@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.1

package/dist/routes/nodes.js

@@ -2,6 +2,7 @@ import { bridge } from "../lib/bridge.js";
 import { handleNodeMetadata } from "../http-api.js";
 import { resolveKieDynamicSchema } from "@nodetool-ai/base-nodes";
 import { ApiErrorCode, apiError } from "../error-codes.js";
+import { isNonBlankString, isObjectLike, isString } from "../lib/wire-values.js";
 const nodesRoutes = async (app, opts) => {
     const { apiOptions } = opts;
     /**
@@ -11,19 +12,13 @@ const nodesRoutes = async (app, opts) => {
     app.get("/api/nodes/metadata", async (req, reply) => {
         await bridge(req, reply, (request) => handleNodeMetadata(request, apiOptions));
     });
-    /**
-     * Legacy alias for /api/nodes/metadata.
-     */
-    app.get("/api/node/metadata", async (req, reply) => {
-        await bridge(req, reply, (request) => handleNodeMetadata(request, apiOptions));
-    });
     /**
      * KIE dynamic schema resolution — stays as REST (fast, stateless, no auth needed).
      */
     app.post("/api/kie/resolve-dynamic-schema", async (req, reply) => {
         const body = req.body;
         const modelInfo = extractKieModelInfo(body);
-        if (typeof modelInfo !== "string" || !modelInfo.trim()) {
+        if (!isNonBlankString(modelInfo)) {
             reply
                 .status(400)
                 .send(apiError(ApiErrorCode.INVALID_INPUT, "model_info must be a non-empty string"));
@@ -38,56 +33,6 @@ const nodesRoutes = async (app, opts) => {
                 .send(apiError(ApiErrorCode.INVALID_INPUT, error instanceof Error ? error.message : String(error)));
         }
     });
-    /**
-     * Proxy ComfyUI /object_info through the backend to avoid CORS issues
-     * with remote hosts (e.g. RunPod Pods).
-     */
-    app.get("/api/comfy/object_info", async (req, reply) => {
-        const host = req.query["host"]?.trim();
-        if (!host) {
-            reply.status(400).send({ error: "host query parameter is required" });
-            return;
-        }
-        // Validate and normalise the host into a safe URL (prevents SSRF via
-        // non-HTTP schemes such as file://, ftp://, etc.).
-        let parsedUrl;
-        try {
-            const raw = host.startsWith("http") ? host : `http://${host}`;
-            parsedUrl = new URL(raw);
-        }
-        catch {
-            reply.status(400).send({ error: "Invalid host URL" });
-            return;
-        }
-        if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
-            reply
-                .status(400)
-                .send({ error: "Only http and https hosts are supported" });
-            return;
-        }
-        // Trim any trailing slashes without backtracking regex (avoids ReDoS).
-        let base = parsedUrl.origin + parsedUrl.pathname;
-        let end = base.length;
-        while (end > 0 && base[end - 1] === "/")
-            end--;
-        base = base.slice(0, end);
-        try {
-            const resp = await fetch(`${base}/object_info`);
-            if (!resp.ok) {
-                reply
-                    .status(resp.status)
-                    .send({ error: `ComfyUI returned ${resp.status}` });
-                return;
-            }
-            const data = await resp.json();
-            reply.send(data);
-        }
-        catch (err) {
-            reply.status(502).send({
-                error: `Cannot reach ComfyUI at ${base}: ${err instanceof Error ? err.message : String(err)}`
-            });
-        }
-    });
 };
 function extractKieModelInfo(body) {
     if (Buffer.isBuffer(body)) {
@@ -102,7 +47,7 @@ function extractKieModelInfo(body) {
             return text;
         }
     }
-    if (typeof body === "string") {
+    if (isString(body)) {
         try {
             const parsed = JSON.parse(body);
             return extractKieModelInfo(parsed);
@@ -111,9 +56,11 @@ function extractKieModelInfo(body) {
             return body;
         }
     }
-    if (!body || typeof body !== "object") {
+    if (!isObjectLike(body)) {
         return undefined;
     }
+    // SAFETY: the checks above proved `body` is a non-null object; its members
+    // came out of a JSON request body.
     const record = body;
     return (record.model_info ??
         record.modelInfo ??

