@gizmodata/hardcharger-mcp 0.0.0 → 2.0.0

package/dist/oauth-facade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-facade.js","sourceRoot":"","sources":["../src/oauth-facade.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,8DAA8D;AAC9D,EAAE;AACF,0EAA0E;AAC1E,2DAA2D;AAC3D,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,oEAAoE;AAEpE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpE,gGAAgG;AAChG,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEzF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEpC,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,4DAA4D;AAC5D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;AACtD,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,GAAG,WAAW,mCAAmC;QACjD,GAAG,WAAW,yCAAyC;QACvD,0CAA0C,WAAW,EAAE;QACvD,oCAAoC,WAAW,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,eAAe;IAC7B,OAAO,GAAG,WAAW,QAAQ,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAwB,EAAE,UAAoB;IACzE,MAAM,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClI,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAQD,SAAS,QAAQ,CAAC,GAAyB,EAAE,KAAa;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACzD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,MAAc,EAAE,IAAY;IACzD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,MAAM,kBAAkB,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACtF,OAAO,QAAQ,MAAM,mBAAmB,OAAO,gBAAgB,OAAO,GAAG,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3H,OAAO,QAAQ,MAAM,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,WAAW;IAQX;IAPF,MAAM,CAAS;IAChB,MAAM,CAA2D;IACjE,OAAO,CAA+C;IAC7C,SAAS,CAAe;IACxB,GAAG,CAA4B;IAEhD,YACW,MAAuE,EAChF,UAAyB,EAAE;QADlB,WAAM,GAAN,MAAM,CAAiE;QAGhF,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,eAAe,EAAE,EAAE,EAAE,CAAC;IAC9H,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,cAAc,CAAC,GAAyB,EAAE,GAAwB;QACtE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACnG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,WAAW,CAAC,GAAyB,EAAE,GAAwB;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3F,IAAI,WAAW,KAAK,mCAAmC,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC;YACvH,OAAO;QACT,CAAC;QACD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;QAC9C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1B,IAAI,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,qBAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACvG,qBAAqB,GAAG,GAAG,CAAC,cAAc,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,mCAAmC,KAAK,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,wEAAwE;QACxE,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,CAAC,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAErG,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE;gBAC3D,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACvB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;aACjD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CACN,mCAAmC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CACjI,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB;gBAC1E,eAAe,EAAE,UAAU;gBAC3B,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,mCAAmC,KAAK,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,eAAe;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1G,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;iBACxE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YAC3B,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/oauth.d.ts

@@ -0,0 +1,94 @@
+import { type JWTPayload, type JWTVerifyGetKey } from "jose";
+export interface OAuthConfig {
+    /** Canonical public URL of the MCP endpoint, e.g. https://mcp.example.com/mcp. */
+    publicUrl: string;
+    /** Issuer URL of the OpenID Connect provider (the `iss` claim). */
+    issuer: string;
+    /** Accepted `aud` values; a token must carry at least one of them. */
+    audiences: string[];
+    /** JWKS endpoint; discovered from the issuer when unset. */
+    jwksUri?: string;
+    /** Scopes advertised to clients (`scopes_supported`) and requested on a 401. */
+    scopes: string[];
+    /** Claims tried in order to name the caller (first non-empty string wins). */
+    userClaims: string[];
+    /** Glob patterns (`*@example.com`, `alice@example.com`); empty = everyone the provider signs in. */
+    authorizedEmails: string[];
+    /**
+     * Publish an authorization-server facade and proxy the token endpoint so
+     * refresh_token grants carry the API scope (needed for Microsoft Entra ID).
