@kya-os/mcp-i-core 1.3.7-canary.0 → 1.3.7-canary.clientinfo.20251126041014

package/dist/services/oauth-token-retrieval.service.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * OAuth Token Retrieval Service
+ *
+ * Retrieves OAuth tokens from AgentShield after receiving delegation token.
+ * Implements the two-step token flow for Phase 3 custom IDP support.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTokenRetrievalService = void 0;
+/**
+ * Service for retrieving OAuth tokens from AgentShield
+ */
+class OAuthTokenRetrievalService {
+    config;
+    constructor(config) {
+        const defaultRetryConfig = {
+            maxRetries: 3,
+            retryDelay: 1000,
+            retryBackoff: 2,
+        };
+        this.config = {
+            ...config,
+            logger: config.logger || (() => { }),
+            retryConfig: {
+                ...defaultRetryConfig,
+                ...config.retryConfig,
+            },
+        };
+    }
+    /**
+     * Retrieve OAuth tokens from AgentShield
+     *
+     * @param delegationId - Delegation ID from token exchange response
+     * @param delegationToken - Delegation token (JWT) for authorization
+     * @returns OAuth tokens mapped to IdpTokens format, or null if unavailable
+     */
+    async retrieveTokens(delegationId, delegationToken) {
+        const endpoint = `${this.config.baseUrl}/api/v1/bouncer/delegations/${delegationId}/tokens`;
+        this.config.logger("[OAuthTokenRetrievalService] Retrieving OAuth tokens", {
+            delegationId,
+            endpoint,
+        });
+        let lastError = null;
+        let attempt = 0;
+        // Retry logic for transient failures
+        while (attempt <= this.config.retryConfig.maxRetries) {
+            try {
+                const response = await this.config.fetchProvider(endpoint, {
+                    method: "GET",
+                    headers: {
+                        Authorization: `Bearer ${delegationToken}`,
+                        Accept: "application/json",
+                    },
+                });
+                if (!response.ok) {
+                    const errorData = await response.json().catch(() => ({}));
+                    if (response.status === 404 || response.status === 401) {
+                        // Token unavailable or unauthorized - don't retry
+                        this.config.logger("[OAuthTokenRetrievalService] Tokens unavailable", {
+                            status: response.status,
+                            delegationId,
+                            error: errorData,
+                        });
+                        return null;
+                    }
+                    // Transient error - retry
+                    const errorMessage = errorData.error?.message ||
+                        errorData.error ||
+                        errorData.message ||
+                        `HTTP ${response.status}`;
+                    throw new Error(`Token retrieval failed: ${errorMessage}`);
+                }
+                const result = (await response.json());
+                if (!result.success) {
+                    this.config.logger("[OAuthTokenRetrievalService] Token retrieval error response", {
+                        delegationId,
+                        error: result.error,
+                    });
+                    return null;
+                }
+                // Map response to IdpTokens format
+                const tokens = this.mapToIdpTokens(result.data);
+                this.config.logger("[OAuthTokenRetrievalService] OAuth tokens retrieved successfully", {
+                    delegationId,
+                    expiresAt: new Date(tokens.expires_at).toISOString(),
+                    hasRefreshToken: !!tokens.refresh_token,
+                });
+                return tokens;
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error : new Error(String(error));
+                if (attempt < this.config.retryConfig.maxRetries) {
+                    const delay = this.config.retryConfig.retryDelay *
+                        Math.pow(this.config.retryConfig.retryBackoff, attempt);
+                    this.config.logger("[OAuthTokenRetrievalService] Retry attempt failed, retrying", {
+                        attempt: attempt + 1,
+                        maxRetries: this.config.retryConfig.maxRetries,
+                        delay,
+                        error: lastError.message,
+                    });
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                    attempt++;
+                }
+                else {
+                    // Max retries exceeded
+                    this.config.logger("[OAuthTokenRetrievalService] Max retries exceeded", {
+                        delegationId,
+                        error: lastError.message,
