@haikit/mcp 0.32.0 → 0.33.0

package/README.md

@@ -53,6 +53,26 @@ await github.connect(); // at startup: stops here if a declared tool isn't on th
 - `textOf(result)` turns a result into text, for a tool that decides to pass
   some of it on. A cut is always marked in the text.
 
+A server can take each user's own credential instead of the app's. Then each
+call runs as the conversation's owner, over a connection of their own:
+
+```ts
+import { createMcpAuth } from "@haikit/mcp";
+
+const mcpAuth = createMcpAuth({ userOf: (id) => auth.ownerOf(id) }); // auth from @haikit/auth
+const tracker = mcpServer({
+  name: "tracker",
+  transport: http("https://mcp.tracker.example/mcp"),
+  auth: mcpAuth.bearer((userId) => keys.find(userId)), // their token, or null
+});
+```
+
+A call with no one to run as is refused with reason `user`, and one for a user
+with no token with reason `auth`, before anything is sent: it never falls
+back to the app's identity. `err.auth.kind` says what the user must do:
+`connect`, `reconnect`, or grant more `scope`. A job outside any conversation
+passes `{ userId }`.
+
 `McpTool` isn't a HaiKIT `Tool`, so it can't be passed to
 `createHai({ tools })`: `npm run typetest` checks that.
 

package/dist/auth.d.ts

@@ -0,0 +1,80 @@
+import type { AuthProvider } from "@modelcontextprotocol/client";
+export interface McpAuthOptions {
+    /**
+     * Who a conversation belongs to: the user a call made in it runs as. With
+     * @haikit/auth, `(id) => auth.ownerOf(id)`. `null` for no one.
+     */
+    userOf(conversationId: string): string | null | Promise<string | null>;
+}
+/** Makes the `auth` of servers whose calls are made as each user. */
+export interface McpAuth {
+    /**
+     * Each user's own token, which the app already has: `token(userId)` gives
+     * it, or `null` when the user has none. Sent as `Authorization: Bearer`.
+     */
+    bearer(token: (userId: string) => string | null | Promise<string | null>): McpServerAuth;
+}
+/** How a server's calls are made as each user: made by an `McpAuth`, and given to `mcpServer({ auth })`. */
+export interface McpServerAuth {
+    readonly kind: "bearer";
+}
+/** What an `McpServerAuth` stands for. */
+export interface AuthConfig {
+    readonly kind: "bearer";
+    userOf(conversationId: string): string | null | Promise<string | null>;
+    token(userId: string): string | null | Promise<string | null>;
+    /** Server names in use with this `McpAuth`: each is a key for its users' credentials. */
+    readonly names: Set<string>;
+}
+/** The config an `McpServerAuth` stands for, or undefined if `createMcpAuth` didn't make it. */
+export declare const configOf: (auth: unknown) => AuthConfig | undefined;
+/**
+ * For servers whose calls are made as each user, with that user's own
+ * credential: `mcpServer({ auth: mcpAuth.bearer(token) })`.
+ */
+export declare function createMcpAuth(options: McpAuthOptions): McpAuth;
+/**
+ * The user has no credential, or the server refused theirs: thrown inside a
+ * connection, where the transport passes it on unchanged, and made an
+ * `McpError` with reason `auth`.
+ */
+export declare class NeedsAuth extends Error {
+    readonly kind: "connect" | "reconnect";
+    readonly name = "NeedsAuth";
+    constructor(kind: "connect" | "reconnect");
+}
+/** The app's lookup of a credential failed: made an `McpError` with reason `connection`. */
+export declare class LookupFailed extends Error {
+    readonly name = "LookupFailed";
+    constructor(cause: unknown);
+}
+/** One user's credential for one server, and the `AuthProvider` that sends it. */
+export interface Credential {
+    /** Before a connection or call: finds the credential, or throws `NeedsAuth("connect")`, so nothing is sent without one. */
+    ensure(): Promise<void>;
+    /** For a connection being closed: stops a lookup on its way, and its timer. */
+    close(): void;
+    readonly provider: AuthProvider;
+}
+/** A token from `bearer`'s function, kept until a lookup on a 401 finds another, or none. */
+export declare class BearerCredential implements Credential {
+    private readonly read;
+    private readonly user;
+    /** How long `read` may take: a lookup that never answers would hold up every call after it. */
+    private readonly timeoutMs;
+    private token;
+    /** The lookup on its way, which every caller shares: only it sets `token`. */
+    private looking;
+    /** Stops the lookup on its way, for `close()`. */
+    private stop;
+    constructor(read: (userId: string) => string | null | Promise<string | null>, user: string, 
+    /** How long `read` may take: a lookup that never answers would hold up every call after it. */
+    timeoutMs: number);
+    ensure(): Promise<void>;
+    close(): void;
+    readonly provider: AuthProvider;
+    /** One lookup at a time, for first calls and 401s that come together, so none overwrites another's token. */
+    private look;
+    private lookup;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACxE;AAED,qEAAqE;AACrE,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC;CAC1F;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAID,gGAAgG;AAChG,eAAO,MAAM,QAAQ,GAAI,MAAM,OAAO,KAAG,UAAU,GAAG,SACqB,CAAC;AAE5E;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAgB9D;AAED;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAEtB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW;IADlD,QAAQ,CAAC,IAAI,eAAe;gBACP,IAAI,EAAE,SAAS,GAAG,WAAW;CAGnD;AAED,4FAA4F;AAC5F,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,kBAAkB;gBACnB,KAAK,EAAE,OAAO;CAG3B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,2HAA2H;IAC3H,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,+EAA+E;IAC/E,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC;AAED,6FAA6F;AAC7F,qBAAa,gBAAiB,YAAW,UAAU;IAQ/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,SAAS;IAV5B,OAAO,CAAC,KAAK,CAAuB;IACpC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAuC;IACtD,kDAAkD;IAClD,OAAO,CAAC,IAAI,CAA6B;gBAGtB,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAChE,IAAI,EAAE,MAAM;IAC7B,+FAA+F;IAC9E,SAAS,EAAE,MAAM;IAG9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B,KAAK,IAAI,IAAI;IAMb,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAc7B;IAEF,6GAA6G;IAC7G,OAAO,CAAC,IAAI;YASE,MAAM;CAiBrB"}

