@ni-c/mcp-hub 0.9.2 → 0.10.0

package/dist/tool-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAmBA,iDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,MAAwB;IACpD,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,QAA2B,EAAE,IAAY;IACxD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwB,EAAE,IAAY;IAChE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,MAAwB,EAAE,KAAa;IACjE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAwB,EAAE,KAAa;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CACvE,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC"}

package/dist/upstream/auth.js

@@ -0,0 +1,435 @@
+import { discoverOAuthServerInfo, exchangeAuthorization, refreshAuthorization, startAuthorization } from '@modelcontextprotocol/sdk/client/auth.js';
+import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
+import { guardedRequest } from '../auth/pinned-fetch.js';
+import { logSafe } from '../auth/text.js';
+import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata } from './provider.js';
+/**
+ * Everything the hub needs to authenticate itself to one upstream MCP server.
+ *
+ * The SDK's `auth()` orchestrator is deliberately not used to drive this. Two
+ * reasons, both verified against the SDK:
+ *
+ * It has no single-flight anywhere, so parallel requests that each see a 401
+ * each refresh, and an authorization server with rotating refresh tokens
+ * revokes the whole family when the losers replay. Refresh is therefore ours.
+ *
+ * And the `fetch` given to the transport is the *same object* the SDK hands to
+ * `auth()` as `fetchFn` — `createFetchWithInit` returns the base fetch
+ * unchanged when there is no `requestInit`. So one function has to serve both
+ * the MCP data plane and the authorization server, and it is the classifier
+ * below that tells them apart.
+ */
+/** Nothing the hub can do without a human: no credentials, or a refresh token
+ *  the upstream will not honour any more. */
+export class UpstreamLoginRequiredError extends Error {
+    serverName;
+    constructor(serverName, reason) {
+        super(reason);
+        this.serverName = serverName;
+        this.name = 'UpstreamLoginRequiredError';
+    }
+}
+/** Refresh a little before the token actually dies, to absorb clock skew. */
+const EXPIRY_SKEW_S = 60;
+/** Discovery is stable; re-deriving it on every connection is pure latency. */
+const DISCOVERY_TTL_S = 3600;
+const AS_MAX_BYTES = 256 * 1024;
+const AS_TIMEOUT_MS = 10_000;
+export class UpstreamAuth {
+    config;
+    store;
+    identity;
+    /** Which configuration a stored credential has to belong to. */
+    fingerprint;
+    /** Collapses concurrent token work into one request. Without it a burst of
+     *  tool calls would each refresh with the same rotating token. */
+    inFlight;
+    /**
+     * Whether the authorization server may live on a private address.
+     *
+     * Derived from the upstream itself rather than fixed: refusing private
+     * addresses outright is right when an untrusted party chose the URL, but here
+     * the operator did — and the common self-hosted shape is an internal MCP
+     * server behind an internal Keycloak on the same Docker network. A *public*
+     * upstream pointing discovery at `169.254.169.254` is still an attack, and
+     * still refused.
