@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/mcp/oauth-flow.js

@@ -0,0 +1,473 @@
+import { auth, discoverOAuthServerInfo, isHttpsUrl, registerClient, selectClientAuthMethod, selectResourceURL, } from "@modelcontextprotocol/sdk/client/auth.js";
+import { OAuthTokensSchema, } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { VERSION } from "../../config.js";
+import { VoltMcpOAuthProvider } from "./oauth-provider.js";
+import { redactMcpText } from "./safety.js";
+const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const DEFAULT_DEVICE_INTERVAL_MS = 5000;
+const SLOW_DOWN_INCREMENT_MS = 5000;
+function isLoopbackHostname(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+}
+function assertLoopbackRedirectUrl(value) {
+    const url = new URL(String(value));
+    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.hostname === "localhost") {
+        throw new Error("MCP OAuth redirect URL must use HTTP on a numeric loopback address");
+    }
+    if (url.username || url.password || url.hash) {
+        throw new Error("MCP OAuth redirect URL must not include userinfo or fragments");
+    }
+}
+function assertBrowserTargetUrl(value, label) {
+    assertHttpsEndpoint(value, label);
+}
+function getOAuthFetchUrl(input) {
+    if (typeof input === "string") {
+        return new URL(input);
+    }
+    if (input instanceof URL) {
+        return input;
+    }
+    return new URL(input.url);
+}
+/**
+ * OAuth requests never follow redirects. Endpoint metadata is validated before
+ * credential-bearing requests, and rejecting redirects prevents an HTTPS token
+ * endpoint from forwarding codes, verifiers, or client secrets to plaintext or
+ * a different origin. Loopback HTTP remains available for MCP resource
+ * discovery; OAuth authorization-server endpoints themselves must be HTTPS.
+ */
+export function createSafeMcpOAuthFetch(fetchFn = fetch) {
+    return async (input, init) => {
+        const requestUrl = getOAuthFetchUrl(input);
+        if (requestUrl.protocol !== "https:" &&
+            !(requestUrl.protocol === "http:" && isLoopbackHostname(requestUrl.hostname))) {
+            throw new Error("MCP OAuth network requests must use HTTPS unless the MCP resource is loopback HTTP");
+        }
+        const response = await fetchFn(input, { ...init, redirect: "error" });
+        if (response.redirected || (response.status >= 300 && response.status < 400)) {
+            throw new Error("MCP OAuth network redirects are not allowed");
+        }
+        if (response.url) {
+            const responseUrl = new URL(response.url);
+            if (responseUrl.protocol !== "https:" &&
+                !(responseUrl.protocol === "http:" && isLoopbackHostname(responseUrl.hostname))) {
+                throw new Error("MCP OAuth response URL must use HTTPS unless the MCP resource is loopback HTTP");
+            }
+        }
+        return response;
+    };
+}
+function assertHttpsEndpoint(value, label) {
+    if (!value) {
+        throw new Error(`MCP OAuth ${label} is missing`);
+    }
+    const url = new URL(value);
+    if (url.protocol !== "https:") {
+        throw new Error(`MCP OAuth ${label} must use HTTPS`);
+    }
+    if (url.username || url.password || url.hash) {
+        throw new Error(`MCP OAuth ${label} must not include userinfo or fragments`);
+    }
+}
+function assertOAuthServerUrlAllowed(server) {
+    if (!server.url) {
+        throw new Error(`MCP OAuth server ${server.id} is missing URL`);
+    }
+    const url = new URL(server.url);
+    if (url.protocol === "https:") {
+        return;
+    }
+    if (url.protocol === "http:" && isLoopbackHostname(url.hostname)) {
+        return;
+    }
+    throw new Error(`MCP OAuth server ${server.id} must use HTTPS unless it is loopback HTTP`);
+}
+function getDeviceAuthorizationEndpoint(metadata) {
+    const value = metadata.device_authorization_endpoint;
+    return typeof value === "string" ? value : undefined;
+}
+function validateBrowserServerInfo(serverInfo) {
+    assertHttpsEndpoint(serverInfo.authorizationServerUrl, "authorization server URL");
+    const metadata = serverInfo.authorizationServerMetadata;
+    if (!metadata) {
+        throw new Error("MCP OAuth browser flow requires authorization server metadata");
+    }
+    assertHttpsEndpoint(metadata.authorization_endpoint, "authorization endpoint");
+    assertHttpsEndpoint(metadata.token_endpoint, "token endpoint");
+    if (metadata.registration_endpoint) {
+        assertHttpsEndpoint(metadata.registration_endpoint, "registration endpoint");
+    }
+    if (!metadata.code_challenge_methods_supported?.includes("S256")) {
+        throw new Error("MCP OAuth authorization server must support PKCE S256");
+    }
+}
+function validateDeviceServerInfo(serverInfo) {
+    assertHttpsEndpoint(serverInfo.authorizationServerUrl, "authorization server URL");
+    const metadata = serverInfo.authorizationServerMetadata;
+    if (!metadata) {
+        throw new Error("MCP OAuth device flow requires authorization server metadata");
+    }
+    assertHttpsEndpoint(metadata.token_endpoint, "token endpoint");
+    assertHttpsEndpoint(getDeviceAuthorizationEndpoint(metadata), "device authorization endpoint");
+    if (metadata.registration_endpoint) {
+        assertHttpsEndpoint(metadata.registration_endpoint, "registration endpoint");
+    }
+    const grants = metadata.grant_types_supported;
+    if (grants && !grants.includes(DEVICE_CODE_GRANT)) {
+        throw new Error("MCP OAuth authorization server does not advertise device-code grant support");
+    }
+    return metadata;
+}
+function providerFor(server, store, redirectUrl) {
+    return new VoltMcpOAuthProvider({
+        server,
+        store,
+        redirectUrl,
+        clientName: "Volt",
+        clientVersion: VERSION,
+    });
+}
+async function discoverOAuthForServer(server, fetchFn = fetch) {
+    assertOAuthServerUrlAllowed(server);
+    if (!server.url) {
+        throw new Error(`MCP OAuth server ${server.id} is missing URL`);
+    }
+    const resourceMetadataUrl = server.auth?.resourceMetadataUrl ? new URL(server.auth.resourceMetadataUrl) : undefined;
+    if (resourceMetadataUrl) {
+        assertHttpsEndpoint(resourceMetadataUrl.toString(), "resource metadata URL");
+    }
+    return discoverOAuthServerInfo(server.url, {
+        resourceMetadataUrl,
+        fetchFn,
+    });
+}
+function saveDiscoveryState(server, provider, serverInfo) {
+    provider.saveDiscoveryState({
+        authorizationServerUrl: serverInfo.authorizationServerUrl,
+        resourceMetadata: serverInfo.resourceMetadata,
+        authorizationServerMetadata: serverInfo.authorizationServerMetadata,
+        ...(server.auth?.resourceMetadataUrl ? { resourceMetadataUrl: server.auth.resourceMetadataUrl } : {}),
+    });
+}
+async function ensureClientInformation(_server, provider, authorizationServerUrl, metadata, scope, fetchFn = fetch) {
+    const existing = provider.clientInformation();
+    if (existing) {
+        return existing;
+    }
+    if (metadata?.client_id_metadata_document_supported && provider.clientMetadataUrl) {
+        if (!isHttpsUrl(provider.clientMetadataUrl)) {
+            throw new Error("MCP OAuth client metadata URL must be an HTTPS URL with a path");
+        }
+        const clientInformation = { client_id: provider.clientMetadataUrl };
+        provider.saveClientInformation(clientInformation);
+        return clientInformation;
+    }
+    if (!metadata?.registration_endpoint) {
+        throw new Error("MCP OAuth dynamic client registration is not available; configure auth.clientId");
+    }
+    const registered = await registerClient(authorizationServerUrl, {
+        metadata,
+        clientMetadata: provider.clientMetadata,
+        scope,
+        fetchFn,
+    });
+    provider.saveClientInformation(registered);
+    return registered;
+}
+function addClientAuthentication(params, headers, clientInformation, metadata) {
+    const supported = metadata.token_endpoint_auth_methods_supported ?? [];
+    const method = selectClientAuthMethod(clientInformation, supported);
+    if (method === "client_secret_basic") {
+        if (!clientInformation.client_secret) {
+            params.set("client_id", clientInformation.client_id);
+            return;
+        }
+        const credentials = Buffer.from(`${clientInformation.client_id}:${clientInformation.client_secret}`).toString("base64");
+        headers.set("authorization", `Basic ${credentials}`);
+        return;
+    }
+    params.set("client_id", clientInformation.client_id);
+    if (method === "client_secret_post" && clientInformation.client_secret) {
+        params.set("client_secret", clientInformation.client_secret);
+    }
+}
+function parseDeviceAuthorizationResponse(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error("MCP OAuth device authorization response must be an object");
+    }
+    const record = value;
+    const verificationUri = record.verification_uri ?? record.verification_url;
+    if (typeof record.device_code !== "string" ||
+        typeof record.user_code !== "string" ||
+        typeof verificationUri !== "string" ||
+        typeof record.expires_in !== "number") {
+        throw new Error("MCP OAuth device authorization response is missing required fields");
+    }
+    return {
+        device_code: record.device_code,
+        user_code: record.user_code,
+        verification_uri: verificationUri,
+        verification_url: typeof record.verification_url === "string" ? record.verification_url : undefined,
+        verification_uri_complete: typeof record.verification_uri_complete === "string" ? record.verification_uri_complete : undefined,
+        expires_in: record.expires_in,
+        interval: typeof record.interval === "number" ? record.interval : undefined,
+        message: typeof record.message === "string" ? record.message : undefined,
+    };
+}
+async function parseOAuthTokenResponse(response) {
+    const parsed = (await response.json());
+    return OAuthTokensSchema.parse(parsed);
+}
+async function parseOAuthErrorCode(response) {
+    try {
+        const parsed = (await response.json());
+        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            const error = parsed.error;
+            return typeof error === "string" ? error : `http_${response.status}`;
+        }
+    }
+    catch {
+        // Fall through to status-based error.
