@ninomae/mcp-app-server 0.1.0

package/dist/oauth.js

@@ -0,0 +1,338 @@
+import { AppServerError } from './types.js';
+import { defaultRateLimitKey } from './rate-limit.js';
+import { json, nowIso, parseJsonList, randomSecret, readBody, sha256Hex, str, base64url } from './util.js';
+const AUTH_METHODS = ['none', 'client_secret_post', 'client_secret_basic'];
+const CODE_TTL_MS = 10 * 60 * 1000;
+const REFRESH_PREFIX = 'agr_';
+export const mcpResource = (rt) => rt.origins.publicOrigin + rt.mcpPath;
+export const resourceMetadataUrl = (rt) => rt.origins.publicOrigin + '/.well-known/oauth-protected-resource';
+const scopeNames = (rt) => Object.keys(rt.scopes);
+const requiredScopes = (rt) => scopeNames(rt).filter((s) => rt.scopes[s].required);
+export function isWellKnownPath(rt, pathname) {
+    return (pathname === '/.well-known/oauth-protected-resource' ||
+        pathname === '/.well-known/oauth-protected-resource' + rt.mcpPath ||
+        pathname === '/.well-known/oauth-authorization-server');
+}
+export function wellKnownResponse(rt, pathname) {
+    const origin = rt.origins.publicOrigin;
+    const body = pathname.startsWith('/.well-known/oauth-protected-resource')
+        ? { resource: mcpResource(rt), authorization_servers: [origin], scopes_supported: scopeNames(rt), bearer_methods_supported: ['header'] }
+        : {
+            issuer: origin,
+            authorization_endpoint: origin + rt.oauthPath + '/authorize',
+            token_endpoint: origin + rt.oauthPath + '/token',
+            registration_endpoint: origin + rt.oauthPath + '/register',
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: [...AUTH_METHODS],
+            scopes_supported: scopeNames(rt),
+        };
+    return json(body, 200, { 'access-control-allow-origin': '*' });
+}
+export function oauthErrorResponse(error) {
+    return json({ error: error.code, error_description: error.message }, error.status);
+}
+export function challengeResponse(rt, error, description, status = 401) {
+    return json({ error, error_description: description }, status, { 'www-authenticate': `Bearer resource_metadata="${resourceMetadataUrl(rt)}", error="${error}", error_description="${description.replace(/"/g, "'")}"` });
+}
+async function pkceChallenge(verifier) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return base64url(new Uint8Array(digest));
+}
+// Loopback redirects may change port per run (RFC 8252 §7.3); custom schemes serve
+// desktop apps; https must match exactly; plain http elsewhere is refused.
+export function classifyRedirect(uri) {
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return null;
+    }
+    if (url.hash)
+        return null;
+    if (url.protocol === 'http:')
+        return ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) ? 'loopback' : null;
+    if (url.protocol === 'https:')
+        return 'https';
+    if (['javascript:', 'data:', 'file:', 'blob:', 'vbscript:'].includes(url.protocol))
+        return null;
+    return /^[a-z][a-z0-9+.-]*:$/i.test(url.protocol) ? 'custom' : null;
+}
+function redirectMatches(registered, requested) {
+    if (registered === requested)
+        return true;
+    if (classifyRedirect(registered) !== 'loopback' || classifyRedirect(requested) !== 'loopback')
+        return false;
+    const a = new URL(registered);
+    const b = new URL(requested);
+    return a.hostname === b.hostname && a.pathname === b.pathname && a.search === b.search;
+}
+async function throttleRegistration(rt, request) {
+    if (!rt.registrationLimit)
+        return;
+    const key = (rt.registrationLimit.key || defaultRateLimitKey)(request);
+    if (!(await rt.registrationLimit.limiter.allow(key)))
+        throw new AppServerError(429, 'Registration rate limit exceeded', 'too_many_requests');
+}
+async function loadClient(rt, clientId) {
+    if (!clientId)
+        throw new AppServerError(400, 'client_id is required', 'invalid_client');
+    const client = await rt.store.clients.get(clientId);
+    if (!client)
+        throw new AppServerError(400, 'Unknown client_id', 'invalid_client');
+    return client;
+}
+function requestedScopes(rt, client, scopeParam) {