+     */
+    allowPrivate;
+    constructor(serverName, config, store, externalUrl) {
+        this.config = config;
+        this.store = store;
+        this.identity = { serverName, serverUrl: config.url, oauth: config.oauth, externalUrl };
+        this.fingerprint = credentialFingerprint(this.identity);
+    }
+    provider(options = {}) {
+        return new UpstreamAuthProvider(this.identity, this.store, options);
+    }
+    get record() {
+        return this.store.getUpstreamCredentials(this.identity.serverName, this.fingerprint);
+    }
+    /** The full pair including the refresh token: this class is the only thing
+     *  allowed to spend it, which is why the provider withholds it. */
+    tokens() {
+        return this.record?.tokens;
+    }
+    /** The public key the upstream needs, but only when we sign assertions. */
+    async publicJwkIfNeeded() {
+        return this.identity.oauth.clientAuth === 'private_key_jwt' ? await this.provider().publicJwk() : undefined;
+    }
+    /** True when the upstream's own host is private, so its authorization server
+     *  is allowed to be too. Resolved once. */
+    async privateAllowed() {
+        if (this.allowPrivate === undefined) {
+            const hostname = new URL(this.identity.serverUrl).hostname.replace(/^\[|\]$/g, '');
+            try {
+                this.allowPrivate = isPrivateAddress(hostname) || (await resolvePublicAddress(hostname).then(() => false, () => true));
+            }
+            catch {
+                this.allowPrivate = true;
+            }
+        }
+        return this.allowPrivate;
+    }
+    /** The guarded fetch used for every authorization-server request: no static
+     *  headers, no bearer, address-checked, pinned, capped, no redirects. */
+    async asFetch(input, init) {
+        const url = new URL(input instanceof Request ? input.url : String(input));
+        const allowPrivate = await this.privateAllowed();
+        const pinned = await resolvePublicAddress(url.hostname, allowPrivate);
+        if (!pinned) {
+            return fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(AS_TIMEOUT_MS) });
+        }
+        return guardedRequest(url, {
+            pinnedAddress: pinned,
+            method: init?.method ?? 'GET',
+            headers: toRecord(init?.headers),
+            body: typeof init?.body === 'string' ? init.body : init?.body instanceof URLSearchParams ? init.body.toString() : undefined,
+            timeoutMs: AS_TIMEOUT_MS,
+            maxBytes: AS_MAX_BYTES
+        });
+    }
+    boundAsFetch = (input, init) => this.asFetch(input, init);
+    // --- Discovery and client identity ---------------------------------------
+    async discover(force = false) {
+        const cached = this.record?.discovery;
+        const now = Math.floor(Date.now() / 1000);
+        if (!force && cached?.authorizationServerUrl && now - cached.fetchedAt < DISCOVERY_TTL_S)
+            return cached;
+        const info = await discoverOAuthServerInfo(this.identity.serverUrl, { fetchFn: this.boundAsFetch });
+        const discovery = { ...info, fetchedAt: now };
+        this.provider().saveDiscoveryState(discovery);
+        return discovery;
+    }
+    /**
+     * The client_id this hub uses with this upstream, registering dynamically the
+     * first time when that is the configured mode.
+     */
+    async clientInformation(discovery) {
+        const { oauth } = this.identity;
+        if (oauth.mode === 'static') {
+            return { client_id: oauth.clientId, ...(oauth.clientSecret ? { client_secret: oauth.clientSecret } : {}) };
+        }
+        const existing = this.record;
+        if (existing?.clientId) {
+            return { client_id: existing.clientId, ...(existing.clientSecret ? { client_secret: existing.clientSecret } : {}) };
+        }
+        if (oauth.mode === 'cimd') {
+            if (discovery.authorizationServerMetadata?.client_id_metadata_document_supported !== true) {
+                throw new UpstreamLoginRequiredError(this.identity.serverName, 'the upstream does not accept client ID metadata documents; use mode "dcr" or "static"');
+            }
+            const clientId = this.provider().clientMetadataUrl;
+            this.provider().saveClientInformation({ client_id: clientId });
+            return { client_id: clientId };
+        }
+        const registered = await this.registerDynamically(discovery);
+        this.provider().saveClientInformation(registered);
+        console.log(`mcp-hub: registered with ${logSafe(discovery.authorizationServerUrl)} for upstream "${logSafe(this.identity.serverName)}"`);
+        return registered;
+    }
+    /**
+     * RFC 7591 registration, done here rather than through the SDK's
+     * `registerClient`.
+     *
+     * That helper parses the response with `OAuthClientInformationFullSchema`,
+     * which strips unknown fields — including `registration_access_token` and
+     * `registration_client_uri`. Those are exactly what `upstream logout` needs
+     * to delete the registration again (RFC 7592), so they have to survive.
