverId,
+					kind,
+					payload,
+					expiresAt
+				});
+			};
+			writeOAuthSecretChanges(retrieveResult.changes, {
+				upsert: (kind, payload) => {
+					upsertSecret(kind, payload, null);
+				},
+				remove: (kind) => {
+					const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+					if (existing) uow.delete("secret", existing.id);
+				}
+			});
+			if (retrieveResult.changes.authPayload) {
+				const after = {
+					payload: retrieveResult.changes.authPayload,
+					expiresAt: retrieveResult.changes.authExpiresAt ?? null
+				};
+				upsertSecret("auth", after.payload, after.expiresAt);
+				uow.update("server_configuration", retrieveResult.server.id, (b) => b.set({
+					authMode: "oauth",
+					updatedAt: b.now()
+				}).check());
+				const before = retrieveResult.secrets.find((secret) => secret.kind === "auth");
+				const ready = isMcpAuthReady("oauth", after);
+				if (ready !== isMcpAuthReady(retrieveResult.server.authMode, before)) uow.triggerHook("onServerReadinessChanged", {
+					serverId,
+					ready
+				});
+				scheduleMcpAuthExpiry(uow, serverId, "oauth", after);
+				if (retrieveResult.cache) uow.delete("server_connection_cache", retrieveResult.cache.id);
+				uow.triggerHook("internalRefreshServerConfiguration", { serverId });
+			}
+			if (retrieveResult.changes.consumeStateId) uow.update("oauthState", input.stateId, (b) => b.set({ consumedAt: b.now() }));
+			return { found: true };
+		}).transform(({ retrieveResult }) => retrieveResult.found ? { found: true } : {
+			found: false,
+			reason: retrieveResult.reason
+		}).build();
+	},
+	prepareMcpOperation: function(input) {
+		return this.serviceTx(mcpSchema).retrieve((uow) => uow.findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", input.serverId))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.serverId)))).transformRetrieve(async ([server, secrets, cache]) => {
+			if (!server) return { found: false };
+			const resolved = await resolveMcpOperationAuth({
+				config,
+				server,
+				secrets
+			});
+			return {
+				found: true,
+				serverId: server.id.toString(),
+				endpointUrl: server.endpointUrl,
+				token: resolved.token,
+				secrets,
+				cache,
+				authChanges: resolved.authChanges
+			};
+		}).transform(({ retrieveResult }) => retrieveResult.found ? {
+			found: true,
+			endpointUrl: retrieveResult.endpointUrl,
+			token: retrieveResult.token,
+			secrets: retrieveResult.secrets,
+			cache: retrieveResult.cache,
+			authChanges: retrieveResult.authChanges,
+			serverId: retrieveResult.serverId
+		} : { found: false }).build();
+	}
+})).build();
+//#endregion
+export { mcpFragmentDefinition, scheduleMcpAuthExpiry };
+
+//# sourceMappingURL=definition.js.map

package/dist/cli/definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.js","names":[],"sources":["../../src/definition.ts"],"sourcesContent":["import { defineFragment } from \"@fragno-dev/core\";\nimport { withDatabase, type HookContext, type HookFn } from \"@fragno-dev/db\";\n\nimport { listMcpTools } from \"./mcp-api\";\nimport type { McpFragmentConfig as BaseMcpFragmentConfig } from \"./mcp-types\";\nimport { mcpSchema } from \"./schema\";\nimport {\n  createOAuthCallbackSnapshot,\n  createMcpOperationAuth,\n  createOAuthStartSnapshot,\n  isMcpAuthReady,\n  mcpAuthReadyUntil,\n  resolveMcpOperationAuth,\n  resolveOAuthStartClient,\n  withoutOAuthConsent,\n  writeOAuthSecretChanges,\n  type AuthPersistenceChanges,\n} from \"./services\";\n\nexport interface McpServerConfigurationChangedPayload {\n  serverId: string;\n  current: {\n    tools: unknown[];\n  };\n}\n\nexport interface McpServerConfigurationDeletedPayload {\n  serverId: string;\n}\n\nexport interface McpServerReadinessChangedPayload {\n  serverId: string;\n  /** Whether stored auth can authorize operations; the server can still reject it. */\n  ready: boolean;\n}\n\n/**\n * A readiness change as delivered. The server is read at delivery rather than stored with the hook,\n * so it is the current configuration, or null after it was deleted.