+     */
+    tokenProxy?: boolean;
+}
+/** Identity derived from a verified access token. */
+export interface AuthenticatedUser {
+    /** The `sub` claim. */
+    subject: string;
+    /** Display name: the first configured user claim that is present. */
+    name: string;
+    /** Email-like address if any of `email`, `preferred_username` or `upn` looks like one. */
+    email?: string;
+    claims: JWTPayload;
+}
+export type AuthFailureCode = "invalid_token" | "forbidden";
+export declare class OAuthError extends Error {
+    readonly code: AuthFailureCode;
+    constructor(code: AuthFailureCode, message: string);
+    /** HTTP status the transport should answer with. */
+    get status(): 401 | 403;
+}
+/** Asymmetric algorithms only: a symmetric alg would let the JWKS-hosted public key act as a secret. */
+export declare const ALLOWED_ALGORITHMS: string[];
+/**
+ * OpenID Connect scope that asks the provider for a refresh token. Claude
+ * requests exactly the scopes named in the WWW-Authenticate challenge, so it
+ * must be advertised here or the client cannot outlive the access token.
+ */
+export declare const OFFLINE_ACCESS_SCOPE = "offline_access";
+/** Tolerated clock skew between the provider and this host, in seconds. */
+export declare const CLOCK_TOLERANCE_SECONDS = 60;
+/** Well-known path of the protected-resource metadata, without and with the endpoint path (RFC 9728 §3.1). */
+export declare function protectedResourceMetadataPaths(publicUrl: string): string[];
+/** URL of the protected-resource metadata document (the path-suffixed form, which clients try first). */
+export declare function protectedResourceMetadataUrl(publicUrl: string): string;
+/** Candidate discovery documents for an issuer: OpenID Connect first, then RFC 8414 (both path placements). */
+export declare function discoveryUrls(issuer: string): string[];
+/** Case-insensitive glob match where `*` matches any run of characters. */
+export declare function emailMatches(email: string, pattern: string): boolean;
+/** Builds the identity for a verified token payload. */
+export declare function userFromClaims(claims: JWTPayload, userClaims: string[]): AuthenticatedUser;
+export interface VerifierOptions {
+    /** Test hook: replaces global fetch for discovery. */
+    fetch?: typeof fetch;
+    /** Test hook: replaces the remote JWKS key resolver. */
+    getKey?: JWTVerifyGetKey;
+    log?: (message: string) => void;
+}
+/** Verifies bearer tokens against one OpenID Connect provider. */
+export declare class OAuthVerifier {
+    readonly config: OAuthConfig;
+    private keyResolver;
+    private discovering;
+    private readonly fetchImpl;
+    private readonly log;
+    constructor(config: OAuthConfig, options?: VerifierOptions);
+    /** RFC 9728 protected-resource metadata document; `authorizationServer` overrides the issuer (token-proxy facade). */
+    protectedResourceMetadata(authorizationServer?: string): Record<string, unknown>;
+    /** `WWW-Authenticate` value for a 401 (RFC 6750 §3 + RFC 9728 §5.1). */
+    challenge(error?: AuthFailureCode, description?: string): string;
+    /**
+     * Validates a bearer token and returns the caller. Throws OAuthError with
+     * code `invalid_token` (401) for a missing, malformed, expired or
+     * mis-issued token and `forbidden` (403) when the caller is not on the
+     * email allowlist.
+     */
+    verify(authorization: string | undefined): Promise<AuthenticatedUser>;
+    private resolveKeys;
+    /** Returns the JWKS URI: configured, or read from the provider's discovery document. */
+    private discoverJwks;
+}
+/**
+ * Fetches the provider's discovery document (OpenID Connect first, then RFC
+ * 8414). The document must name the configured issuer and a jwks_uri.
+ */
+export declare function discoverMetadata(issuer: string, fetchImpl?: typeof fetch): Promise<Record<string, unknown>>;

package/dist/oauth.js

@@ -0,0 +1,228 @@
+// OAuth 2.1 resource-server support for the Streamable HTTP transport.
+//
+// The MCP server never issues tokens itself. An OpenID Connect provider
+// (Microsoft Entra ID, Okta, Auth0, Keycloak, Cognito, Clerk, ...) is the
+// authorization server; this module
+//   - discovers the provider's JWKS from its issuer URL,
+//   - verifies the bearer token on every request (signature, issuer,
+//     audience, expiry) and derives the caller's identity from its claims,
+//   - optionally restricts callers to an email allowlist, and
+//   - renders the RFC 9728 protected-resource metadata and the
+//     WWW-Authenticate challenge that let MCP clients such as Claude.ai
+//     find the authorization server on their own.