package/dist/routes/nodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAM3D,MAAM,WAAW,GAAqC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,uCAAuC,CACxC,CACF,CAAC;YACJ,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CACF,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,IAAI,GAAI,GAAG,CAAC,KAAgC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,mDAAmD;QACnD,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YAC9D,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtE,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,GAAG,EAAE,CAAC;QAC/C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK;qBACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;qBACnB,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE,2BAA2B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YAC3C,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,OAAO,CACL,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,SAAS;QAChB,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAM/B,MAAM,WAAW,GAAqC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,uCAAuC,CACxC,CACF,CAAC;YACJ,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CACF,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAWF,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YAC3C,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,MAAM,GAAG,IAAoC,CAAC;IACpD,OAAO,CACL,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,SAAS;QAChB,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,eAAe,WAAW,CAAC"}

package/dist/routes/oauth-as.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MCP OAuth 2.1 authorization server + resource-server discovery routes
+ * (`docs/mcp-oauth-design.md`). NodeTool is both the AS and the RS for
+ * `/mcp` — this plugin registers the seven endpoints that make that work:
+ *
+ *   GET  /.well-known/oauth-protected-resource/mcp   (RFC 9728)
+ *   GET  /.well-known/oauth-protected-resource        (RFC 9728, root form)
+ *   GET  /.well-known/oauth-authorization-server       (RFC 8414)
+ *   GET  /oauth/authorize
+ *   POST /oauth/token
+ *   POST /oauth/register                                (RFC 7591)
+ *   POST /oauth/revoke                                   (RFC 7009)
+ *
+ * Self-contained: no dependency on `server.ts` wiring, no import of the
+ * agent-access tRPC router. The consent page and the `approveOauthRequest`
+ * mutation (T4) are reached only through `pendingStore` — `/oauth/authorize`
+ * parks a request and 302s to `/oauth/consent?request_id=…` (an SPA route
+ * this plugin never renders), and `/oauth/token` reads back whatever
+ * `pendingStore.putCode` produced, from either the real consent flow or a
+ * test driving the store directly.
+ *
+ * Grant lifetime: the consent step (`approveOauthRequest`) creates the
+ * `McpOauthGrant` and threads its id through `pendingStore.putCode`, so the
+ * token endpoint mints tokens for exactly that grant — and revokes it when a
+ * code is replayed (OAuth 2.1 code-replay rule). One consent, one grant row.
+ */
+import type { FastifyPluginAsync } from "fastify";
+export declare const oauthAsRoutes: FastifyPluginAsync;
+export default oauthAsRoutes;
+//# sourceMappingURL=oauth-as.d.ts.map

package/dist/routes/oauth-as.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-as.d.ts","sourceRoot":"","sources":["../../src/routes/oauth-as.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAgB,MAAM,SAAS,CAAC;AAkHhE,eAAO,MAAM,aAAa,EAAE,kBA6f3B,CAAC;eAEa,aAAa"}

package/dist/routes/oauth-as.js

@@ -0,0 +1,412 @@
+/**
+ * MCP OAuth 2.1 authorization server + resource-server discovery routes
+ * (`docs/mcp-oauth-design.md`). NodeTool is both the AS and the RS for
+ * `/mcp` — this plugin registers the seven endpoints that make that work:
+ *
+ *   GET  /.well-known/oauth-protected-resource/mcp   (RFC 9728)
+ *   GET  /.well-known/oauth-protected-resource        (RFC 9728, root form)
+ *   GET  /.well-known/oauth-authorization-server       (RFC 8414)
+ *   GET  /oauth/authorize
+ *   POST /oauth/token
+ *   POST /oauth/register                                (RFC 7591)
+ *   POST /oauth/revoke                                   (RFC 7009)
+ *
+ * Self-contained: no dependency on `server.ts` wiring, no import of the
+ * agent-access tRPC router. The consent page and the `approveOauthRequest`
+ * mutation (T4) are reached only through `pendingStore` — `/oauth/authorize`
+ * parks a request and 302s to `/oauth/consent?request_id=…` (an SPA route
+ * this plugin never renders), and `/oauth/token` reads back whatever
+ * `pendingStore.putCode` produced, from either the real consent flow or a
+ * test driving the store directly.
+ *
+ * Grant lifetime: the consent step (`approveOauthRequest`) creates the
+ * `McpOauthGrant` and threads its id through `pendingStore.putCode`, so the
+ * token endpoint mints tokens for exactly that grant — and revokes it when a
+ * code is replayed (OAuth 2.1 code-replay rule). One consent, one grant row.
