@ni-c/mcp-hub 0.9.2 → 0.10.0

package/dist/auth/private-key-jwt.js

@@ -0,0 +1,213 @@
+import { createLocalJWKSet, createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+import { isClientIdMetadataUrl } from './cimd.js';
+import { logSafe } from './text.js';
+/**
+ * RFC 7523 client authentication for Client ID Metadata Document clients.
+ *
+ * A CIMD client cannot hold a shared secret, so a confidential one proves
+ * itself with a JWT signed by a key published in its own metadata document.
+ * ChatGPT's connectors take exactly this path.
+ *
+ * This runs ahead of the SDK's token handler and, on success, rewrites the
+ * request body into the shape that handler already understands: a client_id
+ * and no secret. The SDK then looks the client up through the same
+ * clientsStore.getClient() that CIMD hooks into, so authorization, token and
+ * refresh all agree on one client record.
+ */
+export const CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+/** RFC 7523 §3: assertions are single-use and short-lived. Anything longer is
+ *  a replay window we would have to remember. */
+const MAX_ASSERTION_LIFETIME_S = 5 * 60;
+const CLOCK_TOLERANCE_S = 60;
+const MAX_REPLAY_ENTRIES = 5_000;
+const SUPPORTED_ALGS = ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512', 'EdDSA'];
+/** Remote key sets are cached per jwks_uri, and the URI comes out of a document
+ *  an unauthenticated caller pointed us at — so the cache needs a ceiling. */
+const MAX_REMOTE_KEY_SETS = 50;
+/** jti values already redeemed, dropped once the assertion that carried them
+ *  could no longer be valid anyway. */
+export class ReplayGuard {
+    maxEntries;
+    seen = new Map();
+    constructor(maxEntries = MAX_REPLAY_ENTRIES) {
+        this.maxEntries = maxEntries;
+    }
+    /** False when this jti has been used before. */
+    admit(jti, expiresAtMs) {
+        this.sweep();
+        if (this.seen.has(jti))
+            return false;
+        // A flood of distinct assertions must not grow this without bound; the
+        // sweep only removes expired ones.
+        if (this.seen.size >= this.maxEntries)
+            return false;
+        this.seen.set(jti, expiresAtMs);
+        return true;
+    }
+    sweep() {
+        const now = Date.now();
+        for (const [jti, expiresAt] of this.seen) {
+            if (expiresAt <= now)
+                this.seen.delete(jti);
+        }
+    }
+}
+export function privateKeyJwtAuth(options) {
+    const replay = new ReplayGuard();
+    const remoteKeys = new Map();
+    return async (req, res, next) => {
+        const body = req.body;
+        const assertion = body?.client_assertion;
+        const refuse = (reason) => {
+            console.warn(`mcp-hub: client assertion refused: ${logSafe(reason)}`);
+            res.status(400).json({ error: 'invalid_client', error_description: 'Client authentication failed' });
+        };
+        if (body?.client_assertion_type === undefined && assertion === undefined) {
+            // Nothing to verify — but "no credentials" must not be a way to be
+            // treated as a public client. The SDK's client authentication only ever
+            // looks for a client_secret, and a CIMD client never has one, so a
+            // confidential client that simply omits its assertion would otherwise be
+            // let through on its client_id alone. That is the whole guarantee
+            // private_key_jwt exists to provide.
+            if (!(await requiresAssertion(body?.client_id, options.resolver))) {
+                next();
+                return;
+            }
+            refuse(`${String(body?.client_id)} declares private_key_jwt and must present a client assertion`);
+            return;
+        }
+        if (body?.client_assertion_type !== CLIENT_ASSERTION_TYPE) {
+            refuse(`unsupported client_assertion_type ${String(body?.client_assertion_type)}`);
+            return;
+        }
+        if (typeof assertion !== 'string' || assertion.length === 0) {
+            refuse('client_assertion is missing');
+            return;
+        }
+        try {
+            const clientId = clientIdFromAssertion(assertion, typeof body.client_id === 'string' ? body.client_id : undefined);
+            if (!isClientIdMetadataUrl(clientId)) {
+                refuse('client assertions are only accepted for client ID metadata documents');
+                return;
+            }
+            const client = await options.resolver.resolve(clientId);
+            if (!client) {
+                refuse(`no usable metadata document for ${clientId}`);
+                return;
+            }
+            if (client.token_endpoint_auth_method !== 'private_key_jwt') {
+                refuse(`${clientId} does not declare private_key_jwt`);
+                return;
+            }
+            const keys = keySource(client, options.resolver, remoteKeys);
+            const { payload } = await jwtVerify(assertion, keys, {
+                issuer: clientId,
+                subject: clientId,
+                algorithms: SUPPORTED_ALGS,
+                clockTolerance: CLOCK_TOLERANCE_S
+            });
+            const failure = checkClaims(payload, options);
+            if (failure) {
+                refuse(failure);
+                return;
+            }
+            if (!replay.admit(payload.jti, payload.exp * 1000)) {
+                refuse(`jti ${payload.jti} was already used`);
+                return;
+            }
+            // Hand the SDK a plain public-client request. The stored record carries
+            // no client_secret, so its middleware asks for none.