+    const raw = scopeParam ? scopeParam.split(/\s+/) : parseJsonList(client.scope);
+    const known = scopeNames(rt).filter((s) => raw.includes(s));
+    const scopes = known.length ? known : scopeNames(rt);
+    for (const required of requiredScopes(rt))
+        if (!scopes.includes(required))
+            scopes.unshift(required);
+    return scopes;
+}
+export async function register(rt, request) {
+    await throttleRegistration(rt, request);
+    const body = await readBody(request);
+    const uris = Array.isArray(body.redirect_uris) ? body.redirect_uris.map(str).filter(Boolean) : [];
+    if (!uris.length)
+        throw new AppServerError(400, 'redirect_uris is required', 'invalid_redirect_uri');
+    for (const uri of uris) {
+        if (uri.length > 2000 || !classifyRedirect(uri))
+            throw new AppServerError(400, `Unsupported redirect_uri: ${uri}`, 'invalid_redirect_uri');
+    }
+    const method = str(body.token_endpoint_auth_method) || 'none';
+    if (!AUTH_METHODS.includes(method))
+        throw new AppServerError(400, 'Unsupported token_endpoint_auth_method', 'invalid_client_metadata');
+    const grants = Array.isArray(body.grant_types) ? body.grant_types.map(str) : ['authorization_code'];
+    if (grants.some((g) => !['authorization_code', 'refresh_token'].includes(g)))
+        throw new AppServerError(400, 'Unsupported grant_types', 'invalid_client_metadata');
+    const name = (str(body.client_name) || 'MCP client').slice(0, 200);
+    const scope = str(body.scope).slice(0, 500) || null;
+    const clientId = crypto.randomUUID();
+    const secret = method === 'none' ? null : randomSecret();
+    const createdAt = nowIso();
+    await rt.store.clients.create({ id: clientId, secretHash: secret ? await sha256Hex(secret) : null, name, redirectUris: uris, tokenEndpointAuthMethod: method, scope, createdAt, lastUsedAt: null });
+    return json({
+        client_id: clientId,
+        ...(secret ? { client_secret: secret, client_secret_expires_at: 0 } : {}),
+        client_id_issued_at: Math.floor(Date.parse(createdAt) / 1000),
+        client_name: name,
+        redirect_uris: uris,
+        token_endpoint_auth_method: method,
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        ...(scope ? { scope } : {}),
+    }, 201);
+}
+const reader = (source) => (key) => (source instanceof URLSearchParams ? source.get(key) || '' : str(source[key]));
+function readAuthorizeParams(source) {
+    const get = reader(source);
+    return { clientId: get('client_id'), redirectUri: get('redirect_uri'), codeChallenge: get('code_challenge'), state: get('state'), scope: get('scope'), resource: get('resource') };
+}
+async function validateAuthorize(rt, params, source) {
+    const get = reader(source);
+    const client = await loadClient(rt, params.clientId);
+    const registered = client.redirectUris;
+    if (!params.redirectUri || !registered.some((uri) => redirectMatches(uri, params.redirectUri)))
+        throw new AppServerError(400, 'redirect_uri does not match the registered value');
+    // Beyond this point the redirect target is trusted, so errors may be sent back to it.
+    const responseType = get('response_type');
+    if (responseType && responseType !== 'code')
+        throw new AppServerError(400, 'Only response_type=code is supported', 'unsupported_response_type');
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(params.codeChallenge))
+        throw new AppServerError(400, 'PKCE code_challenge is required');
+    if (get('code_challenge_method') !== 'S256')
+        throw new AppServerError(400, 'code_challenge_method must be S256');
+    if (params.resource && params.resource !== mcpResource(rt))
+        throw new AppServerError(400, 'resource must be ' + mcpResource(rt), 'invalid_target');
+    return client;
+}
+function appendQuery(uri, entries) {
+    const url = new URL(uri);
+    for (const [key, value] of Object.entries(entries))
+        if (value)
+            url.searchParams.set(key, value);
+    return url.toString();
+}
+// GET <oauth>/authorize: validate, then hand the user to the host's consent page.
