@kieksme/mcp-http-kit 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 kieks.me
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,198 @@
-# Temporary Holding Version
+# `@kieksme/mcp-http-kit`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Shared **Streamable HTTP** transport, **auth** (bearer + OAuth 2.1 resource server), and **deploy templates** for kieksme MCP servers.
+
+Use this so every server speaks the same env scheme, passes Railway healthchecks, and can be listed on MCP registries without copy-pasting HTTP glue.
+
+## SDK decision (v2 only)
+
+This kit targets the **MCP TypeScript SDK v2** packages:
+
+| Package | Role |
+| --- | --- |
+| `@modelcontextprotocol/server` | `McpServer`, `createMcpHandler` |
+| `@modelcontextprotocol/node` | `toNodeHandler`, Node Streamable HTTP |
+
+**Why not v1 / dual adapters?** Upstream marked v2 as the stable release line implementing the **2026-07-28** spec; `@modelcontextprotocol/sdk` is the legacy monolith. Newer kieksme servers (`mcp-enhancv`, `mcp-balena`) already use v2. Older ones (`mcp-contabo`, `mcp-listmonk`, `mcp-swetrix`, `mcp-hashnode`) should migrate to v2 rather than the kit carrying a forever-v1 adapter. See [`docs/migration.md`](./docs/migration.md).
+
+Peer dependencies: install `@modelcontextprotocol/server` and `@modelcontextprotocol/node` in each server.
+
+## Install
+
+```bash
+pnpm add @kieksme/mcp-http-kit
+pnpm add @modelcontextprotocol/server @modelcontextprotocol/node
+```
+
+Node **22.14+**, ESM only, MIT.
+
+## Quick start
+
+```ts
+import { McpServer } from '@modelcontextprotocol/server';
+import { loadConfig, startMcpServer } from '@kieksme/mcp-http-kit';
+
+function createServer(ctx) {
+  const server = new McpServer({ name: 'demo-mcp', version: '1.0.0' });
+  // ctx.auth.mode / ctx.auth.scopes available to tool handlers
+  return server;
+}
+
+const config = loadConfig(process.env, { realm: 'demo-mcp' });
+await startMcpServer({ createServer, config });
+```
+
+- `MCP_TRANSPORT=stdio` → stdio (default)
+- `MCP_TRANSPORT=http` → stateless Streamable HTTP (`POST /mcp`)
+
+Example: [`examples/echo-server`](./examples/echo-server).
+
+```bash
+MCP_TRANSPORT=stdio pnpm example:echo
+MCP_TRANSPORT=http MCP_AUTH_TOKEN=dev MCP_HTTP_HOST=127.0.0.1 pnpm example:echo
+```
+
+## Environment variables
+
+| Variable | Default | Notes |
+| --- | --- | --- |
+| `MCP_TRANSPORT` | `stdio` | `stdio` \| `http` |
+| `PORT` | `3000` | Preferred listen port (Railway). Fallback: `MCP_HTTP_PORT` |
+| `MCP_HTTP_HOST` | `127.0.0.1` | Use `0.0.0.0` in containers |
+| `MCP_HTTP_PATH` | `/mcp` | MCP endpoint |
+| `MCP_HEALTH_PATH` | `/health` | Primary unauthenticated health path |
+| `MCP_HEALTH_ALIASES` | — | Extra health paths (comma-separated), e.g. `/healthz` |
+| `MCP_ALLOWED_HOSTS` | localhost trio | Required when binding beyond localhost |
+| `MCP_ALLOWED_ORIGINS` | _(derived)_ | Optional absolute origins; else Origin hostname must be in hosts |
+| `MCP_AUTH_MODE` | `bearer` | `bearer` \| `oauth` \| `none` |
+| `MCP_AUTH_TOKEN` | — | Bearer secrets; **comma-separated** for rotation |
+| `MCP_AUTH_ALLOW_NONE` | `false` | Opt-in for `none` off localhost (public read-only) |
+| `MCP_AUTH_REALM` | `mcp` | WWW-Authenticate realm (or pass `loadConfig(..., { realm })`) |
+| `MCP_HTTP_ENABLE_SESSION_METHODS` | `false` | If true, GET/DELETE on MCP path are forwarded (else **405**) |
+| `MCP_OAUTH_RESOURCE` | — | Canonical resource URL (oauth) |
+| `MCP_OAUTH_AUTHORIZATION_SERVERS` | — | Comma-separated AS issuer URLs |
+| `MCP_OAUTH_AUDIENCES` | resource | Expected JWT `aud` / resource |
+| `MCP_OAUTH_JWKS_URL` | _(discovered)_ | Optional JWKS override |
+| `MCP_OAUTH_REQUIRED_SCOPES` | _(none)_ | All must be present |
+| `MCP_OAUTH_SCOPES_SUPPORTED` | required | Advertised in RFC 9728 metadata |
+
+**Deprecated aliases** (still work, warn once): `MCP_HTTP_AUTH_TOKEN`, `MCP_SERVER_AUTH_TOKEN`, `MCP_HTTP_ALLOWED_HOSTS`, `MCP_HTTP_ALLOWED_ORIGINS`, `MCP_HTTP_ENDPOINT`, `HEALTH_ENDPOINT`.