+//
+// The Hardcharger connection itself keeps using the configured service
+// credentials: the caller's token is validated here and never forwarded.
+import { createRemoteJWKSet, jwtVerify } from "jose";
+export class OAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "OAuthError";
+    }
+    /** HTTP status the transport should answer with. */
+    get status() {
+        return this.code === "forbidden" ? 403 : 401;
+    }
+}
+/** Asymmetric algorithms only: a symmetric alg would let the JWKS-hosted public key act as a secret. */
+export const ALLOWED_ALGORITHMS = ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"];
+/**
+ * OpenID Connect scope that asks the provider for a refresh token. Claude
+ * requests exactly the scopes named in the WWW-Authenticate challenge, so it
+ * must be advertised here or the client cannot outlive the access token.
+ */
+export const OFFLINE_ACCESS_SCOPE = "offline_access";
+/** Tolerated clock skew between the provider and this host, in seconds. */
+export const CLOCK_TOLERANCE_SECONDS = 60;
+/** Well-known path of the protected-resource metadata, without and with the endpoint path (RFC 9728 §3.1). */
+export function protectedResourceMetadataPaths(publicUrl) {
+    const path = new URL(publicUrl).pathname.replace(/\/+$/u, "");
+    const base = "/.well-known/oauth-protected-resource";
+    return path && path !== "/" ? [base, `${base}${path}`] : [base];
+}
+/** URL of the protected-resource metadata document (the path-suffixed form, which clients try first). */
+export function protectedResourceMetadataUrl(publicUrl) {
+    const u = new URL(publicUrl);
+    const paths = protectedResourceMetadataPaths(publicUrl);
+    return `${u.origin}${paths[paths.length - 1]}`;
+}
+/** Candidate discovery documents for an issuer: OpenID Connect first, then RFC 8414 (both path placements). */
+export function discoveryUrls(issuer) {
+    const u = new URL(issuer);
+    const path = u.pathname.replace(/\/+$/u, "");
+    const urls = [`${u.origin}${path}/.well-known/openid-configuration`];
+    if (path) {
+        urls.push(`${u.origin}/.well-known/oauth-authorization-server${path}`);
+        urls.push(`${u.origin}${path}/.well-known/oauth-authorization-server`);
+    }
+    else {
+        urls.push(`${u.origin}/.well-known/oauth-authorization-server`);
+    }
+    return urls;
+}
+/** Case-insensitive glob match where `*` matches any run of characters. */
+export function emailMatches(email, pattern) {
+    const re = new RegExp("^" +
+        pattern
+            .trim()
+            .toLowerCase()
+            .split("*")
+            .map((s) => s.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"))
+            .join(".*") +
+        "$", "u");
+    return re.test(email.trim().toLowerCase());
+}
+const EMAIL_CLAIMS = ["email", "preferred_username", "upn"];
+function firstString(claims, names) {
+    for (const n of names) {
+        const v = claims[n];
+        if (typeof v === "string" && v.trim() !== "")
+            return v.trim();
+    }
+    return undefined;
+}
+/** Builds the identity for a verified token payload. */
+export function userFromClaims(claims, userClaims) {
+    const subject = typeof claims.sub === "string" ? claims.sub : "";
+    const emailish = EMAIL_CLAIMS.map((n) => claims[n]).find((v) => typeof v === "string" && v.includes("@"));
+    return {
+        subject,
+        name: firstString(claims, userClaims) ?? subject ?? "unknown",
+        email: emailish?.trim(),
+        claims,
+    };
+}
+/** Verifies bearer tokens against one OpenID Connect provider. */
+export class OAuthVerifier {
+    config;
+    keyResolver;
+    discovering;
+    fetchImpl;
+    log;
+    constructor(config, options = {}) {
+        this.config = config;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.log = options.log ?? ((m) => console.error(m));
+        if (options.getKey)
+            this.keyResolver = options.getKey;
+    }