+export async function authorize(rt, request) {
+    const query = new URL(request.url).searchParams;
+    const params = readAuthorizeParams(query);
+    try {
+        await validateAuthorize(rt, params, query);
+    }
+    catch (error) {
+        if (!(error instanceof AppServerError))
+            throw error;
+        const trusted = error.code !== 'invalid_client' && !error.message.startsWith('redirect_uri');
+        if (trusted)
+            return Response.redirect(appendQuery(params.redirectUri, { error: error.code, error_description: error.message, state: params.state }), 302);
+        throw error;
+    }
+    const target = new URL(rt.consentPath, rt.origins.webOrigin);
+    target.search = query.toString();
+    return Response.redirect(target.toString(), 302);
+}
+// GET <oauth>/client: the consent page shows who is asking, where it returns, and what each scope means.
+export async function clientInfo(rt, request) {
+    const query = new URL(request.url).searchParams;
+    const client = await loadClient(rt, query.get('client_id') || '');
+    const redirectHosts = client.redirectUris.map((uri) => {
+        const kind = classifyRedirect(uri);
+        if (kind === 'loopback')
+            return 'localhost';
+        try {
+            return kind === 'custom' ? new URL(uri).protocol.replace(/:$/, '://') : new URL(uri).host;
+        }
+        catch {
+            return uri;
+        }
+    });
+    const scopes = requestedScopes(rt, client, query.get('scope') || '');
+    return json({
+        clientId: client.id,
+        clientName: client.name,
+        redirectHosts: [...new Set(redirectHosts)],
+        scopes,
+        scopesSupported: scopeNames(rt),
+        scopeDetails: scopes.map((name) => ({ name, description: rt.scopes[name].description, required: !!rt.scopes[name].required, default: !!(rt.scopes[name].required || rt.scopes[name].default) })),
+    });
+}
+// POST <oauth>/approve: the identified user consents (or refuses).
+export async function approve(rt, request, ownerId) {
+    const body = await readBody(request);
+    const params = readAuthorizeParams(body);
+    const client = await validateAuthorize(rt, params, body);
+    const decision = str(body.decision);
+    if (decision === 'deny')
+        return json({ redirect: appendQuery(params.redirectUri, { error: 'access_denied', error_description: 'The user refused the request', state: params.state }) });
+    if (decision !== 'approve')
+        throw new AppServerError(400, 'decision must be approve or deny');
+    const allowed = requestedScopes(rt, client, params.scope);
+    const chosen = Array.isArray(body.scopes) ? body.scopes.map(str).filter((s) => allowed.includes(s)) : allowed;
+    for (const required of requiredScopes(rt))
+        if (!chosen.includes(required))
+            chosen.unshift(required);
+    const code = randomSecret();
+    await rt.store.codes.create({ hash: await sha256Hex(code), clientId: client.id, ownerId, redirectUri: params.redirectUri, scopes: chosen, codeChallenge: params.codeChallenge, resource: params.resource || null, expiresAt: new Date(Date.now() + CODE_TTL_MS).toISOString(), usedAt: null, issuedTokenId: null });
+    return json({ redirect: appendQuery(params.redirectUri, { code, state: params.state }) });
+}
+async function authenticateClient(rt, request, body) {
+    let clientId = str(body.client_id);
+    let secret = str(body.client_secret);
+    const header = request.headers.get('authorization') || '';
+    if (header.startsWith('Basic ')) {
+        try {
+            const [id, ...rest] = atob(header.slice(6)).split(':');
+            clientId = decodeURIComponent(id);
+            secret = decodeURIComponent(rest.join(':'));
+        }
+        catch {
+            throw new AppServerError(401, 'Malformed Basic credentials', 'invalid_client');
+        }
+    }
+    const client = await loadClient(rt, clientId);