+    }
+    return `http_${response.status}`;
+}
+export async function startMcpOAuthBrowserAuth(options) {
+    assertLoopbackRedirectUrl(options.redirectUrl);
+    const fetchFn = createSafeMcpOAuthFetch(options.fetchFn);
+    const provider = providerFor(options.server, options.store, options.redirectUrl);
+    try {
+        const serverInfo = await discoverOAuthForServer(options.server, fetchFn);
+        validateBrowserServerInfo(serverInfo);
+        saveDiscoveryState(options.server, provider, serverInfo);
+        const result = await auth(provider, {
+            serverUrl: options.server.url ?? "",
+            scope: options.server.auth?.scope,
+            resourceMetadataUrl: options.server.auth?.resourceMetadataUrl
+                ? new URL(options.server.auth.resourceMetadataUrl)
+                : undefined,
+            fetchFn,
+        });
+        if (result === "AUTHORIZED") {
+            return {
+                action: "auth",
+                server: options.server.id,
+                flow: "browser",
+                status: "authenticated",
+                redirectUrl: String(options.redirectUrl),
+                message: "MCP server is already authenticated.",
+            };
+        }
+        if (!provider.authorizationUrl) {
+            throw new Error("MCP OAuth authorization URL was not produced");
+        }
+        return {
+            action: "auth",
+            server: options.server.id,
+            flow: "browser",
+            status: "pending",
+            authorizationUrl: provider.authorizationUrl.toString(),
+            redirectUrl: String(options.redirectUrl),
+            state: provider.expectedState,
+            message: "Open the authorization URL and complete the browser flow.",
+        };
+    }
+    catch (error) {
+        throw new Error(redactMcpText(error instanceof Error ? error.message : String(error)));
+    }
+}
+export async function completeMcpOAuthBrowserAuth(options) {
+    assertLoopbackRedirectUrl(options.redirectUrl);
+    const record = options.store.getRecord(options.server);
+    if (typeof record?.state !== "string" || record.state.length === 0 || options.state !== record.state) {
+        throw new Error("MCP OAuth state mismatch");
+    }
+    const fetchFn = createSafeMcpOAuthFetch(options.fetchFn);
+    const provider = providerFor(options.server, options.store, options.redirectUrl);
+    try {
+        await auth(provider, {
+            serverUrl: options.server.url ?? "",
+            authorizationCode: options.code,
+            scope: options.server.auth?.scope,
+            resourceMetadataUrl: options.server.auth?.resourceMetadataUrl
+                ? new URL(options.server.auth.resourceMetadataUrl)
+                : undefined,
+            fetchFn,
+        });
+        options.store.clear(options.server, "verifier");
+        return {
+            action: "auth",
+            server: options.server.id,
+            flow: "browser",
+            status: "authenticated",
+            message: "MCP server authenticated.",
+        };
+    }
+    catch (error) {
+        throw new Error(redactMcpText(error instanceof Error ? error.message : String(error)));
+    }
+}
+export async function startMcpOAuthDeviceAuth(options) {
+    const fetchFn = createSafeMcpOAuthFetch(options.fetchFn);
+    const provider = providerFor(options.server, options.store);
+    try {
+        const serverInfo = await discoverOAuthForServer(options.server, fetchFn);
+        const metadata = validateDeviceServerInfo(serverInfo);
+        saveDiscoveryState(options.server, provider, serverInfo);
+        const resource = options.server.url
+            ? await selectResourceURL(options.server.url, provider, serverInfo.resourceMetadata)
+            : undefined;
+        const scope = options.server.auth?.scope ?? serverInfo.resourceMetadata?.scopes_supported?.join(" ");
+        const clientInformation = await ensureClientInformation(options.server, provider, serverInfo.authorizationServerUrl, metadata, scope, fetchFn);
+        const endpoint = getDeviceAuthorizationEndpoint(metadata);
+        if (!endpoint) {
+            throw new Error("MCP OAuth device authorization endpoint is missing");
+        }
+        assertHttpsEndpoint(endpoint, "device authorization endpoint");
+        const params = new URLSearchParams();
+        const headers = new Headers({ "content-type": "application/x-www-form-urlencoded" });
+        addClientAuthentication(params, headers, clientInformation, metadata);
+        if (scope) {
+            params.set("scope", scope);
+        }
+        if (resource) {
+            params.set("resource", resource.toString());
+        }
+        const response = await fetchFn(endpoint, { method: "POST", headers, body: params });
+        if (!response.ok) {
+            throw new Error(`MCP OAuth device authorization failed: ${await parseOAuthErrorCode(response)}`);
+        }
+        const device = parseDeviceAuthorizationResponse((await response.json()));
+        assertBrowserTargetUrl(device.verification_uri ?? device.verification_url ?? "", "verification URL");
+        if (device.verification_uri_complete) {
+            assertBrowserTargetUrl(device.verification_uri_complete, "complete verification URL");
+        }
+        const intervalMs = Math.max(1, device.interval ?? DEFAULT_DEVICE_INTERVAL_MS / 1000) * 1000;
+        const expiresAtMs = Date.now() + Math.max(1, device.expires_in) * 1000;
+        const pending = {
+            serverId: options.server.id,
+            deviceCode: device.device_code,
+            userCode: device.user_code,
+            verificationUri: device.verification_uri ?? device.verification_url ?? "",
+            ...(device.verification_uri_complete ? { verificationUriComplete: device.verification_uri_complete } : {}),
+            expiresAtMs,
+            intervalMs,
+            nextPollAtMs: Date.now() + intervalMs,
+            authorizationServerUrl: serverInfo.authorizationServerUrl,
+            metadata,
+            clientInformation,
+            resource,
+        };
+        return {
+            pending,
+            result: {
+                action: "auth",
+                server: options.server.id,
+                flow: "device",
+                status: "pending",
+                verificationUri: pending.verificationUri,
+                ...(pending.verificationUriComplete ? { verificationUriComplete: pending.verificationUriComplete } : {}),
+                userCode: pending.userCode,
+                expiresAt: new Date(expiresAtMs).toISOString(),
+                intervalMs,
+                message: device.message ?? "Open the verification URL and enter the user code.",
+            },
+        };
+    }
+    catch (error) {
+        throw new Error(redactMcpText(error instanceof Error ? error.message : String(error)));
+    }
+}
+export async function pollMcpOAuthDeviceAuth(options) {
+    if (Date.now() >= options.pending.expiresAtMs) {
+        return {
+            result: {
+                action: "auth",
+                server: options.server.id,
+                flow: "device",
+                status: "failed",
+                message: "MCP OAuth device code expired.",
+            },
+        };
+    }
+    const waitMs = options.pending.nextPollAtMs - Date.now();
+    if (waitMs > 0) {
+        return {
+            pending: options.pending,
+            result: {
+                action: "auth",
+                server: options.server.id,