+            delete body.client_assertion;
+            delete body.client_assertion_type;
+            body.client_id = clientId;
+            next();
+        }
+        catch (error) {
+            refuse(error.message);
+        }
+    };
+}
+/**
+ * RFC 7523 allows the client_id form parameter to be omitted when the
+ * assertion carries the identity. Reading `iss` before verification is safe
+ * because it only selects which keys to verify against — a forged value
+ * resolves to a document whose keys will not match the signature.
+ */
+function clientIdFromAssertion(assertion, formClientId) {
+    const segments = assertion.split('.');
+    if (segments.length !== 3)
+        throw new Error('client_assertion is not a JWS');
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(segments[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('client_assertion payload is not JSON');
+    }
+    if (typeof claims.iss !== 'string' || claims.iss.length === 0)
+        throw new Error('client_assertion has no iss');
+    if (formClientId !== undefined && formClientId !== claims.iss)
+        throw new Error('client_id does not match the assertion issuer');
+    return claims.iss;
+}
+/**
+ * Whether this client_id belongs to a client that promised to authenticate
+ * with an assertion. Only a metadata document can make that promise: a
+ * dynamically registered client either holds a secret the SDK checks, or is
+ * public by registration.
+ */
+async function requiresAssertion(clientId, resolver) {
+    if (typeof clientId !== 'string' || !isClientIdMetadataUrl(clientId))
+        return false;
+    // resolve() answers undefined for anything it refuses, and an unknown client
+    // is the SDK's to reject with its own invalid_client.
+    const client = await resolver.resolve(clientId);
+    return client?.token_endpoint_auth_method === 'private_key_jwt';
+}
+function keySource(client, resolver, remoteKeys) {
+    // An inline JWKS needs no second request, so it is preferred when present.
+    if (client.jwks && typeof client.jwks === 'object') {
+        return createLocalJWKSet(client.jwks);
+    }
+    if (typeof client.jwks_uri !== 'string')
+        throw new Error('client publishes neither jwks nor jwks_uri');
+    const uri = client.jwks_uri;
+    const cached = remoteKeys.get(uri);
+    if (cached) {
+        // Re-insert so insertion order stays recency order for the eviction below.
+        remoteKeys.delete(uri);
+        remoteKeys.set(uri, cached);
+        return cached;
+    }
+    // jose caches the key set and refetches on an unknown kid; the fetch goes
+    // through the same SSRF guard and byte cap as the metadata document.
+    const keys = createRemoteJWKSet(new URL(uri), { [customFetch]: resolver.safeFetch });
+    remoteKeys.set(uri, keys);
+    // This entry is created before the signature is checked, so anyone able to
+    // reach /token can add one. Drop the coldest instead of growing forever.
+    while (remoteKeys.size > MAX_REMOTE_KEY_SETS) {
+        const oldest = remoteKeys.keys().next();
+        if (oldest.done)
+            break;
+        remoteKeys.delete(oldest.value);
+    }
+    return keys;
+}
+/** Everything jwtVerify does not check for us. */
+function checkClaims(payload, options) {
+    const audiences = Array.isArray(payload.aud) ? payload.aud : payload.aud === undefined ? [] : [payload.aud];
+    // The token endpoint is what RFC 7523 asks for; the issuer identifier is what
+    // several clients send instead, and OpenID Connect blesses it.