+     */
+    async registerDynamically(discovery) {
+        const endpoint = discovery.authorizationServerMetadata?.registration_endpoint;
+        if (!endpoint) {
+            throw new UpstreamLoginRequiredError(this.identity.serverName, 'the upstream offers no dynamic client registration; use mode "static" with a client_id it issued you');
+        }
+        const response = await this.asFetch(new URL(endpoint), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(hubClientMetadata(this.identity, await this.publicJwkIfNeeded()))
+        });
+        if (!response.ok) {
+            const detail = await response.text().catch(() => '');
+            throw new UpstreamLoginRequiredError(this.identity.serverName, `dynamic registration failed with HTTP ${response.status}${detail ? `: ${errorCode(detail)}` : ''}`);
+        }
+        const registered = (await response.json());
+        if (typeof registered.client_id !== 'string') {
+            throw new UpstreamLoginRequiredError(this.identity.serverName, 'the upstream returned a registration without a client_id');
+        }
+        return registered;
+    }
+    // --- Tokens ---------------------------------------------------------------
+    /** Seconds until the stored access token should be replaced; negative when it
+     *  already should have been. Infinity when the upstream gave no expiry. */
+    secondsLeft() {
+        const validUntil = this.record?.accessTokenValidUntil;
+        if (validUntil === undefined)
+            return Number.POSITIVE_INFINITY;
+        return validUntil - EXPIRY_SKEW_S - Math.floor(Date.now() / 1000);
+    }
+    /**
+     * Makes sure a usable access token is on disk, doing nothing when one already
+     * is. Every caller funnels through here, so a burst produces one request.
+     *
+     * `staleAccessToken` is what a 401 handler passes: the token that was just
+     * refused. If the stored token is no longer that one, somebody else has
+     * already replaced it and there is nothing to do — without that check a
+     * straggler arriving just after a refresh completed would spend the rotating
+     * refresh token a second time, which is exactly what the upstream treats as
+     * replay.
+     */
+    async prepare(options = {}) {
+        const usable = Boolean(this.tokens()?.access_token) && this.secondsLeft() > 0;
+        if (options.staleAccessToken !== undefined) {
+            if (this.tokens()?.access_token !== options.staleAccessToken)
+                return;
+        }
+        else if (!options.force && usable) {
+            return;
+        }
+        if (this.inFlight)
+            return this.inFlight;
+        this.inFlight = this.obtain(true).finally(() => {
+            this.inFlight = undefined;
+        });
+        return this.inFlight;
+    }
+    async obtain(force) {
+        // Another process may have refreshed while we queued; adopt rather than
+        // spend the refresh token a second time.
+        if (!force && this.tokens()?.access_token && this.secondsLeft() > 0)
+            return;
+        const discovery = await this.discover();
+        const clientInformation = await this.clientInformation(discovery);
+        const resource = discovery.resourceMetadata?.resource ? new URL(discovery.resourceMetadata.resource) : undefined;
+        if (this.identity.oauth.grant === 'client_credentials') {
+            const tokens = await this.fetchClientCredentialsTokens(discovery, clientInformation, resource);
+            this.provider().saveTokens(tokens);
+            return;
+        }
+        const refreshToken = this.tokens()?.refresh_token;
+        if (!refreshToken) {
+            throw new UpstreamLoginRequiredError(this.identity.serverName, 'no upstream tokens are stored');
+        }
+        try {
+            const tokens = await refreshAuthorization(discovery.authorizationServerUrl, {
+                metadata: discovery.authorizationServerMetadata,
+                clientInformation,
+                refreshToken,
+                resource,
+                addClientAuthentication: this.provider().addClientAuthentication,
+                fetchFn: this.boundAsFetch
+            });
+            this.provider().saveTokens(tokens);
+        }
+        catch (error) {
+            // A refresh token the upstream will not honour cannot be recovered from
+            // without a human, so say so rather than restarting forever.