+    if (client.tokenEndpointAuthMethod !== 'none') {
+        if (!secret || (await sha256Hex(secret)) !== client.secretHash)
+            throw new AppServerError(401, 'Client authentication failed', 'invalid_client');
+    }
+    return client;
+}
+async function issuePair(rt, client, ownerId, scopes, type) {
+    const access = await rt.tokens.issue({ ownerId, clientId: client.id, clientName: client.name, scopes, audience: mcpResource(rt) });
+    await rt.onEvent?.({ type, ownerId, grantId: access.id, clientId: client.id, clientName: client.name, scopes });
+    const refresh = randomSecret(REFRESH_PREFIX);
+    await rt.store.refreshTokens.create({ hash: await sha256Hex(refresh), clientId: client.id, ownerId, accessTokenId: access.id, scopes, expiresAt: new Date(Date.now() + rt.refreshDays * 86400 * 1000).toISOString(), revoked: false, successorId: null });
+    await rt.store.clients.touch(client.id, nowIso());
+    const response = json({
+        access_token: access.token,
+        token_type: 'Bearer',
+        expires_in: Math.max(0, Math.floor((Date.parse(access.expiresAt) - Date.now()) / 1000)),
+        refresh_token: refresh,
+        scope: scopes.join(' '),
+    });
+    return { response, accessId: access.id };
+}
+// POST <oauth>/token
+export async function token(rt, request) {
+    const body = await readBody(request);
+    const client = await authenticateClient(rt, request, body);
+    const grant = str(body.grant_type);
+    const now = nowIso();
+    if (grant === 'authorization_code') {
+        const code = str(body.code);
+        if (!code)
+            throw new AppServerError(400, 'code is required', 'invalid_grant');
+        const row = await rt.store.codes.get(await sha256Hex(code));
+        if (!row || row.clientId !== client.id)
+            throw new AppServerError(400, 'Unknown authorization code', 'invalid_grant');
+        if (row.usedAt) {
+            // Replay of a consumed code: revoke what it produced (RFC 6819 §5.2.1.1).
+            if (row.issuedTokenId)
+                await revokeChain(rt, row.issuedTokenId);
+            throw new AppServerError(400, 'Authorization code already used', 'invalid_grant');
+        }
+        if (row.expiresAt < now)
+            throw new AppServerError(400, 'Authorization code expired', 'invalid_grant');
+        if (str(body.redirect_uri) && str(body.redirect_uri) !== row.redirectUri)
+            throw new AppServerError(400, 'redirect_uri mismatch', 'invalid_grant');
+        const verifier = str(body.code_verifier);
+        if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier) || (await pkceChallenge(verifier)) !== row.codeChallenge)
+            throw new AppServerError(400, 'PKCE verification failed', 'invalid_grant');
+        const resource = str(body.resource);
+        if (resource && resource !== mcpResource(rt))
+            throw new AppServerError(400, 'resource mismatch', 'invalid_target');
+        // Consume the code before issuing so a concurrent replay cannot win a second token.
+        if (!(await rt.store.codes.consume(row.hash, now)))
+            throw new AppServerError(400, 'Authorization code already used', 'invalid_grant');
+        const issued = await issuePair(rt, client, row.ownerId, row.scopes, 'authorized');
+        await rt.store.codes.setIssuedToken(row.hash, issued.accessId);
+        return issued.response;
+    }
+    if (grant === 'refresh_token') {
+        const refresh = str(body.refresh_token);
+        if (!refresh.startsWith(REFRESH_PREFIX))
+            throw new AppServerError(400, 'refresh_token is required', 'invalid_grant');
+        const row = await rt.store.refreshTokens.get(await sha256Hex(refresh));
+        if (!row || row.clientId !== client.id)
+            throw new AppServerError(400, 'Unknown refresh token', 'invalid_grant');
+        if (row.revoked) {
+            // A rotated refresh token being replayed means the chain leaked; cut every successor.
