@noodleseed/one 0.58.0 → 0.59.0

package/node_modules/@noodle-borg/service/dist/oauth/consent-claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-claims.js","sourceRoot":"","sources":["../../src/oauth/consent-claims.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,2BAA2B,CAAC;AAiBjF,MAAM,UAAU,eAAe,CAAC,OAAmB;IACjD,OAAO,CACJ,OAA8B,CAAC,IAAI,KAAK,SAAS;QAClD,OAAQ,OAAkC,CAAC,QAAQ,KAAK,QAAQ;QAChE,OAAQ,OAAqC,CAAC,WAAW,KAAK,QAAQ;QACtE,OAAQ,OAAuC,CAAC,aAAa,KAAK,QAAQ;QAC1E,OAAQ,OAAkC,CAAC,QAAQ,KAAK,QAAQ;QAChE,OAAQ,OAAsC,CAAC,YAAY,KAAK,QAAQ;QACxE,oCAAoC,CAAC;YACnC,MAAM,EAAE,OAAO,CAAC,WAAW;YAC3B,QAAQ,EAAE,OAAO,CAAC,aAAa;SAChC,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"consent-claims.js","sourceRoot":"","sources":["../../src/oauth/consent-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAInE,OAAO,EAAE,oCAAoC,EAAE,MAAM,2BAA2B,CAAC;AAsBjF,MAAM,UAAU,eAAe,CAAC,OAAmB;IACjD,OAAO,CACJ,OAA8B,CAAC,IAAI,KAAK,SAAS;QAClD,OAAQ,OAAkC,CAAC,QAAQ,KAAK,QAAQ;QAChE,OAAQ,OAAqC,CAAC,WAAW,KAAK,QAAQ;QACtE,OAAQ,OAAuC,CAAC,aAAa,KAAK,QAAQ;QAC1E,OAAQ,OAAkC,CAAC,QAAQ,KAAK,QAAQ;QAChE,OAAQ,OAAsC,CAAC,YAAY,KAAK,QAAQ;QACxE,oCAAoC,CAAC;YACnC,MAAM,EAAE,OAAO,CAAC,WAAW;YAC3B,QAAQ,EAAE,OAAO,CAAC,aAAa;SAChC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAmB;IAEnB,OAAO,CACJ,OAA8B,CAAC,IAAI,KAAK,iBAAiB;QAC1D,OAAQ,OAAkC,CAAC,QAAQ,KAAK,QAAQ;QAChE,OAAQ,OAAqC,CAAC,WAAW,KAAK,QAAQ;QACtE,OAAQ,OAAuC,CAAC,aAAa,KAAK,QAAQ;QAC1E,OAAQ,OAAkC,CAAC,QAAQ,KAAK,QAAQ;QAChE,OAAQ,OAAsC,CAAC,YAAY,KAAK,QAAQ;QACxE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9B,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC7C,oCAAoC,CAAC;YACnC,MAAM,EAAE,OAAO,CAAC,WAAW;YAC3B,QAAQ,EAAE,OAAO,CAAC,aAAa;SAChC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC;QAC5E,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC;QAC3E,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,qBAAqB,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-authorizer.d.ts

@@ -0,0 +1,48 @@
+import { type DeveloperCapability } from '@noodle-borg/developer-mcp';
+import type { AppSummary, ControlPlaneStore, EnvSummary } from '../store.js';
+import type { DeveloperAccessGrant, DeveloperGrantStore } from './developer-grant.js';
+export interface DeveloperGrantChoice {
+    readonly org: string;
+    readonly displayName?: string;
+    readonly environments: readonly string[];
+    readonly capabilities: readonly DeveloperCapability[];
+}
+export interface DeveloperGrantInventory {
+    listApps(org: string, opts?: {
+        readonly includeArchived?: boolean;
+        readonly limit?: number;
+    }): Promise<{
+        readonly apps: readonly AppSummary[];
+        readonly truncated: boolean;
+    }>;
+    listEnvironments(org: string, app: string, opts?: {
+        readonly includeArchived?: boolean;
+    }): Promise<readonly EnvSummary[]>;
+}
+export interface DeveloperGrantSelectionInput {
+    readonly clientId: string;
+    readonly subject: string;
+    readonly resource: string;
+    readonly choices: readonly DeveloperGrantChoice[];
+    readonly org: string;
+    readonly environments: readonly string[];
+}
+export interface DeveloperGrantAuthorizerOptions {
+    readonly controlPlane: ControlPlaneStore;
+    readonly inventory: DeveloperGrantInventory;
+    readonly grants: DeveloperGrantStore;
+}
+export declare class DeveloperGrantAuthorizer {
+    #private;
+    constructor(options: DeveloperGrantAuthorizerOptions);
+    listChoices(subject: string, resource: string): Promise<readonly DeveloperGrantChoice[]>;
+    create(input: DeveloperGrantSelectionInput): Promise<DeveloperAccessGrant>;
+    /** Revoke only the exact grant carried by a verified subject/client token. */
+    revoke(input: {
+        readonly id: string;
+        readonly clientId: string;
+        readonly subject: string;
+        readonly at: string;
+    }): Promise<DeveloperAccessGrant | undefined>;
+}
+//# sourceMappingURL=developer-grant-authorizer.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-authorizer.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAItF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClF,gBAAgB,CACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5C,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAED,qBAAa,wBAAwB;;gBAKvB,OAAO,EAAE,+BAA+B;IAM9C,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC;IAoCxF,MAAM,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA2BhF,8EAA8E;IACxE,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAW9C"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-authorizer.js