+            throw new UpstreamLoginRequiredError(this.identity.serverName, `refresh failed: ${error.message}`);
+        }
+    }
+    async fetchClientCredentialsTokens(discovery, clientInformation, resource) {
+        // The SDK has no client_credentials helper of its own that we can call
+        // without going through auth(); the request is three fields.
+        const provider = this.provider();
+        const params = provider.prepareTokenRequest();
+        if (resource)
+            params.set('resource', resource.href);
+        const tokenUrl = new URL(discovery.authorizationServerMetadata?.token_endpoint ?? new URL('/token', discovery.authorizationServerUrl).href);
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json'
+        };
+        if (this.identity.oauth.clientAuth === 'private_key_jwt') {
+            // Same hook the authorization-code paths use, so there is one place that
+            // decides how this hub proves itself.
+            await provider.addClientAuthentication(new Headers(), params, tokenUrl);
+        }
+        else if (clientInformation.client_secret) {
+            const basic = Buffer.from(`${clientInformation.client_id}:${clientInformation.client_secret}`).toString('base64');
+            headers.authorization = `Basic ${basic}`;
+        }
+        else {
+            params.set('client_id', clientInformation.client_id);
+        }
+        const response = await this.asFetch(tokenUrl, { method: 'POST', headers, body: params.toString() });
+        if (!response.ok) {
+            const detail = await response.text().catch(() => '');
+            throw new UpstreamLoginRequiredError(this.identity.serverName, `client_credentials token request failed with HTTP ${response.status}${detail ? `: ${errorCode(detail)}` : ''}`);
+        }
+        return (await response.json());
+    }
+    // --- The interactive login, driven by the admin CLI -----------------------
+    /** Everything the operator has to be sent to, plus what the callback will
+     *  need to finish. The caller persists the login and prints the URL. */
+    async startLogin(signedState) {
+        const discovery = await this.discover(true);
+        const clientInformation = await this.clientInformation(discovery);
+        const scope = this.identity.oauth.scopes.join(' ') || undefined;
+        const { authorizationUrl, codeVerifier } = await startAuthorization(discovery.authorizationServerUrl, {
+            metadata: discovery.authorizationServerMetadata,
+            clientInformation,
+            redirectUrl: callbackUrl(this.identity.externalUrl),
+            scope,
+            state: signedState,
+            resource: discovery.resourceMetadata?.resource ? new URL(discovery.resourceMetadata.resource) : undefined
+        });
+        return {
+            authorizationUrl: authorizationUrl.href,
+            login: {
+                serverName: this.identity.serverName,
+                codeVerifier,
+                authorizationServerUrl: discovery.authorizationServerUrl,
+                ...(discovery.resourceMetadata?.resource ? { resourceMetadataUrl: discovery.resourceMetadata.resource } : {}),
+                ...(scope ? { scope } : {})
+            }
+        };
+    }
+    /** Redeems the code the upstream sent back. */
+    async finishLogin(login, code) {
+        const discovery = await this.discover();
+        const clientInformation = await this.clientInformation(discovery);
+        const tokens = await exchangeAuthorization(login.authorizationServerUrl, {
+            metadata: discovery.authorizationServerMetadata,
+            clientInformation,
+            authorizationCode: code,
+            codeVerifier: login.codeVerifier,
+            redirectUri: callbackUrl(this.identity.externalUrl),
+            resource: discovery.resourceMetadata?.resource ? new URL(discovery.resourceMetadata.resource) : undefined,
+            addClientAuthentication: this.provider().addClientAuthentication,
+            fetchFn: this.boundAsFetch
+        });
+        this.provider().saveTokens(tokens);
+    }
+    /**
+     * Best effort: tell the upstream to forget the token (RFC 7009) and, for a
+     * dynamic registration, the registration itself (RFC 7592). Neither is
+     * offered by the SDK, and neither may stop the local record from going away.