+                flow: "device",
+                status: "pending",
+                nextPollMs: waitMs,
+                message: "MCP OAuth device authorization is still pending.",
+            },
+        };
+    }
+    const params = new URLSearchParams({ grant_type: DEVICE_CODE_GRANT, device_code: options.pending.deviceCode });
+    const headers = new Headers({ "content-type": "application/x-www-form-urlencoded" });
+    addClientAuthentication(params, headers, options.pending.clientInformation, options.pending.metadata);
+    if (options.pending.resource) {
+        params.set("resource", options.pending.resource.toString());
+    }
+    assertHttpsEndpoint(options.pending.metadata.token_endpoint, "token endpoint");
+    const fetchFn = createSafeMcpOAuthFetch(options.fetchFn);
+    const response = await fetchFn(options.pending.metadata.token_endpoint, {
+        method: "POST",
+        headers,
+        body: params,
+    });
+    if (response.ok) {
+        const tokens = await parseOAuthTokenResponse(response);
+        options.store.patchRecord(options.server, { tokens });
+        return {
+            result: {
+                action: "auth",
+                server: options.server.id,
+                flow: "device",
+                status: "authenticated",
+                message: "MCP server authenticated.",
+            },
+        };
+    }
+    const error = await parseOAuthErrorCode(response);
+    if (error === "authorization_pending") {
+        const next = { ...options.pending, nextPollAtMs: Date.now() + options.pending.intervalMs };
+        return {
+            pending: next,
+            result: {
+                action: "auth",
+                server: options.server.id,
+                flow: "device",
+                status: "pending",
+                nextPollMs: options.pending.intervalMs,
+                message: "MCP OAuth device authorization is still pending.",
+            },
+        };
+    }
+    if (error === "slow_down") {
+        const intervalMs = options.pending.intervalMs + SLOW_DOWN_INCREMENT_MS;
+        const next = { ...options.pending, intervalMs, nextPollAtMs: Date.now() + intervalMs };
+        return {
+            pending: next,
+            result: {
+                action: "auth",
+                server: options.server.id,
+                flow: "device",
+                status: "pending",
+                nextPollMs: intervalMs,
+                message: "MCP OAuth authorization server asked Volt to slow down polling.",
+            },
+        };
+    }
+    return {
+        result: {
+            action: "auth",
+            server: options.server.id,
+            flow: "device",
+            status: "failed",
+            message: `MCP OAuth device authorization failed: ${redactMcpText(error)}`,
+        },
+    };
+}
+//# sourceMappingURL=oauth-flow.js.map

package/dist/core/mcp/oauth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow.js","sourceRoot":"","sources":["../../../src/core/mcp/oauth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,IAAI,EACJ,uBAAuB,EACvB,UAAU,EAEV,cAAc,EACd,sBAAsB,EACtB,iBAAiB,GACjB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAIN,iBAAiB,GACjB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAqEpC,SAAS,kBAAkB,CAAC,QAAgB,EAAW;IACtD,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAC;AAAA,CAC1G;AAED,SAAS,yBAAyB,CAAC,KAAmB,EAAQ;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;AAAA,CACD;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa,EAAQ;IACnE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,gBAAgB,CAAC,KAAkC,EAAO;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAAA,CAC1B;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAO,GAAiB,KAAK,EAAgB;IACpF,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3C,IACC,UAAU,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAC5E,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1C,IACC,WAAW,CAAC,QAAQ,KAAK,QAAQ;gBACjC,CAAC,CAAC,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAC9E,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QACD,OAAO,QAAQ,CAAC;IAAA,CAChB,CAAC;AAAA,CACF;AAED,SAAS,mBAAmB,CAAC,KAAyB,EAAE,KAAa,EAAQ;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,yCAAyC,CAAC,CAAC;IAC9E,CAAC;AAAA,CACD;AAED,SAAS,2BAA2B,CAAC,MAA+B,EAAQ;IAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;IACR,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,EAAE,4CAA4C,CAAC,CAAC;AAAA,CAC3F;AAED,SAAS,8BAA8B,CAAC,QAAqC,EAAsB;IAClG,MAAM,KAAK,GAAI,QAAwD,CAAC,6BAA6B,CAAC;IACtG,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACrD;AAED,SAAS,yBAAyB,CAAC,UAA2B,EAAQ;IACrE,mBAAmB,CAAC,UAAU,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,UAAU,CAAC,2BAA2B,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,mBAAmB,CAAC,QAAQ,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;IAC/E,mBAAmB,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACpC,mBAAmB,CAAC,QAAQ,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;AAAA,CACD;AAED,SAAS,wBAAwB,CAAC,UAA2B,EAA+B;IAC3F,mBAAmB,CAAC,UAAU,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,UAAU,CAAC,2BAA2B,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACjF,CAAC;IACD,mBAAmB,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC/D,mBAAmB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,+BAA+B,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACpC,mBAAmB,CAAC,QAAQ,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAC9C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,WAAW,CACnB,MAA+B,EAC/B,KAAoB,EACpB,WAA0B,EACH;IACvB,OAAO,IAAI,oBAAoB,CAAC;QAC/B,MAAM;QACN,KAAK;QACL,WAAW;QACX,UAAU,EAAE,MAAM;QAClB,aAAa,EAAE,OAAO;KACtB,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,sBAAsB,CACpC,MAA+B,EAC/B,OAAO,GAAiB,KAAK,EACF;IAC3B,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,IAAI,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,uBAAuB,CAAC,MAAM,CAAC,GAAG,EAAE;QAC1C,mBAAmB;QACnB,OAAO;KACP,CAAC,CAAC;AAAA,CACH;AAED,SAAS,kBAAkB,CAC1B,MAA+B,EAC/B,QAA8B,EAC9B,UAA2B,EACpB;IACP,QAAQ,CAAC,kBAAkB,CAAC;QAC3B,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,2BAA2B,EAAE,UAAU,CAAC,2BAA2B;QACnE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,uBAAuB,CACrC,OAAgC,EAChC,QAA8B,EAC9B,sBAA8B,EAC9B,QAAiD,EACjD,KAAyB,EACzB,OAAO,GAAiB,KAAK,EACU;IACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,EAAE,qCAAqC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,iBAAiB,GAAgC,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACjG,QAAQ,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,sBAAsB,EAAE;QAC/D,QAAQ;QACR,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,KAAK;QACL,OAAO;KACP,CAAC,CAAC;IACH,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,uBAAuB,CAC/B,MAAuB,EACvB,OAAgB,EAChB,iBAA8C,EAC9C,QAAqC,EAC9B;IACP,MAAM,SAAS,GAAG,QAAQ,CAAC,qCAAqC,IAAI,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO;QACR,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAC5G,QAAQ,CACR,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO;IACR,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,oBAAoB,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC9D,CAAC;AAAA,CACD;AAED,SAAS,gCAAgC,CAAC,KAAc,EAA+B;IACtF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC3E,IACC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,eAAe,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,eAAe;QACjC,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACnG,yBAAyB,EACxB,OAAO,MAAM,CAAC,yBAAyB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS;QACpG,