+    /** RFC 9728 protected-resource metadata document; `authorizationServer` overrides the issuer (token-proxy facade). */
+    protectedResourceMetadata(authorizationServer = this.config.issuer) {
+        const doc = {
+            resource: this.config.publicUrl,
+            authorization_servers: [authorizationServer],
+            bearer_methods_supported: ["header"],
+        };
+        if (this.config.scopes.length > 0)
+            doc.scopes_supported = this.config.scopes;
+        return doc;
+    }
+    /** `WWW-Authenticate` value for a 401 (RFC 6750 §3 + RFC 9728 §5.1). */
+    challenge(error, description) {
+        const parts = [];
+        if (error)
+            parts.push(`error="${error}"`);
+        if (description)
+            parts.push(`error_description="${description.replace(/["\\\r\n]/gu, " ")}"`);
+        parts.push(`resource_metadata="${protectedResourceMetadataUrl(this.config.publicUrl)}"`);
+        if (this.config.scopes.length > 0)
+            parts.push(`scope="${this.config.scopes.join(" ")}"`);
+        return `Bearer ${parts.join(", ")}`;
+    }
+    /**
+     * Validates a bearer token and returns the caller. Throws OAuthError with
+     * code `invalid_token` (401) for a missing, malformed, expired or
+     * mis-issued token and `forbidden` (403) when the caller is not on the
+     * email allowlist.
+     */
+    async verify(authorization) {
+        const m = authorization ? /^Bearer\s+(.+)$/iu.exec(authorization.trim()) : null;
+        if (!m)
+            throw new OAuthError("invalid_token", "Bearer token required");
+        const token = m[1].trim();
+        const getKey = await this.resolveKeys();
+        let claims;
+        try {
+            const result = await jwtVerify(token, getKey, {
+                issuer: this.config.issuer,
+                audience: this.config.audiences,
+                algorithms: ALLOWED_ALGORITHMS,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            });
+            claims = result.payload;
+        }
+        catch (err) {
+            throw new OAuthError("invalid_token", err instanceof Error ? err.message : String(err));
+        }
+        const user = userFromClaims(claims, this.config.userClaims);
+        if (this.config.authorizedEmails.length > 0) {
+            const email = user.email;
+            const allowed = email !== undefined && this.config.authorizedEmails.some((p) => emailMatches(email, p));
+            if (!allowed) {
+                throw new OAuthError("forbidden", `${email ?? user.name} is not authorized to use this server`);
+            }
+        }
+        return user;
+    }
+    resolveKeys() {
+        if (this.keyResolver)
+            return Promise.resolve(this.keyResolver);
+        if (!this.discovering) {
+            this.discovering = this.discoverJwks()
+                .then((uri) => {
+                this.keyResolver = createRemoteJWKSet(new URL(uri));
+                this.log(`[hardcharger-mcp] OAuth: verifying tokens from ${this.config.issuer} with keys at ${uri}`);
+                return this.keyResolver;
+            })
+                .finally(() => {
+                this.discovering = undefined;
+            });
+        }
+        return this.discovering;
+    }
+    /** Returns the JWKS URI: configured, or read from the provider's discovery document. */
+    async discoverJwks() {
+        if (this.config.jwksUri)
+            return this.config.jwksUri;
+        try {
+            const doc = await discoverMetadata(this.config.issuer, this.fetchImpl);
+            return doc.jwks_uri;
+        }
+        catch (err) {
+            throw new OAuthError("invalid_token", `${err instanceof Error ? err.message : String(err)}; set HARDCHARGER_MCP_OAUTH_JWKS_URI to skip discovery`);
+        }
+    }
+}
+/**
+ * Fetches the provider's discovery document (OpenID Connect first, then RFC
+ * 8414). The document must name the configured issuer and a jwks_uri.