@@ -0,0 +1,90 @@
+import { capabilitiesForDeveloperResource, isDeveloperResource, } from '@noodle-borg/developer-mcp';
+const STANDARD_ENVIRONMENTS = ['dev', 'staging', 'prod'];
+export class DeveloperGrantAuthorizer {
+    #controlPlane;
+    #inventory;
+    #grants;
+    constructor(options) {
+        this.#controlPlane = options.controlPlane;
+        this.#inventory = options.inventory;
+        this.#grants = options.grants;
+    }
+    async listChoices(subject, resource) {
+        if (!isDeveloperResource(resource))
+            return [];
+        const organizations = await this.#controlPlane.listOrgsForSubject(subject);
+        return Promise.all(organizations.map(async (organization) => {
+            const member = await this.#controlPlane.getOrgMember({
+                org: organization.slug,
+                subject,
+            });
+            const inventory = await this.#inventory.listApps(organization.slug, {
+                includeArchived: false,
+                limit: Number.MAX_SAFE_INTEGER,
+            });
+            const environments = new Set(STANDARD_ENVIRONMENTS);
+            await Promise.all(inventory.apps.map(async (app) => {
+                for (const environment of app.environments)
+                    environments.add(environment);
+                const appEnvironments = await this.#inventory.listEnvironments(organization.slug, app.appSlug);
+                for (const environment of appEnvironments)
+                    environments.add(environment.envName);
+            }));
+            return {
+                org: organization.slug,
+                ...(organization.displayName === undefined
+                    ? {}
+                    : { displayName: organization.displayName }),
+                environments: [...environments].sort(),
+                capabilities: capabilitiesForMember(resource, member?.role),
+            };
+        }));
+    }
+    async create(input) {
+        if (!isDeveloperResource(input.resource))
+            throw new Error('invalid developer resource');
+        const choice = input.choices.find((candidate) => candidate.org === input.org);
+        if (choice === undefined)
+            throw new Error('organization is not available');
+        const environments = [...new Set(input.environments)];
+        if (environments.length === 0)
+            throw new Error('select at least one environment');
+        const availableEnvironments = new Set(choice.environments);
+        if (environments.some((environment) => !availableEnvironments.has(environment))) {
+            throw new Error('environment is not available');
+        }
+        const member = await this.#controlPlane.getOrgMember({
+            org: input.org,
+            subject: input.subject,
+        });
+        if (member === undefined)
+            throw new Error('organization membership is no longer active');
+        const capabilities = capabilitiesForMember(input.resource, member.role);
+        if (capabilities.length === 0)
+            throw new Error('developer resource has no available capabilities');
+        return this.#grants.create({
+            clientId: input.clientId,
+            subject: input.subject,
+            org: input.org,
+            environments,
+            capabilities,
+        });
+    }
+    /** Revoke only the exact grant carried by a verified subject/client token. */
+    async revoke(input) {
+        const grant = await this.#grants.get(input.id);
+        if (grant === undefined ||
+            grant.clientId !== input.clientId ||
+            grant.subject !== input.subject) {
+            return undefined;
+        }
+        return this.#grants.revoke(input.id, input.at);
+    }
+}
+function capabilitiesForMember(resource, role) {
+    const capabilities = capabilitiesForDeveloperResource(resource);
+    return role === 'owner'
+        ? capabilities
+        : capabilities.filter((capability) => capability !== 'deployments:rollback');
+}