\n */\nexport interface McpServerReadinessChange extends McpServerReadinessChangedPayload {\n  server: { name: string | null; authMode: string } | null;\n}\n\nexport interface McpFragmentHooksConfig {\n  onServerConfigurationChanged?: (\n    payload: McpServerConfigurationChangedPayload,\n    context: HookContext,\n  ) => Promise<void> | void;\n  onServerConfigurationDeleted?: (\n    payload: McpServerConfigurationDeletedPayload,\n    context: HookContext,\n  ) => Promise<void> | void;\n  /**\n   * Fires when a write changes whether the server can authorize operations, including creation\n   * and credentials the server invalidates during an operation, and when an access token without a\n   * refresh token expires.\n   */\n  onServerReadinessChanged?: (\n    payload: McpServerReadinessChange,\n    context: HookContext,\n  ) => Promise<void> | void;\n}\n\nexport type McpFragmentConfig = BaseMcpFragmentConfig & McpFragmentHooksConfig;\n\nexport interface McpInternalRefreshServerConfigurationPayload {\n  serverId: string;\n}\n\n/** The token stored when expiry was scheduled; a later write replaces it and reports itself. */\ninterface McpInternalAuthExpiredPayload {\n  serverId: string;\n  expiresAt: string;\n}\n\nexport type McpHooksMap = {\n  internalRefreshServerConfiguration: HookFn<McpInternalRefreshServerConfigurationPayload>;\n  internalAuthExpired: HookFn<McpInternalAuthExpiredPayload>;\n  onServerConfigurationChanged: HookFn<McpServerConfigurationChangedPayload>;\n  onServerConfigurationDeleted: HookFn<McpServerConfigurationDeletedPayload>;\n  onServerReadinessChanged: HookFn<McpServerReadinessChangedPayload>;\n};\n\n/** Expiry changes readiness without a write, so a write that starts the countdown schedules it. */\nexport function scheduleMcpAuthExpiry(\n  // Hook transactions type their hooks loosely, so only the one trigger is required.\n  uow: {\n    triggerHook(\n      name: \"internalAuthExpired\",\n      payload: McpInternalAuthExpiredPayload,\n      options: { processAt: Date },\n    ): void;\n  },\n  serverId: string,\n  authMode: string,\n  after: { payload: string; expiresAt: Date | null },\n) {\n  const readyUntil = mcpAuthReadyUntil(authMode, after);\n  if (readyUntil && after.expiresAt && isMcpAuthReady(authMode, after)) {\n    uow.triggerHook(\n      \"internalAuthExpired\",\n      { serverId, expiresAt: after.expiresAt.toISOString() },\n      { processAt: readyUntil },\n    );\n  }\n}\n\nexport const mcpFragmentDefinition = defineFragment<McpFragmentConfig>(\"mcp-fragment\")\n  .extend(withDatabase(mcpSchema))\n  .provideHooks<McpHooksMap>(({ defineHook, config }) => ({\n    internalRefreshServerConfiguration: defineHook(async function ({ serverId }) {\n      let prepared:\n        | {\n            authChanges?: AuthPersistenceChanges;\n            toolsOperation: Awaited<ReturnType<typeof listMcpTools<AuthPersistenceChanges>>>;\n          }\n        | undefined;\n\n      const result = await this.handlerTx()\n        .retrieve(({ forSchema }) =>\n          forSchema(mcpSchema)\n            .findFirst(\"server_configuration\", (b) =>\n              b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", serverId)),\n            )\n            .find(\"secret\", (b) =>\n              b.whereIndex(\"idx_secret_server_kind\", (eb) => eb(\"serverId\", \"=\", serverId)),\n            )\n            .findFirst(\"server_connection_cache\", (b) =>\n              b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", serverId)),\n            ),\n        )\n        .afterRetrieve(async (_uow, [server, secrets]) => {\n          if (!server) {\n            return;\n          }\n\n          const auth = await createMcpOperationAuth({ config, server, secrets });\n          const toolsOperation = await listMcpTools({\n            endpointUrl: server.endpointUrl,\n            auth,\n            fetchImplementation: config.fetch,\n          });\n          prepared = {\n            authChanges: toolsOperation.authChanges,\n            toolsOperation,\n          };\n        })\n        .mutate(({ forSchema, retrieveResult: [server, secrets, cache] }) => {\n          if (!server) {\n            return { action: \"missing\" as const };\n          }\n          if (!prepared) {\n            throw new Error(\"MCP refresh operation was not prepared\");\n          }\n\n          const preparedOperation = prepared;\n          const uow = forSchema(mcpSchema);\n          const upsertSecret = (kind: string, payload: string, expiresAt: Date | null) => {\n            const existing = secrets.find((secret) => secret.kind === kind);\n            if (existing) {\n              uow.update(\"secret\", existing.id, (b) =>\n                b.set({ payload, expiresAt, updatedAt: b.now() }).check(),\n              );\n              return;\n            }\n            uow.create(\"secret\", {\n              id: `${serverId}:${kind}`,\n              serverId,\n              kind,\n              payload,\n              expiresAt,\n            });\n          };\n\n          if (preparedOperation.authChanges) {\n            writeOAuthSecretChanges(preparedOperation.authChanges, {\n              upsert: (kind, payload) => {\n                upsertSecret(kind, payload, null);\n              },\n              remove: (kind) => {\n                const existing = secrets.find((secret) => secret.kind === kind);\n                if (existing) {\n                  uow.delete(\"secret\", existing.id);\n                }\n              },\n            });\n          }\n          if (preparedOperation.authChanges?.authPayload) {\n            const after = {\n              payload: preparedOperation.authChanges.authPayload,\n              expiresAt: preparedOperation.authChanges.authExpiresAt ?? null,\n            };\n            upsertSecret(\"auth\", after.payload, after.expiresAt);\n            const before = secrets.find((secret) => secret.kind === \"auth\");\n            const ready = isMcpAuthReady(server.authMode, after);\n            if (ready !== isMcpAuthReady(server.authMode, before)) {\n              uow.triggerHook(\"onServerReadinessChanged\", { serverId, ready });\n            }\n            scheduleMcpAuthExpiry(uow, serverId, server.authMode, after);\n          }\n\n          if (!preparedOperation.toolsOperation.ok) {\n            return {\n              action: \"error\" as const,\n              error:\n                preparedOperation.toolsOperation.error instanceof Error\n                  ? preparedOperation.toolsOperation.error.message\n                  : String(preparedOperation.toolsOperation.error),\n            };\n          }\n\n          const tools = Array.isArray(preparedOperation.toolsOperation.result.tools)\n            ? preparedOperation.toolsOperation.result.tools\n            : [];\n          const previousTools = Array.isArray(cache?.tools) ? cache.tools : null;\n          if (!previousTools || JSON.stringify(previousTools) !== JSON.stringify(tools)) {\n            uow.triggerHook(\"onServerConfigurationChanged\", {\n              serverId,\n              current: { tools },\n            });\n          }\n\n          uow.delete(\"server_connection_cache\", serverId);\n          uow.create(\"server_connection_cache\", {\n            id: serverId,\n            serverId,\n            protocolVersion: preparedOperation.toolsOperation.metadata.protocolVersion ?? null,\n            serverInfo: preparedOperation.toolsOperation.metadata.serverInfo ?? null,\n            capabilities: preparedOperation.toolsOperation.metadata.capabilities ?? null,\n            tools,\n          });\n\n          return { action: \"refreshed\" as const };\n        })\n        .execute();\n\n      if (result.action === \"error\") {\n        throw new Error(result.error);\n      }\n    }),\n    onServerConfigurationChanged: defineHook(async function (payload) {\n      await config.onServerConfigurationChanged?.(payload, this);\n    }),\n    onServerConfigurationDeleted: defineHook(async function (payload) {\n      await config.onServerConfigurationDeleted?.(payload, this);\n    }),\n    onServerReadinessChanged: defineHook(async function (payload) {\n      const server = await this.handlerTx()\n        .retrieve(({ forSchema }) =>\n          forSchema(mcpSchema).findFirst(\"server_configuration\", (b) =>\n            b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", payload.serverId)),\n          ),\n        )\n        .transformRetrieve(([server]) => server && { name: server.name, authMode: server.authMode })\n        .execute();\n      await config.onServerReadinessChanged?.