+ */
+import { McpOauthClient, McpOauthGrant, McpOauthToken, MCP_OAUTH_ACCESS_TTL_MS } from "@nodetool-ai/models";
+import { enabledPublicUrl as resolveEnabledPublicUrl } from "../oauth/gate.js";
+import { buildProtectedResourceMetadata, buildAuthServerMetadata } from "../oauth/metadata.js";
+import { isAllowedRedirectUri, canonicalResource, resourceMatches, validateScope } from "../oauth/validate.js";
+import { verifyS256 } from "../oauth/pkce.js";
+import { pendingStore } from "../oauth/pending-store.js";
+import { isClientIdUrl, fetchClientMetadata } from "../oauth/cimd.js";
+/**
+ * Per-route @fastify/rate-limit config, picked up by the server's globally
+ * registered limiter via its onRoute hook. Tighter than the global cap:
+ * these endpoints issue and redeem credentials, so a flood is a guessing
+ * attack, not load. Register is tightest — anonymous writes a DB row.
+ * Inert when no limiter is registered (standalone plugin tests).
+ */
+const OAUTH_ROUTE_RATE_LIMIT = { max: 30, timeWindow: "1 minute" };
+const OAUTH_REGISTER_RATE_LIMIT = { max: 10, timeWindow: "1 minute" };
+/**
+ * Bounds on what an anonymous `/oauth/register` may write. The route is
+ * unauthenticated and its row is durable, so the rate limit alone is not a
+ * size limit: ten requests a minute at the server's 100 MB body cap is a
+ * gigabyte a minute of client metadata. A registration document is a name and
+ * a handful of redirect URIs — 8 KB is generous for that.
+ */
+const REGISTER_BODY_LIMIT_BYTES = 8 * 1024;
+const MAX_CLIENT_NAME_LENGTH = 256;
+const MAX_REDIRECT_URIS = 10;
+const MAX_REDIRECT_URI_LENGTH = 2048;
+function notFound(reply) {
+    return reply.status(404).send({ error: "not_found" });
+}
+function oauthError(reply, status, error, description) {
+    return reply
+        .status(status)
+        .type("application/json")
+        .send(description === undefined
+        ? { error }
+        : { error, error_description: description });
+}
+function escapeHtml(input) {
+    return input
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+/** Pre-redirect-validation failure: rendered in-page, never redirects
+ * (open-redirect rule — the client's own redirect_uri isn't trusted yet). */
+function htmlError(reply, status, error, description) {
+    return reply
+        .status(status)
+        .type("text/html")
+        .send(`<!doctype html><title>Authorization error</title>` +
+        `<p><strong>${escapeHtml(error)}</strong>: ${escapeHtml(description)}</p>`);
+}
+function firstValue(value) {
+    if (Array.isArray(value))
+        return typeof value[0] === "string" ? value[0] : undefined;
+    return typeof value === "string" ? value : undefined;
+}
+async function resolveClient(clientId) {
+    if (isClientIdUrl(clientId)) {
+        const result = await fetchClientMetadata(clientId);
+        if (!result.ok)
+            return null;
+        return { clientName: result.clientName, redirectUris: result.redirectUris };
+    }
+    const client = await McpOauthClient.get(clientId);
+    if (!client)
+        return null;
+    return { clientName: client.client_name, redirectUris: client.redirect_uris };
+}
+function parseFormBody(body) {
+    return typeof body === "string" ? new URLSearchParams(body) : new URLSearchParams();
+}
+export const oauthAsRoutes = async (app) => {
+    // Body parsing is registered on this plugin's own encapsulation context,
+    // so it applies to these routes regardless of what the outer app does
+    // with content-type parsers (the real server parses everything as a raw
+    // buffer — see `server.ts`'s `addContentTypeParser("*", …)`).