+//# sourceMappingURL=developer-grant-authorizer.js.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-authorizer.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAEhC,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAKpC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAoClE,MAAM,OAAO,wBAAwB;IAC1B,aAAa,CAAoB;IACjC,UAAU,CAA0B;IACpC,OAAO,CAAsB;IAEtC,YAAY,OAAwC;QAClD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,QAAgB;QACjD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,GAAG,CAChB,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;gBACnD,GAAG,EAAE,YAAY,CAAC,IAAI;gBACtB,OAAO;aACR,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBAClE,eAAe,EAAE,KAAK;gBACtB,KAAK,EAAE,MAAM,CAAC,gBAAgB;aAC/B,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/B,KAAK,MAAM,WAAW,IAAI,GAAG,CAAC,YAAY;oBAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAC5D,YAAY,CAAC,IAAI,EACjB,GAAG,CAAC,OAAO,CACZ,CAAC;gBACF,KAAK,MAAM,WAAW,IAAI,eAAe;oBAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC,CAAC,CACH,CAAC;YACF,OAAO;gBACL,GAAG,EAAE,YAAY,CAAC,IAAI;gBACtB,GAAG,CAAC,YAAY,CAAC,WAAW,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE;gBACtC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;aAC5D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAmC;QAC9C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAClF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;YACnD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzF,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,YAAY;YACZ,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,IACE,KAAK,KAAK,SAAS;YACnB,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACjC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAC/B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,IAAuC;IAEvC,MAAM,YAAY,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO,IAAI,KAAK,OAAO;QACrB,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,sBAAsB,CAAC,CAAC;AACjF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-bootstrap.d.ts

@@ -0,0 +1,18 @@
+import type { Pool } from 'pg';
+import type { ServerRegistry } from '../registry.js';
+import type { ControlPlaneStore } from '../store.js';
+import type { DeveloperGrantStore } from './developer-grant.js';
+import { DeveloperGrantAuthorizer } from './developer-grant-authorizer.js';
+export interface DeveloperGrantStoreBootstrapOptions {
+    readonly pool?: Pool;
+    readonly store?: DeveloperGrantStore;
+}
+export interface DeveloperGrantAuthorizerBootstrapOptions {
+    readonly controlPlane: ControlPlaneStore;
+    readonly grants: DeveloperGrantStore;
+    readonly registry: () => ServerRegistry | undefined;
+}
+export declare function createDeveloperGrantAuthorizer(options: DeveloperGrantAuthorizerBootstrapOptions): DeveloperGrantAuthorizer;
+/** Resolve the OAuth grant store while preserving PostgreSQL schema initialization for injected stores. */
+export declare function resolveDeveloperGrantStore(options: DeveloperGrantStoreBootstrapOptions): Promise<DeveloperGrantStore>;
+//# sourceMappingURL=developer-grant-bootstrap.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-bootstrap.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;CACrD;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,wCAAwC,GAChD,wBAAwB,CAc1B;AAED,2GAA2G;AAC3G,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,mBAAmB,CAAC,CAS9B"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-bootstrap.js

@@ -0,0 +1,29 @@
+import { DeveloperGrantAuthorizer } from './developer-grant-authorizer.js';
+export function createDeveloperGrantAuthorizer(options) {
+    const registry = () => {
+        const value = options.registry();
+        if (value === undefined)
+            throw new Error('developer inventory is not ready');
+        return value;
+    };
+    return new DeveloperGrantAuthorizer({
+        controlPlane: options.controlPlane,
+        grants: options.grants,
+        inventory: {
+            listApps: (org, request) => registry().listApps(org, request),
+            listEnvironments: (org, app, request) => registry().listEnvironments(org, app, request),
+        },
+    });
+}
+/** Resolve the OAuth grant store while preserving PostgreSQL schema initialization for injected stores. */
+export async function resolveDeveloperGrantStore(options) {
+    if (options.pool !== undefined) {