+     */
+    async revokeRemotely() {
+        const problems = [];
+        const record = this.record;
+        if (!record)
+            return problems;
+        const discovery = record.discovery;
+        // Declared by RFC 8414 and carried by the SDK's loose metadata schema, but
+        // absent from its TypeScript type.
+        const revocationEndpoint = discovery?.authorizationServerMetadata?.revocation_endpoint;
+        const tokens = record.tokens;
+        if (revocationEndpoint && tokens?.refresh_token) {
+            try {
+                const body = new URLSearchParams({ token: tokens.refresh_token, token_type_hint: 'refresh_token' });
+                if (record.clientId)
+                    body.set('client_id', record.clientId);
+                if (record.clientSecret)
+                    body.set('client_secret', record.clientSecret);
+                await this.asFetch(new URL(revocationEndpoint), {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                    body: body.toString()
+                });
+            }
+            catch (error) {
+                problems.push(`token revocation failed: ${error.message}`);
+            }
+        }
+        if (record.registrationClientUri && record.registrationAccessToken) {
+            try {
+                await this.asFetch(new URL(record.registrationClientUri), {
+                    method: 'DELETE',
+                    headers: { authorization: `Bearer ${record.registrationAccessToken}` }
+                });
+            }
+            catch (error) {
+                problems.push(`registration delete failed: ${error.message}`);
+            }
+        }
+        return problems;
+    }
+    /**
+     * The one fetch the transport gets.
+     *
+     * Requests to the upstream itself carry the configured headers and the bearer
+     * and go out on the ordinary fetch, because the data plane streams. Anything
+     * aimed at the authorization server takes the guarded path instead, and is
+     * never shown a header or a token belonging to the upstream.
+     */
+    createFetch() {
+        const upstreamOrigin = new URL(this.identity.serverUrl).origin;
+        return async (input, init) => {
+            const url = new URL(input instanceof Request ? input.url : String(input));
+            const isControlPlane = url.origin !== upstreamOrigin || url.pathname.startsWith('/.well-known/');
+            if (isControlPlane)
+                return this.asFetch(url, init);
+            const send = async () => {
+                const headers = new Headers(init?.headers);
+                const token = this.tokens()?.access_token;
+                if (token)
+                    headers.set('authorization', `Bearer ${token}`);
+                for (const [key, value] of Object.entries(this.config.headers)) {
+                    if (!headers.has(key))
+                        headers.set(key, value);
+                }
+                return { response: await fetch(url, { ...init, headers }), token };
+            };
+            const first = await send();
+            if (first.response.status !== 401)
+                return first.response;
+            // Handled here rather than by the SDK: its recovery has no single flight,
+            // so parallel 401s would each refresh. Passing the token that was refused
+            // means a caller whose token was already replaced skips straight to the
+            // retry instead of refreshing again.
+            try {
+                await this.prepare({ staleAccessToken: first.token });
+            }
+            catch {
+                // Leave the 401 standing; the supervisor turns it into `unauthorized`.