+                        attempts: attempt + 1,
+                    });
+                    // Return null instead of throwing - delegation token still valid
+                    return null;
+                }
+            }
+        }
+        return null;
+    }
+    /**
+     * Map AgentShield response to IdpTokens format
+     *
+     * @param data - Response data from AgentShield
+     * @returns IdpTokens object
+     */
+    mapToIdpTokens(data) {
+        // Convert ISO 8601 string to milliseconds timestamp
+        let expiresAt;
+        if (data.oauth_expires_at) {
+            expiresAt = new Date(data.oauth_expires_at).getTime();
+        }
+        else if (data.oauth_expires_in) {
+            expiresAt = Date.now() + data.oauth_expires_in * 1000;
+        }
+        else {
+            // Default to 1 hour if neither provided
+            expiresAt = Date.now() + 3600 * 1000;
+        }
+        return {
+            access_token: data.oauth_access_token,
+            refresh_token: data.oauth_refresh_token || undefined,
+            expires_in: data.oauth_expires_in || undefined,
+            expires_at: expiresAt,
+            token_type: data.oauth_token_type || "Bearer",
+            scope: data.oauth_scope || undefined,
+        };
+    }
+}
+exports.OAuthTokenRetrievalService = OAuthTokenRetrievalService;
+//# sourceMappingURL=oauth-token-retrieval.service.js.map

package/dist/services/oauth-token-retrieval.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-retrieval.service.js","sourceRoot":"","sources":["../../src/services/oauth-token-retrieval.service.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAqDH;;GAEG;AACH,MAAa,0BAA0B;IAC7B,MAAM,CAEZ;IAEF,YAAY,MAAwC;QAClD,MAAM,kBAAkB,GAAG;YACzB,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,CAAC;SAChB,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACnC,WAAW,EAAE;gBACX,GAAG,kBAAkB;gBACrB,GAAG,MAAM,CAAC,WAAW;aACtB;SAGF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,YAAoB,EACpB,eAAuB;QAEvB,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,+BAA+B,YAAY,SAAS,CAAC;QAE5F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,sDAAsD,EAAE;YACzE,YAAY;YACZ,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,qCAAqC;QACrC,OAAO,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE;oBACzD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,eAAe,EAAE;wBAC1C,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAEhB,CAAC;oBAEzC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACvD,kDAAkD;wBAClD,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,iDAAiD,EACjD;4BACE,MAAM,EAAE,QAAQ,CAAC,MAAM;4BACvB,YAAY;4BACZ,KAAK,EAAE,SAAS;yBACjB,CACF,CAAC;wBACF,OAAO,IAAI,CAAC;oBACd,CAAC;oBAED,0BAA0B;oBAC1B,MAAM,YAAY,GACf,SAA8C,CAAC,KAAK,EAAE,OAAO;wBAC7D,SAAiB,CAAC,KAAK;wBACvB,SAAiB,CAAC,OAAO;wBAC1B,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAE5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAED,CAAC;gBAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,6DAA6D,EAC7D;wBACE,YAAY;wBACZ,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB,CACF,CAAC;oBACF,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,mCAAmC;gBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAEhD,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,kEAAkE,EAClE;oBACE,YAAY;oBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;oBACpD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;iBACxC,CACF,CAAC;gBAEF,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAEtE,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;oBACjD,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU;wBAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBAE1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,6DAA6D,EAC7D;wBACE,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU;wBAC9C,KAAK;wBACL,KAAK,EAAE,SAAS,CAAC,OAAO;qBACzB,CACF,CAAC;oBAEF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC3D,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,uBAAuB;oBACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,mDAAmD,EACnD;wBACE,YAAY;wBACZ,KAAK,EAAE,SAAS,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,GAAG,CAAC;qBACtB,CACF,CAAC;oBACF,iEAAiE;oBACjE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,cAAc,CACpB,IAAyC;QAEzC,oDAAoD;QACpD,IAAI,SAAiB,CAAC;QACtB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACvC,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,kBAAkB;YACrC,aAAa,EAAE,IAAI,CAAC,mBAAmB,IAAI,SAAS;YACpD,UAAU,EAAE,IAAI,CAAC,gBAAgB,IAAI,SAAS;YAC9C,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI,CAAC,gBAAgB,IAAI,QAAQ;YAC7C,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;SACrC,CAAC;IACJ,CAAC;CACF;AApLD,gEAoLC"}

package/dist/services/provider-resolver.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Provider Resolver
+ *
+ * Resolves OAuth provider for tools using priority-based resolution strategy.
+ * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { ToolProtection } from "@kya-os/contracts/tool-protection";
+import type { OAuthProviderRegistry } from "./oauth-provider-registry.js";
+import type { OAuthConfigService } from "./oauth-config.service.js";
+/**
+ * Resolves OAuth provider for tools with priority-based fallback strategy
+ *
+ * Priority order:
+ * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
+ * 2. Scope prefix inference (fallback)
+ * 3. Project-configured provider from AgentShield dashboard
+ * 4. Error if no provider can be resolved
+ */
+export declare class ProviderResolver {
+    private registry;
+    private configService;
+    constructor(registry: OAuthProviderRegistry, configService: OAuthConfigService);
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * @param toolProtection - Tool protection configuration
+     * @param projectId - Project ID for fetching provider config
+     * @returns Provider name (never null - throws if cannot resolve)
+     * @throws Error if provider cannot be resolved
+     */
+    resolveProvider(toolProtection: ToolProtection, projectId: string): Promise<string>;
+    /**
+     * Infer provider from scope prefixes
+     *
+     * Used as Priority 2 fallback when oauthProvider is not specified.
+     * Examples:
+     * - github:repo:read → github
+     * - gmail:read → google
+     * - microsoft:calendar:read → microsoft
+     *
+     * @param scopes - Required scopes for the tool
+     * @returns Provider name if uniquely inferred, null otherwise
+     */
+    private inferProviderFromScopes;
+}
+//# sourceMappingURL=provider-resolver.d.ts.map

package/dist/services/provider-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-resolver.d.ts","sourceRoot":"","sources":["../../src/services/provider-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa;gBADb,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,kBAAkB;IAG3C;;;;;;;OAOG;IACG,eAAe,CACnB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;CAoChC"}

package/dist/services/provider-resolver.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Provider Resolver
+ *
+ * Resolves OAuth provider for tools using priority-based resolution strategy.
+ * Supports Phase 2+ tool-specific providers with backward compatibility for Phase 1.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderResolver = void 0;
+/**
+ * Resolves OAuth provider for tools with priority-based fallback strategy
+ *
+ * Priority order:
+ * 1. Tool-specific oauthProvider field (Phase 2+ preferred)
+ * 2. Scope prefix inference (fallback)
+ * 3. Project-configured provider from AgentShield dashboard
+ * 4. Error if no provider can be resolved
+ */
+class ProviderResolver {
+    registry;
+    configService;
+    constructor(registry, configService) {
+        this.registry = registry;
+        this.configService = configService;
+    }
+    /**
+     * Resolve OAuth provider for a tool
+     *
+     * @param toolProtection - Tool protection configuration
+     * @param projectId - Project ID for fetching provider config
+     * @returns Provider name (never null - throws if cannot resolve)
+     * @throws Error if provider cannot be resolved
+     */
+    async resolveProvider(toolProtection, projectId) {
+        // Priority 1: Tool-specific provider (Phase 2+ preferred)
+        if (toolProtection.oauthProvider) {
+            // Ensure registry is loaded before checking
+            if (this.registry.getProviderNames().length === 0) {
+                await this.registry.loadFromAgentShield(projectId);
+            }
+            if (!this.registry.hasProvider(toolProtection.oauthProvider)) {
+                throw new Error(`Provider "${toolProtection.oauthProvider}" not configured for project "${projectId}". ` +
+                    `Add provider in project settings.`);
+            }
+            return toolProtection.oauthProvider;
+        }
+        // Priority 2: Scope prefix inference (fallback)
+        const inferredProvider = this.inferProviderFromScopes(toolProtection.requiredScopes || []);
+        if (inferredProvider) {
+            // Ensure registry is loaded before checking
+            if (this.registry.getProviderNames().length === 0) {
+                await this.registry.loadFromAgentShield(projectId);
+            }
+            if (this.registry.hasProvider(inferredProvider)) {
+                console.log(`[ProviderResolver] Inferred provider "${inferredProvider}" from scopes`);
+                return inferredProvider;
+            }
+        }
+        // Priority 3: Use explicitly configured provider from AgentShield dashboard
+        // This is the provider the user has actually configured, not just any available provider
+        await this.registry.loadFromAgentShield(projectId);
+        const configuredProvider = this.registry.getConfiguredProvider();
+        if (configuredProvider && this.registry.hasProvider(configuredProvider)) {
+            console.warn(`[ProviderResolver] Tool does not specify oauthProvider. ` +
+                `Using project-configured provider "${configuredProvider}" as fallback. ` +
+                `Consider explicitly setting oauthProvider in tool protection config.`);
+            return configuredProvider;
+        }
+        // Priority 4: Error if no provider is configured
+        // NOTE: We intentionally do NOT fall back to "first available provider" anymore
+        // because AgentShield returns ALL providers (even unconfigured ones).