+        const { PostgresDeveloperGrantStore } = await import('./developer-grant-store-postgres.js');
+        const postgres = new PostgresDeveloperGrantStore(options.pool);
+        await postgres.initialize();
+        return options.store ?? postgres;
+    }
+    const { InMemoryDeveloperGrantStore } = await import('./developer-grant.js');
+    return options.store ?? new InMemoryDeveloperGrantStore();
+}
+//# sourceMappingURL=developer-grant-bootstrap.js.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-bootstrap.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-bootstrap.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAa3E,MAAM,UAAU,8BAA8B,CAC5C,OAAiD;IAEjD,MAAM,QAAQ,GAAG,GAAmB,EAAE;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,IAAI,wBAAwB,CAAC;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE;YACT,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7D,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;SACxF;KACF,CAAC,CAAC;AACL,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAA4C;IAE5C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACnC,CAAC;IACD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,2BAA2B,EAAE,CAAC;AAC5D,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-flow.d.ts

@@ -0,0 +1,22 @@
+import type { SigningKeyProvider } from '@noodle-borg/auth';
+import type { Request, Response } from 'express';
+import type { DeveloperGrantAuthorizer } from './developer-grant-authorizer.js';
+import type { GoogleIdentity } from './google.js';
+import type { OAuthStore, PendingAuthorizationRecord } from './store.js';
+import type { OAuthTokenIssuer } from './token-issuer.js';
+export interface DeveloperGrantOAuthFlowOptions {
+    readonly issuer: string;
+    readonly signer: SigningKeyProvider;
+    readonly store: OAuthStore;
+    readonly authorizer: DeveloperGrantAuthorizer;
+    readonly tokenIssuer: OAuthTokenIssuer;
+    readonly tokenTtlSeconds: number;
+}
+export declare class DeveloperGrantOAuthFlow {
+    #private;
+    constructor(options: DeveloperGrantOAuthFlowOptions);
+    renderSelection(pending: PendingAuthorizationRecord, identity: GoogleIdentity, res: Response): Promise<void>;
+    handleDecision(req: Request, res: Response): Promise<void>;
+}
+export declare function isDeveloperResourceForIssuer(resource: string, issuer: string): boolean;
+//# sourceMappingURL=developer-grant-flow.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-flow.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,uBAAuB;;gBAGtB,OAAO,EAAE,8BAA8B;IAI7C,eAAe,CACnB,OAAO,EAAE,0BAA0B,EACnC,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAiCV,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAkFjE;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQtF"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-flow.js

@@ -0,0 +1,144 @@
+import { isDeveloperResource } from '@noodle-borg/developer-mcp';
+import { jwtVerify, SignJWT } from 'jose';
+import { isDeveloperGrantClaims } from './consent-claims.js';
+import { renderDeveloperGrantPage } from './developer-grant-page.js';
+import { storedOAuthOwnerPreferences } from './identity-preferences.js';
+import { hostOf } from './provider-util.js';
+const DEVELOPER_GRANT_PATH = '/oauth/developer-grant';
+const DEVELOPER_GRANT_FORM_FIELDS = new Set(['grant_token', 'org', 'environment', 'decision']);
+export class DeveloperGrantOAuthFlow {
+    #options;
+    constructor(options) {
+        this.#options = options;
+    }
+    async renderSelection(pending, identity, res) {
+        const choices = await this.#options.authorizer.listChoices(identity.subject, pending.resource);
+        const grantToken = await this.#sign({
+            kind: 'developer-grant',
+            clientId: pending.clientId,
+            redirectUri: pending.redirectUri,
+            codeChallenge: pending.codeChallenge,
+            resource: pending.resource,
+            ownerSubject: identity.subject,
+            ownerEmail: identity.email,
+            ...storedOAuthOwnerPreferences(identity),
+            ...(pending.clientState !== undefined ? { clientState: pending.clientState } : {}),
+            ...(pending.scope !== undefined ? { scope: pending.scope } : {}),
+            choices,
+        });
+        const client = await this.#options.store.getClient(pending.clientId);