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC3E,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AAAA,CACF;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB,EAAwB;IAChF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IAClD,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAAA,CACvC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAmB;IACvE,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;YACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,sCAAsC;IACvC,CAAC;IACD,OAAO,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;AAAA,CACjC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAK9C,EAAuC;IACvC,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACtC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACnC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE;YACnC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK;YACjC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB;gBAC5D,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAClD,CAAC,CAAC,SAAS;YACZ,OAAO;SACP,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC7B,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,eAAe;gBACvB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;gBACxC,OAAO,EAAE,sCAAsC;aAC/C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;YACN,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE;YACtD,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YACxC,KAAK,EAAE,QAAQ,CAAC,aAAa;YAC7B,OAAO,EAAE,2DAA2D;SACpE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAOjD,EAA0C;IAC1C,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,IAAI,CAAC;QACJ,MAAM,IAAI,CAAC,QAAQ,EAAE;YACpB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE;YACnC,iBAAiB,EAAE,OAAO,CAAC,IAAI;YAC/B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK;YACjC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB;gBAC5D,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAClD,CAAC,CAAC,SAAS;YACZ,OAAO;SACP,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChD,OAAO;YACN,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,2BAA2B;SACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAI7C,EAAsF;IACtF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACtD,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG;YAClC,CAAC,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,gBAAgB,CAAC;YACpF,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,iBAAiB,GAAG,MAAM,uBAAuB,CACtD,OAAO,CAAC,MAAM,EACd,QAAQ,EACR,UAAU,CAAC,sBAAsB,EACjC,QAAQ,EACR,KAAK,EACL,OAAO,CACP,CAAC;QACF,MAAM,QAAQ,GAAG,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACvE,CAAC;QACD,mBAAmB,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACrF,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC,CAAC;QACpF,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACrG,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,sBAAsB,CAAC,MAAM,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,IAAI,0BAA0B,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QAC5F,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACvE,MAAM,OAAO,GAA8B;YAC1C,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YAC3B,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,IAAI,EAAE;YACzE,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,WAAW;YACX,UAAU;YACV,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU;YACrC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;YACzD,QAAQ;YACR,iBAAiB;YACjB,QAAQ;SACR,CAAC;QACF,OAAO;YACN,OAAO;YACP,MAAM,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxG,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;gBAC9C,UAAU;gBACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,oDAAoD;aAC/E;SACD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C,EAAsF;IACtF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO;YACN,MAAM,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gCAAgC;aACzC;SACD,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,kDAAkD;aAC3D;SACD,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAC;IACrF,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,MAAM;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO;YACN,MAAM,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,2BAA2B;aACpC;SACD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3F,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;gBACtC,OAAO,EAAE,kDAAkD;aAC3D;SACD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,GAAG,sBAAsB,CAAC;QACvE,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QACvF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,iEAAiE;aAC1E;SACD,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YACzB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,0CAA0C,aAAa,CAAC,KAAK,CAAC,EAAE;SACzE;KACD,CAAC;AAAA,CACF","sourcesContent":["import {\n\tauth,\n\tdiscoverOAuthServerInfo,\n\tisHttpsUrl,\n\ttype OAuthServerInfo,\n\tregisterClient,\n\tselectClientAuthMethod,\n\tselectResourceURL,\n} from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport {\n\ttype AuthorizationServerMetadata,\n\ttype OAuthClientInformationMixed,\n\ttype OAuthTokens,\n\tOAuthTokensSchema,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { VERSION } from \"../../config.ts\";\nimport { VoltMcpOAuthProvider } from \"./oauth-provider.ts\";\nimport type { McpOAuthStore } from \"./oauth-store.ts\";\nimport { redactMcpText } from \"./safety.ts\";\nimport type { McpResolvedServerConfig } from \"./types.ts\";\n\nconst DEVICE_CODE_GRANT = \"urn:ietf:params:oauth:grant-type:device_code\";\nconst DEFAULT_DEVICE_INTERVAL_MS = 5000;\nconst SLOW_DOWN_INCREMENT_MS = 5000;\n\nexport interface McpOAuthBrowserStartResult {\n\taction: \"auth\";\n\tserver: string;\n\tflow: \"browser\";\n\tstatus: \"pending\" | \"authenticated\";\n\tauthorizationUrl?: string;\n\tredirectUrl: string;\n\tstate?: string;\n\tmessage: string;\n}\n\nexport interface McpOAuthBrowserCompleteResult {\n\taction: \"auth\";\n\tserver: string;\n\tflow: \"browser\";\n\tstatus: \"authenticated\";\n\tmessage: string;\n}\n\nexport interface McpOAuthDeviceStartResult {\n\taction: \"auth\";\n\tserver: string;\n\tflow: \"device\";\n\tstatus: \"pending\";\n\tverificationUri: string;\n\tverificationUriComplete?: string;\n\tuserCode: string;\n\texpiresAt: string;\n\tintervalMs: number;\n\tmessage: string;\n}\n\nexport interface McpOAuthDevicePollResult {\n\taction: \"auth\";\n\tserver: string;\n\tflow: \"device\";\n\tstatus: \"pending\" | \"authenticated\" | \"failed\";\n\tnextPollMs?: number;\n\tmessage: string;\n}\n\nexport interface McpOAuthPendingDeviceFlow {\n\tserverId: string;\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tverificationUriComplete?: string;\n\texpiresAtMs: number;\n\tintervalMs: number;\n\tnextPollAtMs: number;\n\tauthorizationServerUrl: string;\n\tmetadata: AuthorizationServerMetadata;\n\tclientInformation: OAuthClientInformationMixed;\n\tresource?: URL;\n}\n\ninterface DeviceAuthorizationResponse {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri?: string;\n\tverification_url?: string;\n\tverification_uri_complete?: string;\n\texpires_in: number;\n\tinterval?: number;\n\tmessage?: string;\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n\treturn hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\" || hostname === \"[::1]\";\n}\n\nfunction assertLoopbackRedirectUrl(value: string | URL): void {\n\tconst url = new URL(String(value));\n\tif (url.protocol !