+        // Only use providers explicitly configured by the user.
+        throw new Error(`Tool requires OAuth but no provider is configured for project "${projectId}". ` +
+            `Configure an OAuth provider in AgentShield dashboard.`);
+    }
+    /**
+     * Infer provider from scope prefixes
+     *
+     * Used as Priority 2 fallback when oauthProvider is not specified.
+     * Examples:
+     * - github:repo:read → github
+     * - gmail:read → google
+     * - microsoft:calendar:read → microsoft
+     *
+     * @param scopes - Required scopes for the tool
+     * @returns Provider name if uniquely inferred, null otherwise
+     */
+    inferProviderFromScopes(scopes) {
+        if (!scopes || scopes.length === 0) {
+            return null;
+        }
+        // Extract first part of scope (before first colon)
+        const scopePrefixes = scopes.map((scope) => {
+            const parts = scope.split(":");
+            return parts[0].toLowerCase();
+        });
+        // Provider mapping
+        const providerMap = {
+            github: "github",
+            google: "google",
+            gmail: "google", // gmail:read → google
+            calendar: "google", // calendar:read → google (if ambiguous, use project default)
+            microsoft: "microsoft",
+            outlook: "microsoft",
+            slack: "slack",
+            auth0: "auth0",
+            okta: "okta",
+        };
+        // Find unique provider
+        const providers = new Set(scopePrefixes.map((prefix) => providerMap[prefix]).filter(Boolean));
+        if (providers.size === 1) {
+            return Array.from(providers)[0];
+        }
+        // Ambiguous or no prefix → return null (use project-level provider)
+        return null;
+    }
+}
+exports.ProviderResolver = ProviderResolver;
+//# sourceMappingURL=provider-resolver.js.map

package/dist/services/provider-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-resolver.js","sourceRoot":"","sources":["../../src/services/provider-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAMH;;;;;;;;GAQG;AACH,MAAa,gBAAgB;IAEjB;IACA;IAFV,YACU,QAA+B,EAC/B,aAAiC;QADjC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,kBAAa,GAAb,aAAa,CAAoB;IACxC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,cAA8B,EAC9B,SAAiB;QAEjB,0DAA0D;QAC1D,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;YACjC,4CAA4C;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,aAAa,cAAc,CAAC,aAAa,iCAAiC,SAAS,KAAK;oBACtF,mCAAmC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,aAAa,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CACnD,cAAc,CAAC,cAAc,IAAI,EAAE,CACpC,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,4CAA4C;YAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,GAAG,CACT,yCAAyC,gBAAgB,eAAe,CACzE,CAAC;gBACF,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,yFAAyF;QACzF,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAEjE,IAAI,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CACV,0DAA0D;gBACxD,sCAAsC,kBAAkB,iBAAiB;gBACzE,sEAAsE,CACzE,CAAC;YACF,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,iDAAiD;QACjD,gFAAgF;QAChF,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,KAAK;YAC9E,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,MAAgB;QAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAA2B;YAC1C,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,EAAE,sBAAsB;YACvC,QAAQ,EAAE,QAAQ,EAAE,6DAA6D;YACjF,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACnE,CAAC;QAEF,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA1HD,4CA0HC"}

package/dist/services/provider-validator.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Provider Validator
+ *
+ * Validates OAuth provider configurations for custom IDP support.