+        res
+            .status(200)
+            .setHeader('Cache-Control', 'no-store')
+            .type('html')
+            .send(renderDeveloperGrantPage({
+            clientName: client?.client_name ?? pending.clientId,
+            resourceHost: hostOf(pending.resource),
+            redirectHost: hostOf(pending.redirectUri),
+            userEmail: identity.email,
+            grantToken,
+            grantAction: DEVELOPER_GRANT_PATH,
+            choices,
+        }));
+    }
+    async handleDecision(req, res) {
+        const body = (req.body ?? {});
+        if (Object.keys(body).some((key) => !DEVELOPER_GRANT_FORM_FIELDS.has(key))) {
+            res.status(400).type('text/plain').send('invalid developer access selection');
+            return;
+        }
+        const grantToken = typeof body.grant_token === 'string' ? body.grant_token : undefined;
+        const decision = typeof body.decision === 'string' ? body.decision : undefined;
+        if (grantToken === undefined) {
+            res.status(400).type('text/plain').send('missing grant_token');
+            return;
+        }
+        let claims;
+        try {
+            claims = await this.#verify(grantToken);
+        }
+        catch {
+            res.status(400).type('text/plain').send('invalid or expired developer access selection');
+            return;
+        }
+        const redirect = new URL(claims.redirectUri);
+        if (decision !== 'approve') {
+            redirect.searchParams.set('error', 'access_denied');
+            if (claims.clientState !== undefined)
+                redirect.searchParams.set('state', claims.clientState);
+            res.redirect(302, redirect.href);
+            return;
+        }
+        const org = typeof body.org === 'string' ? body.org : undefined;
+        const environments = formStrings(body.environment);
+        if (org === undefined || environments.length === 0) {
+            res.status(400).type('text/plain').send('invalid developer access selection');
+            return;
+        }
+        let grant;
+        try {
+            grant = await this.#options.authorizer.create({
+                clientId: claims.clientId,
+                subject: claims.ownerSubject,
+                resource: claims.resource,
+                choices: claims.choices,
+                org,
+                environments,
+            });
+        }
+        catch {
+            res.status(400).type('text/plain').send('invalid developer access selection');
+            return;
+        }
+        await this.#options.store.createConsentGrant({
+            clientId: claims.clientId,
+            ownerSubject: claims.ownerSubject,
+            resource: claims.resource,
+        });
+        await this.#options.tokenIssuer.issueAuthorizationCode(res, {
+            clientId: claims.clientId,
+            codeChallenge: claims.codeChallenge,
+            redirectUri: claims.redirectUri,
+            resource: claims.resource,
+            ownerSubject: claims.ownerSubject,
+            ...(claims.ownerEmail !== undefined ? { ownerEmail: claims.ownerEmail } : {}),
+            ...(claims.ownerLocale !== undefined ? { ownerLocale: claims.ownerLocale } : {}),
+            ...(claims.ownerTimeZone !== undefined ? { ownerTimeZone: claims.ownerTimeZone } : {}),
+            ...(claims.clientState !== undefined ? { clientState: claims.clientState } : {}),
+            ...(claims.scope !== undefined ? { scope: claims.scope } : {}),
+            developerGrantId: grant.id,
+        });
+    }
+    async #sign(claims) {
+        const key = await this.#options.signer.signingKey();
+        return new SignJWT({ ...claims })
+            .setProtectedHeader({ alg: key.alg, kid: key.kid })
+            .setIssuer(this.#options.issuer)
+            .setIssuedAt()
+            .setExpirationTime(`${this.#options.tokenTtlSeconds}s`)
+            .sign(key.privateKey);
+    }
+    async #verify(token) {
+        const getKey = await this.#options.signer.verifierKey();
+        const { payload } = await jwtVerify(token, getKey, { issuer: this.#options.issuer });
+        if (!isDeveloperGrantClaims(payload))
+            throw new Error('not a developer grant token');
+        return payload;
