@nestr/mcp 0.1.53 → 0.1.55

package/build/oauth/storage.js

@@ -1,238 +1,33 @@
 /**
- * Persistent Storage for OAuth Data
+ * Backward-compatibility re-exports from the OAuthStore abstraction.
  *
- * Stores registered OAuth clients and pending auth requests to disk.
- * Uses a simple JSON file-based storage that persists across restarts.
- * OAuth sessions are encrypted at rest using AES-256-GCM.
- */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
-import { randomBytes, createCipheriv, createDecipheriv, timingSafeEqual } from "node:crypto";
-// Storage directory - use /data in production (mounted volume), fallback to local .data
-const STORAGE_DIR = process.env.OAUTH_STORAGE_DIR ||
-    (process.env.NODE_ENV === "production" ? "/data" : ".data");
-const CLIENTS_FILE = join(STORAGE_DIR, "oauth-clients.json");
-const PENDING_AUTH_FILE = join(STORAGE_DIR, "pending-auth.json");
-const SESSIONS_FILE_ENCRYPTED = join(STORAGE_DIR, "oauth-sessions.enc");
-const SESSIONS_FILE_PLAINTEXT = join(STORAGE_DIR, "oauth-sessions.json");
-// Encryption constants
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 16;
-/**
- * Check if encryption is enabled (OAUTH_ENCRYPTION_KEY env var is set)
- */
-function isEncryptionEnabled() {
-    return !!process.env.OAUTH_ENCRYPTION_KEY;
-}
-/**
- * Get the encryption key from environment variable.
- * Returns null if not set.
- */
-function getEncryptionKey() {
-    if (!process.env.OAUTH_ENCRYPTION_KEY) {
-        return null;
-    }
-    const key = Buffer.from(process.env.OAUTH_ENCRYPTION_KEY, "base64");
-    if (key.length !== 32) {
-        throw new Error("OAUTH_ENCRYPTION_KEY must be 32 bytes (256 bits) base64-encoded");
-    }
-    return key;
-}
-/**
- * Encrypt data using AES-256-GCM
- */
-function encrypt(data, key) {
-    const iv = randomBytes(IV_LENGTH);
-    const cipher = createCipheriv(ALGORITHM, key, iv);
-    let encrypted = cipher.update(data, "utf8", "base64");
-    encrypted += cipher.final("base64");
-    const authTag = cipher.getAuthTag();
-    // Format: iv:authTag:encryptedData (all base64)
-    return `${iv.toString("base64")}:${authTag.toString("base64")}:${encrypted}`;
-}
-/**
- * Decrypt data using AES-256-GCM
+ * All types and the store singleton are canonical in store.ts.
+ * This file provides synchronous-looking wrappers that delegate to the
+ * initialized store for callers that haven't migrated yet.
+ *
+ * TODO: Remove this file once all callers import from store.ts directly.
  */
-function decrypt(encryptedData, key) {
-    const parts = encryptedData.split(":");
-    if (parts.length !== 3) {
-        throw new Error("Invalid encrypted data format");
-    }
-    const iv = Buffer.from(parts[0], "base64");
-    const authTag = Buffer.from(parts[1], "base64");
-    const data = parts[2];
-    const decipher = createDecipheriv(ALGORITHM, key, iv);
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(data, "base64", "utf8");
-    decrypted += decipher.final("utf8");
-    return decrypted;
-}
+import { timingSafeEqual } from "node:crypto";
+import { getStore } from "./store.js";
 /**
  * Constant-time string comparison to prevent timing attacks on secrets.
- * Uses crypto.timingSafeEqual under the hood.
+ * Standalone utility — not part of the store interface.
  */
 export function constantTimeCompare(a, b) {
     const bufA = Buffer.from(a);
     const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length) {
+    if (bufA.length !== bufB.length)
         return false;
-    }
     return timingSafeEqual(bufA, bufB);
 }
-// In-memory cache backed by disk
-let clientsCache = null;
-let pendingAuthCache = null;
-let sessionsCache = null;
 /**
- * Ensure storage directory exists
+ * Validate redirect URI against a registered client's allowed URIs.