+ */
+export async function discoverMetadata(issuer, fetchImpl = fetch) {
+    const errors = [];
+    for (const url of discoveryUrls(issuer)) {
+        try {
+            const res = await fetchImpl(url, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10000) });
+            if (!res.ok) {
+                errors.push(`${url}: HTTP ${res.status}`);
+                continue;
+            }
+            const doc = (await res.json());
+            if (typeof doc.jwks_uri !== "string" || doc.jwks_uri === "") {
+                errors.push(`${url}: no jwks_uri`);
+                continue;
+            }
+            if (typeof doc.issuer === "string" && doc.issuer.replace(/\/+$/u, "") !== issuer.replace(/\/+$/u, "")) {
+                errors.push(`${url}: issuer ${doc.issuer} does not match ${issuer}`);
+                continue;
+            }
+            return doc;
+        }
+        catch (err) {
+            errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    throw new Error(`OAuth discovery failed for ${issuer} (${errors.join("; ")})`);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,oCAAoC;AACpC,yDAAyD;AACzD,qEAAqE;AACrE,2EAA2E;AAC3E,8DAA8D;AAC9D,+DAA+D;AAC/D,wEAAwE;AACxE,kDAAkD;AAClD,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AAEzE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AAqC5F,MAAM,OAAO,UAAW,SAAQ,KAAK;IAExB;IADX,YACW,IAAqB,EAC9B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAiB;QAI9B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;IACD,oDAAoD;IACpD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/C,CAAC;CACF;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE7H;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,8GAA8G;AAC9G,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,uCAAuC,CAAC;IACrD,OAAO,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,mCAAmC,CAAC,CAAC;IACrE,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,0CAA0C,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,yCAAyC,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,yCAAyC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAe;IACzD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,GAAG;QACD,OAAO;aACJ,IAAI,EAAE;aACN,WAAW,EAAE;aACb,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;aACrD,IAAI,CAAC,IAAI,CAAC;QACb,GAAG,EACL,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;AAE5D,SAAS,WAAW,CAAC,MAAkB,EAAE,KAAe;IACtD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,UAAoB;IACrE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAE3F,CAAC;IACd,OAAO;QACL,OAAO;QACP,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,OAAO,IAAI,SAAS;QAC7D,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvB,MAAM;KACP,CAAC;AACJ,CAAC;AAUD,kEAAkE;AAClE,MAAM,OAAO,aAAa;IAOb;IANH,WAAW,CAA8B;IACzC,WAAW,CAAuC;IACzC,SAAS,CAAe;IACxB,GAAG,CAA4B;IAEhD,YACW,MAAmB,EAC5B,UAA2B,EAAE;QADpB,WAAM,GAAN,MAAM,CAAa;QAG5B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM;YAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IACxD,CAAC;IAED,sHAAsH;IACtH,yBAAyB,CAAC,sBAA8B,IAAI,CAAC,MAAM,CAAC,MAAM;QACxE,MAAM,GAAG,GAA4B;YACnC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC/B,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;YAC5C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wEAAwE;IACxE,SAAS,CAAC,KAAuB,EAAE,WAAoB;QACrD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC1C,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,sBAAsB,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzF,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,aAAiC;QAC5C,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAC/B,UAAU,EAAE,kBAAkB;gBAC9B,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACxG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,uCAAuC,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE;iBACnC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,kDAAkD,IAAI,CAAC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC,CAAC;gBACrG,OAAO,IAAI,CAAC,WAAW,CAAC;YAC1B,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC/B,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,QAAkB,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,wDAAwD,CAC5G,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,YAA0B,KAAK;IACpF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC1D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;gBACtG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,YAAY,GAAG,CAAC,MAAM,mBAAmB,MAAM,EAAE,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/params.d.ts

@@ -0,0 +1,61 @@
+import type { JsonScalar } from "@gizmodata/hardcharger";
+import { Table } from "apache-arrow";
+import { z } from "zod";
+export declare const TYPED_PARAM_TYPES: readonly ["string", "number", "bigint", "boolean", "date", "timestamp", "binary", "null"];
+export type TypedParamType = (typeof TYPED_PARAM_TYPES)[number];
+export declare const typedParamSchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        bigint: "bigint";
+        boolean: "boolean";
+        date: "date";
+        timestamp: "timestamp";
+        binary: "binary";
+        null: "null";
+    }>;
+    value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+}, z.core.$strict>;
+export declare const paramValueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        bigint: "bigint";
+        boolean: "boolean";
+        date: "date";
+        timestamp: "timestamp";
+        binary: "binary";
+        null: "null";
+    }>;
+    value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+}, z.core.$strict>]>;
+export declare const paramsSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        bigint: "bigint";
+        boolean: "boolean";
+        date: "date";
+        timestamp: "timestamp";
+        binary: "binary";
+        null: "null";
+    }>;
+    value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+}, z.core.$strict>]>>;
+export type JsonParamValue = z.infer<typeof paramValueSchema>;
+/** What a statement is bound with: JSON values, or one row of Arrow data. */
+export type BoundParams = JsonScalar[] | Table;
+export declare class ParameterError extends Error {
+    constructor(message: string);
+}
+/** Parses an ISO-8601 date or timestamp string into a Date (UTC when no zone given). */
+export declare function parseIsoDateTime(text: string): Date | undefined;
+/**
+ * Converts the JSON `params` array from a tool call into the values the client binds.
