@open-everywhere/adapters 0.1.0

package/dist/agent/oe-oauth/errors.js

@@ -0,0 +1,73 @@
+// Typed errors for the own-rolled OAuth adapter. Each carries a stable `code`, so classification is
+// DUCK-TYPED across processes. SECURITY: no error here carries a token, a code, or a PKCE verifier.
+/** The subject an error is about, as a log-safe label (never an opaque token). */
+export function subjectLabel(subject) {
+    return subject.type === "app" ? "app" : `user:${subject.id}`;
+}
+/** The human has NEVER authorized this (provider, subject) — no token is stored. The connector plane
+ *  turns this into a fresh consent link. */
+export class OeOauthNeedsConsentError extends Error {
+    code = "oe_oauth_needs_consent";
+    constructor(providerRef, subject) {
+        super(`connection "${providerRef}": ${subjectLabel(subject)} has not authorized this account — user authorization required.`);
+        this.name = "OeOauthNeedsConsentError";
+    }
+}
+/** A previously-working authorization is dead (refresh token rejected / rotated away) — the human
+ *  must RE-authorize. Distinct from needs-consent so the audit trail can tell a first connect from a
+ *  lapsed one, but both classify as "user authorization required". */
+export class OeOauthNeedsReconsentError extends Error {
+    code = "oe_oauth_needs_reconsent";
+    constructor(providerRef, subject, why) {
+        super(`connection "${providerRef}": ${subjectLabel(subject)} must re-authorize — ${why}.`);
+        this.name = "OeOauthNeedsReconsentError";
+    }
+}
+/** The cross-process single-flight LOSER timed out (OPE-91): another instance holds the refresh claim
+ *  and did not release a rotated token within this caller's wait budget. TRANSIENT and RETRYABLE — a
+ *  fresh request may win the claim or find the rotated token — so it is DELIBERATELY not classified as
+ *  user-auth-required (the human need do nothing; nothing is re-consented). Carries no secret material,
+ *  only the provider ref + subject label. */
+export class OeOauthRefreshContendedError extends Error {
+    code = "oe_oauth_refresh_contended";
+    constructor(providerRef, subject) {
+        super(`connection "${providerRef}": ${subjectLabel(subject)} token refresh is in progress on another instance and did not complete in time — retry.`);
+        this.name = "OeOauthRefreshContendedError";
+    }
+}
+/** A generic upstream OAuth failure (token endpoint / discovery / DCR returned an error). `oauthError`
+ *  is the RFC 6749 `error` code when the body carried one (e.g. "invalid_grant", "invalid_client") —
+ *  a fixed-vocabulary string, never a secret. */
+export class OeOauthError extends Error {
+    code = "oe_oauth_error";
+    oauthError;
+    httpStatus;
+    constructor(message, opts = {}) {
+        super(message);
+        this.name = "OeOauthError";
+        if (opts.oauthError)
+            this.oauthError = opts.oauthError;
+        if (opts.httpStatus !== undefined)
+            this.httpStatus = opts.httpStatus;
+    }
+}
+/** True iff `e` is an upstream OAuth failure whose `error` code is `invalid_grant` (the refresh token
+ *  was rejected — consumed by a rotation, revoked, or expired). Duck-typed for cross-process safety. */
+export function isInvalidGrant(e) {
+    if (!(e instanceof Error))
+        return false;
+    const oauthError = e.oauthError;
+    return typeof oauthError === "string" && oauthError.toLowerCase() === "invalid_grant";
+}
+/** The connector-plane classifier (used by UserAuthFlowProvider.isUserAuthRequired). Duck-typed on
+ *  the stable `code` strings so a cross-process instance still matches. */
+export function isUserAuthRequiredError(e) {
+    if (!(e instanceof Error))
+        return false;
+    const code = e.code;
+    return ((typeof code === "string" && (code === "oe_oauth_needs_consent" || code === "oe_oauth_needs_reconsent")) ||
+        e.name === "OeOauthNeedsConsentError" ||
+        e.name === "OeOauthNeedsReconsentError" ||
+        /user[_ ]?authorization[_ ]?required/i.test(e.message));
+}
+//# sourceMappingURL=errors.js.map