({ ...payload, server }, this);\n    }),\n    internalAuthExpired: defineHook(async function ({ serverId, expiresAt }) {\n      const expired = await this.handlerTx()\n        .retrieve(({ forSchema }) =>\n          forSchema(mcpSchema)\n            .findFirst(\"server_configuration\", (b) =>\n              b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", serverId)),\n            )\n            .findFirst(\"secret\", (b) =>\n              b.whereIndex(\"idx_secret_server_kind\", (eb) =>\n                eb.and(eb(\"serverId\", \"=\", serverId), eb(\"kind\", \"=\", \"auth\")),\n              ),\n            ),\n        )\n        .transformRetrieve(([server, secret]) =>\n          // The hook's due time already passed, so an untouched token is the expired one.\n          server !== null &&\n          secret !== null &&\n          secret.expiresAt?.getTime() === Date.parse(expiresAt) &&\n          mcpAuthReadyUntil(server.authMode, secret) !== null\n            ? { name: server.name, authMode: server.authMode }\n            : null,\n        )\n        .execute();\n      if (expired) {\n        await config.onServerReadinessChanged?.({ serverId, ready: false, server: expired }, this);\n      }\n    }),\n  }))\n  .providesBaseService(({ defineService, config }) =>\n    defineService({\n      startOAuth: function (input: {\n        serverId: string;\n        stateId: string;\n        redirectUri: string;\n        scope?: string;\n        clientId?: string;\n        clientSecret?: string;\n        discardTokens: boolean;\n      }) {\n        return this.serviceTx(mcpSchema)\n          .retrieve((uow) =>\n            uow\n              .findFirst(\"server_configuration\", (b) =>\n                b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", input.serverId)),\n              )\n              .find(\"secret\", (b) =>\n                b.whereIndex(\"idx_secret_server_kind\", (eb) => eb(\"serverId\", \"=\", input.serverId)),\n              ),\n          )\n          .transformRetrieve(async ([server, secrets]) => {\n            if (!server) {\n              return { found: false as const };\n            }\n            const { authorizationUrl, changes } = await createOAuthStartSnapshot({\n              config,\n              server,\n              secrets,\n              stateId: input.stateId,\n              redirectUri: input.redirectUri,\n              ...resolveOAuthStartClient(secrets, input),\n            });\n            return {\n              found: true as const,\n              authorizationUrl: authorizationUrl.toString(),\n              serverId: server.id.toString(),\n              authMode: server.authMode,\n              secrets,\n              changes,\n            };\n          })\n          .mutate(({ uow, retrieveResult }) => {\n            if (!retrieveResult.found) {\n              return { found: false as const };\n            }\n\n            const upsertSecret = (kind: string, payload: string, expiresAt: Date | null) => {\n              const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);\n              if (existing) {\n                uow.update(\"secret\", existing.id, (b) =>\n                  b.set({ payload, expiresAt, updatedAt: b.now() }).check(),\n                );\n                return;\n              }\n              uow.create(\"secret\", {\n                id: `${retrieveResult.serverId}:${kind}`,\n                serverId: retrieveResult.serverId,\n                kind,\n                payload,\n                expiresAt,\n              });\n            };\n\n            writeOAuthSecretChanges(retrieveResult.changes, {\n              upsert: (kind, payload) => {\n                upsertSecret(kind, payload, null);\n              },\n              remove: (kind) => {\n                const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);\n                if (existing) {\n                  uow.delete(\"secret\", existing.id);\n                }\n              },\n            });\n            const authSecret = retrieveResult.secrets.find((secret) => secret.kind === \"auth\");\n            if (input.discardTokens && authSecret) {\n              // Keeps the client configuration; only consent evidence is discarded.\n              const payload = withoutOAuthConsent(authSecret.payload);\n              uow.update(\"secret\", authSecret.id, (b) =>\n                b.set({ payload, expiresAt: null, updatedAt: b.now() }).check(),\n              );\n              const { authMode } = retrieveResult;\n              const ready = isMcpAuthReady(authMode, { payload, expiresAt: null });\n              if (ready !