+    }
+}
+export function isDeveloperResourceForIssuer(resource, issuer) {
+    try {
+        const resourceUrl = new URL(resource);
+        const issuerUrl = new URL(issuer);
+        return resourceUrl.origin === issuerUrl.origin && isDeveloperResource(resourceUrl.pathname);
+    }
+    catch {
+        return false;
+    }
+}
+function formStrings(value) {
+    if (typeof value === 'string')
+        return [value];
+    return Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : [];
+}
+//# sourceMappingURL=developer-grant-flow.js.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-flow.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-flow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAA6B,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAW/F,MAAM,OAAO,uBAAuB;IACzB,QAAQ,CAAiC;IAElD,YAAY,OAAuC;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,OAAmC,EACnC,QAAwB,EACxB,GAAa;QAEb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YAClC,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,UAAU,EAAE,QAAQ,CAAC,KAAK;YAC1B,GAAG,2BAA2B,CAAC,QAAQ,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO;SACR,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrE,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CACH,wBAAwB,CAAC;YACvB,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,QAAQ;YACnD,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YACzC,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,UAAU;YACV,WAAW,EAAE,oBAAoB;YACjC,OAAO;SACR,CAAC,CACH,CAAC;IACN,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;gBAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,IAAI,KAA2B,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,YAAY;gBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG;gBACH,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,sBAAsB,CAAC,GAAG,EAAE;YAC1D,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,gBAAgB,EAAE,KAAK,CAAC,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAA4B;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;aAC9B,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;aAClD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC/B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,GAAG,CAAC;aACtD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAgB,EAAE,MAAc;IAC3E,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.d.ts

@@ -0,0 +1,12 @@
+import type { DeveloperGrantChoice } from './developer-grant-authorizer.js';
+export interface DeveloperGrantPageInput {
+    readonly clientName: string;
+    readonly resourceHost: string;
+    readonly redirectHost: string;
+    readonly userEmail: string;
+    readonly grantToken: string;
+    readonly grantAction: string;
+    readonly choices: readonly DeveloperGrantChoice[];
+}
+export declare function renderDeveloperGrantPage(input: DeveloperGrantPageInput): string;
+//# sourceMappingURL=developer-grant-page.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-page.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AAQD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAyB/E"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js

@@ -0,0 +1,61 @@
+import { renderOAuthPage } from './branding.js';
+const CAPABILITY_COPY = {
+    'cloud:read': 'Read cloud apps, deployments, logs, analytics, and diagnostics',
+    'deployments:write': 'Build and deploy apps to the selected environments',
+    'deployments:rollback': 'Roll back deployments',
+};
+export function renderDeveloperGrantPage(input) {
+    const choices = input.choices.map(renderChoice).join('');
+    const controls = input.choices.length === 0
+        ? '<p class="ns-note">No organizations are available for this account.</p>'
+        : `${choices}<div class="ns-row">
+        <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
+        <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary">Authorize</button></span>
+      </div>`;
+    const contentHtml = `<p class="ns-lede"><strong>${escapeHtml(input.clientName)}</strong> will be able to guide and operate Noodle Cloud autonomously within the access you select.</p>
+    <dl class="ns-dl">
+      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd">${escapeHtml(input.userEmail)}</dd></div>
+      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd">${escapeHtml(input.resourceHost)}</dd></div>