package/dist/auth.js

@@ -0,0 +1,119 @@
+const configs = new WeakMap();
+/** The config an `McpServerAuth` stands for, or undefined if `createMcpAuth` didn't make it. */
+export const configOf = (auth) => typeof auth === "object" && auth !== null ? configs.get(auth) : undefined;
+/**
+ * For servers whose calls are made as each user, with that user's own
+ * credential: `mcpServer({ auth: mcpAuth.bearer(token) })`.
+ */
+export function createMcpAuth(options) {
+    if (typeof options?.userOf !== "function") {
+        throw new TypeError("createMcpAuth: userOf must be a function, such as (id) => auth.ownerOf(id)");
+    }
+    const names = new Set();
+    const userOf = (conversationId) => options.userOf(conversationId);
+    return Object.freeze({
+        bearer(token) {
+            if (typeof token !== "function") {
+                throw new TypeError("bearer: token must be a function that takes a user id and returns their token, or null");
+            }
+            const auth = Object.freeze({ kind: "bearer" });
+            configs.set(auth, { kind: "bearer", userOf, token, names });
+            return auth;
+        },
+    });
+}
+/**
+ * The user has no credential, or the server refused theirs: thrown inside a
+ * connection, where the transport passes it on unchanged, and made an
+ * `McpError` with reason `auth`.
+ */
+export class NeedsAuth extends Error {
+    kind;
+    name = "NeedsAuth";
+    constructor(kind) {
+        super(kind === "connect" ? "the user has no credential" : "the server refused the user's credential");
+        this.kind = kind;
+    }
+}
+/** The app's lookup of a credential failed: made an `McpError` with reason `connection`. */
+export class LookupFailed extends Error {
+    name = "LookupFailed";
+    constructor(cause) {
+        super("the user's credential could not be looked up", { cause });
+    }
+}
+/** A token from `bearer`'s function, kept until a lookup on a 401 finds another, or none. */
+export class BearerCredential {
+    read;
+    user;
+    timeoutMs;
+    token = null;
+    /** The lookup on its way, which every caller shares: only it sets `token`. */
+    looking = null;
+    /** Stops the lookup on its way, for `close()`. */
+    stop = null;
+    constructor(read, user, 
+    /** How long `read` may take: a lookup that never answers would hold up every call after it. */
+    timeoutMs) {
+        this.read = read;
+        this.user = user;
+        this.timeoutMs = timeoutMs;
+    }
+    async ensure() {
+        if (this.token === null)
+            await this.look();
+        if (this.token === null)
+            throw new NeedsAuth("connect");
+    }
+    close() {
+        this.stop?.();
+    }
+    // The transport asks for the token before every request, and on a 401
+    // calls onUnauthorized, then tries once more with what it finds.
+    provider = {
+        // A request is never sent without the user's token: the transport would
+        // send it with no Authorization at all. Gone since its call began, as
+        // when another call's 401 found none, it stops the request here.
+        token: async () => {
+            if (this.token === null)
+                throw new NeedsAuth("reconnect");
+            return this.token;
+        },
+        onUnauthorized: async () => {
+            // A token the server still refuses gets its 401 on the retry, and is
+            // kept: the next 401 looks again. Forgetting it would throw away a
+            // newer one that another call's 401 found meanwhile.
+            if ((await this.look()) === null)
+                throw new NeedsAuth("reconnect");
+        },
+    };
+    /** One lookup at a time, for first calls and 401s that come together, so none overwrites another's token. */
+    look() {
+        this.looking ??= this.lookup()
+            .then((token) => (this.token = token))
+            .finally(() => {
+            this.looking = null;
+        });
+        return this.looking;
+    }
+    async lookup() {