package/dist/agent/oe-oauth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../agent/oe-oauth/errors.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AAEpG,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,OAAkF;IAC7G,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;4CAC4C;AAC5C,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,wBAAwB,CAAC;IACzC,YAAY,WAAmB,EAAE,OAAkF;QACjH,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;sEAEsE;AACtE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,0BAA0B,CAAC;IAC3C,YAAY,WAAmB,EAAE,OAAkF,EAAE,GAAW;QAC9H,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;6CAI6C;AAC7C,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,IAAI,GAAG,4BAA4B,CAAC;IAC7C,YAAY,WAAmB,EAAE,OAAkF;QACjH,KAAK,CAAC,eAAe,WAAW,MAAM,YAAY,CAAC,OAAO,CAAC,yFAAyF,CAAC,CAAC;QACtJ,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;iDAEiD;AACjD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,gBAAgB,CAAC;IACxB,UAAU,CAAU;IACpB,UAAU,CAAU;IAC7B,YAAY,OAAe,EAAE,IAAI,GAAmE,EAAE;QACpG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvE,CAAC;CACF;AAED;wGACwG;AACxG,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,UAAU,GAAI,CAA8B,CAAC,UAAU,CAAC;IAC9D,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AACxF,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;IAC5C,OAAO,CACL,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,0BAA0B,CAAC,CAAC;QACxG,CAAC,CAAC,IAAI,KAAK,0BAA0B;QACrC,CAAC,CAAC,IAAI,KAAK,4BAA4B;QACvC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CACvD,CAAC;AACJ,CAAC"}