+ * Ensures provider configurations are valid before registration.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { OAuthProvider } from "@kya-os/contracts/config";
+/**
+ * Validation error for provider configuration issues
+ */
+export declare class ProviderValidationError extends Error {
+    readonly field?: string | undefined;
+    constructor(message: string, field?: string | undefined);
+}
+/**
+ * Service for validating OAuth provider configurations
+ */
+export declare class ProviderValidator {
+    /**
+     * Validate provider configuration
+     *
+     * @param provider - Provider configuration to validate
+     * @param name - Provider name (for error messages)
+     * @throws ProviderValidationError if validation fails
+     */
+    validate(provider: OAuthProvider, name: string): void;
+    /**
+     * Validate URL format
+     *
+     * @param url - URL to validate
+     * @param providerName - Provider name (for error messages)
+     * @param fieldName - Field name (for error messages)
+     * @throws ProviderValidationError if URL is invalid
+     */
+    private validateUrl;
+    /**
+     * Validate custom parameters don't override reserved OAuth parameters
+     *
+     * @param customParams - Custom parameters to validate
+     * @param providerName - Provider name (for error messages)
+     * @throws ProviderValidationError if reserved parameter is overridden
+     */
+    private validateCustomParams;
+    /**
+     * Test provider endpoint reachability (optional)
+     *
+     * @param provider - Provider configuration
+     * @param fetchProvider - Fetch implementation
+     * @returns True if endpoint is reachable, false otherwise
+     */
+    testProvider(provider: OAuthProvider, fetchProvider: typeof fetch): Promise<boolean>;
+}
+//# sourceMappingURL=provider-validator.d.ts.map

package/dist/services/provider-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-validator.d.ts","sourceRoot":"","sources":["../../src/services/provider-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAe9D;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aACH,KAAK,CAAC,EAAE,MAAM;gBAA/C,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,MAAM,YAAA;CAI5D;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IA6CrD;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAoBnB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAqB5B;;;;;;OAMG;IACG,YAAY,CAChB,QAAQ,EAAE,aAAa,EACvB,aAAa,EAAE,OAAO,KAAK,GAC1B,OAAO,CAAC,OAAO,CAAC;CAYpB"}

package/dist/services/provider-validator.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Provider Validator
+ *
+ * Validates OAuth provider configurations for custom IDP support.
+ * Ensures provider configurations are valid before registration.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderValidator = exports.ProviderValidationError = void 0;
+/**
+ * Reserved OAuth parameters that cannot be overridden by custom parameters
+ */
+const RESERVED_PARAMETERS = [
+    "response_type",
+    "client_id",
+    "redirect_uri",
+    "scope",
+    "state",
+    "code_challenge",
+    "code_challenge_method",
+];
+/**
+ * Validation error for provider configuration issues
+ */
+class ProviderValidationError extends Error {
+    field;
+    constructor(message, field) {
+        super(message);
+        this.field = field;
+        this.name = "ProviderValidationError";
+    }
+}
+exports.ProviderValidationError = ProviderValidationError;
+/**
+ * Service for validating OAuth provider configurations
+ */
+class ProviderValidator {
+    /**
+     * Validate provider configuration
+     *
+     * @param provider - Provider configuration to validate
+     * @param name - Provider name (for error messages)
+     * @throws ProviderValidationError if validation fails
+     */
+    validate(provider, name) {
+        // Validate required fields
+        if (!provider.clientId || provider.clientId.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have a clientId`, "clientId");
+        }
+        if (!provider.authorizationUrl || provider.authorizationUrl.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have an authorizationUrl`, "authorizationUrl");
+        }
+        if (!provider.tokenUrl || provider.tokenUrl.trim().length === 0) {
+            throw new ProviderValidationError(`Provider "${name}" must have a tokenUrl`, "tokenUrl");
+        }
+        // Validate URL formats
+        this.validateUrl(provider.authorizationUrl, name, "authorizationUrl");
+        this.validateUrl(provider.tokenUrl, name, "tokenUrl");
+        if (provider.userInfoUrl) {
+            this.validateUrl(provider.userInfoUrl, name, "userInfoUrl");
+        }
+        // Validate proxy mode requirements
+        if (provider.proxyMode && !provider.requiresClientSecret) {
+            throw new ProviderValidationError(`Provider "${name}" with proxyMode=true must have requiresClientSecret=true`, "proxyMode");
+        }
+        // Validate custom parameters don't conflict with reserved parameters
+        if (provider.customParams) {
+            this.validateCustomParams(provider.customParams, name);