== isMcpAuthReady(authMode, authSecret)) {\n                uow.triggerHook(\"onServerReadinessChanged\", {\n                  serverId: retrieveResult.serverId,\n                  ready,\n                });\n              }\n            }\n            if (retrieveResult.changes.oauthState) {\n              uow.create(\"oauthState\", {\n                id: retrieveResult.changes.oauthState.id,\n                serverId: retrieveResult.serverId,\n                // The link carries only the PKCE challenge, never the verifier.\n                authorizationUrl: retrieveResult.authorizationUrl,\n                codeVerifier: retrieveResult.changes.oauthState.codeVerifier,\n                redirectUri: retrieveResult.changes.oauthState.redirectUri,\n                scope: retrieveResult.changes.oauthState.scope ?? null,\n                expiresAt: retrieveResult.changes.oauthState.expiresAt,\n                consumedAt: null,\n              });\n            }\n\n            return { found: true as const };\n          })\n          .transform(({ retrieveResult }) =>\n            retrieveResult.found\n              ? {\n                  found: true as const,\n                  authorizationUrl: retrieveResult.authorizationUrl,\n                }\n              : { found: false as const },\n          )\n          .build();\n      },\n\n      completeOAuthCallback: function (input: {\n        stateId: string;\n        code: string;\n        iss: string | undefined;\n      }) {\n        const serverId = input.stateId.split(\":\")[0] ?? \"\";\n        return this.serviceTx(mcpSchema)\n          .retrieve((uow) =>\n            uow\n              .findFirst(\"oauthState\", (b) =>\n                b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", input.stateId)),\n              )\n              .findFirst(\"server_configuration\", (b) =>\n                b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", serverId)),\n              )\n              .find(\"secret\", (b) =>\n                b.whereIndex(\"idx_secret_server_kind\", (eb) => eb(\"serverId\", \"=\", serverId)),\n              )\n              .findFirst(\"server_connection_cache\", (b) =>\n                b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", serverId)),\n              ),\n          )\n          .transformRetrieve(async ([state, server, secrets, cache]) => {\n            if (!state || state.consumedAt || new Date(state.expiresAt).getTime() < Date.now()) {\n              return { found: false as const, reason: \"invalid_state\" as const };\n            }\n            if (!server) {\n              return { found: false as const, reason: \"server_not_found\" as const };\n            }\n            const changes = await createOAuthCallbackSnapshot({\n              config,\n              stateId: input.stateId,\n              code: input.code,\n              iss: input.iss,\n              state,\n              server,\n              secrets,\n            });\n            return { found: true as const, server, secrets, cache, changes };\n          })\n          .mutate(({ uow, retrieveResult }) => {\n            if (!retrieveResult.found) {\n              return { found: false as const, reason: retrieveResult.reason };\n            }\n\n            const serverId = retrieveResult.server.id.toString();\n            const upsertSecret = (kind: string, payload: string, expiresAt: Date | null) => {\n              const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);\n              if (existing) {\n                uow.update(\"secret\", existing.id, (b) =>\n                  b.set({ payload, expiresAt, updatedAt: b.now() }).check(),\n                );\n                return;\n              }\n              uow.create(\"secret\", {\n                id: `${serverId}:${kind}`,\n                serverId,\n                kind,\n                payload,\n                expiresAt,\n              });\n            };\n\n            writeOAuthSecretChanges(retrieveResult.changes, {\n              upsert: (kind, payload) => {\n                