+            await revokeChain(rt, row.accessTokenId);
+            throw new AppServerError(400, 'Refresh token revoked', 'invalid_grant');
+        }
+        if (row.expiresAt < now)
+            throw new AppServerError(400, 'Refresh token expired', 'invalid_grant');
+        if (!(await rt.store.refreshTokens.revoke(row.hash)))
+            throw new AppServerError(400, 'Refresh token revoked', 'invalid_grant');
+        await revokeAccess(rt, row.accessTokenId);
+        const issued = await issuePair(rt, client, row.ownerId, row.scopes, 'refreshed');
+        await rt.store.refreshTokens.setSuccessor(row.hash, issued.accessId);
+        return issued.response;
+    }
+    throw new AppServerError(400, 'grant_type must be authorization_code or refresh_token', 'unsupported_grant_type');
+}
+async function revokeAccess(rt, id) {
+    const revoked = await rt.tokens.revoke(id);
+    if (revoked)
+        await rt.onEvent?.({ type: 'revoked', ownerId: revoked.ownerId, grantId: id, clientId: revoked.clientId, clientName: revoked.clientName });
+}
+// Revokes an access token, its refresh token, and every pair rotated from it.
+export async function revokeChain(rt, accessTokenId) {
+    const seen = new Set();
+    let current = accessTokenId;
+    while (current && !seen.has(current)) {
+        seen.add(current);
+        await revokeAccess(rt, current);
+        const row = await rt.store.refreshTokens.getByAccessToken(current);
+        await rt.store.refreshTokens.revokeByAccessToken(current);
+        current = row?.successorId ?? null;
+    }
+}
+export async function pruneOauth(rt) {
+    await rt.store.prune?.(nowIso());
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3G,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAU,CAAC;AACpF,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,cAAc,GAAG,MAAM,CAAC;AAgB9B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAA6C,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC;AACnH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,EAAiC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,YAAY,GAAG,uCAAuC,CAAC;AAC5I,MAAM,UAAU,GAAG,CAAC,EAAgC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,cAAc,GAAG,CAAC,EAAgC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEjH,MAAM,UAAU,eAAe,CAAC,EAAiC,EAAE,QAAgB;IACjF,OAAO,CACL,QAAQ,KAAK,uCAAuC;QACpD,QAAQ,KAAK,uCAAuC,GAAG,EAAE,CAAC,OAAO;QACjE,QAAQ,KAAK,yCAAyC,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAgB,EAAE,QAAgB;IAClE,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,uCAAuC,CAAC;QACvE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,wBAAwB,EAAE,CAAC,QAAQ,CAAC,EAAE;QACxI,CAAC,CAAC;YACE,MAAM,EAAE,MAAM;YACd,sBAAsB,EAAE,MAAM,GAAG,EAAE,CAAC,SAAS,GAAG,YAAY;YAC5D,cAAc,EAAE,MAAM,GAAG,EAAE,CAAC,SAAS,GAAG,QAAQ;YAChD,qBAAqB,EAAE,MAAM,GAAG,EAAE,CAAC,SAAS,GAAG,WAAW;YAC1D,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,GAAG,YAAY,CAAC;YACxD,gBAAgB,EAAE,UAAU,CAAC,EAAE,CAAC;SACjC,CAAC;IACN,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACtD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAiC,EAAE,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG;IACnH,OAAO,IAAI,CACT,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EACzC,MAAM,EACN,EAAE,kBAAkB,EAAE,6BAA6B,mBAAmB,CAAC,EAAE,CAAC,aAAa,KAAK,yBAAyB,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,CACzJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACpH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,SAAiB;IAC5D,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,UAAU,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC5G,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,EAAgB,EAAE,OAAgB;IACpE,IAAI,CAAC,EAAE,CAAC,iBAAiB;QAAE,OAAO;IAClC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,kCAAkC,EAAE,mBAAmB,CAAC,CAAC;AAC/I,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAAgB,EAAE,QAAgB;IAC1D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,EAAgB,EAAE,MAAoB,EAAE,UAAkB;IACjF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAgB,EAAE,OAAgB;IAC/D,MAAM,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,sBAAsB,CAAC,CAAC;IACrG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,6BAA6B,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC;IAC9D,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,wCAAwC,EAAE,yBAAyB,CAAC,CAAC;IAC9J,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;IAClK,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACpM,OAAO,IAAI,CACT;QACE,SAAS,EAAE,QAAQ;QACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QAC7D,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAID,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,MAAM,YAAY,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAExI,SAAS,mBAAmB,CAAC,MAAmB;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACrL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAgB,EAAE,MAAuB,EAAE,MAAmB;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5F,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;IACpF,sFAAsF;IACtF,