+        let timer;
+        const cut = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`no token within ${this.timeoutMs} ms`)), this.timeoutMs);
+            this.stop = () => reject(new Error("closed while the token was being looked up"));
+        });
+        let token;
+        try {
+            token = await Promise.race([Promise.resolve().then(() => this.read(this.user)), cut]);
+        }
+        catch (err) {
+            throw new LookupFailed(err);
+        }
+        finally {
+            clearTimeout(timer);
+            this.stop = null;
+        }
+        return typeof token === "string" && token !== "" ? token : null;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,GAAG,IAAI,OAAO,EAAsB,CAAC;AAElD,gGAAgG;AAChG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAA0B,EAAE,CAChE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE5E;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,4EAA4E,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,KAAiE;YACtE,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,SAAS,CAAC,wFAAwF,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,IAAI,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEb;IADZ,IAAI,GAAG,WAAW,CAAC;IAC5B,YAAqB,IAA6B;QAChD,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC;QADnF,SAAI,GAAJ,IAAI,CAAyB;IAElD,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,cAAc,CAAC;IAC/B,YAAY,KAAc;QACxB,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAWD,6FAA6F;AAC7F,MAAM,OAAO,gBAAgB;IAQR;IACA;IAEA;IAVX,KAAK,GAAkB,IAAI,CAAC;IACpC,8EAA8E;IACtE,OAAO,GAAkC,IAAI,CAAC;IACtD,kDAAkD;IAC1C,IAAI,GAAwB,IAAI,CAAC;IAEzC,YACmB,IAAgE,EAChE,IAAY;IAC7B,+FAA+F;IAC9E,SAAiB;QAHjB,SAAI,GAAJ,IAAI,CAA4D;QAChE,SAAI,GAAJ,IAAI,CAAQ;QAEZ,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACxD,QAAQ,GAAiB;QAChC,wEAAwE;QACxE,sEAAsE;QACtE,iEAAiE;QACjE,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;IAEF,6GAA6G;IACrG,IAAI;QACV,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE;aAC3B,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;aACrC,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,KAAgD,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;CACF"}

package/dist/errors.d.ts

@@ -9,8 +9,21 @@ import type { ContentBlock } from "@modelcontextprotocol/client";
  * - `protocol`: the server refused the call, such as for a tool it doesn't
  *   have, or asked for something this client doesn't do.
  * - `closed`: `close()` was called.
+ * - `user`: a server with `auth` had no user to call as, so nothing was sent.
+ * - `auth`: the user's credential for the server is missing, was refused, or
+ *   needs more access. `auth` on the error says which.
  */
-export type McpErrorReason = "args" | "result" | "timeout" | "connection" | "protocol" | "closed";
+export type McpErrorReason = "args" | "result" | "timeout" | "connection" | "protocol" | "closed" | "user" | "auth";
+/** What a call with reason `auth` needs from the user. */
+export interface McpAuthNeed {
+    /**
+     * `connect`: the user has no credential for the server, so nothing was sent.
+     * `reconnect`: the server refused theirs. `scope`: theirs needs more access.
+     */
+    readonly kind: "connect" | "reconnect" | "scope";
+    /** On `scope`: the scope the server asked for, as its challenge put it. */
+    readonly scope?: string;
+}
 /**
  * A call that didn't get a result. The message names only the server and the
  * tool, never what the server said: a HaiKIT tool that lets this go reaches the
@@ -32,12 +45,15 @@ export declare class McpError extends Error {
     readonly text: string | undefined;
     /** A JSON-RPC error's code. */
     readonly code: number | undefined;
+    /** With reason `auth`: what the user's credential needs. */
+    readonly auth: McpAuthNeed | undefined;
     constructor(reason: McpErrorReason, message: string, detail: {
         server: string;
         tool?: string;
         text?: string;
         code?: number;
         cause?: unknown;
+        auth?: McpAuthNeed;
     });
 }
 /**