+ * Accepts the client object directly to avoid an extra async lookup.
  */
-function ensureStorageDir() {
-    if (!existsSync(STORAGE_DIR)) {
-        mkdirSync(STORAGE_DIR, { recursive: true });
-    }
-}
-/**
- * Load registered clients from disk
- */
-function loadClients() {
-    if (clientsCache)
-        return clientsCache;
-    ensureStorageDir();
-    clientsCache = new Map();
-    if (existsSync(CLIENTS_FILE)) {
-        try {
-            const data = JSON.parse(readFileSync(CLIENTS_FILE, "utf-8"));
-            for (const [id, client] of Object.entries(data)) {
-                clientsCache.set(id, client);
-            }
-            console.log(`Loaded ${clientsCache.size} registered OAuth clients`);
-        }
-        catch (error) {
-            console.error("Failed to load OAuth clients:", error);
-        }
-    }
-    return clientsCache;
-}
-/**
- * Save registered clients to disk
- */
-function saveClients() {
-    if (!clientsCache)
-        return;
-    ensureStorageDir();
-    const data = {};
-    for (const [id, client] of clientsCache) {
-        data[id] = client;
-    }
-    try {
-        writeFileSync(CLIENTS_FILE, JSON.stringify(data, null, 2));
-    }
-    catch (error) {
-        console.error("Failed to save OAuth clients:", error);
-    }
-}
-/**
- * Load pending auth requests from disk
- */
-function loadPendingAuth() {
-    if (pendingAuthCache)
-        return pendingAuthCache;
-    ensureStorageDir();
-    pendingAuthCache = new Map();
-    if (existsSync(PENDING_AUTH_FILE)) {
-        try {
-            const data = JSON.parse(readFileSync(PENDING_AUTH_FILE, "utf-8"));
-            const now = Date.now();
-            const TTL = 5 * 60 * 1000; // 5 minutes
-            for (const [state, pending] of Object.entries(data)) {
-                const p = pending;
-                // Only load non-expired entries
-                if (now - p.createdAt < TTL) {
-                    pendingAuthCache.set(state, p);
-                }
-            }
-        }
-        catch (error) {
-            console.error("Failed to load pending auth:", error);
-        }
-    }
-    return pendingAuthCache;
-}
-/**
- * Save pending auth requests to disk
- */
-function savePendingAuth() {
-    if (!pendingAuthCache)
-        return;
-    ensureStorageDir();
-    const data = {};
-    for (const [state, pending] of pendingAuthCache) {
-        data[state] = pending;
-    }
-    try {
-        writeFileSync(PENDING_AUTH_FILE, JSON.stringify(data, null, 2));
-    }
-    catch (error) {
-        console.error("Failed to save pending auth:", error);
-    }
-}
-// ============ Client Registration ============
-/**
- * Register a new OAuth client
- */
-export function registerClient(client) {
-    const clients = loadClients();
-    clients.set(client.client_id, client);
-    saveClients();
-    console.log(`Registered OAuth client: ${client.client_id}`);
-}
-/**
- * Get a registered client by ID
- */
-export function getClient(clientId) {
-    const clients = loadClients();
-    return clients.get(clientId);
-}
-/**
- * Get the total number of registered clients
- */
-export function getClientCount() {
-    return loadClients().size;
-}
-/**
- * Check if a client ID exists
- */
-export function clientExists(clientId) {
-    const clients = loadClients();
-    return clients.has(clientId);
-}
-/**
- * Validate client credentials
- */
-export function validateClientCredentials(clientId, clientSecret) {
-    const client = getClient(clientId);
-    if (!client)
-        return false;
-    // If client has no secret (public client), accept
-    if (!client.client_secret)
-        return true;
-    // Otherwise validate secret using constant-time comparison
-    return constantTimeCompare(client.client_secret, clientSecret || "");
-}
-/**
- * Validate redirect URI for a client
- */
-export function validateRedirectUri(clientId, redirectUri) {
-    const client = getClient(clientId);
-    if (!client)
-        return false;
+export function validateRedirectUri(client, redirectUri) {
     return client.redirect_uris.some((uri) => {
-        // Exact match or localhost with any port
         if (uri === redirectUri)
             return true;
-        // Handle localhost wildcards (common for CLI tools)
-        // Per RFC 8252, localhost redirects should use http: and we treat
-        // localhost and 127.0.0.1 as equivalent.