+      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd">${escapeHtml(input.redirectHost)}</dd></div>
+    </dl>
+    <form method="post" action="${escapeHtml(input.grantAction)}">
+      <input type="hidden" name="grant_token" value="${escapeHtml(input.grantToken)}" />
+      ${controls}
+    </form>`;
+    return renderOAuthPage({
+        title: 'Authorize developer access — Noodle Seed',
+        kicker: 'Developer access',
+        heading: 'Choose where this developer plugin can operate',
+        contentHtml,
+    });
+}
+function renderChoice(choice, index) {
+    const org = escapeHtml(choice.org);
+    const label = escapeHtml(choice.displayName ?? choice.org);
+    const environments = choice.environments
+        .map((environment) => {
+        const escaped = escapeHtml(environment);
+        const productionNote = environment === 'prod' ? ' <span class="ns-note">explicit access</span>' : '';
+        return `<label><input type="checkbox" name="environment" value="${escaped}" /> ${escaped}${productionNote}</label>`;
+    })
+        .join('');
+    const capabilities = choice.capabilities
+        .map((capability) => `<li>${escapeHtml(CAPABILITY_COPY[capability])}</li>`)
+        .join('');
+    return `<fieldset>
+      <legend><label><input type="radio" name="org" value="${org}"${index === 0 ? ' checked' : ''} /> ${label}</label></legend>
+      <p class="ns-note">Environments</p>
+      <div>${environments}</div>
+      <p class="ns-note">Autonomous capabilities</p>
+      <ul>${capabilities}</ul>
+    </fieldset>`;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+//# sourceMappingURL=developer-grant-page.js.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,oDAAoD;IACzE,sBAAsB,EAAE,uBAAuB;CAChD,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,GAAG,OAAO;;;aAGL,CAAC;IACZ,MAAM,WAAW,GAAG,8BAA8B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;kEAEd,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;kEAC3B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;kEAC9B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;kCAE9D,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;uDACR,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3E,QAAQ;YACJ,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gDAAgD;QACzD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAA4B,EAAE,KAAa;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,cAAc,GAClB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,2DAA2D,OAAO,QAAQ,OAAO,GAAG,cAAc,UAAU,CAAC;IACtH,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO;6DACoD,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK;;aAEhG,YAAY;;YAEb,YAAY;gBACR,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.d.ts

@@ -0,0 +1,11 @@
+import type { Pool } from 'pg';
+import { type CreateDeveloperAccessGrant, type DeveloperAccessGrant, type DeveloperGrantFactoryOptions, type DeveloperGrantStore } from './developer-grant.js';
+export declare class PostgresDeveloperGrantStore implements DeveloperGrantStore {
+    #private;
+    constructor(pool: Pool, options?: DeveloperGrantFactoryOptions);
+    initialize(): Promise<void>;
+    create(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    get(id: string): Promise<DeveloperAccessGrant | undefined>;
+    revoke(id: string, at: string): Promise<DeveloperAccessGrant | undefined>;
+}
+//# sourceMappingURL=developer-grant-store-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-store-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAI/B,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EAGzB,MAAM,sBAAsB,CAAC;AAe9B,qBAAa,2BAA4B,YAAW,mBAAmB;;gBAIzD,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,4BAAiC;IAK5D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BxE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAO1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAYhF"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.js

@@ -0,0 +1,89 @@
+import { DEVELOPER_CAPABILITIES } from '@noodle-borg/developer-mcp';
+import { z } from 'zod';
+import { ensureDeveloperGrantSchema } from '../store/postgres-schema.js';
+import { createDeveloperAccessGrantRecord, normalizeDeveloperAccessGrant, normalizeDeveloperGrantTimestamp, } from './developer-grant.js';