+    app.addContentTypeParser("application/x-www-form-urlencoded", { parseAs: "string" }, (_req, body, done) => done(null, body.toString()));
+    app.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
+        try {
+            const text = body.toString();
+            done(null, text.length > 0 ? JSON.parse(text) : {});
+        }
+        catch (err) {
+            done(err instanceof Error ? err : new Error("invalid JSON"), undefined);
+        }
+    });
+    // ── Well-known discovery documents ──────────────────────────────────
+    function serveWellKnown(reply, build) {
+        const publicUrl = resolveEnabledPublicUrl();
+        if (!publicUrl)
+            return notFound(reply);
+        return reply
+            .status(200)
+            .header("Cache-Control", "public, max-age=3600")
+            .type("application/json")
+            .send(build(publicUrl));
+    }
+    /** The issuer's path component with no trailing slash — "" when the
+     * public URL is at the origin root. RFC 8414/9728 path-insertion appends
+     * this to the well-known prefix, so a sub-path deployment's documents
+     * live at `/.well-known/<suffix>/<issuer-path>[...]`. */
+    function issuerPath(publicUrl) {
+        const path = new URL(publicUrl).pathname;
+        return path === "/" ? "" : path.replace(/\/$/, "");
+    }
+    function serveWellKnownAt(req, reply, expectedSuffixPath, build) {
+        const publicUrl = resolveEnabledPublicUrl();
+        if (!publicUrl)
+            return notFound(reply);
+        const wildcard = req.params["*"] ?? "";
+        if (`/${wildcard}` !== expectedSuffixPath(publicUrl)) {
+            return notFound(reply);
+        }
+        return reply
+            .status(200)
+            .header("Cache-Control", "public, max-age=3600")
+            .type("application/json")
+            .send(build(publicUrl));
+    }
+    // Path-inserted forms (the only valid forms when the issuer carries a
+    // sub-path): metadata for issuer https://host/base lives at
+    // /.well-known/oauth-authorization-server/base, and the protected-resource
+    // document for https://host/base/mcp at
+    // /.well-known/oauth-protected-resource/base/mcp. A root deployment's
+    // resource form /.well-known/oauth-protected-resource/mcp is the same
+    // wildcard with issuerPath = "".
+    app.get("/.well-known/oauth-protected-resource/*", async (req, reply) => serveWellKnownAt(req, reply, (publicUrl) => `${issuerPath(publicUrl)}/mcp`, buildProtectedResourceMetadata));
+    app.get("/.well-known/oauth-protected-resource", async (_req, reply) => serveWellKnown(reply, buildProtectedResourceMetadata));
+    app.get("/.well-known/oauth-authorization-server/*", async (req, reply) => serveWellKnownAt(req, reply, (publicUrl) => issuerPath(publicUrl) || "/", buildAuthServerMetadata));
+    app.get("/.well-known/oauth-authorization-server", async (_req, reply) => serveWellKnown(reply, buildAuthServerMetadata));
+    // ── GET /oauth/authorize ─────────────────────────────────────────────
+    app.get("/oauth/authorize", { config: { rateLimit: OAUTH_ROUTE_RATE_LIMIT } }, async (req, reply) => {
+        const publicUrl = resolveEnabledPublicUrl();
+        if (!publicUrl)
+            return notFound(reply);
+        const query = req.query;
+        const clientId = firstValue(query["client_id"]);
+        if (!clientId) {
+            return htmlError(reply, 400, "invalid_request", "missing client_id");
+        }
+        const resolved = await resolveClient(clientId);
+        if (!resolved) {
+            return htmlError(reply, 400, "invalid_client", "unknown client_id");
+        }
+        if (clientId.startsWith("ntc_")) {
+            await McpOauthClient.touch(clientId).catch(() => {
+                // best-effort — a missed touch never blocks the flow
+            });
+        }
+        const redirectUri = firstValue(query["redirect_uri"]);
+        if (!redirectUri) {
+            return htmlError(reply, 400, "invalid_request", "missing redirect_uri");
+        }
+        if (!isAllowedRedirectUri(redirectUri) ||
+            !resolved.redirectUris.includes(redirectUri)) {
+            return htmlError(reply, 400, "invalid_request", "redirect_uri is not registered for this client");
+        }
+        // redirect_uri is trusted from here on — later failures redirect with
+        // an error instead of rendering in-page.