+    if (!audiences.includes(options.tokenEndpoint) && !audiences.includes(options.externalUrl)) {
+        return `aud ${audiences.join(',') || 'missing'} is neither the token endpoint nor the issuer`;
+    }
+    if (typeof payload.jti !== 'string' || payload.jti.length === 0)
+        return 'assertion has no jti';
+    if (typeof payload.exp !== 'number')
+        return 'assertion has no exp';
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp > now + MAX_ASSERTION_LIFETIME_S + CLOCK_TOLERANCE_S)
+        return 'assertion lifetime exceeds five minutes';
+    return undefined;
+}
+//# sourceMappingURL=private-key-jwt.js.map

package/dist/auth/private-key-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-key-jwt.js","sourceRoot":"","sources":["../../src/auth/private-key-jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErF,OAAO,EAAgB,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,wDAAwD,CAAC;AAC9F;iDACiD;AACjD,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,CAAC;AACxC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElH;8EAC8E;AAC9E,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;uCACuC;AACvC,MAAM,OAAO,WAAW;IAGO,UAAU;IAFtB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YAA6B,UAAU,GAAG,kBAAkB;0BAA/B,UAAU;IAAwB,CAAC;IAEhE,gDAAgD;IAChD,KAAK,CAAC,GAAW,EAAE,WAAmB;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,uEAAuE;QACvE,mCAAmC;QACnC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;CACF;AASD,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,EAAE,gBAAgB,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YACtC,OAAO,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACvG,CAAC,CAAC;QACF,IAAI,IAAI,EAAE,qBAAqB,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,mEAAmE;YACnE,yEAAyE;YACzE,kEAAkE;YAClE,qCAAqC;YACrC,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAClE,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,+DAA+D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,qBAAqB,KAAK,qBAAqB,EAAE,CAAC;YAC1D,MAAM,CAAC,qCAAqC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnH,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,sEAAsE,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,0BAA0B,KAAK,iBAAiB,EAAE,CAAC;gBAC5D,MAAM,CAAC,GAAG,QAAQ,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE;gBACnD,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,QAAQ;gBACjB,UAAU,EAAE,cAAc;gBAC1B,cAAc,EAAE,iBAAiB;aAClC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAI,EAAE,OAAO,CAAC,GAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,OAAO,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,wEAAwE;YACxE,qDAAqD;YACrD,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC7B,OAAO,IAAI,CAAC,qBAAqB,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAAiB,EAAE,YAAgC;IAChF,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5E,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9G,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChI,OAAO,MAAM,CAAC,GAAG,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,QAAiB,EAAE,QAAsB;IACxE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,MAAM,EAAE,0BAA0B,KAAK,iBAAiB,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAChB,MAA8C,EAC9C,QAAsB,EACtB,UAAwC;IAExC,2EAA2E;IAC3E,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAA+C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,2EAA2E;QAC3E,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,2EAA2E;IAC3E,yEAAyE;IACzE,OAAO,UAAU,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM;QACvB,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kDAAkD;AAClD,SAAS,WAAW,CAAC,OAAmB,EAAE,OAA6B;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5G,8EAA8E;IAC9E,+DAA+D;IAC/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3F,OAAO,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,+CAA+C,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC/F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,sBAAsB,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,wBAAwB,GAAG,iBAAiB;QAAE,OAAO,yCAAyC,CAAC;IACvH,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/auth/provider.js

@@ -1,7 +1,12 @@
 import crypto from 'node:crypto';
 import { SignJWT, jwtVerify } from 'jose';
-import { InvalidGrantError, InvalidTargetError, InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { InvalidClientMetadataError, InvalidGrantError, InvalidTargetError, InvalidTokenError, TooManyRequestsError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { redirectUriMatches } from '@modelcontextprotocol/sdk/server/auth/handlers/authorize.js';
+import { isClientIdMetadataUrl } from './cimd.js';
+import { isLoopbackOnly, isSafeRedirectUri } from './redirect-uri.js';
+import { registrationClientUri } from './registration.js';
+import { readSignedPayload, sign, signPayload, signatureMatches } from './signed-token.js';
+import { clampDisplayName, logSafe } from './text.js';
 import { renderLoginPage } from './login-page.js';
 import { renderConsentPage } from './consent-page.js';
 import { allowFormActionTo } from './headers.js';
@@ -18,9 +23,6 @@ export const SESSION_COOKIE = 'mcp_hub_session';
 export function sessionCookieName(externalUrl) {
     return new URL(externalUrl).protocol === 'https:' ? `__Host-${SESSION_COOKIE}` : SESSION_COOKIE;
 }
-function sign(value, secret) {
-    return crypto.createHmac('sha256', secret).update(value).digest('base64url');
-}
 /** Distinguishes admin-minted API tokens from interactive OAuth tokens. */
 export const API_TOKEN_SUBJECT = 'mcp-hub-token';
 /**
@@ -58,32 +60,87 @@ export class HubOAuthProvider {
         this.options = options;
         this.sessionCookieName = sessionCookieName(externalUrl);
     }
+    /**
+     * Both registration mechanisms meet here, and this is the only place the SDK
+     * looks a client up — the authorize handler, the token handler's client
+     * authentication and the revocation endpoint all go through it. A client_id
+     * that is an https URL is a Client ID Metadata Document and is fetched from
+     * the client; anything else is a locally registered DCR client.