+                return first.response;
+            }
+            return (await send()).response;
+        };
+    }
+}
+function toRecord(headers) {
+    const result = {};
+    if (!headers)
+        return result;
+    if (headers instanceof Headers)
+        for (const [key, value] of headers)
+            result[key] = value;
+    else if (Array.isArray(headers))
+        for (const [key, value] of headers)
+            result[key] = value;
+    else
+        Object.assign(result, headers);
+    return result;
+}
+/** An OAuth error body carries a code worth logging and a description that may
+ *  carry anything at all; only the code is repeated. */
+function errorCode(body) {
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.error === 'string' ? parsed.error : 'unknown_error';
+    }
+    catch {
+        return 'unknown_error';
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/upstream/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/upstream/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,0CAA0C,CAAC;AAKlD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG5G;;;;;;;;;;;;;;;GAeG;AAEH;6CAC6C;AAC7C,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAExC,UAAU;IADrB,YACW,UAAkB,EAC3B,MAAc;QAEd,KAAK,CAAC,MAAM,CAAC,CAAC;0BAHL,UAAU;QAInB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC;AAChC,MAAM,aAAa,GAAG,MAAM,CAAC;AAM7B,MAAM,OAAO,YAAY;IAqBJ,MAAM;IACN,KAAK;IArBf,QAAQ,CAAmB;IACpC,gEAAgE;IACvD,WAAW,CAAS;IAC7B;sEACkE;IAC1D,QAAQ,CAAiB;IACjC;;;;;;;;;OASG;IACK,YAAY,CAAW;IAE/B,YACE,UAAkB,EACD,MAA0B,EAC1B,KAAgB,EACjC,WAAmB;sBAFF,MAAM;qBACN,KAAK;QAGtB,IAAI,CAAC,QAAQ,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,WAAW,EAAE,CAAC;QACzF,IAAI,CAAC,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ,CAAC,OAAO,GAA4D,EAAE;QAC5E,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC;IAED;uEACmE;IAC3D,MAAM;QACZ,OAAO,IAAI,CAAC,MAAM,EAAE,MAAiC,CAAC;IACxD,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,iBAAiB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,CAAC;IAED;+CAC2C;IACnC,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;6EACyE;IACjE,KAAK,CAAC,OAAO,CAAC,KAA6B,EAAE,IAAkB;QACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,EAAE;YACzB,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YAChC,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC3H,SAAS,EAAE,aAAa;YACxB,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAEgB,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEzF,4EAA4E;IAE5E,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,KAAK;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,SAAwC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,sBAAsB,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,eAAe;YAAE,OAAO,MAAM,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpG,MAAM,SAAS,GAAoB,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAA0B;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAS,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACvB,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACtH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,SAAS,CAAC,2BAA2B,EAAE,qCAAqC,KAAK,IAAI,EAAE,CAAC;gBAC1F,MAAM,IAAI,0BAA0B,CAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,EACxB,uFAAuF,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,iBAAkB,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,SAAS,CAAC,sBAAsB,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzI,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,mBAAmB,CAAC,SAA0B;QAC1D,MAAM,QAAQ,GAAG,SAAS,CAAC,2BAA2B,EAAE,qBAAqB,CAAC;QAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0BAA0B,CAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,EACxB,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;SACvF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,0BAA0B,CAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,EACxB,yCAAyC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqD,CAAC;QAC/F,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,0DAA0D,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,6EAA6E;IAE7E;+EAC2E;IACnE,WAAW;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;QAC9D,OAAO,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,OAAO,GAAmD,EAAE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,KAAK,OAAO,CAAC,gBAAgB;gBAAE,OAAO;QACvE,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAc;QACjC,wEAAwE;QACxE,yCAAyC;QACzC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;YAAE,OAAO;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjH,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YAC/F,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,sBAAsB,EAAE;gBAC1E,QAAQ,EAAE,SAAS,CAAC,2BAA2B;gBAC/C,iBAAiB;gBACjB,YAAY;gBACZ,QAAQ;gBACR,uBAAuB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,uBAAuB;gBAChE,OAAO,EAAE,IAAI,CAAC,YAAY;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,6DAA6D;YAC7D,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,4BAA4B,CACxC,SAA0B,EAC1B,iBAAyC,EACzC,QAAyB;QAEzB,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,mBAAmB,EAAG,CAAC;QAC/C,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,cAAc,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5I,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACzD,yEAAyE;YACzE,sCAAsC;YACtC,MAAM,QAAQ,CAAC,uBAAuB,CAAC,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClH,OAAO,CAAC,aAAa,GAAG,SAAS,KAAK,EAAE,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,0BAA0B,CAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,EACxB,qDAAqD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChH,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAChD,CAAC;IAED,6EAA6E;IAE7E;4EACwE;IACxE,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAChE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,sBAAsB,EAAE;YACpG,QAAQ,EAAE,SAAS,CAAC,2BAA2B;YAC/C,iBAAiB;YACjB,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnD,KAAK;YACL,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SAC1G,CAAC,CAAC;QACH,OAAO;YACL,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;YACvC,KAAK,EAAE;gBACL,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;gBACpC,YAAY;gBACZ,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;gBACxD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7G,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,WAAW,CAAC,KAAoB,EAAE,IAAY;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACvE,QAAQ,EAAE,SAAS,CAAC,2BAA2B;YAC/C,iBAAiB;YACjB,iBAAiB,EAAE,IAAI;YACvB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnD,QAAQ,EAAE,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YACzG,uBAAuB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,uBAAuB;YAChE,OAAO,EAAE,IAAI,CAAC,YAAY;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAwC,CAAC;QAClE,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,kBAAkB,GAAI,SAAS,EAAE,2BAA4E,EAAE,mBAAmB,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAiC,CAAC;QACxD,IAAI,kBAAkB,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;gBACpG,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC5D,IAAI,MAAM,CAAC,YAAY;oBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,EAAE;oBAC9C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,4BAA6B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE;oBACxD,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,uBAAuB,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,WAAW;QACT,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YACjG,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAEnD,MAAM,IAAI,GAAG,KAAK,IAAqD,EAAE;gBACvE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC;gBAC1C,IAAI,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;gBAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;YACrE,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;YACzD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,OAAO,KAAK,CAAC,QAAQ,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,OAAgC;IAChD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC5B,IAAI,OAAO,YAAY,OAAO;QAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;SACnF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;;QACpF,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;wDACwD;AACxD,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACvD,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/upstream/login.js

@@ -0,0 +1,94 @@
+import { signPayload } from '../auth/signed-token.js';
+import { UpstreamAuth } from './auth.js';
+/**
+ * The operator-facing half of outbound OAuth, shared by the admin CLI and — for
+ * the parts that need it — the callback route.
+ *
+ * Deliberately free of Express and of `process.exit`, so `admin.ts` stays what
+ * it is elsewhere: argument parsing and printing. That also keeps this file
+ * inside the coverage gate, which excludes `admin.ts`.
+ */
+/** Long enough for a sign-in with MFA and a consent screen, short enough that an
+ *  abandoned attempt does not linger. */
+export const LOGIN_TTL_MS = 15 * 60_000;
+export class UpstreamCommandError extends Error {
+}
+/** The remote server with this name, or a clear reason why it cannot be used. */
+export function requireOAuthServer(config, name) {
+    const server = config.get(name);
+    if (!server)
+        throw new UpstreamCommandError(`Unknown server: ${name}`);
+    if (server.kind !== 'remote')
+        throw new UpstreamCommandError(`Server "${name}" is not a remote server`);
+    if (!server.oauth)
+        throw new UpstreamCommandError(`Server "${name}" has no "oauth" block in mcp.json`);
+    return server;
+}
+export function authFor(store, externalUrl, name, server) {
+    return new UpstreamAuth(name, server, store, externalUrl);
+}
+/**
+ * Starts an interactive login and returns the URL the operator has to open.
+ *
+ * The `state` is signed with the same secret the hub's own browser tokens use,
+ * so the callback can trust which server a redirect belongs to without taking
+ * the server name from the query string.