upsertSecret(kind, payload, null);\n              },\n              remove: (kind) => {\n                const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);\n                if (existing) {\n                  uow.delete(\"secret\", existing.id);\n                }\n              },\n            });\n            if (retrieveResult.changes.authPayload) {\n              const after = {\n                payload: retrieveResult.changes.authPayload,\n                expiresAt: retrieveResult.changes.authExpiresAt ?? null,\n              };\n              upsertSecret(\"auth\", after.payload, after.expiresAt);\n              uow.update(\"server_configuration\", retrieveResult.server.id, (b) =>\n                b.set({ authMode: \"oauth\", updatedAt: b.now() }).check(),\n              );\n              const before = retrieveResult.secrets.find((secret) => secret.kind === \"auth\");\n              const ready = isMcpAuthReady(\"oauth\", after);\n              if (ready !== isMcpAuthReady(retrieveResult.server.authMode, before)) {\n                uow.triggerHook(\"onServerReadinessChanged\", { serverId, ready });\n              }\n              scheduleMcpAuthExpiry(uow, serverId, \"oauth\", after);\n              if (retrieveResult.cache) {\n                uow.delete(\"server_connection_cache\", retrieveResult.cache.id);\n              }\n              uow.triggerHook(\"internalRefreshServerConfiguration\", { serverId });\n            }\n            if (retrieveResult.changes.consumeStateId) {\n              uow.update(\"oauthState\", input.stateId, (b) => b.set({ consumedAt: b.now() }));\n            }\n\n            return { found: true as const };\n          })\n          .transform(({ retrieveResult }) =>\n            retrieveResult.found\n              ? { found: true as const }\n              : { found: false as const, reason: retrieveResult.reason },\n          )\n          .build();\n      },\n\n      prepareMcpOperation: function (input: { serverId: string }) {\n        return this.serviceTx(mcpSchema)\n          .retrieve((uow) =>\n            uow\n              .findFirst(\"server_configuration\", (b) =>\n                b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", input.serverId)),\n              )\n              .find(\"secret\", (b) =>\n                b.whereIndex(\"idx_secret_server_kind\", (eb) => eb(\"serverId\", \"=\", input.serverId)),\n              )\n              .findFirst(\"server_connection_cache\", (b) =>\n                b.whereIndex(\"primary\", (eb) => eb(\"id\", \"=\", input.serverId)),\n              ),\n          )\n          .transformRetrieve(async ([server, secrets, cache]) => {\n            if (!server) {\n              return { found: false as const };\n            }\n            const resolved = await resolveMcpOperationAuth({ config, server, secrets });\n            return {\n              found: true as const,\n              serverId: server.id.toString(),\n              endpointUrl: server.endpointUrl,\n              token: resolved.token,\n              secrets,\n              cache,\n              authChanges: resolved.authChanges,\n            };\n          })\n          .transform(({ retrieveResult }) =>\n            retrieveResult.found\n              ? {\n                  found: true as const,\n                  endpointUrl: retrieveResult.endpointUrl,\n                  token: retrieveResult.token,\n                  secrets: retrieveResult.secrets,\n                  cache: retrieveResult.cache,\n                  authChanges: retrieveResult.authChanges,\n                  serverId: retrieveResult.serverId,\n                }\n              : { found: false as const },\n          )\n          .build();\n      },\n    }),\n  )\n  .build();\n"],"mappings":";;;;;;;AAqFA,SAAgB,sBAEd,KAOA,UACA,UACA,OACA;CACA,MAAM,aAAa,kBAAkB,UAAU,KAAK;CACpD,IAAI,cAAc,MAAM,aAAa,eAAe,UAAU,KAAK,GACjE,IAAI,YACF,uBACA;EAAE;EAAU,WAAW,MAAM,UAAU,YAAY;CAAE,GACrD,EAAE,WAAW,WAAW,CAC1B;AAEJ;AAEA,MAAa,wBAAwB,eAAkC,cAAc,CAAC,CACnF,OAAO,aAAa,SAAS,CAAC,CAAC,CAC/B,cAA2B,EAAE,YAAY,cAAc;CACtD,oCAAoC,WAAW,eAAgB,EAAE,YAAY;EAC3E,IAAI;EAOJ,MAAM,SAAS,MAAM,KAAK,UAAU,CAAC,CAClC,UAAU,EAAE,gBACX,UAAU,SAAS,CAAC,CACjB,UAAU,yBAAyB,MAClC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CACzD,CAAC,CACA,KAAK,WAAW,MACf,EAAE,WAAW,2BAA2B,OAAO,GAAG,YAAY,KAAK,QAAQ,CAAC,CAC9E,CAAC,CACA,UAAU,4BAA4B,MACrC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CACzD,CACJ,CAAC,CACA,cAAc,OAAO,MAAM,CAAC,QAAQ,aAAa;GAChD,IAAI,CAAC,QACH;GAGF,MAAM,OAAO,MAAM,uBAAuB;IAAE;IAAQ;IAAQ;GAAQ,CAAC;GACrE,MAAM,iBAAiB,MAAM,aAAa;IACxC,aAAa,OAAO;IACpB;IACA,qBAAqB,OAAO;GAC9B,CAAC;GACD,WAAW;IACT,aAAa,eAAe;IAC5B;GACF;EACF,CAAC,CAAC,CACD,QAAQ,EAAE,WAAW,gBAAgB,CAAC,QAAQ,SAAS,aAAa;GACnE,IAAI,CAAC,QACH,OAAO,EAAE,QAAQ,UAAmB;GAEtC,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,wCAAwC;GAG1D,MAAM,oBAAoB;GAC1B,MAAM,MAAM,UAAU,SAAS;GAC/B,MAAM,gBAAgB,MAAc,SAAiB,cAA2B;IAC9E,MAAM,WAAW,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;IAC9D,IAAI,UAAU;KACZ,IAAI,OAAO,UAAU,SAAS,KAAK,MACjC,EAAE,IAAI;MAAE;MAAS;MAAW,WAAW,EAAE,IAAI;KAAE,CAAC,CAAC,CAAC,MAAM,CAC1D;KACA;IACF;IACA,IAAI,OAAO,UAAU;KACnB,IAAI,GAAG,SAAS,GAAG;KACnB;KACA;KACA;KACA;IACF,CAAC;GACH;GAEA,IAAI,kBAAkB,aACpB,wBAAwB,kBAAkB,aAAa;IACrD,SAAS,MAAM,YAAY;KACzB,aAAa,MAAM,SAAS,IAAI;IAClC;IACA,SAAS,SAAS;KAChB,MAAM,WAAW,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;KAC9D,IAAI,UACF,IAAI,OAAO,UAAU,SAAS,EAAE;IAEpC;GACF,CAAC;GAEH,IAAI,kBAAkB,aAAa,aAAa;IAC9C,MAAM,QAAQ;KACZ,SAAS,kBAAkB,YAAY;KACvC,WAAW,kBAAkB,YAAY,iBAAiB;IAC5D;IACA,aAAa,QAAQ,MAAM,SAAS,MAAM,SAAS;IACnD,MAAM,SAAS,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM;IAC9D,MAAM,QAAQ,eAAe,OAAO,UAAU,KAAK;IACnD,IAAI,UAAU,eAAe,OAAO,UAAU,MAAM,GAClD,IAAI,YAAY,4BAA4B;KAAE;KAAU;IAAM,CAAC;IAEjE,sBAAsB,KAAK,UAAU,OAAO,UAAU,KAAK;GAC7D;GAEA,IAAI,CAAC,kBAAkB,eAAe,IACpC,OAAO;IACL,QAAQ;IACR,OACE,kBAAkB,eAAe,iBAAiB,QAC9C,kBAAkB,eAAe,MAAM,UACvC,OAAO,kBAAkB,eAAe,KAAK;GACrD;GAGF,MAAM,QAAQ,MAAM,QAAQ,kBAAkB,eAAe,OAAO,KAAK,IACrE,kBAAkB,eAAe,OAAO,QACxC,CAAC;GACL,MAAM,gBAAgB,MAAM,QAAQ,OAAO,KAAK,IAAI,MAAM,QAAQ;GAClE,IAAI,CAAC,iBAAiB,KAAK,UAAU,aAAa,MAAM,KAAK,UAAU,KAAK,GAC1E,IAAI,YAAY,gCAAgC;IAC9C;IACA,SAAS,EAAE,MAAM;GACnB,CAAC;GAGH,IAAI,OAAO,2BAA2B,QAAQ;GAC9C,IAAI,OAAO,2BAA2B;IACpC,IAAI;IACJ;IACA,iBAAiB,kBAAkB,eAAe,SAAS,mBAAmB;IAC9E,YAAY,kBAAkB,eAAe,SAAS,cAAc;IACpE,cAAc,kBAAkB,eAAe,SAAS,gBAAgB;IACxE;GACF,CAAC;GAED,OAAO,EAAE,QAAQ,YAAqB;EACxC,CAAC,CAAC,CACD,QAAQ;EAEX,IAAI,OAAO,WAAW,SACpB,MAAM,IAAI,MAAM,OAAO,KAAK;CAEhC,CAAC;CACD,8BAA8B,WAAW,eAAgB,SAAS;EAChE,MAAM,OAAO,+BAA+B,SAAS,IAAI;CAC3D,CAAC;CACD,8BAA8B,WAAW,eAAgB,SAAS;EAChE,MAAM,OAAO,+BAA+B,SAAS,IAAI;CAC3D,CAAC;CACD,0BAA0B,WAAW,eAAgB,SAAS;EAC5D,MAAM,SAAS,MAAM,KAAK,UAAU,CAAC,CAClC,UAAU,EAAE,gBACX,UAAU,SAAS,CAAC,CAAC,UAAU,yBAAyB,MACtD,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,QAAQ,QAAQ,CAAC,CACjE,CACF,CAAC,CACA,mBAAmB,CAAC,YAAY,UAAU;GAAE,MAAM,OAAO;GAAM,UAAU,OAAO;EAAS,CAAC,CAAC,CAC3F,QAAQ;EACX,MAAM,OAAO,2BAA2B;GAAE,GAAG;GAAS;EAAO,GAAG,IAAI;CACtE,CAAC;CACD,qBAAqB,WAAW,eAAgB,EAAE,UAAU,aAAa;EACvE,MAAM,UAAU,MAAM,KAAK,UAAU,CAAC,CACnC,UAAU,EAAE,gBACX,UAAU,SAAS,CAAC,CACjB,UAAU,yBAAyB,MAClC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CACzD,CAAC,CACA,UAAU,WAAW,MACpB,EAAE,WAAW,2BAA2B,OACtC,GAAG,IAAI,GAAG,YAAY,KAAK,QAAQ,GAAG,GAAG,QAAQ,KAAK,MAAM,CAAC,CAC/D,CACF,CACJ,CAAC,CACA,mBAAmB,CAAC,QAAQ,YAE3B,WAAW,QACX,WAAW,QACX,OAAO,WAAW,QAAQ,MAAM,KAAK,MAAM,SAAS,KACpD,kBAAkB,OAAO,UAAU,MAAM,MAAM,OAC3C;GAAE,MAAM,OAAO;GAAM,UAAU,OAAO;EAAS,IAC/C,IACN,CAAC,CACA,QAAQ;EACX,IAAI,SACF,MAAM,OAAO,2BAA2B;GAAE;GAAU,OAAO;GAAO,QAAQ;EAAQ,GAAG,IAAI;CAE7F,CAAC;AACH,EAAE,CAAC,CACF,qBAAqB,EAAE,eAAe,aACrC,cAAc;CACZ,YAAY,SAAU,OAQnB;EACD,OAAO,KAAK,UAAU,SAAS,CAAC,CAC7B,UAAU,QACT,IACG,UAAU,yBAAyB,MAClC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,MAAM,QAAQ,CAAC,CAC/D,CAAC,CACA,KAAK,WAAW,MACf,EAAE,WAAW,2BAA2B,OAAO,GAAG,YAAY,KAAK,MAAM,QAAQ,CAAC,CACpF,CACJ,CAAC,CACA,kBAAkB,OAAO,CAAC,QAAQ,aAAa;GAC9C,IAAI,CAAC,QACH,OAAO,EAAE,OAAO,MAAe;GAEjC,MAAM,EAAE,kBAAkB,YAAY,MAAM,yBAAyB;IACnE;IACA;IACA;IACA,SAAS,MAAM;IACf,aAAa,MAAM;IACnB,GAAG,wBAAwB,SAAS,KAAK;GAC3C,CAAC;GACD,OAAO;IACL,OAAO;IACP,kBAAkB,iBAAiB,SAAS;IAC5C,UAAU,OAAO,GAAG,SAAS;IAC7B,UAAU,OAAO;IACjB;IACA;GACF;EACF,CAAC,CAAC,CACD,QAAQ,EAAE,KAAK,qBAAqB;GACnC,IAAI,CAAC,eAAe,OAClB,OAAO,EAAE,OAAO,MAAe;GAGjC,MAAM,gBAAgB,MAAc,SAAiB,cAA2B;IAC9E,MAAM,WAAW,eAAe,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;IAC7E,IAAI,UAAU;KACZ,IAAI,OAAO,UAAU,SAAS,KAAK,MACjC,EAAE,IAAI;MAAE;MAAS;MAAW,WAAW,EAAE,IAAI;KAAE,CAAC,CAAC,CAAC,MAAM,CAC1D;KACA;IACF;IACA,IAAI,OAAO,UAAU;KACnB,IAAI,GAAG,eAAe,SAAS,GAAG;KAClC,UAAU,eAAe;KACzB;KACA;KACA;IACF,CAAC;GACH;GAEA,wBAAwB,eAAe,SAAS;IAC9C,SAAS,MAAM,YAAY;KACzB,aAAa,MAAM,SAAS,IAAI;IAClC;IACA,SAAS,SAAS;KAChB,MAAM,WAAW,eAAe,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;KAC7E,IAAI,UACF,IAAI,OAAO,UAAU,SAAS,EAAE;IAEpC;GACF,CAAC;GACD,MAAM,aAAa,eAAe,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM;GACjF,IAAI,MAAM,iBAAiB,YAAY;IAErC,MAAM,UAAU,oBAAoB,WAAW,OAAO;IACtD,IAAI,OAAO,UAAU,WAAW,KAAK,MACnC,EAAE,IAAI;KAAE;KAAS,WAAW;KAAM,WAAW,EAAE,IAAI;IAAE,CAAC,CAAC,CAAC,MAAM,CAChE;IACA,MAAM,EAAE,aAAa;IACrB,MAAM,QAAQ,eAAe,UAAU;KAAE;KAAS,WAAW;IAAK,CAAC;IACnE,IAAI,UAAU,eAAe,UAAU,UAAU,GAC/C,IAAI,YAAY,4BAA4B;KAC1C,UAAU,eAAe;KACzB;IACF,CAAC;GAEL;GACA,IAAI,eAAe,QAAQ,YACzB,IAAI,OAAO,cAAc;IACvB,IAAI,eAAe,QAAQ,WAAW;IACtC,UAAU,eAAe;IAEzB,kBAAkB,eAAe;IACjC,cAAc,eAAe,QAAQ,WAAW;IAChD,aAAa,eAAe,QAAQ,WAAW;IAC/C,OAAO,eAAe,QAAQ,WAAW,SAAS;IAClD,WAAW,eAAe,QAAQ,WAAW;IAC7C,YAAY;GACd,CAAC;GAGH,OAAO,EAAE,OAAO,KAAc;EAChC,CAAC,CAAC,CACD,WAAW,EAAE,qBACZ,eAAe,QACX;GACE,OAAO;GACP,kBAAkB,eAAe;EACnC,IACA,EAAE,OAAO,MAAe,CAC9B,CAAC,CACA,MAAM;CACX;CAEA,uBAAuB,SAAU,OAI9B;EACD,MAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM;EAChD,OAAO,KAAK,UAAU,SAAS,CAAC,CAC7B,UAAU,QACT,IACG,UAAU,eAAe,MACxB,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,MAAM,OAAO,CAAC,CAC9D,CAAC,CACA,UAAU,yBAAyB,MAClC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CACzD,CAAC,CACA,KAAK,WAAW,MACf,EAAE,WAAW,2BAA2B,OAAO,GAAG,YAAY,KAAK,QAAQ,CAAC,CAC9E,CAAC,CACA,UAAU,4BAA4B,MACrC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CACzD,CACJ,CAAC,CACA,kBAAkB,OAAO,CAAC,OAAO,QAAQ,SAAS,WAAW;GAC5D,IAAI,CAAC,SAAS,MAAM,cAAc,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI,GAC/E,OAAO;IAAE,OAAO;IAAgB,QAAQ;GAAyB;GAEnE,IAAI,CAAC,QACH,OAAO;IAAE,OAAO;IAAgB,QAAQ;GAA4B;GAWtE,OAAO;IAAE,OAAO;IAAe;IAAQ;IAAS;IAAO,SAAA,MATjC,4BAA4B;KAChD;KACA,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,KAAK,MAAM;KACX;KACA;KACA;IACF,CAAC;GAC8D;EACjE,CAAC,CAAC,CACD,QAAQ,EAAE,KAAK,qBAAqB;GACnC,IAAI,CAAC,eAAe,OAClB,OAAO;IAAE,OAAO;IAAgB,QAAQ,eAAe;GAAO;GAGhE,MAAM,WAAW,eAAe,OAAO,GAAG,SAAS;GACnD,MAAM,gBAAgB,MAAc,SAAiB,cAA2B;IAC9E,MAAM,WAAW,eAAe,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;IAC7E,IAAI,UAAU;KACZ,IAAI,OAAO,UAAU,SAAS,KAAK,MACjC,EAAE,IAAI;MAAE;MAAS;MAAW,WAAW,EAAE,IAAI;KAAE,CAAC,CAAC,CAAC,MAAM,CAC1D;KACA;IACF;IACA,IAAI,OAAO,UAAU;KACnB,IAAI,GAAG,SAAS,GAAG;KACnB;KACA;KACA;KACA;IACF,CAAC;GACH;GAEA,wBAAwB,eAAe,SAAS;IAC9C,SAAS,MAAM,YAAY;KACzB,aAAa,MAAM,SAAS,IAAI;IAClC;IACA,SAAS,SAAS;KAChB,MAAM,WAAW,eAAe,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;KAC7E,IAAI,UACF,IAAI,OAAO,UAAU,SAAS,EAAE;IAEpC;GACF,CAAC;GACD,IAAI,eAAe,QAAQ,aAAa;IACtC,MAAM,QAAQ;KACZ,SAAS,eAAe,QAAQ;KAChC,WAAW,eAAe,QAAQ,iBAAiB;IACrD;IACA,aAAa,QAAQ,MAAM,SAAS,MAAM,SAAS;IACnD,IAAI,OAAO,wBAAwB,eAAe,OAAO,KAAK,MAC5D,EAAE,IAAI;KAAE,UAAU;KAAS,WAAW,EAAE,IAAI;IAAE,CAAC,CAAC,CAAC,MAAM,CACzD;IACA,MAAM,SAAS,eAAe,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM;IAC7E,MAAM,QAAQ,eAAe,SAAS,KAAK;IAC3C,IAAI,UAAU,eAAe,eAAe,OAAO,UAAU,MAAM,GACjE,IAAI,YAAY,4BAA4B;KAAE;KAAU;IAAM,CAAC;IAEjE,sBAAsB,KAAK,UAAU,SAAS,KAAK;IACnD,IAAI,eAAe,OACjB,IAAI,OAAO,2BAA2B,eAAe,MAAM,EAAE;IAE/D,IAAI,YAAY,sCAAsC,EAAE,SAAS,CAAC;GACpE;GACA,IAAI,eAAe,QAAQ,gBACzB,IAAI,OAAO,cAAc,MAAM,UAAU,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;GAG/E,OAAO,EAAE,OAAO,KAAc;EAChC,CAAC,CAAC,CACD,WAAW,EAAE,qBACZ,eAAe,QACX,EAAE,OAAO,KAAc,IACvB;GAAE,OAAO;GAAgB,QAAQ,eAAe;EAAO,CAC7D,CAAC,CACA,MAAM;CACX;CAEA,qBAAqB,SAAU,OAA6B;EAC1D,OAAO,KAAK,UAAU,SAAS,CAAC,CAC7B,UAAU,QACT,IACG,UAAU,yBAAyB,MAClC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,MAAM,QAAQ,CAAC,CAC/D,CAAC,CACA,KAAK,WAAW,MACf,EAAE,WAAW,2BAA2B,OAAO,GAAG,YAAY,KAAK,MAAM,QAAQ,CAAC,CACpF,CAAC,CACA,UAAU,4BAA4B,MACrC,EAAE,WAAW,YAAY,OAAO,GAAG,MAAM,KAAK,MAAM,QAAQ,CAAC,CAC/D,CACJ,CAAC,CACA,kBAAkB,OAAO,CAAC,QAAQ,SAAS,WAAW;GACrD,IAAI,CAAC,QACH,OAAO,EAAE,OAAO,MAAe;GAEjC,MAAM,WAAW,MAAM,wBAAwB;IAAE;IAAQ;IAAQ;GAAQ,CAAC;GAC1E,OAAO;IACL,OAAO;IACP,UAAU,OAAO,GAAG,SAAS;IAC7B,aAAa,OAAO;IACpB,OAAO,SAAS;IAChB;IACA;IACA,aAAa,SAAS;GACxB;EACF,CAAC,CAAC,CACD,WAAW,EAAE,qBACZ,eAAe,QACX;GACE,OAAO;GACP,aAAa,eAAe;GAC5B,OAAO,eAAe;GACtB,SAAS,eAAe;GACxB,OAAO,eAAe;GACtB,aAAa,eAAe;GAC5B,UAAU,eAAe;EAC3B,IACA,EAAE,OAAO,MAAe,CAC9B,CAAC,CACA,MAAM;CACX;AACF,CAAC,CACH,CAAC,CACA,MAAM"}