== \"http:\" || !isLoopbackHostname(url.hostname) || url.hostname === \"localhost\") {\n\t\tthrow new Error(\"MCP OAuth redirect URL must use HTTP on a numeric loopback address\");\n\t}\n\tif (url.username || url.password || url.hash) {\n\t\tthrow new Error(\"MCP OAuth redirect URL must not include userinfo or fragments\");\n\t}\n}\n\nfunction assertBrowserTargetUrl(value: string, label: string): void {\n\tassertHttpsEndpoint(value, label);\n}\n\nfunction getOAuthFetchUrl(input: Parameters<typeof fetch>[0]): URL {\n\tif (typeof input === \"string\") {\n\t\treturn new URL(input);\n\t}\n\tif (input instanceof URL) {\n\t\treturn input;\n\t}\n\treturn new URL(input.url);\n}\n\n/**\n * OAuth requests never follow redirects. Endpoint metadata is validated before\n * credential-bearing requests, and rejecting redirects prevents an HTTPS token\n * endpoint from forwarding codes, verifiers, or client secrets to plaintext or\n * a different origin. Loopback HTTP remains available for MCP resource\n * discovery; OAuth authorization-server endpoints themselves must be HTTPS.\n */\nexport function createSafeMcpOAuthFetch(fetchFn: typeof fetch = fetch): typeof fetch {\n\treturn async (input, init) => {\n\t\tconst requestUrl = getOAuthFetchUrl(input);\n\t\tif (\n\t\t\trequestUrl.protocol !== \"https:\" &&\n\t\t\t!(requestUrl.protocol === \"http:\" && isLoopbackHostname(requestUrl.hostname))\n\t\t) {\n\t\t\tthrow new Error(\"MCP OAuth network requests must use HTTPS unless the MCP resource is loopback HTTP\");\n\t\t}\n\t\tconst response = await fetchFn(input, { ...init, redirect: \"error\" });\n\t\tif (response.redirected || (response.status >= 300 && response.status < 400)) {\n\t\t\tthrow new Error(\"MCP OAuth network redirects are not allowed\");\n\t\t}\n\t\tif (response.url) {\n\t\t\tconst responseUrl = new URL(response.url);\n\t\t\tif (\n\t\t\t\tresponseUrl.protocol !== \"https:\" &&\n\t\t\t\t!(responseUrl.protocol === \"http:\" && isLoopbackHostname(responseUrl.hostname))\n\t\t\t) {\n\t\t\t\tthrow new Error(\"MCP OAuth response URL must use HTTPS unless the MCP resource is loopback HTTP\");\n\t\t\t}\n\t\t}\n\t\treturn response;\n\t};\n}\n\nfunction assertHttpsEndpoint(value: string | undefined, label: string): void {\n\tif (!value) {\n\t\tthrow new Error(`MCP OAuth ${label} is missing`);\n\t}\n\tconst url = new URL(value);\n\tif (url.protocol !== \"https:\") {\n\t\tthrow new Error(`MCP OAuth ${label} must use HTTPS`);\n\t}\n\tif (url.username || url.password || url.hash) {\n\t\tthrow new Error(`MCP OAuth ${label} must not include userinfo or fragments`);\n\t}\n}\n\nfunction assertOAuthServerUrlAllowed(server: McpResolvedServerConfig): void {\n\tif (!server.url) {\n\t\tthrow new Error(`MCP OAuth server ${server.id} is missing URL`);\n\t}\n\tconst url = new URL(server.url);\n\tif (url.protocol === \"https:\") {\n\t\treturn;\n\t}\n\tif (url.protocol === \"http:\" && isLoopbackHostname(url.hostname)) {\n\t\treturn;\n\t}\n\tthrow new Error(`MCP OAuth server ${server.id} must use HTTPS unless it is loopback HTTP`);\n}\n\nfunction getDeviceAuthorizationEndpoint(metadata: AuthorizationServerMetadata): string | undefined {\n\tconst value = (metadata as { device_authorization_endpoint?: unknown }).device_authorization_endpoint;\n\treturn typeof value === \"string\" ? value : undefined;\n}\n\nfunction validateBrowserServerInfo(serverInfo: OAuthServerInfo): void {\n\tassertHttpsEndpoint(serverInfo.authorizationServerUrl, \"authorization server URL\");\n\tconst metadata = serverInfo.authorizationServerMetadata;\n\tif (!metadata) {\n\t\tthrow new Error(\"MCP OAuth browser flow requires authorization server metadata\");\n\t}\n\tassertHttpsEndpoint(metadata.authorization_endpoint, \"authorization endpoint\");\n\tassertHttpsEndpoint(metadata.token_endpoint, \"token endpoint\");\n\tif (metadata.registration_endpoint) {\n\t\tassertHttpsEndpoint(metadata.registration_endpoint, \"registration endpoint\");\n\t}\n\tif (!metadata.code_challenge_methods_supported?.includes(\"S256\")) {\n\t\tthrow new Error(\"MCP OAuth authorization server must support PKCE S256\");\n\t}\n}\n\nfunction validateDeviceServerInfo(serverInfo: OAuthServerInfo): AuthorizationServerMetadata {\n\tassertHttpsEndpoint(serverInfo.authorizationServerUrl, \"authorization server URL\");\n\tconst metadata = serverInfo.authorizationServerMetadata;\n\tif (!metadata) {\n\t\tthrow new Error(\"MCP OAuth device flow requires authorization server metadata\");\n\t}\n\tassertHttpsEndpoint(metadata.token_endpoint, \"token endpoint\");\n\tassertHttpsEndpoint(getDeviceAuthorizationEndpoint(metadata), \"device authorization endpoint\");\n\tif (metadata.registration_endpoint) {\n\t\tassertHttpsEndpoint(metadata.registration_endpoint, \"registration endpoint\");\n\t}\n\tconst grants = metadata.grant_types_supported;\n\tif (grants && !grants.includes(DEVICE_CODE_GRANT)) {\n\t\tthrow new Error(\"MCP OAuth authorization server does not advertise device-code grant support\");\n\t}\n\treturn metadata;\n}\n\nfunction providerFor(\n\tserver: McpResolvedServerConfig,\n\tstore: McpOAuthStore,\n\tredirectUrl?: string | URL,\n): VoltMcpOAuthProvider {\n\treturn new VoltMcpOAuthProvider({\n\t\tserver,\n\t\tstore,\n\t\tredirectUrl,\n\t\tclientName: \"Volt\",\n\t\tclientVersion: VERSION,\n\t});\n}\n\nasync function discoverOAuthForServer(\n\tserver: McpResolvedServerConfig,\n\tfetchFn: typeof fetch = fetch,\n): Promise<OAuthServerInfo> {\n\tassertOAuthServerUrlAllowed(server);\n\tif (!server.url) {\n\t\tthrow new Error(`MCP OAuth server ${server.id} is missing URL`);\n\t}\n\tconst resourceMetadataUrl = server.auth?.resourceMetadataUrl ? new URL(server.auth.resourceMetadataUrl) : undefined;\n\tif (resourceMetadataUrl) {\n\t\tassertHttpsEndpoint(resourceMetadataUrl.toString(), \"resource metadata URL\");\n\t}\n\treturn discoverOAuthServerInfo(server.url, {\n\t\tresourceMetadataUrl,\n\t\tfetchFn,\n\t});\n}\n\nfunction saveDiscoveryState(\n\tserver: McpResolvedServerConfig,\n\tprovider: VoltMcpOAuthProvider,\n\tserverInfo: OAuthServerInfo,\n): void {\n\tprovider.saveDiscoveryState({\n\t\tauthorizationServerUrl: serverInfo.authorizationServerUrl,\n\t\tresourceMetadata: serverInfo.resourceMetadata,\n\t\tauthorizationServerMetadata: serverInfo.authorizationServerMetadata,\n\t\t...(server.auth?.resourceMetadataUrl ? { resourceMetadataUrl: server.auth.resourceMetadataUrl } : {}),\n\t});\n}\n\nasync function ensureClientInformation(\n\t_server: McpResolvedServerConfig,\n\tprovider: VoltMcpOAuthProvider,\n\tauthorizationServerUrl: string,\n\tmetadata: AuthorizationServerMetadata | undefined,\n\tscope: string | undefined,\n\tfetchFn: typeof fetch = fetch,\n): Promise<OAuthClientInformationMixed> {\n\tconst existing = provider.clientInformation();\n\tif (existing) {\n\t\treturn existing;\n\t}\n\tif (metadata?.client_id_metadata_document_supported && provider.clientMetadataUrl) {\n\t\tif (!isHttpsUrl(provider.clientMetadataUrl)) {\n\t\t\tthrow new Error(\"MCP OAuth client metadata URL must be an HTTPS URL with a path\");\n\t\t}\n\t\tconst clientInformation: OAuthClientInformationMixed = { client_id: provider.clientMetadataUrl };\n\t\tprovider.saveClientInformation(clientInformation);\n\t\treturn clientInformation;\n\t}\n\tif (!metadata?.registration_endpoint) {\n\t\tthrow new Error(\"MCP OAuth dynamic client registration is not available; configure auth.clientId\");\n\t}\n\tconst registered = await registerClient(authorizationServerUrl, {\n\t\tmetadata,\n\t\tclientMetadata: provider.clientMetadata,\n\t\tscope,\n\t\tfetchFn,\n\t});\n\tprovider.saveClientInformation(registered);\n\treturn registered;\n}\n\nfunction addClientAuthentication(\n\tparams: URLSearchParams,\n\theaders: Headers,\n\tclientInformation: OAuthClientInformationMixed,\n\tmetadata: AuthorizationServerMetadata,\n): void {\n\tconst supported = metadata.token_endpoint_auth_methods_supported ?? [];\n\tconst method = selectClientAuthMethod(clientInformation, supported);\n\tif (method === \"client_secret_basic\") {\n\t\tif (!clientInformation.client_secret) {\n\t\t\tparams.set(\"client_id\", clientInformation.client_id);\n\t\t\treturn;\n\t\t}\n\t\tconst credentials = Buffer.from(`${clientInformation.client_id}:${clientInformation.client_secret}`).toString(\n\t\t\t\"base64\",\n\t\t);\n\t\theaders.set(\"authorization\", `Basic ${credentials}`);\n\t\treturn;\n\t}\n\tparams.set(\"client_id\", clientInformation.client_id);\n\tif (method === \"client_secret_post\" && clientInformation.client_secret) {\n\t\tparams.set(\"client_secret\", clientInformation.client_secret);\n\t}\n}\n\nfunction parseDeviceAuthorizationResponse(value: unknown): DeviceAuthorizationResponse {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(\"MCP OAuth device authorization response must be an object\");\n\t}\n\tconst record = value as Record<string, unknown>;\n\tconst verificationUri = record.verification_uri ?? record.verification_url;\n\tif (\n\t\ttypeof record.device_code !== \"string\" ||\n\t\ttypeof record.user_code !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\ttypeof record.expires_in !== \"number\"\n\t) {\n\t\tthrow new Error(\"MCP OAuth device authorization response is missing required fields\");\n\t}\n\treturn {\n\t\tdevice_code: record.device_code,\n\t\tuser_code: record.user_code,\n\t\tverification_uri: verificationUri,\n\t\tverification_url: typeof record.verification_url === \"string\" ? record.verification_url : undefined,\n\t\tverification_uri_complete:\n\t\t\ttypeof record.verification_uri_complete === \"string\" ? record.verification_uri_complete : undefined,\n\t\texpires_in: record.expires_in,\n\t\tinterval: typeof record.interval === \"number\" ? record.interval : undefined,\n\t\tmessage: typeof record.message === \"string\" ? record.message : undefined,\n\t};\n}\n\nasync function parseOAuthTokenResponse(response: Response): Promise<OAuthTokens> {\n\tconst parsed = (await response.json()) as unknown;\n\treturn OAuthTokensSchema.parse(parsed);\n}\n\nasync function parseOAuthErrorCode(response: Response): Promise<string> {\n\ttry {\n\t\tconst parsed = (await response.json()) as unknown;\n\t\tif (typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed)) {\n\t\t\tconst error = (parsed as { error?: unknown }).error;\n\t\t\treturn typeof error === \"string\" ? error : `http_${response.status}`;\n\t\t}\n\t} catch {\n\t\t// Fall through to status-based error.\n\t}\n\treturn `http_${response.status}`;\n}\n\nexport async function startMcpOAuthBrowserAuth(options: {\n\tserver: McpResolvedServerConfig;\n\tstore: McpOAuthStore;\n\tredirectUrl: string | URL;\n\tfetchFn?: typeof fetch;\n}): Promise<McpOAuthBrowserStartResult> {\n\tassertLoopbackRedirectUrl(options.redirectUrl);\n\tconst fetchFn = createSafeMcpOAuthFetch(options.fetchFn);\n\tconst provider = providerFor(options.server, options.store, options.redirectUrl);\n\ttry {\n\t\tconst serverInfo = await discoverOAuthForServer(options.server, fetchFn);\n\t\tvalidateBrowserServerInfo(serverInfo);\n\t\tsaveDiscoveryState(options.server, provider, serverInfo);\n\t\tconst result = await auth(provider, {\n\t\t\tserverUrl: options.server.url ?? \"\",\n\t\t\tscope: options.server.auth?.scope,\n\t\t\tresourceMetadataUrl: options.server.auth?.resourceMetadataUrl\n\t\t\t\t? new URL(options.server.auth.resourceMetadataUrl)\n\t\t\t\t: undefined,\n\t\t\tfetchFn,\n\t\t});\n\t\tif (result === \"AUTHORIZED\") {\n\t\t\treturn {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"browser\",\n\t\t\t\tstatus: \"authenticated\",\n\t\t\t\tredirectUrl: String(options.redirectUrl),\n\t\t\t\tmessage: \"MCP server is already authenticated.\",\n\t\t\t};\n\t\t}\n\t\tif (!provider.authorizationUrl) {\n\t\t\tthrow new Error(\"MCP OAuth authorization URL was not produced\");\n\t\t}\n\t\treturn {\n\t\t\taction: \"auth\",\n\t\t\tserver: options.server.id,\n\t\t\tflow: \"browser\",\n\t\t\tstatus: \"pending\",\n\t\t\tauthorizationUrl: provider.authorizationUrl.toString(),\n\t\t\tredirectUrl: String(options.redirectUrl),\n\t\t\tstate: provider.expectedState,\n\t\t\tmessage: \"Open the authorization URL and complete the browser flow.\",\n\t\t};\n\t} catch (error) {\n\t\tthrow new Error(redactMcpText(error instanceof Error ? error.message : String(error)));\n\t}\n}\n\nexport async function completeMcpOAuthBrowserAuth(options: {\n\tserver: McpResolvedServerConfig;\n\tstore: McpOAuthStore;\n\tredirectUrl: string | URL;\n\tcode: string;\n\tstate?: string;\n\tfetchFn?: typeof fetch;\n}): Promise<McpOAuthBrowserCompleteResult> {\n\tassertLoopbackRedirectUrl(options.redirectUrl);\n\tconst record = options.store.getRecord(options.server);\n\tif (typeof record?.state !== \"string\" || record.state.length === 0 || options.state !== record.state) {\n\t\tthrow new Error(\"MCP OAuth state mismatch\");\n\t}\n\tconst fetchFn = createSafeMcpOAuthFetch(options.fetchFn);\n\tconst provider = providerFor(options.server, options.store, options.redirectUrl);\n\ttry {\n\t\tawait auth(provider, {\n\t\t\tserverUrl: options.server.url ?? \"\",\n\t\t\tauthorizationCode: options.code,\n\t\t\tscope: options.server.auth?.scope,\n\t\t\tresourceMetadataUrl: options.server.auth?.resourceMetadataUrl\n\t\t\t\t? new URL(options.server.auth.resourceMetadataUrl)\n\t\t\t\t: undefined,\n\t\t\tfetchFn,\n\t\t});\n\t\toptions.store.clear(options.server, \"verifier\");\n\t\treturn {\n\t\t\taction: \"auth\",\n\t\t\tserver: options.server.id,\n\t\t\tflow: \"browser\",\n\t\t\tstatus: \"authenticated\",\n\t\t\tmessage: \"MCP server authenticated.\",\n\t\t};\n\t} catch (error) {\n\t\tthrow new Error(redactMcpText(error instanceof Error ? error.message : String(error)));\n\t}\n}\n\nexport async function startMcpOAuthDeviceAuth(options: {\n\tserver: McpResolvedServerConfig;\n\tstore: McpOAuthStore;\n\tfetchFn?: typeof fetch;\n}): Promise<{ result: McpOAuthDeviceStartResult; pending: McpOAuthPendingDeviceFlow }> {\n\tconst fetchFn = createSafeMcpOAuthFetch(options.fetchFn);\n\tconst provider = providerFor(options.server, options.store);\n\ttry {\n\t\tconst serverInfo = await discoverOAuthForServer(options.server, fetchFn);\n\t\tconst metadata = validateDeviceServerInfo(serverInfo);\n\t\tsaveDiscoveryState(options.server, provider, serverInfo);\n\t\tconst resource = options.server.url\n\t\t\t? await selectResourceURL(options.server.url, provider, serverInfo.resourceMetadata)\n\t\t\t: undefined;\n\t\tconst scope = options.server.auth?.scope ?? serverInfo.resourceMetadata?.scopes_supported?.join(\" \");\n\t\tconst clientInformation = await ensureClientInformation(\n\t\t\toptions.server,\n\t\t\tprovider,\n\t\t\tserverInfo.authorizationServerUrl,\n\t\t\tmetadata,\n\t\t\tscope,\n\t\t\tfetchFn,\n\t\t);\n\t\tconst endpoint = getDeviceAuthorizationEndpoint(metadata);\n\t\tif (!endpoint) {\n\t\t\tthrow new Error(\"MCP OAuth device authorization endpoint is missing\");\n\t\t}\n\t\tassertHttpsEndpoint(endpoint, \"device authorization endpoint\");\n\t\tconst params = new URLSearchParams();\n\t\tconst headers = new Headers({ \"content-type\": \"application/x-www-form-urlencoded\" });\n\t\taddClientAuthentication(params, headers, clientInformation, metadata);\n\t\tif (scope) {\n\t\t\tparams.set(\"scope\", scope);\n\t\t}\n\t\tif (resource) {\n\t\t\tparams.set(\"resource\", resource.toString());\n\t\t}\n\t\tconst response = await fetchFn(endpoint, { method: \"POST\", headers, body: params });\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`MCP OAuth device authorization failed: ${await parseOAuthErrorCode(response)}`);\n\t\t}\n\t\tconst device = parseDeviceAuthorizationResponse((await response.json()) as unknown);\n\t\tassertBrowserTargetUrl(device.verification_uri ?? device.verification_url ?? \"\", \"verification URL\");\n\t\tif (device.verification_uri_complete) {\n\t\t\tassertBrowserTargetUrl(device.verification_uri_complete, \"complete verification URL\");\n\t\t}\n\t\tconst intervalMs = Math.max(1, device.interval ?? DEFAULT_DEVICE_INTERVAL_MS / 1000) * 1000;\n\t\tconst expiresAtMs = Date.now() + Math.max(1, device.expires_in) * 1000;\n\t\tconst pending: McpOAuthPendingDeviceFlow = {\n\t\t\tserverId: options.server.id,\n\t\t\tdeviceCode: device.device_code,\n\t\t\tuserCode: device.user_code,\n\t\t\tverificationUri: device.verification_uri ?? device.verification_url ?? \"\",\n\t\t\t...