+
+## Auth modes
+
+### `bearer`
+
+Constant-time compare against `MCP_AUTH_TOKEN` list. Missing/invalid → **401** + `WWW-Authenticate: Bearer realm="…"`.
+
+### `oauth`
+
+MCP server acts as an **OAuth 2.1 resource server** only (never an authorization server):
+
+1. Serves RFC 9728 metadata at `/.well-known/oauth-protected-resource` (+ path-aware variant for `/mcp`)
+2. Validates JWT access tokens via JWKS (issuer, audience/resource, expiry, scopes)
+3. 401 responses include `resource_metadata="…"` so clients can discover the AS
+4. Scopes are available on `ctx.auth.scopes` and as SDK `authInfo` for `requireScopes`
+
+### `none`
+
+Allowed on **localhost** binds, or with `MCP_AUTH_ALLOW_NONE=true` for intentional public read-only endpoints. Header-based upstream credentials are **refused** in this mode.
+
+## Request pipeline (HTTP)
+
+1. **`GET` health paths** (`MCP_HEALTH_PATH` + `MCP_HEALTH_ALIASES`) — no auth, **before** Host/Origin checks (Railway-friendly)
+2. **OAuth well-known** — no auth, before Host checks
+3. Host / Origin allowlist → **403**
+4. MCP path; non-POST → **405** (unless session methods enabled)
+5. Auth → **401**
+6. Stateless `createMcpHandler` (body size limit applied)
+
+Graceful **SIGTERM** / **SIGINT** shutdown is wired by `startMcpServer`.
+
+### Health body hook
+
+Default body is `{ "status": "ok" }`. Pass `getHealthInfo` to add fields (version, tool count, …). `status: "ok"` always wins:
+
+```ts
+await startMcpServer({
+  createServer,
+  config,
+  getHealthInfo: () => ({ version: '1.2.3', tools: 12 }),
+});
+// → { "version": "1.2.3", "tools": 12, "status": "ok" }
+```
+
+Aliases via env or `loadConfig(..., { healthPathAliases: ['/healthz'] })`.
+
+## Framework-agnostic core
+
+```ts
+import { createMcpHttpApp, handleWithKitApp, createNodeHttpServer } from '@kieksme/mcp-http-kit';
+
+const app = createMcpHttpApp({ createServer, config });
+// Web Fetch API: app.fetch(request)
+// Node: createNodeHttpServer({ app, config })
+// Fastify/Express: handleWithKitApp(app, req.raw, reply.raw, config, req.body)
+```
+
+## Upstream credentials (per request)
+
+```ts
+import { resolveUpstreamCredential } from '@kieksme/mcp-http-kit';
+
+const { value } = resolveUpstreamCredential(ctx.headers, {
+  mode: 'header', // or 'env'
+  envVar: 'CONTABO_API_KEY',
+  headerName: 'X-Contabo-Api-Key',
+  authMode: ctx.auth.mode,
+});
+```
+
+## Test helpers
+
+```ts
+import { createAppTestClient, createKitContractAssertions } from '@kieksme/mcp-http-kit/test';
+```
+
+Covered contracts: 401 without token, 403 bad Host/Origin, `/health` without auth (incl. bad Host), initialize + `tools/list`.
