@qduc/term2 0.24.0 → 0.25.0

package/dist/services/mcp/mcp-connection-manager.js

@@ -0,0 +1,488 @@
+/**
+ * The MCP connection layer: owns one connection per configured server and
+ * exposes them through {@linkcode McpToolSource} (the fixed contract with the
+ * `run_code` script surface).
+ *
+ * Lifecycle: `start()` connects every server concurrently in the background
+ * (connecting → ready/failed); `snapshot()` keeps a stable array identity until
+ * something actually changes; `notifications/tools/list_changed` triggers a
+ * refetch; `close()` shuts everything down. There is no automatic reconnect in
+ * this slice — a failed server stays failed until the next `start()`.
+ */
+import { Client, SdkError, SdkErrorCode, SdkHttpError, SseError, SSEClientTransport, StreamableHTTPClientTransport, UnauthorizedError, } from '@modelcontextprotocol/client';
+import { StdioClientTransport } from '@modelcontextprotocol/client/stdio';
+import { McpCallError } from './mcp-tool-source.js';
+export { McpCallError };
+import { realpathOrSelf } from './mcp-config.js';
+import { unsandboxedStdioLauncher } from './mcp-stdio-launcher.js';
+import { createRefreshOnlyProvider, McpInteractiveLoginRequiredError, mcpNeedsAuthMessage } from './mcp-oauth-login.js';
+const DEFAULT_CALL_TIMEOUT_MS = 120_000;
+const STDERR_TAIL_CHARS = 2000;
+const CONNECT_TIMEOUT_MS = 15_000;
+const LIST_TIMEOUT_MS = 15_000;
+/** Upper bound on waiting for a client/transport close during `close()`. */
+const CLOSE_TIMEOUT_MS = 5_000;
+/** The exact nested line a user must add to start a project stdio server. */
+const projectOptInError = (name, workspaceRoot, userConfigPath) => `not started — a project stdio server must be enabled for this workspace by adding \`"projectServers": { "${workspaceRoot ?? '<workspace root>'}": { "${name}": { "enabled": true } } }\` to ${userConfigPath ?? 'the user mcp.json'}`;
+/**
+ * Plan decision D2 (2026-09-18): a project `.mcp.json` may name any URL, so an
+ * OAuth login it provokes would send the user to an issuer the repository chose.
+ * Project HTTP servers therefore need the same workspace-scoped opt-in as
+ * project stdio servers before any credential flow may begin.
+ */
+const projectOAuthOptInError = (name, workspaceRoot, userConfigPath) => `requires an OAuth login, which a project config may not start on its own: enable it for this workspace by adding \`"projectServers": { "${workspaceRoot ?? '<workspace root>'}": { "${name}": { "enabled": true } } }\` to ${userConfigPath ?? 'the user mcp.json'}, then run /mcp-login ${name}`;
+export class McpConnectionManager {
+    connections = new Map();
+    listeners = new Set();
+    stdioLauncher;
+    userConfigPath;
+    workspaceRoot;
+    onNotice;
+    oauthStore;
+    interactive;
+    noticedFailures = new Set();
+    snapshotCache = [];
+    started = false;
+    closed = false;
+    settlePromise = Promise.resolve();
+    constructor(options) {
+        this.stdioLauncher = options.stdioLauncher ?? unsandboxedStdioLauncher;
+        this.userConfigPath = options.userConfigPath;
+        this.workspaceRoot = options.workspaceRoot;
+        this.onNotice = options.onNotice;
+        this.oauthStore = options.oauthStore;
+        this.interactive = options.interactive ?? true;
+        for (const config of options.servers) {
+            if (this.connections.has(config.name)) {
+                this.connections.set(config.name, {
+                    config,
+                    state: 'failed',
+                    tools: [],
+                    error: `duplicate server name "${config.name}" in resolved config`,
+                });
+                continue;
+            }
+            this.connections.set(config.name, { config, state: 'connecting', tools: [] });
+        }
+        this.rebuildSnapshot();
+    }
+    /** Begins connecting every server concurrently. Resolved configs never throw. */
+    start() {
+        if (this.started)
+            return;
+        this.started = true;
+        const settling = Array.from(this.connections.values(), (connection) => this.connectOne(connection));
+        this.settlePromise = Promise.all(settling).then(() => undefined);
+    }
+    /** Resolves once every connection started by `start()` left `connecting`. */
+    whenSettled() {
+        return this.settlePromise;
+    }
+    snapshot() {
+        return this.snapshotCache;
+    }
+    onCatalogChanged(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    async callTool(server, tool, args, options) {
+        const connection = this.connections.get(server);
+        if (!connection)
+            throw new McpCallError('unknown_server', `no MCP server named "${server}"`);
+        if (connection.state !== 'ready' || !connection.client) {
+            throw new McpCallError('server_unavailable', `server "${server}" is ${connection.state}${connection.error ? ` (${connection.error})` : ''}`);
+        }
+        if (!connection.tools.some((t) => t.name === tool)) {
+            throw new McpCallError('unknown_tool', `server "${server}" does not list a tool named "${tool}"`);
+        }
+        if (options.signal.aborted)
+            throw new McpCallError('aborted', 'call aborted before it was sent');
+        try {
+            const result = await connection.client.callTool({ name: tool, arguments: args }, { signal: options.signal, timeout: options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS });
+            return {
+                content: result.content ?? [],
+                ...(result.structuredContent !== undefined ? { structuredContent: result.structuredContent } : {}),
+                isError: result.isError === true,
+            };
+        }
+        catch (error) {
+            throw this.mapCallError(server, tool, options.signal, error);
+        }
+    }
+    async close() {
+        this.closed = true;
+        await Promise.all(Array.from(this.connections.values(), async (connection) => {
+            connection.closing = true;
+            // The grace timer is cleared (and unref'd) as soon as teardown wins,
+            // so a finished close() never keeps the event loop alive.