(device.verification_uri_complete ? { verificationUriComplete: device.verification_uri_complete } : {}),\n\t\t\texpiresAtMs,\n\t\t\tintervalMs,\n\t\t\tnextPollAtMs: Date.now() + intervalMs,\n\t\t\tauthorizationServerUrl: serverInfo.authorizationServerUrl,\n\t\t\tmetadata,\n\t\t\tclientInformation,\n\t\t\tresource,\n\t\t};\n\t\treturn {\n\t\t\tpending,\n\t\t\tresult: {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"device\",\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tverificationUri: pending.verificationUri,\n\t\t\t\t...(pending.verificationUriComplete ? { verificationUriComplete: pending.verificationUriComplete } : {}),\n\t\t\t\tuserCode: pending.userCode,\n\t\t\t\texpiresAt: new Date(expiresAtMs).toISOString(),\n\t\t\t\tintervalMs,\n\t\t\t\tmessage: device.message ?? \"Open the verification URL and enter the user code.\",\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tthrow new Error(redactMcpText(error instanceof Error ? error.message : String(error)));\n\t}\n}\n\nexport async function pollMcpOAuthDeviceAuth(options: {\n\tserver: McpResolvedServerConfig;\n\tstore: McpOAuthStore;\n\tpending: McpOAuthPendingDeviceFlow;\n\tfetchFn?: typeof fetch;\n}): Promise<{ result: McpOAuthDevicePollResult; pending?: McpOAuthPendingDeviceFlow }> {\n\tif (Date.now() >= options.pending.expiresAtMs) {\n\t\treturn {\n\t\t\tresult: {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"device\",\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tmessage: \"MCP OAuth device code expired.\",\n\t\t\t},\n\t\t};\n\t}\n\tconst waitMs = options.pending.nextPollAtMs - Date.now();\n\tif (waitMs > 0) {\n\t\treturn {\n\t\t\tpending: options.pending,\n\t\t\tresult: {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"device\",\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tnextPollMs: waitMs,\n\t\t\t\tmessage: \"MCP OAuth device authorization is still pending.\",\n\t\t\t},\n\t\t};\n\t}\n\tconst params = new URLSearchParams({ grant_type: DEVICE_CODE_GRANT, device_code: options.pending.deviceCode });\n\tconst headers = new Headers({ \"content-type\": \"application/x-www-form-urlencoded\" });\n\taddClientAuthentication(params, headers, options.pending.clientInformation, options.pending.metadata);\n\tif (options.pending.resource) {\n\t\tparams.set(\"resource\", options.pending.resource.toString());\n\t}\n\tassertHttpsEndpoint(options.pending.metadata.token_endpoint, \"token endpoint\");\n\tconst fetchFn = createSafeMcpOAuthFetch(options.fetchFn);\n\tconst response = await fetchFn(options.pending.metadata.token_endpoint, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: params,\n\t});\n\tif (response.ok) {\n\t\tconst tokens = await parseOAuthTokenResponse(response);\n\t\toptions.store.patchRecord(options.server, { tokens });\n\t\treturn {\n\t\t\tresult: {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"device\",\n\t\t\t\tstatus: \"authenticated\",\n\t\t\t\tmessage: \"MCP server authenticated.\",\n\t\t\t},\n\t\t};\n\t}\n\tconst error = await parseOAuthErrorCode(response);\n\tif (error === \"authorization_pending\") {\n\t\tconst next = { ...options.pending, nextPollAtMs: Date.now() + options.pending.intervalMs };\n\t\treturn {\n\t\t\tpending: next,\n\t\t\tresult: {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"device\",\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tnextPollMs: options.pending.intervalMs,\n\t\t\t\tmessage: \"MCP OAuth device authorization is still pending.\",\n\t\t\t},\n\t\t};\n\t}\n\tif (error === \"slow_down\") {\n\t\tconst intervalMs = options.pending.intervalMs + SLOW_DOWN_INCREMENT_MS;\n\t\tconst next = { ...options.pending, intervalMs, nextPollAtMs: Date.now() + intervalMs };\n\t\treturn {\n\t\t\tpending: next,\n\t\t\tresult: {\n\t\t\t\taction: \"auth\",\n\t\t\t\tserver: options.server.id,\n\t\t\t\tflow: \"device\",\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tnextPollMs: intervalMs,\n\t\t\t\tmessage: \"MCP OAuth authorization server asked Volt to slow down polling.\",\n\t\t\t},\n\t\t};\n\t}\n\treturn {\n\t\tresult: {\n\t\t\taction: \"auth\",\n\t\t\tserver: options.server.id,\n\t\t\tflow: \"device\",\n\t\t\tstatus: \"failed\",\n\t\t\tmessage: `MCP OAuth device authorization failed: ${redactMcpText(error)}`,\n\t\t},\n\t};\n}\n"]}

package/dist/core/mcp/oauth-provider.d.ts

@@ -0,0 +1,39 @@
+import type { OAuthClientProvider, OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { McpOAuthStore } from "./oauth-store.ts";
+import type { McpResolvedServerConfig } from "./types.ts";
+export interface VoltMcpOAuthProviderOptions {
+    server: McpResolvedServerConfig;
+    store: McpOAuthStore;
+    redirectUrl?: string | URL;
+    clientName?: string;
+    clientVersion?: string;
+    onAuthorizationUrl?: (url: URL) => void | Promise<void>;
+}
+export declare class VoltMcpOAuthProvider implements OAuthClientProvider {
+    private server;
+    private store;
+    private redirectUrlValue;
+    private metadata;
+    private authorizationUrlValue;
+    private stateValue;
+    private onAuthorizationUrl;
+    constructor(options: VoltMcpOAuthProviderOptions);
+    get redirectUrl(): string | URL | undefined;
+    get clientMetadataUrl(): string | undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    get authorizationUrl(): URL | undefined;
+    get expectedState(): string;
+    state(): Promise<string>;
+    clientInformation(): OAuthClientInformationMixed | undefined;
+    saveClientInformation(clientInformation: OAuthClientInformationMixed): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): void;
+    saveDiscoveryState(state: OAuthDiscoveryState): void;
+    discoveryState(): OAuthDiscoveryState | undefined;
+}