+
+## Railway deploy
+
+1. Copy `templates/Dockerfile` and `templates/railway.json`
+2. Set `MCP_TRANSPORT=http`, `MCP_HTTP_HOST=0.0.0.0`, `MCP_AUTH_TOKEN`, `MCP_ALLOWED_HOSTS=<your-public-host>`
+3. Railway sets `PORT`; the kit reads it first
+4. Healthcheck path is `/health` (no auth, Host-agnostic)
+
+## Registry / Smithery
+
+- `templates/server.json` — official MCP registry (`io.github.kieksme/<name>`, npm + OCI + `remotes` streamable-http)
+- `templates/smithery.yaml` — container runtime, HTTP start command
+
+## Public API
+
+| Export | Purpose |
+| --- | --- |
+| `loadConfig` / `resolveHealthPaths` | Env → `KitConfig` (+ legacy aliases) |
+| `startMcpServer` | stdio or HTTP lifecycle (`getHealthInfo` supported) |
+| `createMcpHttpApp` | Web-standard `{ fetch, close }` |
+| `createNodeHttpServer` / `createNodeRequestListener` | `node:http` |
+| `handleWithKitApp` | Fastify/Express bridge |
+| `authenticateRequest` / bearer + oauth helpers | Auth primitives |
+| `resolveUpstreamCredential` | env \| header upstream keys |
+| `@kieksme/mcp-http-kit/test` | Contract test helpers |
+
+### Git installs
+
+`prepare` builds `dist/` when it is missing (typical for `github:` / git URL deps). Published npm tarballs already include `dist`, so prepare is a no-op there.
+
+## Scripts
+
+```bash
+pnpm lint
+pnpm typecheck
+pnpm test
+pnpm build
+```
+
+## License
+
+MIT © kieks.me

package/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are applied to the latest published release of `@kieksme/mcp-http-kit`.
+
+## Reporting a vulnerability
+
+Please open a private security advisory on
+[GitHub](https://github.com/kieksme/mcp-http-kit/security/advisories/new)
+or email the maintainers. Do not file public issues for undisclosed vulnerabilities.
+
+## Hardening notes
+
+- Prefer `MCP_AUTH_MODE=bearer` or `oauth` for any non-localhost deployment.
+- `MCP_AUTH_MODE=none` is refused unless the process binds to localhost or
+  `MCP_AUTH_ALLOW_NONE=true` is set explicitly (intended for public read-only demos).
+- Keep `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS` tight when binding beyond loopback.
+- Never commit bearer tokens or OAuth client secrets; use environment variables / Railway secrets.

package/dist/auth/bearer.d.ts

@@ -0,0 +1,14 @@
+import type { AuthContext } from '../types.js';
+export type BearerAuthResult = {
+    ok: true;
+    context: AuthContext;
+} | {
+    ok: false;
+    status: 401;
+    wwwAuthenticate: string;
+    body: string;
+};
+export declare function extractBearerToken(authorization: string | null | undefined): string | undefined;
+/** Constant-time check of Authorization: Bearer against one or more tokens. */
+export declare function verifyBearerToken(authorization: string | null | undefined, tokens: string[], realm: string): BearerAuthResult;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/auth/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAatE,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI/F;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,gBAAgB,CAuBlB"}

package/dist/auth/bearer.js

@@ -0,0 +1,43 @@
+import { timingSafeEqual } from 'node:crypto';
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length) {
+        // Still compare against something of equal length to reduce timing skew on length.