+     */
     get clientsStore() {
         const store = this.store;
-        return {
-            getClient: clientId => store.getClient(clientId),
-            registerClient: client => {
-                const isPublic = client.token_endpoint_auth_method === 'none';
-                const stored = {
-                    ...client,
-                    client_id: crypto.randomBytes(16).toString('base64url'),
-                    client_id_issued_at: Math.floor(Date.now() / 1000),
-                    // Secrets never expire: ChatGPT registers once per connector and
-                    // never re-registers, so an expiring secret bricks the connector
-                    // when it runs out (the SDK default is 30 days).
-                    client_secret_expires_at: 0
-                };
-                // A stored secret makes the SDK demand it on every token request, so a
-                // public client must be persisted without one — but ChatGPT expects a
-                // client_secret in the registration response even for "none" and
-                // refuses its own registration otherwise. Hand it one in the response
-                // only; token requests from public clients ignore it.
-                if (isPublic)
-                    delete stored.client_secret;
-                store.saveClient(stored);
-                console.log(`mcp-hub: registered OAuth client ${stored.client_id} (${stored.client_name ?? 'unnamed'})`);
-                return isPublic ? { ...stored, client_secret: crypto.randomBytes(32).toString('hex'), client_secret_expires_at: 0 } : stored;
+        const cimd = this.options.cimd;
+        const registerClient = (client) => {
+            // The SDK only keeps javascript:, data: and vbscript: out, so without
+            // this a client could register a plaintext http:// callback on a remote
+            // host and have its authorization code delivered in the clear. Metadata
+            // documents have always been held to this; dynamic registration was not.
+            for (const uri of client.redirect_uris ?? []) {
+                if (!isSafeRedirectUri(uri, { allowPrivateUseSchemes: true })) {
+                    throw new InvalidClientMetadataError(`redirect_uri ${uri} must be https, a loopback address or a private-use scheme`);
+                }
             }
+            const isPublic = client.token_endpoint_auth_method === 'none';
+            const stored = {
+                ...client,
+                // Self-declared and shown on the consent page, so held to one line.
+                client_name: clampDisplayName(client.client_name),
+                client_id: crypto.randomBytes(16).toString('base64url'),
+                client_id_issued_at: Math.floor(Date.now() / 1000),
+                // Secrets never expire: ChatGPT registers once per connector and
+                // never re-registers, so an expiring secret bricks the connector
+                // when it runs out (the SDK default is 30 days).
+                client_secret_expires_at: 0
+            };
+            // A stored secret makes the SDK demand it on every token request, so a
+            // public client must be persisted without one — but ChatGPT expects a
+            // client_secret in the registration response even for "none" and
+            // refuses its own registration otherwise. Hand it one in the response
+            // only; token requests from public clients ignore it.
+            if (isPublic)
+                delete stored.client_secret;
+            // RFC 7592: the credential that later lets this client read, change or
+            // delete its own registration. Only its hash is kept, so this is the one
+            // moment the client can learn it.
+            const registrationToken = crypto.randomBytes(32).toString('base64url');
+            if (!store.addClient(stored, registrationToken)) {
+                console.warn(`mcp-hub: refused a registration: the hub is at its limit of ${store.clientLimits.maxClients} clients`);
+                throw new TooManyRequestsError('This hub is at its client registration limit; ask the operator to remove unused registrations');
+            }
+            console.log(`mcp-hub: registered OAuth client ${stored.client_id} (${logSafe(stored.client_name ?? 'unnamed')})`);
+            // The SDK's type describes RFC 7591 only, but it serializes whatever this
+            // returns — which is how the RFC 7592 fields reach the client. They are
+            // response-only and never stored: the record keeps a hash of the token.
+            return {
+                ...stored,
+                registration_access_token: registrationToken,
+                registration_client_uri: registrationClientUri(this.externalUrl, stored.client_id),
+                ...(isPublic ? { client_secret: crypto.randomBytes(32).toString('hex'), client_secret_expires_at: 0 } : {})
+            };
+        };
+        return {
+            getClient: clientId => (cimd && isClientIdMetadataUrl(clientId) ? cimd.resolve(clientId) : store.getClient(clientId)),
+            // Leaving this undefined is what removes registration_endpoint from the
+            // discovery document and unmounts /register: the SDK derives both from
+            // the presence of this method.
+            ...(this.options.allowDynamicRegistration === false ? {} : { registerClient })
+        };
+    }
+    /** True for a client that proved itself with a metadata document rather than
+     *  a registration. The pages use it to name the origin that vouched. */
+    isMetadataDocumentClient(clientId) {
+        return this.options.cimd !== undefined && isClientIdMetadataUrl(clientId);
+    }
+    /**
+     * What the login and consent pages need to say about who is asking: the
+     * metadata document URL when there is one (draft §6.4 asks for its hostname
+     * to be shown) and whether every redirect URI is local, which the MCP
+     * security considerations single out as impossible to attribute.