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,YAAY,IAAI,YAAY,KAAK,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,sCAAsC,EAAE,2BAA2B,CAAC,CAAC;IAChJ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC9H,IAAI,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IACjH,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACnJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,OAA+B;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChG,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAgB,EAAE,OAAgB;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC7F,IAAI,OAAO;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1J,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAgB,EAAE,OAAgB;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,WAAW,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;QACV,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM;QACN,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC;QAC/B,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KACjM,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAgB,EAAE,OAAgB,EAAE,OAAe;IAC/E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxL,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9G,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACpT,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAAgB,EAAE,OAAgB,EAAE,IAA6B;IACjG,IAAI,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvD,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,gBAAgB,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,EAAgB,EAAE,MAAoB,EAAE,OAAe,EAAE,MAAgB,EAAE,IAAgC;IAClI,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnI,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1P,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC,KAAK;QAC1B,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,qBAAqB;AACrB,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAgB,EAAE,OAAgB;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,eAAe,CAAC,CAAC;QACrH,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,0EAA0E;YAC1E,IAAI,GAAG,CAAC,aAAa;gBAAE,MAAM,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAChE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,iCAAiC,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,eAAe,CAAC,CAAC;QACtG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,WAAW;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,eAAe,CAAC,CAAC;QACrL,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;QACnH,oFAAoF;QACpF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,iCAAiC,EAAE,eAAe,CAAC,CAAC;QACtI,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAClF,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,eAAe,CAAC,CAAC;QACrH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QAChH,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,sFAAsF;YACtF,MAAM,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YACzC,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QACjG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QAC9H,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,wDAAwD,EAAE,wBAAwB,CAAC,CAAC;AACpH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAgB,EAAE,EAAU;IACtD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAC1J,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAgB,EAAE,aAAqB;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAkB,aAAa,CAAC;IAC3C,OAAO,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,GAAG,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAgB;IAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,20 @@
+export interface RateLimiter {
+    /** Return true to allow the action, false to refuse it with HTTP 429. */
+    allow(key: string): Promise<boolean>;
+}
+export interface RateLimitConfig {
+    limiter: RateLimiter;
+    /** Derive the counter key from the request. Default: client IP from `cf-connecting-ip` / `x-forwarded-for`, else `'local'`. */
+    key?: (request: Request) => string;
+}
+export declare function defaultRateLimitKey(request: Request): string;
+/**
+ * Reference limiter: a sliding window per key held in process memory. Correct on a single long-lived
+ * process; on multi-instance or isolate-per-request runtimes (Cloudflare Workers, Lambda) each instance
+ * counts separately, so use your platform's shared primitive there.
+ */
+export declare function memoryRateLimiter(options?: {
+    limit?: number;
+    windowMs?: number;
+}): RateLimiter;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,CAAC;IACrB,+HAA+H;IAC/H,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC;CACpC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,UAEnD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAclG"}

package/dist/rate-limit.js

@@ -0,0 +1,29 @@
+// Rate limiting contract. The server asks "may this key act once more?" and nothing else; where
+// the counters live (memory, KV, Durable Object, Redis, a platform rate-limit binding) is the host's
+// choice. Only dynamic client registration is limited today, since it is the one unauthenticated
+// endpoint that writes to storage.