+        timingSafeEqual(left, left);
+        return false;
+    }
+    return timingSafeEqual(left, right);
+}
+export function extractBearerToken(authorization) {
+    if (!authorization)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
+    return match?.[1]?.trim() || undefined;
+}
+/** Constant-time check of Authorization: Bearer against one or more tokens. */
+export function verifyBearerToken(authorization, tokens, realm) {
+    const token = extractBearerToken(authorization);
+    if (!token) {
+        return {
+            ok: false,
+            status: 401,
+            wwwAuthenticate: `Bearer realm="${realm}"`,
+            body: 'Unauthorized',
+        };
+    }
+    const accepted = tokens.some(expected => safeEqual(token, expected));
+    if (!accepted) {
+        return {
+            ok: false,
+            status: 401,
+            wwwAuthenticate: `Bearer realm="${realm}", error="invalid_token"`,
+            body: 'Unauthorized',
+        };
+    }
+    return {
+        ok: true,
+        context: { mode: 'bearer', token, scopes: [] },
+    };
+}
+//# sourceMappingURL=bearer.js.map

package/dist/auth/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,mFAAmF;QACnF,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAAwC;IACzE,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAC/B,aAAwC,EACxC,MAAgB,EAChB,KAAa;IAEb,MAAM,KAAK,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,eAAe,EAAE,iBAAiB,KAAK,GAAG;YAC1C,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,eAAe,EAAE,iBAAiB,KAAK,0BAA0B;YACjE,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;KAC/C,CAAC;AACJ,CAAC"}

package/dist/auth/context.d.ts

@@ -0,0 +1,7 @@
+import type { AuthInfo } from '@modelcontextprotocol/server';
+import type { AuthContext, KitConfig } from '../types.js';
+/** Map kit auth into the SDK `AuthInfo` pass-through (scopes reach tool handlers). */
+export declare function toAuthInfo(auth: AuthContext, config: KitConfig): AuthInfo | undefined;
+/** Recover kit `AuthContext` from SDK `AuthInfo` (or fall back to none). */
+export declare function fromAuthInfo(authInfo: AuthInfo | undefined): AuthContext;
+//# sourceMappingURL=context.d.ts.map

package/dist/auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAY,SAAS,EAAE,MAAM,aAAa,CAAC;AAKpE,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAsBrF;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAkBxE"}

package/dist/auth/context.js

@@ -0,0 +1,46 @@
+import { resourceMetadataUrl } from './oauth.js';
+const KIT_AUTH_EXTRA_KEY = 'kieksme.auth';
+/** Map kit auth into the SDK `AuthInfo` pass-through (scopes reach tool handlers). */
+export function toAuthInfo(auth, config) {
+    if (auth.mode === 'none')
+        return undefined;
+    const token = auth.token ?? '';
+    const info = {
+        token,
+        clientId: auth.subject ?? auth.mode,
+        scopes: auth.scopes,
+        extra: {
+            [KIT_AUTH_EXTRA_KEY]: {
+                mode: auth.mode,
+                subject: auth.subject,
+                claims: auth.claims,
+            },
+        },
+    };
+    if (config.auth.mode === 'oauth') {
+        info.resource = new URL(config.auth.resource);
+        info.resourceMetadataUrl = resourceMetadataUrl(config.auth.resource);
+        const exp = auth.claims?.exp;
+        if (typeof exp === 'number')
+            info.expiresAt = exp;
+    }
+    return info;
+}
+/** Recover kit `AuthContext` from SDK `AuthInfo` (or fall back to none). */
+export function fromAuthInfo(authInfo) {
+    if (!authInfo) {
+        return { mode: 'none', scopes: [] };
+    }
+    const stamped = authInfo.extra?.[KIT_AUTH_EXTRA_KEY];
+    const subject = stamped?.subject ?? (authInfo.clientId !== 'bearer' && authInfo.clientId !== 'none'
+        ? authInfo.clientId
+        : undefined);
+    return {
+        mode: stamped?.mode ?? (authInfo.scopes.length > 0 ? 'oauth' : 'bearer'),
+        token: authInfo.token,
+        scopes: authInfo.scopes,
+        ...(subject ? { subject } : {}),
+        ...(stamped?.claims ? { claims: stamped.claims } : {}),
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/auth/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,MAAiB;IAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAa;QACrB,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE;YACL,CAAC,kBAAkB,CAAC,EAAE;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;SACF;KACF,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,QAA8B;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAEtC,CAAC;IACd,MAAM,OAAO,GACX,OAAO,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;QACjF,CAAC,CAAC,QAAQ,CAAC,QAAQ;QACnB,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,OAAO;QACL,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,25 @@
+import type { AuthConfig, AuthContext } from '../types.js';
+export type AuthenticateResult = {
+    ok: true;
+    context: AuthContext;
+} | {
+    ok: false;
+    status: 401;
+    wwwAuthenticate: string;
+    body: string;
+    contentType?: string;
+};
+export type AuthenticateOptions = {
+    auth: AuthConfig;
+    realm: string;
+    authorizationHeader: string | null | undefined;
+};
+/**
+ * Authenticate an HTTP request according to kit auth mode.