         try {
             const registered = new URL(uri);
             const requested = new URL(redirectUri);
@@ -251,289 +46,42 @@ export function validateRedirectUri(clientId, redirectUri) {
         return false;
     });
 }
-// ============ Pending Auth with PKCE ============
-/**
- * Store a pending auth request
- */
-export function storePendingAuth(pending) {
-    const cache = loadPendingAuth();
-    cache.set(pending.state, pending);
-    savePendingAuth();
-}
-/**
- * Get and remove a pending auth request
- */
-export function consumePendingAuth(state) {
-    const cache = loadPendingAuth();
-    const pending = cache.get(state);
-    if (!pending)
-        return undefined;
-    // Check if expired (5 minutes)
-    if (Date.now() - pending.createdAt > 5 * 60 * 1000) {
-        cache.delete(state);
-        savePendingAuth();
-        return undefined;
-    }
-    // Remove from cache (one-time use)
-    cache.delete(state);
-    savePendingAuth();
-    return pending;
-}
-/**
- * Cleanup expired pending auth requests
- */
-export function cleanupExpiredPendingAuth() {
-    const cache = loadPendingAuth();
-    const now = Date.now();
-    const TTL = 5 * 60 * 1000;
-    let cleaned = 0;
-    for (const [state, pending] of cache) {
-        if (now - pending.createdAt > TTL) {
-            cache.delete(state);
-            cleaned++;
-        }
-    }
-    if (cleaned > 0) {
-        savePendingAuth();
-    }
-}
-// ============ PKCE Code Storage ============
-// Stores PKCE challenges indexed by authorization code for token exchange verification
-const PKCE_FOR_CODE_FILE = join(STORAGE_DIR, "pkce-codes.json");
-let pkceForCodeCache = null;
-function loadPkceForCode() {
-    if (pkceForCodeCache)
-        return pkceForCodeCache;
-    ensureStorageDir();
-    pkceForCodeCache = new Map();
-    if (existsSync(PKCE_FOR_CODE_FILE)) {
-        try {
-            const data = JSON.parse(readFileSync(PKCE_FOR_CODE_FILE, "utf-8"));
-            const now = Date.now();
-            const TTL = 5 * 60 * 1000;
-            for (const [code, pkce] of Object.entries(data)) {
-                const p = pkce;
-                if (now - p.createdAt < TTL) {
-                    pkceForCodeCache.set(code, p);
-                }
-            }
-        }
-        catch {
-            pkceForCodeCache = new Map();
-        }
-    }
-    return pkceForCodeCache;
+// ============ Async store delegates ============
+// These are used by callers that haven't migrated to the store interface yet.