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC;AAElG;;;;;;;;;GASG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,cAAc;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGhC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAS3F;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAErB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;CAOlE;AAED,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,QAA2D,CAAC;AAE7G,eAAO,MAAM,cAAc,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,YACA,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpH,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,cAAc;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;gBAGrC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE;CAU/G;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAErB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;CAOlE;AAED,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,QAA2D,CAAC;AAE7G,eAAO,MAAM,cAAc,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,YACA,CAAC"}

package/dist/errors.js

@@ -19,6 +19,8 @@ export class McpError extends Error {
     text;
     /** A JSON-RPC error's code. */
     code;
+    /** With reason `auth`: what the user's credential needs. */
+    auth;
     constructor(reason, message, detail) {
         super(message, detail.cause === undefined ? undefined : { cause: detail.cause });
         this.reason = reason;
@@ -26,6 +28,7 @@ export class McpError extends Error {
         this.tool = detail.tool;
         this.text = detail.text;
         this.code = detail.code;
+        this.auth = detail.auth === undefined ? undefined : Object.freeze({ ...detail.auth });
     }
 }
 /**

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,GAAG,UAAU,CAAC;IAC3B,2BAA2B;IAClB,MAAM,CAAS;IACxB,uDAAuD;IAC9C,IAAI,CAAqB;IACzB,MAAM,CAAiB;IAChC,wFAAwF;IAC/E,IAAI,CAAqB;IAClC,+BAA+B;IACtB,IAAI,CAAqB;IAElC,YACE,MAAsB,EACtB,OAAe,EACf,MAAwF;QAExF,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,cAAc,CAAC;IACtB,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,oDAAoD;IAC3C,IAAI,CAAS;IACtB,4DAA4D;IACnD,OAAO,CAAiB;IAEjC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAuB;QAC/D,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAmB,EAAE,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;AAE7G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAY,EAAuB,EAAE,CAClE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA6BA;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,GAAG,UAAU,CAAC;IAC3B,2BAA2B;IAClB,MAAM,CAAS;IACxB,uDAAuD;IAC9C,IAAI,CAAqB;IACzB,MAAM,CAAiB;IAChC,wFAAwF;IAC/E,IAAI,CAAqB;IAClC,+BAA+B;IACtB,IAAI,CAAqB;IAClC,4DAA4D;IACnD,IAAI,CAA0B;IAEvC,YACE,MAAsB,EACtB,OAAe,EACf,MAA4G;QAE5G,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,cAAc,CAAC;IACtB,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,oDAAoD;IAC3C,IAAI,CAAS;IACtB,4DAA4D;IACnD,OAAO,CAAiB;IAEjC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAuB;QAC/D,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAmB,EAAE,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;AAE7G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAY,EAAuB,EAAE,CAClE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC"}