+     */
+    clientIdentity(client) {
+        return {
+            clientId: this.isMetadataDocumentClient(client.client_id) ? client.client_id : undefined,
+            loopbackOnly: isLoopbackOnly(client.redirect_uris)
         };
     }
     // --- Authorization endpoint ---------------------------------------------
@@ -98,6 +155,10 @@ export class HubOAuthProvider {
      * after the response has gone out.
      */
     async authorize(client, params, res) {
+        // Asking to authorize is use: it keeps a registration out of the sweep for
+        // never-confirmed clients, so a user who takes their time over the password
+        // does not have the registration deleted underneath them.
+        this.store.touchClient(client.client_id);
         const resource = this.resolveResource(params.resource);
         const session = this.readSessionCookie(res.req.headers.cookie);
         if (session && this.isApproved(client, params.redirectUri)) {
@@ -105,9 +166,12 @@ export class HubOAuthProvider {
             return;
         }
         const request = this.signPending(client, { ...params, resource });
+        // A metadata-document client is identified by a URL nobody can forge, so
+        // the page can show where the self-declared name came from.
+        const identity = { clientName: client.client_name, resource: resource?.href, ...this.clientIdentity(client) };
         const page = session
-            ? renderConsentPage(request, this.csrfToken(session), params.redirectUri, client.client_name, resource?.href)
-            : renderLoginPage(request, params.redirectUri, client.client_name, undefined, resource?.href);
+            ? renderConsentPage(request, this.csrfToken(session), params.redirectUri, identity)
+            : renderLoginPage(request, params.redirectUri, identity);
         // Submitting either form ends in a redirect to this client's redirect_uri,
         // which the SDK has already matched against its registration.
         allowFormActionTo(res, params.redirectUri);
@@ -126,8 +190,7 @@ export class HubOAuthProvider {
             exp: Date.now() + CODE_TTL_MS,
             resource: resource?.href
         };
-        const payload = Buffer.from(JSON.stringify(pending)).toString('base64url');
-        return `${payload}.${sign(payload, this.store.cookieSecret)}`;
+        return signPayload(pending, this.store.cookieSecret);
     }
     isApproved(client, redirectUri) {
         const approval = this.store.getApproval(client.client_id);
@@ -137,17 +200,11 @@ export class HubOAuthProvider {
     }
     approve(client, redirectUri) {
         this.store.saveApproval(client.client_id, redirectUri, client.client_name);
-        console.log(`mcp-hub: approved OAuth client ${client.client_id} (${client.client_name ?? 'unnamed'}) for ${redirectUri}`);
+        console.log(`mcp-hub: approved OAuth client ${logSafe(client.client_id)} (${logSafe(client.client_name ?? 'unnamed')}) for ${logSafe(redirectUri)}`);
     }
     decodePendingAuthorization(token) {
-        const [payload, signature] = token.split('.');
-        if (!payload || !signature)
-            return undefined;
-        const expected = sign(payload, this.store.cookieSecret);
-        if (signature.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)))
-            return undefined;
-        const pending = JSON.parse(Buffer.from(payload, 'base64url').toString());
-        if (pending.exp < Date.now())
+        const pending = readSignedPayload(token, this.store.cookieSecret);
+        if (!pending || pending.exp < Date.now())
             return undefined;
         return pending;
     }
@@ -202,8 +259,7 @@ export class HubOAuthProvider {
         const [expires, signature] = value.split('.');
         if (!expires || !signature)
             return undefined;
-        const expected = sign(expires, this.store.cookieSecret);
-        if (signature.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)))
+        if (!signatureMatches(expires, signature, this.store.cookieSecret))
             return undefined;
         return Number(expires) > Date.now() ? value : undefined;
     }
@@ -216,8 +272,7 @@ export class HubOAuthProvider {
     verifyCsrfToken(sessionValue, token) {
         if (typeof token !== 'string')
             return false;
-        const expected = this.csrfToken(sessionValue);
-        return token.length === expected.length && crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expected));
+        return signatureMatches(`csrf:${sessionValue}`, token, this.store.cookieSecret);
     }
     // --- Token endpoint ------------------------------------------------------
     async challengeForAuthorizationCode(_client, authorizationCode) {
@@ -239,6 +294,7 @@ export class HubOAuthProvider {
             throw new InvalidGrantError('resource does not match the authorization request');
         }
         this.codes.delete(authorizationCode); // single use
+        this.store.touchClient(client.client_id);
         return this.issueTokens(client.client_id, pending.scopes, undefined, pending.resource);
     }
     async exchangeRefreshToken(client, refreshToken, scopes, resource) {
@@ -249,7 +305,7 @@ export class HubOAuthProvider {
             const consumed = this.store.wasConsumed(refreshToken);
             if (consumed) {
                 const revoked = this.store.revokeFamily(consumed.familyId);
-                console.warn(`mcp-hub: refresh token replay from client ${client.client_id}, revoked ${revoked} token(s)`);
+                console.warn(`mcp-hub: refresh token replay from client ${logSafe(client.client_id)}, revoked ${revoked} token(s)`);
             }
             throw new InvalidGrantError('Invalid refresh token');
         }
@@ -267,6 +323,7 @@ export class HubOAuthProvider {
             throw new InvalidTargetError('A resource indicator is required');
         // Tokens issued before families existed adopt one on their first rotation.