+ * Returns `undefined` when there is nothing to bind.
+ */
+export declare function convertParams(params: JsonParamValue[] | undefined): BoundParams | undefined;
+/** How many values `bound` carries (one per placeholder). */
+export declare function boundCount(bound: BoundParams | undefined): number;
+/** Documentation for the `params` argument, shared by run_query / execute_statement. */
+export declare const PARAMS_DESCRIPTION: string;

package/dist/params.js

@@ -0,0 +1,200 @@
+// Conversion of JSON tool arguments into the values the Hardcharger client binds to
+// `?` / `$1` placeholders.
+//
+// Plain JSON values travel as Warp SQL JSON parameters (§6.1): string, number, boolean
+// and null as they are. The server types each one from where it is used, so a date
+// string compared with a DATE column, or inserted into a TIMESTAMP one, is read as a
+// date. A typed object form `{ "type": "...", "value": ... }` covers what that cannot
+// express: a bigint beyond JavaScript's safe integers (sent exactly), and dates,
+// timestamps and binary values whose type the SQL does not give. When any parameter is
+// a date, timestamp or binary value, all of them are bound as one row of Arrow data
+// (the statement is prepared first), each with its own Arrow type.
+import { Binary, Bool, DateDay, Field, Float64, Int64, Null, RecordBatch, Schema, Struct, Table, TimestampMicrosecond, Utf8, makeData, vectorFromArray, } from "apache-arrow";
+import { z } from "zod";
+export const TYPED_PARAM_TYPES = [
+    "string",
+    "number",
+    "bigint",
+    "boolean",
+    "date",
+    "timestamp",
+    "binary",
+    "null",
+];
+export const typedParamSchema = z
+    .object({
+    type: z.enum(TYPED_PARAM_TYPES),
+    value: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),
+})
+    .strict();
+export const paramValueSchema = z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    typedParamSchema,
+]);
+export const paramsSchema = z.array(paramValueSchema);
+export class ParameterError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ParameterError";
+    }
+}
+// YYYY-MM-DD
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
+// YYYY-MM-DD[T ]HH:MM[:SS[.fraction]][Z|±HH[:MM]]
+const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}(?::?\d{2})?)?$/u;
+/** Parses an ISO-8601 date or timestamp string into a Date (UTC when no zone given). */
+export function parseIsoDateTime(text) {
+    if (ISO_DATE.test(text)) {
+        const d = new Date(`${text}T00:00:00Z`);
+        return Number.isNaN(d.getTime()) ? undefined : d;
+    }
+    if (ISO_TIMESTAMP.test(text)) {
+        let normalized = text.replace(" ", "T");
+        // Treat zone-less timestamps as UTC so the bound value is deterministic.
+        if (!/(?:Z|[+-]\d{2}(?::?\d{2})?)$/u.test(normalized))
+            normalized += "Z";
+        // Trim fractions beyond milliseconds (Date only keeps ms).