package/dist/agent/oe-oauth/oauth-client.d.ts

@@ -0,0 +1,124 @@
+/** The injectable network seam — the global `fetch` in production, a stub in tests. */
+export type OAuthFetch = (input: string, init?: RequestInit) => Promise<Response>;
+/** The endpoint set discovered for a provider's authorization server. */
+export interface DiscoveredEndpoints {
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly registrationEndpoint: string;
+    /** RFC 7009 token revocation (OPE-287). OPTIONAL, and the only optional member here: RFC 8414
+     *  lists `revocation_endpoint` as optional metadata, so a server may legitimately publish none.
+     *  Absent ⇒ {@link revokeToken} is never called and a purge is local-only (see its doc). The other
+     *  three are REQUIRED because without them the flow cannot start at all. */
+    readonly revocationEndpoint?: string;
+}
+/** A token endpoint response (authorization-code exchange or refresh). Only the fields we persist. */
+export interface OAuthTokenResponse {
+    readonly access_token: string;
+    readonly refresh_token?: string;
+    readonly expires_in?: number;
+    readonly scope?: string;
+    readonly token_type?: string;
+}
+/**
+ * Two-hop discovery: the MCP resource's protected-resource metadata → its authorization server →
+ * that server's metadata (authorization/token/registration endpoints). `resource` is the hosted-MCP
+ * server URL (also the RFC 8707 resource indicator). Throws OeOauthError on any missing hop.
+ */
+export declare function discoverEndpoints(resource: string, fetchImpl: OAuthFetch): Promise<DiscoveredEndpoints>;
+/**
+ * Dynamic Client Registration (RFC 7591) for a PUBLIC PKCE client — no secret, auth method "none".
+ * Returns the minted `client_id`. Registers the SINGLE redirect_uri OE owns (the callback route).
+ */
+export declare function registerClient(registrationEndpoint: string, input: {
+    readonly clientName: string;
+    readonly redirectUri: string;
+    readonly scopes?: readonly string[];
+}, fetchImpl: OAuthFetch): Promise<{
+    readonly clientId: string;
+}>;
+/** Build the authorization URL a human opens — PKCE S256 challenge + RFC 8707 resource indicator. */
+export declare function buildAuthorizationUrl(input: {
+    readonly authorizationEndpoint: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly state: string;
+    readonly codeChallenge: string;
+    readonly resource: string;
+    readonly scopes?: readonly string[];
+}): string;
+/** Exchange an authorization `code` for tokens (PKCE `code_verifier`, public client, RFC 8707 resource). */
+export declare function exchangeCode(tokenEndpoint: string, input: {
+    readonly code: string;
+    readonly verifier: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly resource: string;
+}, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
+/**
+ * RFC 7009 TOKEN REVOCATION — the VENDOR-side half of a purge. Present the REFRESH token, so one call kills
+ * the family. RFC 7009 mandates 200 for an invalid token, so a non-200 means the REQUEST was refused.
+ */
+export declare function revokeToken(revocationEndpoint: string, input: {
+    readonly token: string;
+    readonly clientId: string;
+    readonly tokenTypeHint?: "refresh_token" | "access_token";
+}, fetchImpl: OAuthFetch): Promise<void>;
+/** Everything a confidential token call needs, resolved by the caller. The `clientSecret` is the
+ *  live value read from the credential store at call time — it is passed, used and dropped; nothing
+ *  in this module stores it, and no function here puts it anywhere but the Basic header. */
+export interface ConfidentialClient {
+    readonly clientId: string;
+    readonly clientSecret: string;
+    /** How the token body is encoded. `json` is Notion's measured contract; `form` is the RFC default. */
+    readonly bodyEncoding: "json" | "form";
+    /** Vendor-required extra request headers (Notion needs `Notion-Version`). Never `authorization`. */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+/**
+ * The RFC 6749 §2.3.1 HTTP Basic client credential. The RFC's per-half form-encoding is a no-op for the
+ * characters vendors issue, and produces a rejected credential where a portal shows the raw value.
+ */
+export declare function basicAuthHeader(clientId: string, clientSecret: string): string;
+/**
+ * The authorization URL for a static confidential client — NO PKCE and no RFC 8707 `resource`: the code is
+ * bound by the client SECRET instead. `extraParams` apply FIRST, so a parameter this function owns wins.
+ */
+export declare function buildStaticAuthorizationUrl(input: {
+    readonly authorizationEndpoint: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly state: string;
+    readonly scopes?: readonly string[];
+    readonly extraParams?: Readonly<Record<string, string>>;
+}): string;
+/**
+ * Exchange an authorization `code` for tokens as a CONFIDENTIAL client. The body carries no `client_id`:
+ * RFC 6749 §2.3 forbids authenticating by more than one method in one request.
+ */
+export declare function exchangeCodeConfidential(tokenEndpoint: string, input: {
+    readonly code: string;
+    readonly redirectUri: string;
+}, client: ConfidentialClient, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
+/** Refresh an access token as a CONFIDENTIAL client. Same rotation semantics as the public-client
+ *  refresh: a rotating server returns a new `refresh_token`, a non-rotating one omits it. */
+export declare function refreshTokenConfidential(tokenEndpoint: string, input: {
+    readonly refreshToken: string;
+    readonly scopes?: readonly string[];
+}, client: ConfidentialClient, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
+/**
+ * RFC 7009 revocation as a CONFIDENTIAL client. The error contract is {@link revokeToken}'s. Revocation is
+ * form-encoded whatever the token endpoint uses, because RFC 7009 §2.1 defines the request that way.
+ */
+export declare function revokeTokenConfidential(revocationEndpoint: string, input: {
+    readonly token: string;
+    readonly tokenTypeHint?: "refresh_token" | "access_token";
+}, client: ConfidentialClient, fetchImpl: OAuthFetch): Promise<void>;
+/** Refresh an access token (public client, RFC 8707 resource). A rotation-safe server returns a NEW
+ *  refresh_token and invalidates the old one; a non-rotating server omits it (we keep the old). */
+export declare function refreshToken(tokenEndpoint: string, input: {
+    readonly refreshToken: string;
+    readonly clientId: string;
+    readonly resource: string;
+    readonly scopes?: readonly string[];
+}, fetchImpl: OAuthFetch): Promise<OAuthTokenResponse>;
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/agent/oe-oauth/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/oauth-client.ts"],"names":[],"mappings":"AAKA,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;gFAG4E;IAC5E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AA0BD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoC7G;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,KAAK,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACzG,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBxC;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,MAAM,CAWT;AA6BD,4GAA4G;AAC5G,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC/I,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAAE,EACvH,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;4FAE4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,oGAAoG;IACpG,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,GAAG,MAAM,CAST;AAsCD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAC9D,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AAED;6FAC6F;AAC7F,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC7E,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,kBAAkB,EAAE,MAAM,EAC1B,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,GAAG,cAAc,CAAA;CAAE,EAC5F,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;mGACmG;AACnG,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACnI,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}