+export async function registerClient(...args) {
+    return getStore().registerClient(...args);
 }
-function savePkceForCode() {
-    if (!pkceForCodeCache)
-        return;
-    ensureStorageDir();
-    const data = {};
-    for (const [code, pkce] of pkceForCodeCache) {
-        data[code] = pkce;
-    }
-    try {
-        writeFileSync(PKCE_FOR_CODE_FILE, JSON.stringify(data, null, 2));
-    }
-    catch (error) {
-        console.error("Failed to save PKCE codes:", error);
-    }
+export async function getClient(...args) {
+    return getStore().getClient(...args);
 }
-export function storePkceForCode(code, codeChallenge, codeChallengeMethod) {
-    const cache = loadPkceForCode();
-    cache.set(code, {
-        codeChallenge,
-        codeChallengeMethod,
-        createdAt: Date.now(),
-    });
-    savePkceForCode();
+export async function getClientCount() {
+    return getStore().getClientCount();
 }
-export function consumePkceForCode(code) {
-    const cache = loadPkceForCode();
-    const pkce = cache.get(code);
-    if (!pkce)
-        return undefined;
-    if (Date.now() - pkce.createdAt > 5 * 60 * 1000) {
-        cache.delete(code);
-        savePkceForCode();
-        return undefined;
-    }
-    cache.delete(code);
-    savePkceForCode();
-    return pkce;
+export async function clientExists(...args) {
+    return getStore().clientExists(...args);
 }
-// ============ OAuth Sessions ============
-// Uses plaintext storage by default, encrypted storage when OAUTH_ENCRYPTION_KEY is set
-/**
- * Migrate plaintext sessions to encrypted format when encryption key is added
- */
-function migrateToEncrypted(key) {
-    if (!existsSync(SESSIONS_FILE_PLAINTEXT)) {
-        return null;
-    }
-    try {
-        const data = JSON.parse(readFileSync(SESSIONS_FILE_PLAINTEXT, "utf-8"));
-        const sessions = new Map();
-        for (const [id, session] of Object.entries(data)) {
-            sessions.set(id, session);
-        }
-        console.log(`Migrating ${sessions.size} OAuth sessions from plaintext to encrypted storage`);
-        // Save encrypted version
-        const plaintext = JSON.stringify(data);
-        const encrypted = encrypt(plaintext, key);
-        writeFileSync(SESSIONS_FILE_ENCRYPTED, encrypted, { mode: 0o600 });
-        // Remove plaintext file
-        unlinkSync(SESSIONS_FILE_PLAINTEXT);
-        console.log("Migration complete - plaintext sessions file removed");
-        return sessions;
-    }
-    catch (error) {
-        console.error("Failed to migrate sessions to encrypted:", error);
-        return null;
-    }
+export async function storePendingAuth(...args) {
+    return getStore().storePendingAuth(...args);
 }
-/**
- * Load OAuth sessions from disk
- * - If OAUTH_ENCRYPTION_KEY is set: uses encrypted storage, migrates plaintext if exists
- * - Otherwise: uses plaintext storage
- */
-function loadSessions() {
-    if (sessionsCache)
-        return sessionsCache;
-    ensureStorageDir();
-    sessionsCache = new Map();
-    const encryptionKey = getEncryptionKey();
-    if (encryptionKey) {
-        // Encryption enabled - use encrypted storage
-        if (existsSync(SESSIONS_FILE_ENCRYPTED)) {
-            try {
-                const encryptedData = readFileSync(SESSIONS_FILE_ENCRYPTED, "utf-8");
-                const decrypted = decrypt(encryptedData, encryptionKey);
-                const data = JSON.parse(decrypted);
-                for (const [id, session] of Object.entries(data)) {
-                    sessionsCache.set(id, session);
-                }
-                console.log(`Loaded ${sessionsCache.size} OAuth sessions (encrypted)`);
-            }
-            catch (error) {
-                console.error("Failed to load encrypted OAuth sessions (starting fresh):", error);
-                sessionsCache = new Map();
-            }
-        }
-        else {
-            // Try migrating from plaintext
-            const migrated = migrateToEncrypted(encryptionKey);
-            if (migrated) {
-                sessionsCache = migrated;
-            }
-        }
-    }
-    else {
-        // No encryption - use plaintext storage
-        if (existsSync(SESSIONS_FILE_PLAINTEXT)) {
-            try {
-                const data = JSON.parse(readFileSync(SESSIONS_FILE_PLAINTEXT, "utf-8"));
-                for (const [id, session] of Object.entries(data)) {
-                    sessionsCache.set(id, session);
-                }
-                console.log(`Loaded ${sessionsCache.size} OAuth sessions`);
-            }
-            catch (error) {
-                console.error("Failed to load OAuth sessions:", error);
-            }