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/core/mcp/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACzG,OAAO,KAAK,EAEX,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,2BAA2B;IAC3C,MAAM,EAAE,uBAAuB,CAAC;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AA2ED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC/D,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,qBAAqB,CAAkB;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,kBAAkB,CAAmD;IAE7E,YAAY,OAAO,EAAE,2BAA2B,EAO/C;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,GAAG,SAAS,CAE1C;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,gBAAgB,IAAI,GAAG,GAAG,SAAS,CAEtC;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAEK,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAG7B;IAED,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAI3D;IAED,qBAAqB,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI,CAK1E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAED,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAEpC;IAEK,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;IAED,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE3C;IAED,YAAY,IAAI,MAAM,CAMrB;IAED,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAEzF;IAED,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAGnD;IAED,cAAc,IAAI,mBAAmB,GAAG,SAAS,CAMhD;CACD","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport type { OAuthClientProvider, OAuthDiscoveryState } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type {\n\tAuthorizationServerMetadata,\n\tOAuthClientInformationMixed,\n\tOAuthClientMetadata,\n\tOAuthTokens,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { VERSION } from \"../../config.ts\";\nimport type { McpOAuthStore } from \"./oauth-store.ts\";\nimport type { McpResolvedServerConfig } from \"./types.ts\";\n\nexport interface VoltMcpOAuthProviderOptions {\n\tserver: McpResolvedServerConfig;\n\tstore: McpOAuthStore;\n\tredirectUrl?: string | URL;\n\tclientName?: string;\n\tclientVersion?: string;\n\tonAuthorizationUrl?: (url: URL) => void | Promise<void>;\n}\n\nfunction randomState(): string {\n\treturn randomBytes(24).toString(\"base64url\");\n}\n\nfunction assertHttpsEndpoint(value: string | undefined, label: string): void {\n\tif (!value) {\n\t\tthrow new Error(`MCP OAuth ${label} is missing`);\n\t}\n\tconst url = new URL(value);\n\tif (url.protocol !== \"https:\") {\n\t\tthrow new Error(`MCP OAuth ${label} must use HTTPS`);\n\t}\n\tif (url.username || url.password || url.hash) {\n\t\tthrow new Error(`MCP OAuth ${label} must not include userinfo or fragments`);\n\t}\n}\n\nfunction getDeviceAuthorizationEndpoint(metadata: AuthorizationServerMetadata): string | undefined {\n\tconst value = (metadata as { device_authorization_endpoint?: unknown }).device_authorization_endpoint;\n\treturn typeof value === \"string\" ? value : undefined;\n}\n\nfunction assertSafeDiscoveryState(state: OAuthDiscoveryState): void {\n\tassertHttpsEndpoint(state.authorizationServerUrl, \"authorization server URL\");\n\tif (!state.authorizationServerMetadata) {\n\t\tthrow new Error(\"MCP OAuth authorization server metadata is required\");\n\t}\n\tassertHttpsEndpoint(state.authorizationServerMetadata.authorization_endpoint, \"authorization endpoint\");\n\tassertHttpsEndpoint(state.authorizationServerMetadata.token_endpoint, \"token endpoint\");\n\tif (state.authorizationServerMetadata.registration_endpoint) {\n\t\tassertHttpsEndpoint(state.authorizationServerMetadata.registration_endpoint, \"registration endpoint\");\n\t}\n\tconst deviceEndpoint = getDeviceAuthorizationEndpoint(state.authorizationServerMetadata);\n\tif (deviceEndpoint) {\n\t\tassertHttpsEndpoint(deviceEndpoint, \"device authorization endpoint\");\n\t}\n\tif (state.resourceMetadataUrl) {\n\t\tassertHttpsEndpoint(state.resourceMetadataUrl, \"resource metadata URL\");\n\t}\n\tfor (const authorizationServer of state.resourceMetadata?.authorization_servers ?? []) {\n\t\tassertHttpsEndpoint(authorizationServer, \"protected-resource authorization server\");\n\t}\n}\n\nfunction staticClientInformation(server: McpResolvedServerConfig): OAuthClientInformationMixed | undefined {\n\tconst clientId = server.auth?.clientId?.trim();\n\tif (!clientId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tclient_id: clientId,\n\t\t...(server.auth?.clientSecret ? { client_secret: server.auth.clientSecret } : {}),\n\t\t...(server.auth?.tokenEndpointAuthMethod\n\t\t\t? { token_endpoint_auth_method: server.auth.tokenEndpointAuthMethod }\n\t\t\t: {}),\n\t};\n}\n\nfunction clientMetadata(options: VoltMcpOAuthProviderOptions): OAuthClientMetadata {\n\tconst redirectUrl = String(options.redirectUrl ?? \"http://127.0.0.1/mcp/oauth/callback\");\n\tconst auth = options.server.auth;\n\treturn {\n\t\tredirect_uris: [redirectUrl],\n\t\ttoken_endpoint_auth_method:\n\t\t\tauth?.tokenEndpointAuthMethod ?? (auth?.clientSecret ? \"client_secret_basic\" : \"none\"),\n\t\tgrant_types: [\"authorization_code\", \"refresh_token\", \"urn:ietf:params:oauth:grant-type:device_code\"],\n\t\tresponse_types: [\"code\"],\n\t\tclient_name: options.clientName ?? \"Volt\",\n\t\tsoftware_version: options.clientVersion ?? VERSION,\n\t\t...(auth?.scope ? { scope: auth.scope } : {}),\n\t};\n}\n\nexport class VoltMcpOAuthProvider implements OAuthClientProvider {\n\tprivate server: McpResolvedServerConfig;\n\tprivate store: McpOAuthStore;\n\tprivate redirectUrlValue: string | URL | undefined;\n\tprivate metadata: OAuthClientMetadata;\n\tprivate authorizationUrlValue: URL | undefined;\n\tprivate stateValue: string;\n\tprivate onAuthorizationUrl: ((url: URL) => void | Promise<void>) | undefined;\n\n\tconstructor(options: VoltMcpOAuthProviderOptions) {\n\t\tthis.server = options.server;\n\t\tthis.store = options.store;\n\t\tthis.redirectUrlValue = options.redirectUrl;\n\t\tthis.metadata = clientMetadata(options);\n\t\tthis.stateValue = randomState();\n\t\tthis.onAuthorizationUrl = options.onAuthorizationUrl;\n\t}\n\n\tget redirectUrl(): string | URL | undefined {\n\t\treturn this.redirectUrlValue;\n\t}\n\n\tget clientMetadataUrl(): string | undefined {\n\t\treturn this.server.auth?.clientMetadataUrl;\n\t}\n\n\tget clientMetadata(): OAuthClientMetadata {\n\t\treturn this.metadata;\n\t}\n\n\tget authorizationUrl(): URL | undefined {\n\t\treturn this.authorizationUrlValue;\n\t}\n\n\tget expectedState(): string {\n\t\treturn this.stateValue;\n\t}\n\n\tasync state(): Promise<string> {\n\t\tthis.store.patchRecord(this.server, { state: this.stateValue });\n\t\treturn this.stateValue;\n\t}\n\n\tclientInformation(): OAuthClientInformationMixed | undefined {\n\t\treturn (\n\t\t\tstaticClientInformation(this.server) ?? this.store.getClientInformation(this.server, this.redirectUrlValue)\n\t\t);\n\t}\n\n\tsaveClientInformation(clientInformation: OAuthClientInformationMixed): void {\n\t\tif (staticClientInformation(this.server)) {\n\t\t\treturn;\n\t\t}\n\t\tthis.store.patchRecord(this.server, { clientInformation });\n\t}\n\n\ttokens(): OAuthTokens | undefined {\n\t\treturn this.store.getRecord(this.server)?.tokens;\n\t}\n\n\tsaveTokens(tokens: OAuthTokens): void {\n\t\tthis.store.patchRecord(this.server, { tokens });\n\t}\n\n\tasync redirectToAuthorization(authorizationUrl: URL): Promise<void> {\n\t\tassertHttpsEndpoint(authorizationUrl.toString(), \"authorization URL\");\n\t\tthis.authorizationUrlValue = authorizationUrl;\n\t\tawait this.onAuthorizationUrl?.(authorizationUrl);\n\t}\n\n\tsaveCodeVerifier(codeVerifier: string): void {\n\t\tthis.store.patchRecord(this.server, { codeVerifier });\n\t}\n\n\tcodeVerifier(): string {\n\t\tconst verifier = this.store.getRecord(this.server)?.codeVerifier;\n\t\tif (!verifier) {\n\t\t\tthrow new Error(`Missing MCP OAuth code verifier for ${this.server.id}`);\n\t\t}\n\t\treturn verifier;\n\t}\n\n\tinvalidateCredentials(scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\"): void {\n\t\tthis.store.clear(this.server, scope);\n\t}\n\n\tsaveDiscoveryState(state: OAuthDiscoveryState): void {\n\t\tassertSafeDiscoveryState(state);\n\t\tthis.store.patchRecord(this.server, { discoveryState: state });\n\t}\n\n\tdiscoveryState(): OAuthDiscoveryState | undefined {\n\t\tconst state = this.store.getRecord(this.server)?.discoveryState;\n\t\tif (state) {\n\t\t\tassertSafeDiscoveryState(state);\n\t\t}\n\t\treturn state;\n\t}\n}\n"]}