+ * Callers should skip this for `/health` and well-known metadata routes.
+ */
+export declare function authenticateRequest(options: AuthenticateOptions): Promise<AuthenticateResult>;
+export declare function unauthorizedWwwAuthenticate(auth: AuthConfig, realm: string): string;
+export { buildProtectedResourceMetadata, clearOAuthJwksCache, oauthWwwAuthenticate, resourceMetadataUrl, verifyOAuthAccessToken, } from './oauth.js';
+export { extractBearerToken, verifyBearerToken } from './bearer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI3D,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5F,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAChD,CAAC;AAEF;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsBnG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnF;AAED,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,34 @@
+import { verifyBearerToken } from './bearer.js';
+import { oauthWwwAuthenticate, verifyOAuthAccessToken } from './oauth.js';
+/**
+ * Authenticate an HTTP request according to kit auth mode.
+ * Callers should skip this for `/health` and well-known metadata routes.
+ */
+export async function authenticateRequest(options) {
+    const { auth, realm, authorizationHeader } = options;
+    if (auth.mode === 'none') {
+        return { ok: true, context: { mode: 'none', scopes: [] } };
+    }
+    if (auth.mode === 'bearer') {
+        return verifyBearerToken(authorizationHeader, auth.tokens, realm);
+    }
+    const result = await verifyOAuthAccessToken(authorizationHeader, auth);
+    if (!result.ok) {
+        return {
+            ok: false,
+            status: result.status,
+            wwwAuthenticate: result.wwwAuthenticate,
+            body: result.body,
+            contentType: 'application/json',
+        };
+    }
+    return result;
+}
+export function unauthorizedWwwAuthenticate(auth, realm) {
+    if (auth.mode === 'oauth')
+        return oauthWwwAuthenticate(auth, 'invalid_token', 'Authentication required');
+    return `Bearer realm="${realm}"`;
+}
+export { buildProtectedResourceMetadata, clearOAuthJwksCache, oauthWwwAuthenticate, resourceMetadataUrl, verifyOAuthAccessToken, } from './oauth.js';
+export { extractBearerToken, verifyBearerToken } from './bearer.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAY1E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B;IACpE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAErD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,kBAAkB;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAgB,EAAE,KAAa;IACzE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACzG,OAAO,iBAAiB,KAAK,GAAG,CAAC;AACnC,CAAC;AAED,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,25 @@
+import type { AuthContext, OAuthAuthConfig } from '../types.js';
+export type OAuthAuthResult = {
+    ok: true;
+    context: AuthContext;
+} | {
+    ok: false;
+    status: 401;
+    wwwAuthenticate: string;
+    body: string;
+};
+export type ProtectedResourceMetadata = {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported?: string[];
+    bearer_methods_supported: string[];
+};
+declare function resourceMetadataUrl(resource: string): string;
+export declare function buildProtectedResourceMetadata(config: OAuthAuthConfig): ProtectedResourceMetadata;
+export declare function oauthWwwAuthenticate(config: OAuthAuthConfig, error?: string, description?: string): string;