package/dist/agent/oe-oauth/oauth-client.js

@@ -0,0 +1,262 @@
+// Vendor-free OAuth 2.0 client: DCR, the PKCE authorization-code flow, RFC 8707 resource indicators and RFC
+// 7009 revocation. Nothing here logs a token, a code or a verifier, and a client secret rides only a header.
+import { OeOauthError } from "./errors.js";
+function trimSlash(u) {
+    return u.replace(/\/+$/, "");
+}
+/**
+ * RFC 9728 / RFC 8414 well-known derivation: the `.well-known/<suffix>` is INSERTED at the ORIGIN with the
+ * resource's path appended after it. A naive append hits an authed resource path (mcp.notion.com 401s).
+ */
+function wellKnownUrl(base, suffix) {
+    const u = new URL(base);
+    const path = trimSlash(u.pathname) === "" ? "" : trimSlash(u.pathname);
+    return `${u.origin}/.well-known/${suffix}${path}`;
+}
+async function readError(res) {
+    // Parse ONLY the RFC 6749 `error` code — never attach the raw body (may echo a submitted value).
+    try {
+        const body = (await res.json());
+        return typeof body?.error === "string" ? { oauthError: body.error } : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Two-hop discovery: the MCP resource's protected-resource metadata → its authorization server →
+ * that server's metadata (authorization/token/registration endpoints). `resource` is the hosted-MCP
+ * server URL (also the RFC 8707 resource indicator). Throws OeOauthError on any missing hop.
+ */
+export async function discoverEndpoints(resource, fetchImpl) {
+    const base = trimSlash(resource);
+    // RFC-form first (origin-inserted, path-suffixed); origin-root fallback for servers that publish
+    // metadata only at the root regardless of the resource path.
+    let prMeta = await fetchImpl(wellKnownUrl(base, "oauth-protected-resource"), { headers: { accept: "application/json" } });
+    if (!prMeta.ok) {
+        const rootForm = `${new URL(base).origin}/.well-known/oauth-protected-resource`;
+        if (wellKnownUrl(base, "oauth-protected-resource") !== rootForm) {
+            prMeta = await fetchImpl(rootForm, { headers: { accept: "application/json" } });
+        }
+    }
+    if (!prMeta.ok)
+        throw new OeOauthError(`protected-resource discovery failed for ${base}`, { httpStatus: prMeta.status, ...(await readError(prMeta)) });
+    const pr = (await prMeta.json().catch(() => ({})));
+    const authServer = Array.isArray(pr.authorization_servers) && typeof pr.authorization_servers[0] === "string" ? pr.authorization_servers[0] : undefined;
+    if (!authServer)
+        throw new OeOauthError(`protected-resource metadata for ${base} names no authorization_servers`);
+    const asBase = trimSlash(authServer);
+    const asMeta = await fetchImpl(wellKnownUrl(asBase, "oauth-authorization-server"), { headers: { accept: "application/json" } });
+    if (!asMeta.ok)
+        throw new OeOauthError(`authorization-server discovery failed for ${asBase}`, { httpStatus: asMeta.status, ...(await readError(asMeta)) });
+    const as = (await asMeta.json().catch(() => ({})));
+    const authorizationEndpoint = typeof as.authorization_endpoint === "string" ? as.authorization_endpoint : undefined;
+    const tokenEndpoint = typeof as.token_endpoint === "string" ? as.token_endpoint : undefined;
+    const registrationEndpoint = typeof as.registration_endpoint === "string" ? as.registration_endpoint : undefined;
+    // RFC 7009/8414 (OPE-287): optional metadata, so its ABSENCE is never an error — it only means a
+    // purge cannot tell the vendor and stays local. Parsed at discovery (not at purge time) because a
+    // purge must not depend on the authorization server being reachable at the moment of offboarding.
+    const revocationEndpoint = typeof as.revocation_endpoint === "string" && as.revocation_endpoint ? as.revocation_endpoint : undefined;
+    if (!authorizationEndpoint || !tokenEndpoint || !registrationEndpoint) {
+        throw new OeOauthError(`authorization-server metadata for ${asBase} is missing authorization/token/registration endpoints`);
+    }
+    return { authorizationEndpoint, tokenEndpoint, registrationEndpoint, ...(revocationEndpoint ? { revocationEndpoint } : {}) };
+}
+/**
+ * Dynamic Client Registration (RFC 7591) for a PUBLIC PKCE client — no secret, auth method "none".
+ * Returns the minted `client_id`. Registers the SINGLE redirect_uri OE owns (the callback route).
+ */
+export async function registerClient(registrationEndpoint, input, fetchImpl) {
+    const res = await fetchImpl(registrationEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({
+            client_name: input.clientName,
+            redirect_uris: [input.redirectUri],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+            ...(input.scopes && input.scopes.length ? { scope: input.scopes.join(" ") } : {}),