+ */
+export async function startUpstreamLogin(store, auth) {
+    if (auth.identity.oauth.grant !== 'authorization_code') {
+        throw new UpstreamCommandError(`Server "${auth.identity.serverName}" uses the ${auth.identity.oauth.grant} grant, which needs no browser. Use "upstream refresh" instead.`);
+    }
+    const expiresAt = Date.now() + LOGIN_TTL_MS;
+    const payload = { n: auth.identity.serverName, exp: expiresAt };
+    const state = signPayload(payload, store.cookieSecret);
+    const { authorizationUrl, login } = await auth.startLogin(state);
+    store.saveUpstreamLogin(state, { ...login, expiresAt: Math.floor(expiresAt / 1000) });
+    return { authorizationUrl, expiresAt };
+}
+/** What `upstream list`/`status` prints. Reads only — never starts anything. */
+export function upstreamStatus(store, config, only) {
+    const stored = store.listUpstreamCredentials();
+    const rows = [];
+    const pendingFor = new Set(Object.values(store.listUpstreamLogins()).map(login => login.serverName));
+    for (const [name, server] of config) {
+        if (server.kind !== 'remote' || !server.oauth)
+            continue;
+        if (only && name !== only)
+            continue;
+        const auth = new UpstreamAuth(name, server, store, store.getExternalUrl() ?? 'http://localhost/');
+        // Reading through the manager applies the fingerprint check, so a record
+        // left over from a previous configuration shows up as `stale` rather than
+        // as a working credential.
+        const current = store.getUpstreamCredentials(name, auth.fingerprint);
+        const record = current ?? stored[name];
+        rows.push({
+            server: name,
+            mode: server.oauth.mode,
+            grant: server.oauth.grant,
+            scopes: server.oauth.scopes,
+            state: describe(current, record),
+            clientId: current?.clientId ?? server.oauth.clientId,
+            registered: current?.clientId !== undefined,
+            hasRefreshToken: typeof current?.tokens?.refresh_token === 'string',
+            ...(current?.accessTokenValidUntil ? { accessTokenValidUntil: new Date(current.accessTokenValidUntil * 1000).toISOString() } : {}),
+            ...(current?.obtainedAt ? { obtainedAt: new Date(current.obtainedAt * 1000).toISOString() } : {}),
+            loginPending: pendingFor.has(name)
+        });
+    }
+    if (only && rows.length === 0)
+        throw new UpstreamCommandError(`Unknown server, or it has no "oauth" block: ${only}`);
+    return rows;
+}
+/** `stale` means a record exists but belongs to a configuration that has since
+ *  changed — the operator sees why a login they remember doing does not count. */
+function describe(current, anyRecord) {
+    if (!current)
+        return anyRecord ? 'stale' : 'login_required';
+    if (!current.tokens)
+        return 'login_required';
+    if (current.accessTokenValidUntil !== undefined && current.accessTokenValidUntil <= Math.floor(Date.now() / 1000)) {
+        return 'expired';
+    }
+    return 'authorized';
+}
+//# sourceMappingURL=login.js.map

package/dist/upstream/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/upstream/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC;;;;;;;GAOG;AAEH;yCACyC;AACzC,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAExC,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,IAAY;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,WAAW,IAAI,0BAA0B,CAAC,CAAC;IACxG,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,oBAAoB,CAAC,WAAW,IAAI,oCAAoC,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAgB,EAAE,WAAmB,EAAE,IAAY,EAAE,MAA0B;IACrG,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAgB,EAChB,IAAkB;IAElB,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACvD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,CAAC,QAAQ,CAAC,UAAU,cAAc,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,iEAAiE,CAC5I,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;IAC5C,MAAM,OAAO,GAAkB,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACjE,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAgBD,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,KAAgB,EAAE,MAAiB,EAAE,IAAa;IAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACrG,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QACxD,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,mBAAmB,CAAC,CAAC;QAClG,yEAAyE;QACzE,0EAA0E;QAC1E,2BAA2B;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,MAAM,GAAoC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;YACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAChC,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ;YACpD,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS;YAC3C,eAAe,EAAE,OAAQ,OAAO,EAAE,MAAiD,EAAE,aAAa,KAAK,QAAQ;YAC/G,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;kFACkF;AAClF,SAAS,QAAQ,CAAC,OAAwC,EAAE,SAA0C;IACpG,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAC;IAC7C,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}