+/** Validate a Bearer access token as an OAuth 2.1 resource server (JWT + JWKS). */
+export declare function verifyOAuthAccessToken(authorization: string | null | undefined, config: OAuthAuthConfig): Promise<OAuthAuthResult>;
+/** Clear JWKS cache (tests). */
+export declare function clearOAuthJwksCache(): void;
+export { resourceMetadataUrl };
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACpC,CAAC;AAMF,iBAAS,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,GAAG,yBAAyB,CAOjG;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAMR;AAqFD,mFAAmF;AACnF,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CA0D1B;AAED,gCAAgC;AAChC,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/auth/oauth.js

@@ -0,0 +1,161 @@
+import { createRemoteJWKSet, jwtVerify, } from 'jose';
+const jwksCache = new Map();
+function resourceMetadataUrl(resource) {
+    const url = new URL(resource);
+    // RFC 9728 path-aware well-known: insert /.well-known/oauth-protected-resource before path
+    const path = url.pathname === '/' ? '' : url.pathname.replace(/\/$/, '');
+    return `${url.origin}/.well-known/oauth-protected-resource${path}`;
+}
+export function buildProtectedResourceMetadata(config) {
+    return {
+        resource: config.resource,
+        authorization_servers: config.authorizationServers,
+        ...(config.scopesSupported.length > 0 ? { scopes_supported: config.scopesSupported } : {}),
+        bearer_methods_supported: ['header'],
+    };
+}
+export function oauthWwwAuthenticate(config, error, description) {
+    const metadata = resourceMetadataUrl(config.resource);
+    const parts = [`Bearer resource_metadata="${metadata}"`];
+    if (error)
+        parts.push(`error="${error}"`);
+    if (description)
+        parts.push(`error_description="${description.replace(/"/g, "'")}"`);
+    return parts.join(', ');
+}
+function parseScopes(payload) {
+    const scopeClaim = payload.scope;
+    if (typeof scopeClaim === 'string') {
+        return scopeClaim.split(/\s+/).filter(Boolean);
+    }
+    const scp = payload.scp;
+    if (Array.isArray(scp)) {
+        return scp.filter((s) => typeof s === 'string');
+    }
+    return [];
+}
+function audiencesMatch(payload, expected) {
+    const aud = payload.aud;
+    const values = Array.isArray(aud) ? aud : aud ? [aud] : [];
+    // Also accept `resource` / `rsc` style claims used by some AS implementations.
+    const resourceClaim = payload.resource ?? payload.rsc;
+    if (typeof resourceClaim === 'string')
+        values.push(resourceClaim);
+    if (Array.isArray(resourceClaim)) {
+        for (const entry of resourceClaim) {
+            if (typeof entry === 'string')
+                values.push(entry);
+        }
+    }
+    return expected.some(want => values.includes(want));
+}
+async function resolveJwks(config) {
+    if (config.jwksUrl) {
+        const cached = jwksCache.get(config.jwksUrl);
+        if (cached)
+            return cached.getKey;
+        const getKey = createRemoteJWKSet(new URL(config.jwksUrl));
+        jwksCache.set(config.jwksUrl, { url: config.jwksUrl, getKey });
+        return getKey;
+    }
+    const issuer = config.authorizationServers[0];
+    if (!issuer) {
+        throw new Error('OAuth config missing authorizationServers');
+    }
+    const issuerUrl = issuer.endsWith('/') ? issuer : `${issuer}/`;
+    // Prefer OIDC discovery, then OAuth AS metadata.