+export function defaultRateLimitKey(request) {
+    return request.headers.get('cf-connecting-ip') || request.headers.get('x-forwarded-for')?.split(',')[0].trim() || 'local';
+}
+/**
+ * Reference limiter: a sliding window per key held in process memory. Correct on a single long-lived
+ * process; on multi-instance or isolate-per-request runtimes (Cloudflare Workers, Lambda) each instance
+ * counts separately, so use your platform's shared primitive there.
+ */
+export function memoryRateLimiter(options = {}) {
+    const limit = options.limit ?? 20;
+    const windowMs = options.windowMs ?? 60 * 60 * 1000;
+    const hits = new Map();
+    return {
+        async allow(key) {
+            const cutoff = Date.now() - windowMs;
+            const recent = (hits.get(key) || []).filter((at) => at > cutoff);
+            if (recent.length >= limit)
+                return false;
+            recent.push(Date.now());
+            hits.set(key, recent);
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,qGAAqG;AACrG,iGAAiG;AACjG,mCAAmC;AAanC,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC;AAC5H,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAiD,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/react.d.ts

@@ -0,0 +1,36 @@
+export interface ConsentClient {
+    clientId: string;
+    clientName: string;
+    redirectHosts: string[];
+    scopes: string[];
+    scopesSupported: string[];
+    scopeDetails: {
+        name: string;
+        description: string;
+        required: boolean;
+        default: boolean;
+    }[];
+}
+export interface UseAgentConsentOptions {
+    /** Same `basePath` the server was created with. */
+    basePath: string;
+    /** Headers proving who is signed in (e.g. `Authorization: Bearer <host JWT>`); read at approve time. */
+    authHeaders?: () => Promise<Record<string, string>> | Record<string, string>;
+    /** Defaults to `window.location.search`. */
+    search?: string;
+    fetcher?: typeof fetch;
+}
+export declare function useAgentConsent(options: UseAgentConsentOptions): {
+    params: URLSearchParams | null;
+    client: ConsentClient | null;
+    chosen: string[];
+    toggle: (scope: string, on: boolean) => void;
+    decide: (decision: "approve" | "deny") => Promise<void>;
+    error: string;
+    setError: import("react").Dispatch<import("react").SetStateAction<string>>;
+    busy: boolean;
+    redirect: string;
+    destination: string;
+    missingClient: boolean;
+};
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC5F;AAED,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7E,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB;;;;oBA2C1B,MAAM,MAAM,OAAO;uBAKnC,SAAS,GAAG,MAAM;;;;;;;EAsBtC"}

package/dist/react.js

@@ -0,0 +1,73 @@
+'use client';
+// Headless consent flow. The host renders its own login and layout; this hook loads what the
+// agent is asking for, tracks the user's scope choices and posts the decision.
+import { useCallback, useEffect, useMemo, useState, useSyncExternalStore } from 'react';
+const subscribeNever = () => () => { };
+export function useAgentConsent(options) {
+    const { basePath, authHeaders, fetcher } = options;
+    // The query string is a client-only value; the server snapshot is null so hydration matches.