+        const state = firstValue(query["state"]);
+        const iss = buildAuthServerMetadata(publicUrl).issuer;
+        function redirectWithError(error, description) {
+            const url = new URL(redirectUri);
+            url.searchParams.set("error", error);
+            url.searchParams.set("error_description", description);
+            if (state !== undefined)
+                url.searchParams.set("state", state);
+            url.searchParams.set("iss", iss);
+            return reply.redirect(url.toString());
+        }
+        if (firstValue(query["response_type"]) !== "code") {
+            return redirectWithError("unsupported_response_type", "response_type must be code");
+        }
+        const codeChallenge = firstValue(query["code_challenge"]);
+        if (!codeChallenge) {
+            return redirectWithError("invalid_request", "code_challenge is required");
+        }
+        if (firstValue(query["code_challenge_method"]) !== "S256") {
+            return redirectWithError("invalid_request", "code_challenge_method must be S256 — plain is not supported");
+        }
+        const scopeResult = validateScope(firstValue(query["scope"]));
+        if (!scopeResult.ok) {
+            return redirectWithError("invalid_scope", "the only supported scope is mcp");
+        }
+        const requestedResource = firstValue(query["resource"]);
+        if (!resourceMatches(requestedResource, publicUrl)) {
+            return redirectWithError("invalid_target", "resource does not match this server's MCP endpoint");
+        }
+        const redirectHostIsLoopbackOnly = resolved.redirectUris.every((uri) => {
+            try {
+                const parsed = new URL(uri);
+                return (parsed.protocol === "http:" &&
+                    (parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost"));
+            }
+            catch {
+                return false;
+            }
+        });
+        const requestId = pendingStore.putRequest({
+            clientId,
+            clientName: resolved.clientName,
+            redirectUri,
+            codeChallenge,
+            scope: scopeResult.scope,
+            resource: canonicalResource(publicUrl),
+            state,
+            redirectHostIsLoopbackOnly
+        });
+        return reply.redirect(`/oauth/consent?request_id=${encodeURIComponent(requestId)}`);
+    });
+    // ── POST /oauth/token ────────────────────────────────────────────────
+    app.post("/oauth/token", { config: { rateLimit: OAUTH_ROUTE_RATE_LIMIT } }, async (req, reply) => {
+        const publicUrl = resolveEnabledPublicUrl();
+        if (!publicUrl)
+            return notFound(reply);
+        const params = parseFormBody(req.body);
+        const grantType = params.get("grant_type");
+        if (grantType === "authorization_code") {
+            return handleAuthorizationCodeGrant(params, publicUrl, reply);
+        }
+        if (grantType === "refresh_token") {
+            return handleRefreshTokenGrant(params, publicUrl, reply);
+        }
+        return oauthError(reply, 400, "unsupported_grant_type", "grant_type must be authorization_code or refresh_token");
+    });
+    async function handleAuthorizationCodeGrant(params, publicUrl, reply) {
+        const code = params.get("code");
+        if (!code) {
+            return oauthError(reply, 400, "invalid_request", "missing code");
+        }
+        // Every binding the code carries is checked before the code is spent.
+        // Consuming first meant one bad exchange from anyone holding a leaked
+        // code burned it permanently, and the legitimate client's exchange then
+        // read as a replay and revoked the grant.
+        const peeked = pendingStore.peekCode(code);
+        if (!peeked) {
+            return oauthError(reply, 400, "invalid_grant", "authorization code is invalid or expired");
+        }
+        const { request } = peeked;
+        if (params.get("client_id") !== request.clientId) {
+            return oauthError(reply, 400, "invalid_grant", "client_id does not match the authorization request");
+        }
+        if (params.get("redirect_uri") !== request.redirectUri) {
+            return oauthError(reply, 400, "invalid_grant", "redirect_uri does not match the authorization request");
+        }
+        const verifier = params.get("code_verifier");
+        if (!verifier || !verifyS256(verifier, request.codeChallenge)) {
+            return oauthError(reply, 400, "invalid_grant", "PKCE verification failed");
+        }
+        const requestedResource = params.get("resource");
+        if (requestedResource !== null && !resourceMatches(requestedResource, publicUrl)) {
+            return oauthError(reply, 400, "invalid_target", "resource does not match this server's MCP endpoint");
+        }
+        // Bindings hold: spend the code. A second correctly-bound exchange is the
+        // OAuth 2.1 replay case and revokes the grant.