+        normalized = normalized.replace(/(\.\d{3})\d+/u, "$1");
+        const d = new Date(normalized);
+        return Number.isNaN(d.getTime()) ? undefined : d;
+    }
+    return undefined;
+}
+function convertTyped(index, type, value) {
+    const where = `parameter ${index + 1} (type "${type}")`;
+    switch (type) {
+        case "null":
+            return { value: null };
+        case "string":
+            if (value === null || value === undefined)
+                return { value: null };
+            return { value: String(value) };
+        case "boolean":
+            if (typeof value === "boolean")
+                return { value };
+            if (value === "true")
+                return { value: true };
+            if (value === "false")
+                return { value: false };
+            throw new ParameterError(`${where}: expected a boolean value.`);
+        case "number":
+            if (typeof value === "number")
+                return { value };
+            if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) {
+                return { value: Number(value) };
+            }
+            throw new ParameterError(`${where}: expected a numeric value.`);
+        case "bigint": {
+            if (typeof value === "number") {
+                if (!Number.isSafeInteger(value)) {
+                    throw new ParameterError(`${where}: ${value} is not a safe integer; pass the value as a decimal string.`);
+                }
+                return { value: BigInt(value) };
+            }
+            if (typeof value === "string" && /^-?\d+$/u.test(value.trim())) {
+                return { value: BigInt(value.trim()) };
+            }
+            throw new ParameterError(`${where}: expected an integer or a decimal-digit string.`);
+        }
+        case "date":
+        case "timestamp": {
+            let d;
+            if (typeof value === "number")
+                d = new Date(value);
+            else if (typeof value === "string")
+                d = parseIsoDateTime(value) ?? new Date(value);
+            else
+                throw new ParameterError(`${where}: expected an ISO-8601 string or epoch milliseconds.`);
+            if (Number.isNaN(d.getTime())) {
+                throw new ParameterError(`${where}: "${String(value)}" is not a valid ISO-8601 date/timestamp.`);
+            }
+            return { value: d, arrowType: type === "date" ? new DateDay() : new TimestampMicrosecond() };
+        }
+        case "binary": {
+            if (typeof value !== "string") {
+                throw new ParameterError(`${where}: expected a base64 string.`);
+            }
+            return { value: new Uint8Array(Buffer.from(value, "base64")), arrowType: new Binary() };
+        }
+        default:
+            throw new ParameterError(`${where}: unsupported parameter type.`);
+    }
+}
+function convertOne(index, value) {
+    if (value === null)
+        return { value: null };
+    if (typeof value === "boolean" || typeof value === "string")
+        return { value };
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new ParameterError(`parameter ${index + 1}: ${value} is not a finite number.`);
+        if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+            throw new ParameterError(`parameter ${index + 1}: ${value} exceeds JavaScript's safe integer range; ` +
+                `pass it as {"type":"bigint","value":"<digits>"}.`);
+        }
+        return { value };
+    }
+    if (typeof value === "object" && value !== null && "type" in value) {
+        return convertTyped(index, value.type, value.value);
+    }
+    throw new ParameterError(`parameter ${index + 1}: unsupported value.`);
+}
+/** The Arrow type for a value that JSON would have carried. */
+function inferredType(value) {
+    if (value === null)
+        return new Null();
+    if (typeof value === "boolean")
+        return new Bool();
+    if (typeof value === "bigint")
+        return new Int64();
+    if (typeof value === "number")
+        return Number.isInteger(value) ? new Int64() : new Float64();
+    return new Utf8();
+}
+/** One row of Arrow parameters, a column per placeholder (named 1, 2, ...). */
+function arrowRow(converted) {
+    const fields = [];
+    const children = converted.map((c, i) => {
+        const type = c.arrowType ?? inferredType(c.value);
+        let value = c.value;
+        if (typeof value === "number" && type instanceof Int64)
+            value = BigInt(value);
+        const vector = vectorFromArray([value], type);
+        fields.push(new Field(String(i + 1), vector.type, true));
+        return vector.data[0];
+    });
+    const schema = new Schema(fields);
+    const batch = new RecordBatch(schema, makeData({ type: new Struct(schema.fields), length: 1, children }));
+    return new Table([batch]);
+}
+/**
+ * Converts the JSON `params` array from a tool call into the values the client binds.