+        }
+    }
+    /**
+     * Validate URL format
+     *
+     * @param url - URL to validate
+     * @param providerName - Provider name (for error messages)
+     * @param fieldName - Field name (for error messages)
+     * @throws ProviderValidationError if URL is invalid
+     */
+    validateUrl(url, providerName, fieldName) {
+        try {
+            const parsedUrl = new URL(url);
+            if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+                throw new ProviderValidationError(`Provider "${providerName}" ${fieldName} must use HTTP or HTTPS protocol`, fieldName);
+            }
+        }
+        catch (error) {
+            if (error instanceof ProviderValidationError) {
+                throw error;
+            }
+            throw new ProviderValidationError(`Provider "${providerName}" ${fieldName} is not a valid URL: ${error instanceof Error ? error.message : String(error)}`, fieldName);
+        }
+    }
+    /**
+     * Validate custom parameters don't override reserved OAuth parameters
+     *
+     * @param customParams - Custom parameters to validate
+     * @param providerName - Provider name (for error messages)
+     * @throws ProviderValidationError if reserved parameter is overridden
+     */
+    validateCustomParams(customParams, providerName) {
+        for (const [key, value] of Object.entries(customParams)) {
+            const normalizedKey = key.toLowerCase();
+            if (RESERVED_PARAMETERS.includes(normalizedKey)) {
+                throw new ProviderValidationError(`Provider "${providerName}" custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMETERS.join(", ")}`, `customParams.${key}`);
+            }
+            if (!value || value.trim().length === 0) {
+                throw new ProviderValidationError(`Provider "${providerName}" custom parameter "${key}" has empty value`, `customParams.${key}`);
+            }
+        }
+    }
+    /**
+     * Test provider endpoint reachability (optional)
+     *
+     * @param provider - Provider configuration
+     * @param fetchProvider - Fetch implementation
+     * @returns True if endpoint is reachable, false otherwise
+     */
+    async testProvider(provider, fetchProvider) {
+        try {
+            // Test authorization URL (HEAD request to avoid triggering OAuth flow)
+            const authResponse = await fetchProvider(provider.authorizationUrl, {
+                method: "HEAD",
+                signal: AbortSignal.timeout(5000), // 5 second timeout
+            });
+            return authResponse.ok || authResponse.status === 405; // 405 Method Not Allowed is OK
+        }
+        catch (error) {
+            return false;
+        }
+    }
+}
+exports.ProviderValidator = ProviderValidator;
+//# sourceMappingURL=provider-validator.js.map

package/dist/services/provider-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-validator.js","sourceRoot":"","sources":["../../src/services/provider-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIH;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX;;GAEG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IACH;IAA7C,YAAY,OAAe,EAAkB,KAAc;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAS;QAEzD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED;;GAEG;AACH,MAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAuB,EAAE,IAAY;QAC5C,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,wBAAwB,EACzC,UAAU,CACX,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,iCAAiC,EAClD,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,wBAAwB,EACzC,UAAU,CACX,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAEtD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;QAED,mCAAmC;QACnC,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,IAAI,2DAA2D,EAC5E,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,GAAW,EAAE,YAAoB,EAAE,SAAiB;QACtE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,KAAK,SAAS,kCAAkC,EACzE,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,KAAK,SAAS,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACvH,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,YAAoC,EACpC,YAAoB;QAEpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,aAAoB,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,uBAAuB,GAAG,mEAAmE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtJ,gBAAgB,GAAG,EAAE,CACtB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,uBAAuB,CAC/B,aAAa,YAAY,uBAAuB,GAAG,mBAAmB,EACtE,gBAAgB,GAAG,EAAE,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,QAAuB,EACvB,aAA2B;QAE3B,IAAI,CAAC;YACH,uEAAuE;YACvE,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBAClE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,mBAAmB;aACvD,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,+BAA+B;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAnID,8CAmIC"}

package/dist/services/session-registration.service.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with the AgentShield dashboard, enabling
+ * visibility into which MCP clients are connecting to agents.