+        const entry = pendingStore.consumeCode(code);
+        if (!entry) {
+            return oauthError(reply, 400, "invalid_grant", "authorization code is invalid or expired");
+        }
+        if (entry.consumedBefore) {
+            await McpOauthGrant.revoke(entry.userId, entry.grantId);
+            return oauthError(reply, 400, "invalid_grant", "authorization code has already been used");
+        }
+        const pair = await McpOauthToken.mintPair(entry.grantId);
+        return reply.status(200).send({
+            access_token: pair.accessToken,
+            token_type: "Bearer",
+            expires_in: Math.floor(MCP_OAUTH_ACCESS_TTL_MS / 1000),
+            refresh_token: pair.refreshToken,
+            scope: request.scope
+        });
+    }
+    async function handleRefreshTokenGrant(params, publicUrl, reply) {
+        const refreshToken = params.get("refresh_token");
+        if (!refreshToken) {
+            return oauthError(reply, 400, "invalid_request", "missing refresh_token");
+        }
+        const requestedResource = params.get("resource");
+        if (requestedResource !== null && !resourceMatches(requestedResource, publicUrl)) {
+            return oauthError(reply, 400, "invalid_target", "resource does not match this server's MCP endpoint");
+        }
+        const result = await McpOauthToken.rotateRefresh(refreshToken);
+        if (result === null) {
+            return oauthError(reply, 400, "invalid_grant", "refresh_token is invalid or expired");
+        }
+        if ("reuseDetected" in result) {
+            return oauthError(reply, 400, "invalid_grant", "refresh token reuse detected — the grant has been revoked");
+        }
+        // RFC 6749 §3.2.1: when the client identifies itself, the refresh chain
+        // must belong to it. Public clients may omit client_id; a mismatched one
+        // is a valid token presented under the wrong identity — a compromise
+        // signal, handled like refresh reuse: the whole grant is revoked,
+        // including the pair the rotation just minted.
+        const presentedClientId = params.get("client_id");
+        if (presentedClientId !== null) {
+            const grant = await McpOauthGrant.get(result.grantId);
+            if (!grant || grant.client_id !== presentedClientId) {
+                await McpOauthToken.revokeByRawToken(result.refreshToken);
+                return oauthError(reply, 400, "invalid_grant", "client_id does not match the grant");
+            }
+        }
+        return reply.status(200).send({
+            access_token: result.accessToken,
+            token_type: "Bearer",
+            expires_in: Math.floor(MCP_OAUTH_ACCESS_TTL_MS / 1000),
+            refresh_token: result.refreshToken,
+            scope: "mcp"
+        });
+    }
+    // ── POST /oauth/register (RFC 7591) ─────────────────────────────────
+    app.post("/oauth/register", {
+        bodyLimit: REGISTER_BODY_LIMIT_BYTES,
+        config: { rateLimit: OAUTH_REGISTER_RATE_LIMIT }
+    }, async (req, reply) => {
+        const publicUrl = resolveEnabledPublicUrl();
+        if (!publicUrl)
+            return notFound(reply);
+        const body = req.body;
+        const doc = typeof body === "object" && body !== null
+            ? body
+            : null;
+        if (!doc) {
+            return oauthError(reply, 400, "invalid_client_metadata", "request body must be a JSON object");
+        }
+        const authMethod = doc["token_endpoint_auth_method"];
+        if (authMethod !== undefined && authMethod !== "none") {
+            return oauthError(reply, 400, "invalid_client_metadata", "only public clients (token_endpoint_auth_method=none) are supported");
+        }
+        const clientName = doc["client_name"];
+        if (typeof clientName !== "string" || clientName.length === 0) {
+            return oauthError(reply, 400, "invalid_client_metadata", "client_name is required");
+        }
+        if (clientName.length > MAX_CLIENT_NAME_LENGTH) {
+            return oauthError(reply, 400, "invalid_client_metadata", `client_name must be at most ${MAX_CLIENT_NAME_LENGTH} characters`);
+        }
+        const redirectUris = doc["redirect_uris"];
+        if (!Array.isArray(redirectUris) ||
+            redirectUris.length === 0 ||
+            !redirectUris.every((uri) => typeof uri === "string")) {
+            return oauthError(reply, 400, "invalid_client_metadata", "redirect_uris must be a non-empty array of strings");
+        }
+        if (redirectUris.length > MAX_REDIRECT_URIS) {
+            return oauthError(reply, 400, "invalid_client_metadata", `redirect_uris must hold at most ${MAX_REDIRECT_URIS} entries`);
+        }
+        if (redirectUris.some((uri) => uri.length > MAX_REDIRECT_URI_LENGTH)) {
+            return oauthError(reply, 400, "invalid_redirect_uri", `each redirect_uri must be at most ${MAX_REDIRECT_URI_LENGTH} characters`);
+        }
+        if (!redirectUris.every((uri) => isAllowedRedirectUri(uri))) {
+            return oauthError(reply, 400, "invalid_redirect_uri", "redirect_uris must be https, or http on 127.0.0.1/localhost");
+        }
+        const { id } = await McpOauthClient.create({
+            client_name: clientName,
+            redirect_uris: redirectUris
+        });
+        return reply.status(201).send({
+            client_id: id,
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+            client_name: clientName,
+            redirect_uris: redirectUris,
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none"
+        });
+    });
+    // ── POST /oauth/revoke (RFC 7009) ───────────────────────────────────
+    app.post("/oauth/revoke", { config: { rateLimit: OAUTH_ROUTE_RATE_LIMIT } }, async (req, reply) => {
+        const publicUrl = resolveEnabledPublicUrl();
+        if (!publicUrl)
+            return notFound(reply);
+        const params = parseFormBody(req.body);
+        const token = params.get("token");
+        if (token) {
+            // RFC 7009: the endpoint always answers 200, whether or not a
+            // matching token was found — it must not leak which is the case.