+        }),
+    });
+    if (!res.ok)
+        throw new OeOauthError(`dynamic client registration failed at ${registrationEndpoint}`, { httpStatus: res.status, ...(await readError(res)) });
+    const body = (await res.json().catch(() => ({})));
+    if (typeof body.client_id !== "string" || !body.client_id)
+        throw new OeOauthError(`registration response carried no client_id`);
+    return { clientId: body.client_id };
+}
+/** Build the authorization URL a human opens — PKCE S256 challenge + RFC 8707 resource indicator. */
+export function buildAuthorizationUrl(input) {
+    const u = new URL(input.authorizationEndpoint);
+    u.searchParams.set("response_type", "code");
+    u.searchParams.set("client_id", input.clientId);
+    u.searchParams.set("redirect_uri", input.redirectUri);
+    u.searchParams.set("state", input.state);
+    u.searchParams.set("code_challenge", input.codeChallenge);
+    u.searchParams.set("code_challenge_method", "S256");
+    u.searchParams.set("resource", input.resource);
+    if (input.scopes && input.scopes.length)
+        u.searchParams.set("scope", input.scopes.join(" "));
+    return u.toString();
+}
+/** Turn one token-endpoint response into tokens, or into a typed error. Shared by BOTH dialects: the
+ *  public PKCE client and the static confidential client differ in how the request is composed and
+ *  authenticated, never in how the answer is read. The error names the ENDPOINT and the RFC 6749
+ *  error code only — no request material travels into it, which is what keeps a client secret out of
+ *  every message on the confidential path. */
+async function readTokenResponse(tokenEndpoint, res) {
+    if (!res.ok) {
+        const { oauthError } = await readError(res);
+        throw new OeOauthError(`token endpoint ${tokenEndpoint} returned ${res.status}${oauthError ? ` (${oauthError})` : ""}`, {
+            httpStatus: res.status,
+            ...(oauthError ? { oauthError } : {}),
+        });
+    }
+    const body = (await res.json().catch(() => ({})));
+    if (typeof body.access_token !== "string" || !body.access_token)
+        throw new OeOauthError(`token endpoint ${tokenEndpoint} returned no access_token`);
+    return body;
+}
+async function postToken(tokenEndpoint, form, fetchImpl) {
+    const res = await fetchImpl(tokenEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: new URLSearchParams(form).toString(),
+    });
+    return readTokenResponse(tokenEndpoint, res);
+}
+/** Exchange an authorization `code` for tokens (PKCE `code_verifier`, public client, RFC 8707 resource). */
+export function exchangeCode(tokenEndpoint, input, fetchImpl) {
+    return postToken(tokenEndpoint, {
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        client_id: input.clientId,
+        code_verifier: input.verifier,
+        resource: input.resource,
+    }, fetchImpl);
+}
+/**
+ * RFC 7009 TOKEN REVOCATION — the VENDOR-side half of a purge. Present the REFRESH token, so one call kills
+ * the family. RFC 7009 mandates 200 for an invalid token, so a non-200 means the REQUEST was refused.
+ */
+export async function revokeToken(revocationEndpoint, input, fetchImpl) {
+    const res = await fetchImpl(revocationEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: new URLSearchParams({
+            token: input.token,
+            client_id: input.clientId, // public PKCE client — no secret to present (token_endpoint_auth_method "none")
+            ...(input.tokenTypeHint ? { token_type_hint: input.tokenTypeHint } : {}),
+        }).toString(),
+    });
+    if (!res.ok) {
+        const { oauthError } = await readError(res);
+        throw new OeOauthError(`revocation endpoint ${revocationEndpoint} returned ${res.status}${oauthError ? ` (${oauthError})` : ""}`, {
+            httpStatus: res.status,
+            ...(oauthError ? { oauthError } : {}),
+        });
+    }
+}
+/**
+ * The RFC 6749 §2.3.1 HTTP Basic client credential. The RFC's per-half form-encoding is a no-op for the
+ * characters vendors issue, and produces a rejected credential where a portal shows the raw value.
+ */
+export function basicAuthHeader(clientId, clientSecret) {
+    return `Basic ${Buffer.from(`${clientId}:${clientSecret}`, "utf-8").toString("base64")}`;
+}
+/**
+ * The authorization URL for a static confidential client — NO PKCE and no RFC 8707 `resource`: the code is
+ * bound by the client SECRET instead. `extraParams` apply FIRST, so a parameter this function owns wins.
+ */
+export function buildStaticAuthorizationUrl(input) {
+    const u = new URL(input.authorizationEndpoint);
+    for (const [k, v] of Object.entries(input.extraParams ?? {}))
+        u.searchParams.set(k, v);
+    u.searchParams.set("response_type", "code");
+    u.searchParams.set("client_id", input.clientId);