+    const search = useSyncExternalStore(subscribeNever, () => options.search ?? window.location.search, () => options.search ?? null);
+    const params = useMemo(() => (search === null ? null : new URLSearchParams(search)), [search]);
+    const [client, setClient] = useState(null);
+    const [chosen, setChosen] = useState([]);
+    const [error, setError] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [redirect, setRedirect] = useState('');
+    const doFetch = useMemo(() => fetcher ?? globalThis.fetch.bind(globalThis), [fetcher]);
+    useEffect(() => {
+        const clientId = params?.get('client_id') || '';
+        if (!clientId)
+            return;
+        let cancelled = false;
+        void doFetch(basePath + '/oauth/client?' + new URLSearchParams({ client_id: clientId, scope: params?.get('scope') || '' }))
+            .then(async (response) => {
+            const data = (await response.json());
+            if (!response.ok)
+                throw new Error(data.error_description || data.error || 'Unknown client');
+            if (cancelled)
+                return;
+            setClient(data);
+            setChosen(data.scopeDetails.filter((s) => s.default).map((s) => s.name));
+        })
+            .catch((err) => !cancelled && setError(err.message));
+        return () => {
+            cancelled = true;
+        };
+    }, [basePath, params, doFetch]);
+    const destination = useMemo(() => {
+        try {
+            const url = new URL(params?.get('redirect_uri') || '');
+            return url.protocol === 'http:' || url.protocol === 'https:' ? url.host : url.protocol.replace(/:$/, '://');
+        }
+        catch {
+            return '';
+        }
+    }, [params]);
+    const toggle = useCallback((scope, on) => {
+        setChosen((current) => (on ? [...new Set([...current, scope])] : current.filter((s) => s !== scope)));
+    }, []);
+    const decide = useCallback(async (decision) => {
+        if (!params)
+            return;
+        setBusy(true);
+        setError('');
+        try {
+            const headers = { 'content-type': 'application/json', ...(await authHeaders?.()) };
+            const body = { ...Object.fromEntries(params.entries()), decision, scopes: chosen };
+            const response = await doFetch(basePath + '/oauth/approve', { method: 'POST', headers, body: JSON.stringify(body) });
+            const data = (await response.json());
+            if (!response.ok || !data.redirect)
+                throw new Error(data.error_description || data.error || 'Authorization failed');
+            setRedirect(data.redirect);
+            window.location.href = data.redirect;
+        }
+        catch (err) {
+            setError(err instanceof Error ? err.message : 'Authorization failed');
+        }
+        finally {
+            setBusy(false);
+        }
+    }, [params, chosen, basePath, authHeaders, doFetch]);
+    return { params, client, chosen, toggle, decide, error, setError, busy, redirect, destination, missingClient: params !== null && !params.get('client_id') };
+}
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AACb,6FAA6F;AAC7F,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAqBxF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;AAEtC,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnD,6FAA6F;IAC7F,MAAM,MAAM,GAAG,oBAAoB,CACjC,cAAc,EACd,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAC9C,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAC7B,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAuB,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAW,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,QAAQ,GAAG,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,OAAO,CAAC,QAAQ,GAAG,gBAAgB,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aACxH,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmE,CAAC;YACvG,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAC;YAC5F,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,EAAW,EAAE,EAAE;QACxD,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,QAA4B,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,GAAG,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsE,CAAC;YAC1G,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC;YACpH,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EACD,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CACjD,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9J,CAAC"}

package/dist/sql.d.ts

@@ -0,0 +1,27 @@
+import type { AppServerStore } from './store.js';
+/** Minimal SQL surface the adapter needs: `?1 … ?n` placeholders, `first()`, `all()`, `run().meta.changes`. */
+export interface SqlDatabase {
+    exec(sql: string): Promise<unknown>;
+    prepare(sql: string): SqlStatement;
+}
+export interface SqlStatement {
+    bind(...values: unknown[]): SqlStatement;
+    first<T = Record<string, unknown>>(): Promise<T | null>;
+    all<T = Record<string, unknown>>(): Promise<{
+        results?: T[];
+    }>;
+    run(): Promise<{
+        meta: {
+            changes?: number;
+        };
+    }>;
+}
+export interface TableNames {
+    clients: string;
+    codes: string;
+    refreshTokens: string;
+    accessTokens: string;
+}
+/** @param tables Override table names only when adopting an existing schema. */
+export declare function sqlStore(db: SqlDatabase, tables?: Partial<TableNames>): AppServerStore;
+//# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA+C,cAAc,EAAsB,MAAM,YAAY,CAAC;AAElH,+GAA+G;AAC/G,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC;CACpC;AACD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;IACzC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/D,GAAG,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAuBD,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,GAAE,OAAO,CAAC,UAAU,CAAM,GAAG,cAAc,CAwF1F"}