+            await McpOauthToken.revokeByRawToken(token).catch(() => {
+                // best-effort
+            });
+        }
+        return reply.status(200).send({});
+    });
+};
+export default oauthAsRoutes;
+//# sourceMappingURL=oauth-as.js.map

package/dist/routes/oauth-as.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-as.js","sourceRoot":"","sources":["../../src/routes/oauth-as.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,IAAI,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACnE,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,CAAC;AAC3C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAmB;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CACjB,KAAmB,EACnB,MAAc,EACd,KAAa,EACb,WAAoB;IAEpB,OAAO,KAAK;SACT,MAAM,CAAC,MAAM,CAAC;SACd,IAAI,CAAC,kBAAkB,CAAC;SACxB,IAAI,CACH,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,KAAK,EAAE;QACX,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAC9C,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;6EAC6E;AAC7E,SAAS,SAAS,CAChB,KAAmB,EACnB,MAAc,EACd,KAAa,EACb,WAAmB;IAEnB,OAAO,KAAK;SACT,MAAM,CAAC,MAAM,CAAC;SACd,IAAI,CAAC,WAAW,CAAC;SACjB,IAAI,CACH,mDAAmD;QACjD,cAAc,UAAU,CAAC,KAAK,CAAC,cAAc,UAAU,CAAC,WAAW,CAAC,MAAM,CAC7E,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAOD,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7D,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,GAAG,CAAC,oBAAoB,CACtB,mCAAmC,EACnC,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAClD,CAAC;IACF,GAAG,CAAC,oBAAoB,CACtB,kBAAkB,EAClB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,SAAS,cAAc,CACrB,KAAmB,EACnB,KAAqC;QAErC,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;aAC/C,IAAI,CAAC,kBAAkB,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED;;;6DAGyD;IACzD,SAAS,UAAU,CAAC,SAAiB;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;QACzC,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,SAAS,gBAAgB,CACvB,GAAwB,EACxB,KAAmB,EACnB,kBAAiD,EACjD,KAAqC;QAErC,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAI,GAAG,CAAC,MAAiC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,IAAI,QAAQ,EAAE,KAAK,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;aAC/C,IAAI,CAAC,kBAAkB,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,sEAAsE;IACtE,4DAA4D;IAC5D,2EAA2E;IAC3E,wCAAwC;IACxC,sEAAsE;IACtE,sEAAsE;IACtE,iCAAiC;IACjC,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACtE,gBAAgB,CACd,GAAG,EACH,KAAK,EACL,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAC7C,8BAA8B,CAC/B,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACrE,cAAc,CAAC,KAAK,EAAE,8BAA8B,CAAC,CACtD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACxE,gBAAgB,CACd,GAAG,EACH,KAAK,EACL,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,EAC3C,uBAAuB,CACxB,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACvE,cAAc,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAC/C,CAAC;IAEF,wEAAwE;IAExE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClG,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;QACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9C,qDAAqD;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,CAAC,oBAAoB,CAAC,WAAW,CAAC;YAClC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC5C,CAAC;YACD,OAAO,SAAS,CACd,KAAK,EACL,GAAG,EACH,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAEtD,SAAS,iBAAiB,CAAC,KAAa,EAAE,WAAmB;YAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAqB,CAAC,CAAC;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,iBAAiB,CACtB,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,iBAAiB,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,iBAAiB,CACtB,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,iBAAiB,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,iBAAiB,CACtB,gBAAgB,EAChB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,0BAA0B,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,OAAO;oBAC3B,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,CACrE,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC;YACxC,QAAQ;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW;YACX,aAAa;YACb,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC;YACtC,KAAK;YACL,0BAA0B;SAC3B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,6BAA6B,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,wEAAwE;IAExE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/F,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,4BAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,wBAAwB,EACxB,wDAAwD,CACzD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,4BAA4B,CACzC,MAAuB,EACvB,SAAiB,EACjB,KAAmB;QAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;QACnE,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAE3B,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjD,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,oDAAoD,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACvD,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9D,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,iBAAiB,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,CAAC;YACjF,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,gBAAgB,EAChB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACtD,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,uBAAuB,CACpC,MAAuB,EACvB,SAAiB,EACjB,KAAmB;QAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,iBAAiB,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,CAAC;YACjF,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,gBAAgB,EAChB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,kEAAkE;QAClE,+CAA+C;QAC/C,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;gBACpD,MAAM,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC1D,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,eAAe,EACf,oCAAoC,CACrC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACtD,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IAEvE,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;QACE,SAAS,EAAE,yBAAyB;QACpC,MAAM,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE;KACjD,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,yBAAyB,EACzB,oCAAoC,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YACtD,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,yBAAyB,EACzB,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,yBAAyB,EACzB,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YAC/C,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,yBAAyB,EACzB,+BAA+B,sBAAsB,aAAa,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EACpE,CAAC;YACD,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,yBAAyB,EACzB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YAC5C,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,yBAAyB,EACzB,mCAAmC,iBAAiB,UAAU,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC;YACrE,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,sBAAsB,EACtB,qCAAqC,uBAAuB,aAAa,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,UAAU,CACf,KAAK,EACL,GAAG,EACH,sBAAsB,EACtB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;YACzC,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,SAAS,EAAE,EAAE;YACb,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;SACnC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChG,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,8DAA8D;YAC9D,iEAAiE;YACjE,MAAM,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACrD,cAAc;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/dist/routes/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,WAAW,EAAE,kBAAkB,CAAC,YAAY,CAkBjD,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,WAAW,EAAE,kBAAkB,CAAC,YAAY,CAkBjD,CAAC;eAEa,WAAW"}

package/dist/routes/openai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../src/routes/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,YAAY,EAAE,kBAAkB,CAAC,YAAY,CAsBlD,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../src/routes/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,YAAY,EAAE,kBAAkB,CAAC,YAAY,CAsBlD,CAAC;eAEa,YAAY"}

package/dist/routes/public-apps.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The two unauthenticated routes a deployed mini app is served from.
+ *
+ *   GET  /api/apps/:token          → PublicApplication
+ *   POST /api/apps/:token/session  → PublicApplicationSession
+ *
+ * They sit outside `/api/applications` deliberately: everything under that
+ * prefix reads the caller's own library and stays behind auth, and a public
+ * route added there would be one `startsWith` away from exempting the rest.
+ * The prefix is the allowlist entry (`isPublicAppDeploymentRequest`), so the
+ * shape of the URL is what makes it public — not a flag inside a handler.
+ *
+ * Registered on every server; the handlers refuse outside production, so
+ * whether the surface exists is decided at request time by one predicate
+ * rather than by boot order.
+ */
+import type { FastifyPluginAsync } from "fastify";
+export interface PublicAppRouteOptions {
+    /**
+     * HMAC key for minting run sessions. An accessor rather than the key: a
+     * server that never serves a deployed app never derives it.
+     */
+    appSessionSigningKey: () => Buffer | string;
+}
+declare const publicAppRoutes: FastifyPluginAsync<PublicAppRouteOptions>;
+export default publicAppRoutes;
+//# sourceMappingURL=public-apps.d.ts.map

package/dist/routes/public-apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-apps.d.ts","sourceRoot":"","sources":["../../src/routes/public-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAgB,MAAM,SAAS,CAAC;AAgBhE,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,oBAAoB,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC;CAC7C;AAgDD,QAAA,MAAM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAmD9D,CAAC;eAEa,eAAe"}