+ * Returns `undefined` when there is nothing to bind.
+ */
+export function convertParams(params) {
+    if (!params || params.length === 0)
+        return undefined;
+    const converted = params.map((v, i) => convertOne(i, v));
+    if (converted.some((c) => c.arrowType !== undefined))
+        return arrowRow(converted);
+    return converted.map((c) => c.value);
+}
+/** How many values `bound` carries (one per placeholder). */
+export function boundCount(bound) {
+    if (bound === undefined)
+        return 0;
+    return bound instanceof Table ? bound.numCols : bound.length;
+}
+/** Documentation for the `params` argument, shared by run_query / execute_statement. */
+export const PARAMS_DESCRIPTION = "Optional JSON array of values bound positionally to ? or $1, $2, ... placeholders in the SQL " +
+    "(bound parameters, never string interpolation). Use placeholders for any literal that " +
+    "comes from user input or data. Accepted values: string, number, boolean, null. The server types " +
+    "each value from where it is used, so an ISO-8601 date string compared with or inserted into a " +
+    "DATE/TIMESTAMP column is read as a date. For explicit types use " +
+    '{"type":"bigint"|"date"|"timestamp"|"binary"|"string"|"number"|"boolean"|"null","value":...} ' +
+    "(binary values are base64; bigint as a digit string for values beyond 2^53). A placeholder whose " +
+    "type nothing gives (e.g. SELECT ?) is text unless typed or cast, e.g. SELECT ?::INTEGER.";
+//# sourceMappingURL=params.js.map

package/dist/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../src/params.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,2BAA2B;AAC3B,EAAE;AACF,uFAAuF;AACvF,mFAAmF;AACnF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,uFAAuF;AACvF,oFAAoF;AACpF,mEAAmE;AAGnE,OAAO,EACL,MAAM,EACN,IAAI,EAEJ,OAAO,EACP,KAAK,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,WAAW,EACX,MAAM,EACN,MAAM,EACN,KAAK,EACL,oBAAoB,EACpB,IAAI,EACJ,QAAQ,EACR,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,WAAW;IACX,QAAQ;IACR,MAAM;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAOtD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,aAAa;AACb,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,kDAAkD;AAClD,MAAM,aAAa,GACjB,0FAA0F,CAAC;AAE7F,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,yEAAyE;QACzE,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,UAAU,IAAI,GAAG,CAAC;QACzE,2DAA2D;QAC3D,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAS,YAAY,CAAC,KAAa,EAAE,IAAoB,EAAE,KAAc;IACvE,MAAM,KAAK,GAAG,aAAa,KAAK,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;IACxD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,SAAS;YACZ,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,OAAO;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;QAClE,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;QAClE,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,cAAc,CACtB,GAAG,KAAK,KAAK,KAAK,6DAA6D,CAChF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,CAAO,CAAC;YACZ,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;iBAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;;gBAC9E,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;YAC9F,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC/F,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD;YACE,MAAM,IAAI,cAAc,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAqB;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,aAAa,KAAK,GAAG,CAAC,KAAK,KAAK,0BAA0B,CAAC,CAAC;QAClH,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,cAAc,CACtB,aAAa,KAAK,GAAG,CAAC,KAAK,KAAK,4CAA4C;gBAC1E,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,aAAa,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC;AACzE,CAAC;AAED,+DAA+D;AAC/D,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,EAAE,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC5F,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,SAAsB;IACtC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,GAAY,CAAC,CAAC,KAAK,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,YAAY,KAAK;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1G,OAAO,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoC;IAChE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC;AACrD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,KAA8B;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,+FAA+F;IAC/F,wFAAwF;IACxF,kGAAkG;IAClG,gGAAgG;IAChG,kEAAkE;IAClE,+FAA+F;IAC/F,mGAAmG;IACnG,0FAA0F,CAAC"}