-        }
-    }
-    return sessionsCache;
+export async function consumePendingAuth(...args) {
+    return getStore().consumePendingAuth(...args);
 }
-/**
- * Save OAuth sessions to disk
- * - If OAUTH_ENCRYPTION_KEY is set: saves encrypted
- * - Otherwise: saves plaintext
- */
-function saveSessions() {
-    if (!sessionsCache)
-        return;
-    ensureStorageDir();
-    const data = {};
-    for (const [id, session] of sessionsCache) {
-        data[id] = session;
-    }
-    const encryptionKey = getEncryptionKey();
-    try {
-        if (encryptionKey) {
-            // Save encrypted
-            const plaintext = JSON.stringify(data);
-            const encrypted = encrypt(plaintext, encryptionKey);
-            writeFileSync(SESSIONS_FILE_ENCRYPTED, encrypted, { mode: 0o600 });
-        }
-        else {
-            // Save plaintext
-            writeFileSync(SESSIONS_FILE_PLAINTEXT, JSON.stringify(data, null, 2));
-        }
-    }
-    catch (error) {
-        console.error("Failed to save OAuth sessions:", error);
-    }
+export async function storePkceForCode(...args) {
+    return getStore().storePkceForCode(...args);
 }
-/**
- * Store an OAuth session
- */
-export function storeSession(sessionId, session) {
-    const cache = loadSessions();
-    cache.set(sessionId, session);
-    saveSessions();
+export async function consumePkceForCode(...args) {
+    return getStore().consumePkceForCode(...args);
 }
-/**
- * Get an OAuth session by ID
- */
-export function getSession(sessionId) {
-    const cache = loadSessions();
-    return cache.get(sessionId);
+export async function storeSession(...args) {
+    return getStore().storeSession(...args);
 }
-/**
- * Update an existing OAuth session (e.g., after token refresh)
- */
-export function updateSession(sessionId, session) {
-    const cache = loadSessions();
-    if (cache.has(sessionId)) {
-        cache.set(sessionId, session);
-        saveSessions();
-    }
+export async function getSession(...args) {
+    return getStore().getSession(...args);
 }
-/**
- * Remove an OAuth session
- */
-export function removeSession(sessionId) {
-    const cache = loadSessions();
-    if (cache.delete(sessionId)) {
-        saveSessions();
-    }
+export async function updateSession(...args) {
+    return getStore().updateSession(...args);
 }
-/**
- * Cleanup expired OAuth sessions
- * Sessions are considered expired if their expiresAt time has passed
- * and they have no refresh token
- */
-export function cleanupExpiredSessions() {
-    const cache = loadSessions();
-    const now = Date.now();
-    let cleaned = 0;
-    for (const [sessionId, session] of cache) {
-        // Only remove if expired AND no refresh token
-        // Sessions with refresh tokens can be renewed
-        if (now >= session.expiresAt && !session.refreshToken) {
-            cache.delete(sessionId);
-            cleaned++;
-        }
-    }
-    if (cleaned > 0) {
-        saveSessions();
-        console.log(`Cleaned up ${cleaned} expired OAuth sessions`);
-    }
+export async function removeSession(...args) {
+    return getStore().removeSession(...args);
 }
-// Run cleanup every minute
-setInterval(() => {
-    cleanupExpiredPendingAuth();
-    cleanupExpiredSessions();
-}, 60000);
 //# sourceMappingURL=storage.js.map

package/build/oauth/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/oauth/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7F,wFAAwF;AACxF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAC/C,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAE9D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AACjE,MAAM,uBAAuB,GAAG,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AACxE,MAAM,uBAAuB,GAAG,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;AAEzE,uBAAuB;AACvB,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;GAEG;AACH,SAAS,mBAAmB;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAElD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,gDAAgD;IAChD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAC,aAAqB,EAAE,GAAW;IACjD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS,EAAE,CAAS;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AA8CD,iCAAiC;AACjC,IAAI,YAAY,GAAyC,IAAI,CAAC;AAC9D,IAAI,gBAAgB,GAA4C,IAAI,CAAC;AACrE,IAAI,aAAa,GAA2C,IAAI,CAAC;AAEjE;;GAEG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW;IAClB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,gBAAgB,EAAE,CAAC;IACnB,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;IAEzB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,MAA0B,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,UAAU,YAAY,CAAC,IAAI,2BAA2B,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC,YAAY;QAAE,OAAO;IAE1B,gBAAgB,EAAE,CAAC;IACnB,MAAM,IAAI,GAAqC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe;IACtB,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;IAE7B,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;YAEvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,OAA8B,CAAC;gBACzC,gCAAgC;gBAChC,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBAC5B,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,eAAe;IACtB,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAE9B,gBAAgB,EAAE,CAAC;IACnB,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxB,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,gDAAgD;AAEhD;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,YAAqB;IAErB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEvC,2DAA2D;IAC3D,OAAO,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,WAAmB;IAEnB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACvC,yCAAyC;QACzC,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAErC,oDAAoD;QACpD,kEAAkE;QAClE,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,EAAE,CACnC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,CAAC;YAEvD,IACE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAC5B,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC3B,UAAU,CAAC,QAAQ,KAAK,OAAO;gBAC/B,SAAS,CAAC,QAAQ,KAAK,OAAO;gBAC9B,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAC1C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mDAAmD;AAEnD;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA4B;IAC3D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa;IAEb,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACnD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,eAAe,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpB,eAAe,EAAE,CAAC;IAElB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,uFAAuF;AAEvF,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAChE,IAAI,gBAAgB,GAAwC,IAAI,CAAC;AAQjE,SAAS,eAAe;IACtB,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;IAE7B,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAE1B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,IAAuB,CAAC;gBAClC,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBAC5B,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAE9B,gBAAgB,EAAE,CAAC;IACnB,MAAM,IAAI,GAAoC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,aAAqB,EACrB,mBAA2B;IAE3B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QACd,aAAa;QACb,mBAAmB;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,eAAe,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAE5B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,eAAe,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnB,eAAe,EAAE,CAAC;IAElB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2CAA2C;AAC3C,wFAAwF;AAExF;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;QAEvD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAA6B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,IAAI,qDAAqD,CAAC,CAAC;QAE7F,yBAAyB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1C,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnE,wBAAwB;QACxB,UAAU,CAAC,uBAAuB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QAEpE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,gBAAgB,EAAE,CAAC;IACnB,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;IAE1B,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,6CAA6C;QAC7C,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;gBACrE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACnC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,OAA6B,CAAC,CAAC;gBACvD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,UAAU,aAAa,CAAC,IAAI,6BAA6B,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;gBAClF,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,+BAA+B;YAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,GAAG,QAAQ,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC;gBACxE,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,OAA6B,CAAC,CAAC;gBACvD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,UAAU,aAAa,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,gBAAgB,EAAE,CAAC;IACnB,MAAM,IAAI,GAAuC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,IAAI,CAAC;QACH,IAAI,aAAa,EAAE,CAAC;YAClB,iBAAiB;YACjB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACpD,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,aAAa,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,OAA2B;IACzE,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,OAA2B;IAC1E,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9B,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,YAAY,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,8CAA8C;QAC9C,8CAA8C;QAC9