+    const candidates = [
+        new URL('.well-known/openid-configuration', issuerUrl).href,
+        new URL('.well-known/oauth-authorization-server', issuerUrl).href,
+    ];
+    for (const metadataUrl of candidates) {
+        try {
+            const response = await fetch(metadataUrl, {
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok)
+                continue;
+            const body = (await response.json());
+            if (!body.jwks_uri)
+                continue;
+            const cached = jwksCache.get(body.jwks_uri);
+            if (cached)
+                return cached.getKey;
+            const getKey = createRemoteJWKSet(new URL(body.jwks_uri));
+            jwksCache.set(body.jwks_uri, { url: body.jwks_uri, getKey });
+            return getKey;
+        }
+        catch {
+            // try next candidate
+        }
+    }
+    throw new Error(`Unable to resolve JWKS for authorization server ${issuer}; set MCP_OAUTH_JWKS_URL`);
+}
+function unauthorized(config, error, description) {
+    return {
+        ok: false,
+        status: 401,
+        wwwAuthenticate: oauthWwwAuthenticate(config, error, description),
+        body: JSON.stringify({ error, error_description: description }),
+    };
+}
+/** Validate a Bearer access token as an OAuth 2.1 resource server (JWT + JWKS). */
+export async function verifyOAuthAccessToken(authorization, config) {
+    const header = authorization?.trim();
+    if (!header?.toLowerCase().startsWith('bearer ')) {
+        return unauthorized(config, 'invalid_token', 'Authentication required');
+    }
+    const token = header.slice(7).trim();
+    if (!token) {
+        return unauthorized(config, 'invalid_token', 'Authentication required');
+    }
+    let payload;
+    try {
+        const getKey = await resolveJwks(config);
+        const verified = await jwtVerify(token, getKey, {
+            issuer: config.authorizationServers,
+            clockTolerance: 30,
+        });
+        payload = verified.payload;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Token validation failed';
+        return unauthorized(config, 'invalid_token', message);
+    }
+    if (!audiencesMatch(payload, config.audiences)) {
+        return unauthorized(config, 'invalid_token', 'Token audience does not match this resource');
+    }
+    const scopes = parseScopes(payload);
+    if (config.requiredScopes.length > 0) {
+        const missing = config.requiredScopes.filter(scope => !scopes.includes(scope));
+        if (missing.length > 0) {
+            return {
+                ok: false,
+                status: 401,
+                wwwAuthenticate: oauthWwwAuthenticate(config, 'insufficient_scope', `Missing scopes: ${missing.join(' ')}`),
+                body: JSON.stringify({
+                    error: 'insufficient_scope',
+                    error_description: `Missing scopes: ${missing.join(' ')}`,
+                }),
+            };
+        }
+    }
+    const subject = typeof payload.sub === 'string' ? payload.sub : undefined;
+    return {
+        ok: true,
+        context: {
+            mode: 'oauth',
+            token,
+            scopes,
+            claims: payload,
+            ...(subject ? { subject } : {}),
+        },
+    };
+}
+/** Clear JWKS cache (tests). */
+export function clearOAuthJwksCache() {
+    jwksCache.clear();
+}
+export { resourceMetadataUrl };
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,GAGV,MAAM,MAAM,CAAC;AAgBd,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEhD,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,2FAA2F;IAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,GAAG,CAAC,MAAM,wCAAwC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAuB;IACpE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,MAAM,CAAC,oBAAoB;QAClD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,KAAc,EACd,WAAoB;IAEpB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,6BAA6B,QAAQ,GAAG,CAAC,CAAC;IACzD,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC1C,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;IACjC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,OAAmB,EAAE,QAAkB;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,+EAA+E;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;IACtD,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAuB;IAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC;IAC/D,iDAAiD;IACjD,MAAM,UAAU,GAAG;QACjB,IAAI,GAAG,CAAC,kCAAkC,EAAE,SAAS,CAAC,CAAC,IAAI;QAC3D,IAAI,GAAG,CAAC,wCAAwC,EAAE,SAAS,CAAC,CAAC,IAAI;KAClE,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,UAAU,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,SAAS;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2C,CAAC;YAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1D,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,0BAA0B,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAuB,EACvB,KAAa,EACb,WAAmB;IAEnB,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,eAAe,EAAE,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC;QACjE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAwC,EACxC,MAAuB;IAEvB,MAAM,MAAM,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC9C,MAAM,EAAE,MAAM,CAAC,oBAAoB;YACnC,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACnF,OAAO,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,oBAAoB,CACnC,MAAM,EACN,oBAAoB,EACpB,mBAAmB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACvC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,oBAAoB;oBAC3B,iBAAiB,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBAC1D,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,KAAK;YACL,MAAM;YACN,MAAM,EAAE,OAAkC;YAC1C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC;KACF,CAAC;AACJ,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,mBAAmB;IACjC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}