package/dist/index.d.ts

@@ -14,23 +14,40 @@
  * Imports only @haikit/core, like the model adapters.
  */
 import type { Progress, Schema } from "@haikit/core";
-import { type ContentBlock, type Transport, type VersionNegotiationMode } from "@modelcontextprotocol/client";
-export { McpError, McpToolError, isMcpError, isMcpToolError, type McpErrorReason } from "./errors.js";
+import { type AuthProvider, type ContentBlock, type Transport, type VersionNegotiationMode } from "@modelcontextprotocol/client";
+import { type McpServerAuth } from "./auth.js";
+export { createMcpAuth, type McpAuth, type McpAuthOptions, type McpServerAuth } from "./auth.js";
+export { McpError, McpToolError, isMcpError, isMcpToolError, type McpAuthNeed, type McpErrorReason } from "./errors.js";
 export { textOf, type TextOptions } from "./text.js";
 export { http, stdio, type HttpOptions } from "./transports.js";
-export type { ContentBlock, Transport } from "@modelcontextprotocol/client";
+export type { AuthProvider, ContentBlock, Transport } from "@modelcontextprotocol/client";
 export interface McpServerOptions {
     /** Names the server in errors and warnings, as in `github/search_issues`. */
     name: string;
     /**
      * Makes a connection: called by the first `connect()` or call, and again
-     * for each reconnect. `http(url)` and `stdio({ command })` make one.
+     * for each reconnect. `http(url)` and `stdio({ command })` make one. For a
+     * server with `auth`, it's given the user's `AuthProvider`, and must be
+     * `http()`'s.
      */
-    transport: () => Transport | Promise<Transport>;
+    transport: (authProvider?: AuthProvider) => Transport | Promise<Transport>;
+    /**
+     * Makes each call as the user it runs for, with their own credential, over
+     * a connection of their own: `createMcpAuth({ userOf }).bearer(token)`.
+     * Without it, every call shares one connection and one identity.
+     */
+    auth?: McpServerAuth;
+    /**
+     * With `auth`: the most users connected at once. Past it, the least recently
+     * used connection with no call in flight is closed. Default 100.
+     */
+    maxConnections?: number;
+    /** With `auth`: a user's connection is closed after this long with no call, in milliseconds. Default 300,000. */
+    idleMs?: number;
     /**
      * How long the server may go without answering a call or reporting progress
-     * on it, in milliseconds. Also bounds making the transport, connecting and
-     * listing tools. Default 30,000.
+     * on it, in milliseconds. Also bounds making the transport, connecting,
+     * listing tools and, with `auth`, looking up a user's token. Default 30,000.
      */
     timeoutMs?: number;
     /**
@@ -50,6 +67,8 @@ export interface McpServerOptions {
 }
 export interface McpToolChange {
     server: string;
+    /** With `auth`: the user whose connection saw the change. Each user's tools are compared apart. */
+    user?: string;
     /** Declared tools the server no longer has. */
     removed: string[];
     /** Declared tools whose input or output schema, or task support, changed. */
@@ -82,10 +101,16 @@ export interface McpResult {
  */
 export interface McpCallCtx {
     /**
-     * The conversation the call is for. Nothing reads it yet: it is here so a
-     * later version can pick a connection per user without calls changing.
+     * The conversation the call is for. A server with `auth` calls as its
+     * owner, from `userOf`.
      */
     readonly conversationId?: string;
+    /**
+     * For a server with `auth`: the user to call as, for a call made outside any
+     * conversation, such as a job. With a `conversationId` too, it must be the
+     * conversation's owner.
+     */
+    readonly userId?: string;
     /** Hears the server's progress notifications, as `ToolCtx.progress` does. */
     progress?(progress: Progress): void;
 }
@@ -116,9 +141,15 @@ export interface McpConnection {
      * Connects, and checks every declared tool: it throws if the server has no
      * tool of that name, or one that can only run as an MCP task. Call it at
      * startup, so a mistake stops the app there; the first call connects
-     * otherwise, and fails with the same error.
+     * otherwise, and fails with the same error. A server with `auth` needs
+     * the user to connect as, and checks the tools that user sees.
+     */
+    connect(userId?: string): Promise<void>;
+    /**
+     * For a server with `auth`: closes the user's connection, if they have
+     * one. Their next call makes a new one, and looks up their credential again.
      */
-    connect(): Promise<void>;
+    forget(userId: string): Promise<void>;
     /** Closes the connection, and stops a `stdio` server. Final: a later call fails with reason `closed`. */
     close(): Promise<void>;
 }

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAOL,KAAK,YAAY,EAEjB,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAqB5E,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,qGAAqG;IACrG,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;CACrC;AAED,uGAAuG;AACvG,MAAM,WAAW,OAAO,CAAC,CAAC,EAAE,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;QAAE,MAAM,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnG;;;;;OAKG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,yGAAyG;IACzG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAElE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EASL,KAAK,YAAY,EAEjB,KAAK,YAAY,EAEjB,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAyF,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAItI,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACxH,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAuB1F,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,YAAY,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E;;;;OAIG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,qGAAqG;IACrG,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;CACrC;AAED,uGAAuG;AACvG,MAAM,WAAW,OAAO,CAAC,CAAC,EAAE,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;QAAE,MAAM,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnG;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,yGAAyG;IACzG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAElE"}