+    u.searchParams.set("redirect_uri", input.redirectUri);
+    u.searchParams.set("state", input.state);
+    if (input.scopes && input.scopes.length)
+        u.searchParams.set("scope", input.scopes.join(" "));
+    return u.toString();
+}
+/** Compose and send one confidential token request. The secret reaches exactly one field of this
+ *  object — the `authorization` header — and `redirect: "error"` stops that header from being
+ *  replayed to a host a redirect names. Config headers are applied FIRST so neither they nor a
+ *  vendor quirk can displace the ones this function owns. */
+/** Vendor headers from config, MINUS any case-variant of a header this module owns. HTTP header
+ *  names are case-insensitive but a JS object's keys are not, so a config `Content-Type` beside our
+ *  `content-type` is ONE header with two values on the wire. Dropping the config's variant makes the
+ *  ones we own win, which is the same rule the config parser states for `authorization`. */
+function vendorHeaders(client, owned) {
+    const out = {};
+    for (const [name, value] of Object.entries(client.headers ?? {})) {
+        if (!owned.includes(name.toLowerCase()))
+            out[name] = value;
+    }
+    return out;
+}
+const OWNED_TOKEN_HEADERS = ["accept", "content-type", "authorization"];
+async function postTokenConfidential(tokenEndpoint, client, params, fetchImpl) {
+    const headers = vendorHeaders(client, OWNED_TOKEN_HEADERS);
+    headers.accept = "application/json";
+    headers["content-type"] = client.bodyEncoding === "json" ? "application/json" : "application/x-www-form-urlencoded";
+    headers.authorization = basicAuthHeader(client.clientId, client.clientSecret);
+    return fetchImpl(tokenEndpoint, {
+        method: "POST",
+        headers,
+        body: client.bodyEncoding === "json" ? JSON.stringify(params) : new URLSearchParams(params).toString(),
+        redirect: "error",
+    });
+}
+/**
+ * Exchange an authorization `code` for tokens as a CONFIDENTIAL client. The body carries no `client_id`:
+ * RFC 6749 §2.3 forbids authenticating by more than one method in one request.
+ */
+export async function exchangeCodeConfidential(tokenEndpoint, input, client, fetchImpl) {
+    const res = await postTokenConfidential(tokenEndpoint, client, { grant_type: "authorization_code", code: input.code, redirect_uri: input.redirectUri }, fetchImpl);
+    return readTokenResponse(tokenEndpoint, res);
+}
+/** Refresh an access token as a CONFIDENTIAL client. Same rotation semantics as the public-client
+ *  refresh: a rotating server returns a new `refresh_token`, a non-rotating one omits it. */
+export async function refreshTokenConfidential(tokenEndpoint, input, client, fetchImpl) {
+    const res = await postTokenConfidential(tokenEndpoint, client, { grant_type: "refresh_token", refresh_token: input.refreshToken, ...(input.scopes && input.scopes.length ? { scope: input.scopes.join(" ") } : {}) }, fetchImpl);
+    return readTokenResponse(tokenEndpoint, res);
+}
+/**
+ * RFC 7009 revocation as a CONFIDENTIAL client. The error contract is {@link revokeToken}'s. Revocation is
+ * form-encoded whatever the token endpoint uses, because RFC 7009 §2.1 defines the request that way.
+ */
+export async function revokeTokenConfidential(revocationEndpoint, input, client, fetchImpl) {
+    const headers = vendorHeaders(client, OWNED_TOKEN_HEADERS);
+    headers.accept = "application/json";
+    headers["content-type"] = "application/x-www-form-urlencoded";
+    headers.authorization = basicAuthHeader(client.clientId, client.clientSecret);
+    const res = await fetchImpl(revocationEndpoint, {
+        method: "POST",
+        headers,
+        body: new URLSearchParams({ token: input.token, ...(input.tokenTypeHint ? { token_type_hint: input.tokenTypeHint } : {}) }).toString(),
+        redirect: "error",
+    });
+    if (!res.ok) {
+        const { oauthError } = await readError(res);
+        throw new OeOauthError(`revocation endpoint ${revocationEndpoint} returned ${res.status}${oauthError ? ` (${oauthError})` : ""}`, {
+            httpStatus: res.status,
+            ...(oauthError ? { oauthError } : {}),
+        });
+    }
+}
+/** Refresh an access token (public client, RFC 8707 resource). A rotation-safe server returns a NEW
+ *  refresh_token and invalidates the old one; a non-rotating server omits it (we keep the old). */
+export function refreshToken(tokenEndpoint, input, fetchImpl) {
+    return postToken(tokenEndpoint, {
+        grant_type: "refresh_token",
+        refresh_token: input.refreshToken,
+        client_id: input.clientId,
+        resource: input.resource,
+        ...(input.scopes && input.scopes.length ? { scope: input.scopes.join(" ") } : {}),
+    }, fetchImpl);
+}
+//# sourceMappingURL=oauth-client.js.map