+ *
+ * This is a fire-and-forget service - session registration should not
+ * block tool execution or affect the user experience.
+ *
+ * @package @kya-os/mcp-i-core
+ */
+import type { RegisterSessionRequest } from "@kya-os/contracts/agentshield-api";
+import type { FetchProvider } from "../providers/base.js";
+/**
+ * Configuration for the session registration service
+ */
+export interface SessionRegistrationServiceConfig {
+    /** Base URL for the AgentShield API (e.g., "https://kya.vouched.id") */
+    baseUrl: string;
+    /** API key for authentication */
+    apiKey: string;
+    /** Fetch provider for making HTTP requests (platform-agnostic) */
+    fetchProvider: FetchProvider;
+    /** Optional logger callback for diagnostics */
+    logger?: (message: string, data?: unknown) => void;
+    /** Timeout in milliseconds for the registration request (default: 5000) */
+    timeoutMs?: number;
+}
+/**
+ * Result of a session registration attempt
+ */
+export interface SessionRegistrationResult {
+    /** Whether registration was successful */
+    success: boolean;
+    /** Session ID that was registered */
+    sessionId: string;
+    /** Error message if registration failed */
+    error?: string;
+}
+/**
+ * Session Registration Service
+ *
+ * Registers MCP sessions with AgentShield for dashboard visibility.
+ * Designed to be non-blocking - failures are logged but don't throw.
+ */
+export declare class SessionRegistrationService {
+    private config;
+    constructor(config: SessionRegistrationServiceConfig);
+    /**
+     * Register a session with AgentShield
+     *
+     * This is a fire-and-forget operation. Failures are logged but don't throw.
+     * The method returns quickly and doesn't block the caller.
+     *
+     * @param request - Session registration request data
+     * @returns Result indicating success or failure
+     */
+    registerSession(request: RegisterSessionRequest): Promise<SessionRegistrationResult>;
+    /**
+     * Fire-and-forget session registration
+     *
+     * Starts registration in the background without waiting for completion.
+     * Useful when you want to register a session but not delay the response.
+     *
+     * @param request - Session registration request data
+     */
+    registerSessionAsync(request: RegisterSessionRequest): void;
+}
+/**
+ * Create a session registration service from common runtime config
+ *
+ * Helper function to create the service from typical environment config.
+ */
+export declare function createSessionRegistrationService(options: {
+    apiUrl: string;
+    apiKey: string;
+    fetchProvider: FetchProvider;
+    logger?: (message: string, data?: unknown) => void;
+}): SessionRegistrationService | null;
+//# sourceMappingURL=session-registration.service.d.ts.map

package/dist/services/session-registration.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registration.service.d.ts","sourceRoot":"","sources":["../../src/services/session-registration.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,mCAAmC,CAAC;AAM3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IAEf,kEAAkE;IAClE,aAAa,EAAE,aAAa,CAAC;IAE7B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAEnD,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAKZ;gBAEU,MAAM,EAAE,gCAAgC;IAUpD;;;;;;;;OAQG;IACG,eAAe,CACnB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;IA6KrC;;;;;;;OAOG;IACH,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;CAc5D;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD,GAAG,0BAA0B,GAAG,IAAI,CAmBpC"}