         const familyId = record.familyId ?? crypto.randomBytes(16).toString('base64url');
+        this.store.touchClient(client.client_id);
         this.store.consumeRefreshToken(refreshToken, familyId, record.expiresAt);
         return this.issueTokens(client.client_id, scopes ?? record.scopes, familyId, tokenResource);
     }

package/dist/auth/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAK1C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,6DAA6D,CAAC;AAEjG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;AAClG,CAAC;AA4BD,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgB,EAChB,WAAmB,EACnB,QAAa,EACb,IAAY,EACZ,KAAa;IAEb,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;SAChC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;SACpC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC1B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,EAAE,CAAC;SACV,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,gBAAgB;IAOR,KAAK;IACL,WAAW;IACX,OAAO;IAR1B,+EAA+E;IAC9D,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/C,iBAAiB,CAAS;IAEnC,YACmB,KAAgB,EAChB,WAAmB,EACnB,OAAO,GAA4B,EAAE;qBAFrC,KAAK;2BACL,WAAW;uBACX,OAAO;QAExB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,YAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;YAChD,cAAc,EAAE,MAAM,CAAC,EAAE;gBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,0BAA0B,KAAK,MAAM,CAAC;gBAC9D,MAAM,MAAM,GAA+B;oBACzC,GAAG,MAAM;oBACT,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvD,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAClD,iEAAiE;oBACjE,iEAAiE;oBACjE,iDAAiD;oBACjD,wBAAwB,EAAE,CAAC;iBAC5B,CAAC;gBACF,uEAAuE;gBACvE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,sDAAsD;gBACtD,IAAI,QAAQ;oBAAE,OAAO,MAAM,CAAC,aAAa,CAAC;gBAC1C,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,WAAW,IAAI,SAAS,GAAG,CAAC,CAAC;gBACzG,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/H,CAAC;SACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;YAC7G,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChG,2EAA2E;QAC3E,8DAA8D;QAC9D,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED;gEAC4D;IACpD,WAAW,CAAC,MAAkC,EAAE,MAA2B;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAyB;YACpC,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YAC7B,QAAQ,EAAE,QAAQ,EAAE,IAAI;SACzB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,UAAU,CAAC,MAAkC,EAAE,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,+CAA+C;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3F,CAAC;IAED,OAAO,CAAC,MAAkC,EAAE,WAAmB;QAC7D,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,WAAW,IAAI,SAAS,SAAS,WAAW,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,0BAA0B,CAAC,KAAa;QACtC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACrI,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAyB,CAAC;QACjG,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,CACd,MAAkC,EAClC,MAAkH,EAClH,GAAa;QAEb,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;QACrH,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YACnC,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;kCAC8B;IAC9B,iBAAiB,CAAC,WAAmB,EAAE,KAAyB,EAAE,KAAa,EAAE,GAAa;QAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;mFAC+E;IACvE,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,mBAAmB;QACjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;QACpD,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;yCACqC;IACrC,iBAAiB,CAAC,YAAgC;QAChD,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,iBAAiB,UAAU,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACrI,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,eAAe,CAAC,YAAgC;QAC9C,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,YAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,YAAY,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,eAAe,CAAC,YAAoB,EAAE,KAAc;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/G,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,6BAA6B,CAAC,OAAmC,EAAE,iBAAyB;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACrH,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,iBAAiB,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa;QACnD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,6CAA6C,MAAM,CAAC,SAAS,aAAa,OAAO,WAAW,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,CAAC,iBAAiB;YAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAChG,IAAI,MAAM,CAAC,QAAQ,IAAI,iBAAiB,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,aAAa,GAAG,iBAAiB,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC;QACjE,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACrH,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9F,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAAgB,EAChB,MAAgB,EAChB,QAAQ,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/D,QAAiB;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACzG,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;aAC3B,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC;aACzC,UAAU,CAAC,cAAc,CAAC;aAC1B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,kBAAkB,GAAG,CAAC;aAC3C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;YACxC,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;YAC9D,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,WAAW;gBACxB,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnG,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACvG,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,aAAa,KAAK,SAAS,IAAI,QAAQ,IAAI,aAAa;YAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC3H,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACrG,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,+EAA+E;IACvE,qBAAqB,CAAC,QAAgB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjG,wEAAwE;QACxE,2EAA2E;IAC7E,CAAC;IAEO,eAAe,CAAC,QAAyB;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACtE,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;YACnG,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAK1C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6DAA6D,CAAC;AAEjG,OAAO,EAAgB,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;AAClG,CAAC;AAiCD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgB,EAChB,WAAmB,EACnB,QAAa,EACb,IAAY,EACZ,KAAa;IAEb,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;SAChC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;SACpC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC1B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,EAAE,CAAC;SACV,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,gBAAgB;IAOR,KAAK;IACL,WAAW;IACX,OAAO;IAR1B,+EAA+E;IAC9D,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/C,iBAAiB,CAAS;IAEnC,YACmB,KAAgB,EAChB,WAAmB,EACnB,OAAO,GAA4B,EAAE;qBAFrC,KAAK;2BACL,WAAW;uBACX,OAAO;QAExB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,IAAI,YAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,MAAM,cAAc,GAAG,CAAC,MAAkC,EAA8B,EAAE;YACxF,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC9D,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,GAAG,4DAA4D,CAAC,CAAC;gBACxH,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,0BAA0B,KAAK,MAAM,CAAC;YAC9D,MAAM,MAAM,GAA+B;gBACzC,GAAG,MAAM;gBACT,oEAAoE;gBACpE,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;gBACjD,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACvD,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAClD,iEAAiE;gBACjE,iEAAiE;gBACjE,iDAAiD;gBACjD,wBAAwB,EAAE,CAAC;aAC5B,CAAC;YACF,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,sDAAsD;YACtD,IAAI,QAAQ;gBAAE,OAAO,MAAM,CAAC,aAAa,CAAC;YAC1C,uEAAuE;YACvE,yEAAyE;YACzE,kCAAkC;YAClC,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,+DAA+D,KAAK,CAAC,YAAY,CAAC,UAAU,UAAU,CAAC,CAAC;gBACrH,MAAM,IAAI,oBAAoB,CAAC,+FAA+F,CAAC,CAAC;YAClI,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;YAClH,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,OAAO;gBACL,GAAG,MAAM;gBACT,yBAAyB,EAAE,iBAAiB;gBAC5C,uBAAuB,EAAE,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;gBAClF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC;QAClC,CAAC,CAAC;QACF,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrH,wEAAwE;YACxE,uEAAuE;YACvE,+BAA+B;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED;4EACwE;IACxE,wBAAwB,CAAC,QAAgB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,MAAkC;QACvD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACxF,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,2EAA2E;QAC3E,4EAA4E;QAC5E,0DAA0D;QAC1D,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC;YACnF,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3D,2EAA2E;QAC3E,8DAA8D;QAC9D,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED;gEAC4D;IACpD,WAAW,CAAC,MAAkC,EAAE,MAA2B;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAyB;YACpC,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YAC7B,QAAQ,EAAE,QAAQ,EAAE,IAAI;SACzB,CAAC;QACF,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,UAAU,CAAC,MAAkC,EAAE,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,+CAA+C;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3F,CAAC;IAED,OAAO,CAAC,MAAkC,EAAE,WAAmB;QAC7D,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,SAAS,OAAO,CAAC,WAAW,CAAC,EAAE,CACxI,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,KAAa;QACtC,MAAM,OAAO,GAAG,iBAAiB,CAAuB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,CACd,MAAkC,EAClC,MAAkH,EAClH,GAAa;QAEb,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;QACrH,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YACnC,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;kCAC8B;IAC9B,iBAAiB,CAAC,WAAmB,EAAE,KAAyB,EAAE,KAAa,EAAE,GAAa;QAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;mFAC+E;IACvE,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,mBAAmB;QACjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;QACpD,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;yCACqC;IACrC,iBAAiB,CAAC,YAAgC;QAChD,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,iBAAiB,UAAU,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,eAAe,CAAC,YAAgC;QAC9C,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,YAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,YAAY,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,eAAe,CAAC,YAAoB,EAAE,KAAc;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,gBAAgB,CAAC,QAAQ,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,6BAA6B,CAAC,OAAmC,EAAE,iBAAyB;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACrH,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,iBAAiB,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa;QACnD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,OAAO,WAAW,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,CAAC,iBAAiB;YAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAChG,IAAI,MAAM,CAAC,QAAQ,IAAI,iBAAiB,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,aAAa,GAAG,iBAAiB,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC;QACjE,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACrH,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9F,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAAgB,EAChB,MAAgB,EAChB,QAAQ,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/D,QAAiB;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACzG,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;aAC3B,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC;aACzC,UAAU,CAAC,cAAc,CAAC;aAC1B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,kBAAkB,GAAG,CAAC;aAC3C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;YACxC,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;YAC9D,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,WAAW;gBACxB,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnG,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACvG,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,aAAa,KAAK,SAAS,IAAI,QAAQ,IAAI,aAAa;YAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC3H,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACrG,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,+EAA+E;IACvE,qBAAqB,CAAC,QAAgB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjG,wEAAwE;QACxE,2EAA2E;IAC7E,CAAC;IAEO,eAAe,CAAC,QAAyB;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACtE,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;YACnG,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/auth/rate-limit.js

@@ -0,0 +1,43 @@
+/**
+ * A per-IP request budget that rejects before any body is read.