package/dist/agent/oe-oauth/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../../agent/oe-oauth/oauth-client.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,6GAA6G;AAE7G,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0B3C,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,CAAC,MAAM,gBAAgB,MAAM,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa;IACpC,iGAAiG;IACjG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAqB;IAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,iGAAiG;IACjG,6DAA6D;IAC7D,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,uCAAuC,CAAC;QAChF,IAAI,YAAY,CAAC,IAAI,EAAE,0BAA0B,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,2CAA2C,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACvJ,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwC,CAAC;IAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpK,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,IAAI,iCAAiC,CAAC,CAAC;IAElH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,6CAA6C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3J,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKhD,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,EAAE,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,oBAAoB,GAAG,OAAO,EAAE,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,MAAM,kBAAkB,GAAG,OAAO,EAAE,CAAC,mBAAmB,KAAK,QAAQ,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACrI,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,qCAAqC,MAAM,wDAAwD,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,KAAyG,EACzG,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,aAAa,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,yCAAyC,oBAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5J,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;IAChI,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;;8CAI8C;AAC9C,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,GAAa;IACnE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACtH,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,aAAa,2BAA2B,CAAC,CAAC;IACpJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,aAAqB,EAAE,IAA4B,EAAE,SAAqB;IACjG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,KAA+I,EAC/I,SAAqB;IAErB,OAAO,SAAS,CACd,aAAa,EACb;QACE,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,kBAA0B,EAC1B,KAAuH,EACvH,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,gFAAgF;YAC3G,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,uBAAuB,kBAAkB,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChI,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,YAAoB;IACpE,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAO3C;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;6DAG6D;AAC7D;;;4FAG4F;AAC5F,SAAS,aAAa,CAAC,MAA0B,EAAE,KAAwB;IACzE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAEjF,KAAK,UAAU,qBAAqB,CAClC,aAAqB,EACrB,MAA0B,EAC1B,MAA8B,EAC9B,SAAqB;IAErB,MAAM,OAAO,GAA2B,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACpH,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC,aAAa,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QACtG,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,KAA8D,EAC9D,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;IACnK,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;6FAC6F;AAC7F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,KAA6E,EAC7E,MAA0B,EAC1B,SAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,aAAa,EACb,MAAM,EACN,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrJ,SAAS,CACV,CAAC;IACF,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,kBAA0B,EAC1B,KAA4F,EAC5F,MAA0B,EAC1B,SAAqB;IAErB,MAAM,OAAO,GAA2B,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,GAAG,mCAAmC,CAAC;IAC9D,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtI,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,uBAAuB,kBAAkB,aAAa,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChI,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,KAAmI,EACnI,SAAqB;IAErB,OAAO,SAAS,CACd,aAAa,EACb;QACE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,EACD,SAAS,CACV,CAAC;AACJ,CAAC"}