C,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACtD,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,yBAAyB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,2BAA2B;AAC3B,WAAW,CAAC,GAAG,EAAE;IACf,yBAAyB,EAAE,CAAC;IAC5B,sBAAsB,EAAE,CAAC;AAC3B,CAAC,EAAE,KAAK,CAAC,CAAC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/oauth/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAUtC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS,EAAE,CAAS;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmC,EACnC,WAAmB;IAEnB,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACvC,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,EAAE,CACnC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,CAAC;YAEvD,IACE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAC5B,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC3B,UAAU,CAAC,QAAQ,KAAK,OAAO;gBAC/B,SAAS,CAAC,QAAQ,KAAK,OAAO;gBAC9B,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAC1C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAG,IAA+D;IACrG,OAAO,QAAQ,EAAE,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAG,IAA0D;IAC3F,OAAO,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,OAAO,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAG,IAA6D;IACjG,OAAO,QAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAG,IAAiE;IACzG,OAAO,QAAQ,EAAE,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAG,IAAmE;IAC7G,OAAO,QAAQ,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAG,IAAiE;IACzG,OAAO,QAAQ,EAAE,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAG,IAAmE;IAC7G,OAAO,QAAQ,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAG,IAA6D;IACjG,OAAO,QAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,IAA2D;IAC7F,OAAO,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAG,IAA8D;IACnG,OAAO,QAAQ,EAAE,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAG,IAA8D;IACnG,OAAO,QAAQ,EAAE,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/build/oauth/store.d.ts

@@ -0,0 +1,80 @@
+/**
+ * OAuthStore Interface
+ *
+ * Abstraction layer for OAuth state storage. Two implementations:
+ * - FileStore (default): JSON files on disk, for local dev and stdio mode
+ * - RedisStore: Redis-backed, for multi-pod production deployment (REDIS_URL)
+ */
+/**
+ * Registered OAuth Client (RFC 7591)
+ */
+export interface RegisteredClient {
+    client_id: string;
+    client_secret?: string;
+    client_name?: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
+    token_endpoint_auth_method: string;
+    scope?: string;
+    registered_at: number;
+}
+/**
+ * Pending OAuth authorization with PKCE
+ */
+export interface PendingAuthWithPKCE {
+    state: string;
+    redirectUri: string;
+    clientId: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+    createdAt: number;
+    scope?: string;
+    /** Identifier for the MCP client (e.g., "claude-code", "cursor") for token metadata */
+    clientConsumer?: string;
+    /** GA4 client_id for cross-domain analytics tracking */
+    gaClientId?: string;
+}
+/**
+ * Stored OAuth session after successful authentication
+ */
+export interface StoredOAuthSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    scope?: string;
+    /** Nestr user ID for analytics (GA4 user_id) */
+    userId?: string;
+}
+/**
+ * PKCE challenge data indexed by authorization code
+ */
+export interface PkceForCodeData {
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    createdAt: number;
+}
+export interface OAuthStore {
+    registerClient(client: RegisteredClient): Promise<void>;
+    getClient(clientId: string): Promise<RegisteredClient | undefined>;
+    getClientCount(): Promise<number>;
+    clientExists(clientId: string): Promise<boolean>;
+    storePendingAuth(pending: PendingAuthWithPKCE): Promise<void>;
+    consumePendingAuth(state: string): Promise<PendingAuthWithPKCE | undefined>;
+    storePkceForCode(code: string, codeChallenge: string, codeChallengeMethod: string): Promise<void>;
+    consumePkceForCode(code: string): Promise<PkceForCodeData | undefined>;
+    storeSession(sessionId: string, session: StoredOAuthSession): Promise<void>;
+    getSession(sessionId: string): Promise<StoredOAuthSession | undefined>;
+    updateSession(sessionId: string, session: StoredOAuthSession): Promise<void>;
+    removeSession(sessionId: string): Promise<void>;
+    close(): Promise<void>;
+}
+/**
+ * Initialize the global store. Must be called once at startup (before handling requests).
+ */
+export declare function initStore(): Promise<OAuthStore>;
+/**
+ * Get the initialized store. Throws if initStore() hasn't been called.
+ */
+export declare function getStore(): OAuthStore;
+//# sourceMappingURL=store.d.ts.map