+ *
+ * The SDK applies its own limits to the OAuth endpoints, but only after body
+ * parsing — which is the expensive part. This runs first, and refuses without
+ * inserting the offending address into its own table, so a flood of distinct
+ * source addresses cannot grow the map that is supposed to be bounding it.
+ */
+export function earlyRateLimit(windowMs, maxPerIp, maxTotal) {
+    const byIp = new Map();
+    let total = { count: 0, resetAt: 0 };
+    return (req, res, next) => {
+        const now = Date.now();
+        if (total.resetAt <= now)
+            total = { count: 0, resetAt: now + windowMs };
+        const ip = req.ip ?? 'unknown';
+        let entry = byIp.get(ip);
+        if (entry && entry.resetAt <= now) {
+            byIp.delete(ip);
+            entry = undefined;
+        }
+        // Reject before inserting anything: a flood of distinct rejected IPs must
+        // not grow the map. Accepted requests bound it at maxTotal per window.
+        if ((entry?.count ?? 0) >= maxPerIp || total.count >= maxTotal) {
+            res.set('Retry-After', String(Math.max(1, Math.ceil((Math.min(entry?.resetAt ?? Infinity, total.resetAt) - now) / 1000))));
+            res.status(429).json({ error: 'too_many_requests', error_description: 'Request rate limit exceeded' });
+            return;
+        }
+        if (!entry) {
+            if (byIp.size >= maxTotal) {
+                for (const [candidateIp, candidate] of byIp)
+                    if (candidate.resetAt <= now)
+                        byIp.delete(candidateIp);
+            }
+            entry = { count: 0, resetAt: now + windowMs };
+            byIp.set(ip, entry);
+        }
+        entry.count++;
+        total.count++;
+        next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/auth/rate-limit.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAgB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,IAAI,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,OAAO,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B,EAAQ,EAAE;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG;YAAE,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;QACxE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI;oBAAE,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtG,CAAC;YACD,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/redirect-uri.js

@@ -0,0 +1,58 @@
+/**
+ * Where an authorization code is allowed to land.
+ *
+ * Both registration mechanisms end up handing a code to a URL the client chose,
+ * so both have to agree on which URLs are acceptable — they did not before:
+ * a metadata document was held to https-or-loopback while a dynamically
+ * registered client could name any scheme the SDK's three-entry denylist did
+ * not happen to cover, plain `http://` to a remote host included.
+ */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+/** Schemes a browser or the operating system would treat as executable content
+ *  or local file access. Never a legitimate redirect target. */
+const DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:', 'blob:']);
+export function isLoopbackHostname(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname);
+}
+/**
+ * https anywhere, plain http only on this machine, and — where the policy
+ * allows it — a private-use scheme for a native client.
+ *
+ * The point of refusing remote `http://` is that the code travels in the clear
+ * on the final redirect: anyone on the path between the browser and the client
+ * reads it, and a public client has nothing else to prove itself with.
+ */
+export function isSafeRedirectUri(uri, policy) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (DANGEROUS_SCHEMES.has(parsed.protocol))
+        return false;
+    if (parsed.protocol === 'https:')
+        return true;
+    if (parsed.protocol === 'http:')
+        return isLoopbackHostname(parsed.hostname);
+    return policy.allowPrivateUseSchemes;
+}
+/**
+ * True when every redirect URI points at this machine — the case the MCP
+ * security considerations single out, because any local program could be the
+ * one asking. Used to warn on the login and consent pages.
+ */
+export function isLoopbackOnly(redirectUris) {
+    if (!redirectUris?.length)
+        return false;
+    return redirectUris.every(uri => {
+        try {
+            return isLoopbackHostname(new URL(uri).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+//# sourceMappingURL=redirect-uri.js.map