package/dist/agent/oe-oauth/pkce.d.ts

@@ -0,0 +1,8 @@
+/** A fresh PKCE pair: a 43-char base64url `verifier` (32 random bytes) + its S256 `challenge`. */
+export declare function makePkce(): {
+    readonly verifier: string;
+    readonly challenge: string;
+};
+/** A fresh opaque, unforgeable, single-use state token (256 bits of entropy, base64url). */
+export declare function makeState(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/agent/oe-oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/pkce.ts"],"names":[],"mappings":"AAUA,kGAAkG;AAClG,wBAAgB,QAAQ,IAAI;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIpF;AAED,4FAA4F;AAC5F,wBAAgB,SAAS,IAAI,MAAM,CAElC"}

package/dist/agent/oe-oauth/pkce.js

@@ -0,0 +1,18 @@
+// PKCE (RFC 7636) and opaque state for the own-rolled OAuth adapter. The verifier never leaves the host, so
+// a stolen `code` is useless; the 256-bit state is the unguessable, single-use CSRF defence.
+import { randomBytes, createHash } from "node:crypto";
+/** base64url with no padding — the encoding RFC 7636 mandates for verifier/challenge. */
+function base64url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** A fresh PKCE pair: a 43-char base64url `verifier` (32 random bytes) + its S256 `challenge`. */
+export function makePkce() {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+/** A fresh opaque, unforgeable, single-use state token (256 bits of entropy, base64url). */
+export function makeState() {
+    return base64url(randomBytes(32));
+}
+//# sourceMappingURL=pkce.js.map

package/dist/agent/oe-oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../agent/oe-oauth/pkce.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,6FAA6F;AAE7F,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,yFAAyF;AACzF,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,QAAQ;IACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS;IACvB,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/agent/oe-oauth/register.d.ts

@@ -0,0 +1,17 @@
+import { type OeOauthProviderConfig } from "./config.js";
+import type { OeOauthVaultDeps } from "./token-vault.js";
+/** Registration input. `providers` defaults to {@link loadOeOauthConfig}; `deps` is a test/DI seam. */
+export interface RegisterOeOauthOptions {
+    readonly providers?: ReadonlyMap<string, OeOauthProviderConfig>;
+    readonly deps?: OeOauthVaultDeps;
+}
+/**
+ * Construct the own-rolled OAuth provider and callback completer and register both. Throws when no provider
+ * config is available — the caller invokes this only once it has decided to arm.
+ */
+export declare function registerOeOauth(opts?: RegisterOeOauthOptions): {
+    flow: import("@open-everywhere/core/agent/adapter-api.js").UserAuthFlowProvider;
+    completer: import("@open-everywhere/core/agent/adapter-api.js").OeOauthCallbackCompleter;
+    purge: import("@open-everywhere/core/agent/adapter-api.js").CredentialPurgeHook;
+};
+//# sourceMappingURL=register.d.ts.map

package/dist/agent/oe-oauth/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/register.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,uGAAuG;AACvG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B;;;;EAahE"}

package/dist/agent/oe-oauth/register.js

@@ -0,0 +1,24 @@
+// Register the own-rolled OAuth adapter: the user-auth flow, the callback completer and the credential-purge
+// hook, from one shared vault. Flag-off ⇒ none registers and the callback route fails closed with a 404.
+import { registerUserAuthFlow, registerOeOauthCallbackCompleter, registerCredentialPurgeHook } from "@open-everywhere/core/agent/adapter-api.js";
+import { loadOeOauthConfig } from "./config.js";
+import { makeOeOauth } from "./user-auth-flow.js";
+/**
+ * Construct the own-rolled OAuth provider and callback completer and register both. Throws when no provider
+ * config is available — the caller invokes this only once it has decided to arm.
+ */
+export function registerOeOauth(opts = {}) {
+    const providers = opts.providers ?? loadOeOauthConfig();
+    if (!providers || providers.size === 0) {
+        throw new Error("registerOeOauth: no oe-oauth provider config (set OE_OAUTH_CONFIG / OE_OAUTH_NOTION_RESOURCE).");
+    }
+    const { flow, completer, purge } = makeOeOauth(providers, opts.deps ?? {});
+    registerUserAuthFlow(flow);
+    registerOeOauthCallbackCompleter(completer);
+    // (OPE-287) The purge hook registers ALONGSIDE the mint flow, in the same call, deliberately: a
+    // deployment that can mint per-user credentials but has no way to destroy them is the state this
+    // ticket removed, and keeping the two registrations together is what stops it coming back.
+    registerCredentialPurgeHook("oe-oauth", purge);
+    return { flow, completer, purge };
+}
+//# sourceMappingURL=register.js.map

package/dist/agent/oe-oauth/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../agent/oe-oauth/register.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,yGAAyG;AAEzG,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACjJ,OAAO,EAAE,iBAAiB,EAA8B,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASlD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAI,GAA2B,EAAE;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,EAAE,CAAC;IACxD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3E,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,2BAA2B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}