+const developerGrantRowSchema = z.object({
+    id: z.string(),
+    client_id: z.string(),
+    subject: z.string(),
+    org_slug: z.string(),
+    environments: z.array(z.string()),
+    capabilities: z.array(z.enum(DEVELOPER_CAPABILITIES)),
+    created_at: z.coerce.date(),
+    updated_at: z.coerce.date(),
+    expires_at: z.coerce.date().nullable(),
+    revoked_at: z.coerce.date().nullable(),
+});
+export class PostgresDeveloperGrantStore {
+    #pool;
+    #options;
+    constructor(pool, options = {}) {
+        this.#pool = pool;
+        this.#options = options;
+    }
+    async initialize() {
+        await ensureDeveloperGrantSchema(this.#pool);
+    }
+    async create(input) {
+        const grant = createDeveloperAccessGrantRecord(input, this.#options);
+        try {
+            const { rows } = await this.#pool.query(`INSERT INTO developer_access_grants
+           (id, client_id, subject, org_slug, environments, capabilities,
+            created_at, updated_at, expires_at, revoked_at)
+         VALUES ($1, $2, $3, $4, $5::jsonb, $6::jsonb, $7, $8, $9, $10)
+         RETURNING *`, [
+                grant.id,
+                grant.clientId,
+                grant.subject,
+                grant.org,
+                JSON.stringify(grant.environments),
+                JSON.stringify(grant.capabilities),
+                grant.createdAt,
+                grant.updatedAt,
+                grant.expiresAt ?? null,
+                grant.revokedAt ?? null,
+            ]);
+            return grantFromRow(rows[0]);
+        }
+        catch (error) {
+            if (isUniqueViolation(error)) {
+                throw new Error(`developer grant "${grant.id}" already exists`, { cause: error });
+            }
+            throw error;
+        }
+    }
+    async get(id) {
+        const { rows } = await this.#pool.query('SELECT * FROM developer_access_grants WHERE id = $1', [
+            id,
+        ]);
+        return rows[0] === undefined ? undefined : grantFromRow(rows[0]);
+    }
+    async revoke(id, at) {
+        const revokedAt = normalizeDeveloperGrantTimestamp('revokedAt', at);
+        const { rows } = await this.#pool.query(`UPDATE developer_access_grants
+       SET updated_at = CASE WHEN revoked_at IS NULL THEN $2::timestamptz ELSE updated_at END,
+           revoked_at = COALESCE(revoked_at, $2::timestamptz)
+       WHERE id = $1
+       RETURNING *`, [id, revokedAt]);
+        return rows[0] === undefined ? undefined : grantFromRow(rows[0]);
+    }
+}
+function grantFromRow(value) {
+    const row = developerGrantRowSchema.parse(value);
+    return normalizeDeveloperAccessGrant({
+        id: row.id,
+        clientId: row.client_id,
+        subject: row.subject,
+        org: row.org_slug,
+        environments: row.environments,
+        capabilities: row.capabilities,
+        createdAt: row.created_at.toISOString(),
+        updatedAt: row.updated_at.toISOString(),
+        ...(row.expires_at === null ? {} : { expiresAt: row.expires_at.toISOString() }),
+        ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at.toISOString() }),
+    });
+}
+function isUniqueViolation(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === '23505';
+}
+//# sourceMappingURL=developer-grant-store-postgres.js.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-grant-store-postgres.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAEL,gCAAgC,EAIhC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,OAAO,2BAA2B;IAC7B,KAAK,CAAO;IACZ,QAAQ,CAA+B;IAEhD,YAAY,IAAU,EAAE,UAAwC,EAAE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiC;QAC5C,MAAM,KAAK,GAAG,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;qBAIa,EACb;gBACE,KAAK,CAAC,EAAE;gBACR,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,GAAG;gBACT,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;gBAClC,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,SAAS,IAAI,IAAI;aACxB,CACF,CAAC;YACF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAC7F,EAAE;SACH,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,EAAU;QACjC,MAAM,SAAS,GAAG,gCAAgC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;mBAIa,EACb,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,6BAA6B,CAAC;QACnC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAClG,CAAC"}