+            let grace;
+            try {
+                await Promise.race([
+                    this.teardown(connection),
+                    new Promise((resolve) => {
+                        grace = setTimeout(resolve, CLOSE_TIMEOUT_MS);
+                        grace.unref?.();
+                    }),
+                ]);
+            }
+            finally {
+                if (grace !== undefined)
+                    clearTimeout(grace);
+            }
+        }));
+    }
+    /** Reconciles edited config while preserving this stable tool-source object. */
+    async replaceServers(configs) {
+        if (this.closed)
+            return;
+        const nextByName = new Map(configs.map((config) => [config.name, config]));
+        const connect = [];
+        for (const [name, connection] of this.connections) {
+            const next = nextByName.get(name);
+            if (next && JSON.stringify(next) === JSON.stringify(connection.config)) {
+                nextByName.delete(name);
+                continue;
+            }
+            connection.closing = true;
+            await this.teardown(connection);
+            this.connections.delete(name);
+            this.noticedFailures.delete(name);
+        }
+        for (const config of configs) {
+            if (!nextByName.has(config.name))
+                continue;
+            const connection = { config, state: 'connecting', tools: [] };
+            this.connections.set(config.name, connection);
+            connect.push(connection);
+        }
+        this.rebuildSnapshot();
+        const settling = connect.map((connection) => this.connectOne(connection));
+        this.settlePromise = Promise.all(settling).then(() => undefined);
+        await this.settlePromise;
+    }
+    /**
+     * Closes and clears this connection's client and transport, waiting for the
+     * closes to finish (bounded by the caller). Clearing first means a close()
+     * racing an in-flight connect can never double-close or re-await a torn-down
+     * client, and connectOne's post-await checks see the cleared state.
+     */
+    async teardown(connection) {
+        const { client, transport } = connection;
+        connection.client = undefined;
+        connection.transport = undefined;
+        await Promise.all([client?.close().catch(() => { }), transport?.close().catch(() => { })]);
+    }
+    /** True once close() ran or this connection is being torn down. */
+    isAbandoned(connection) {
+        return this.closed || connection.closing === true;
+    }
+    mapCallError(server, tool, signal, error) {
+        if (signal.aborted || (error instanceof Error && error.name === 'AbortError')) {
+            return new McpCallError('aborted', `call to ${server}.${tool} was aborted`);
+        }
+        if (error instanceof SdkError && error.code === SdkErrorCode.RequestTimeout) {
+            return new McpCallError('timeout', `call to ${server}.${tool} exceeded its timeout`);
+        }
+        // A crash or teardown mid-call kills the transport and (soon after) moves
+        // the connection out of `ready`; either signal means the server, not the
+        // protocol, is gone.
+        const connection = this.connections.get(server);
+        const connectionLost = connection !== undefined && connection.state !== 'ready' && !this.isAbandoned(connection);
+        const transportClosed = error instanceof SdkError &&
+            (error.code === SdkErrorCode.ConnectionClosed || error.code === SdkErrorCode.NotConnected);
+        if (connectionLost || transportClosed) {
+            return new McpCallError('server_unavailable', `server "${server}" is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        return new McpCallError('protocol', `call to ${server}.${tool} failed: ${message}`);
+    }
+    async connectOne(connection) {
+        const { config } = connection;
+        if (this.isAbandoned(connection))
+            return;
+        try {
+            if (config.error !== undefined) {
+                this.markFailed(connection, config.error);
+                return;
+            }
+            if (config.transport === 'stdio' && config.provenance === 'project' && config.projectEnabledOverride !== true) {
+                this.markFailed(connection, projectOptInError(config.name, realpathOrSelf(this.workspaceRoot ?? ''), this.userConfigPath));
+                return;
+            }
+            if (config.transport === 'stdio') {
+                await this.connectStdio(connection);
+            }
+            else {
+                await this.connectHttp(connection);
+            }
+            // Re-check after every await: close() may have fired while we were
+            // launching or connecting. Anything just created is torn down, and the
+            // connection never becomes `ready` or notifies after close.
+            if (this.isAbandoned(connection)) {
+                await this.teardown(connection);
+                return;
+            }
+            await this.refreshTools(connection, { cache: 'use' });
+            if (this.isAbandoned(connection)) {
+                await this.teardown(connection);
+                return;
+            }
+            connection.state = 'ready';
+            this.rebuildSnapshot();
+        }
+        catch (error) {
+            // A failure after spawn/connect must not leak the process or transport.
+            await this.teardown(connection);
+            // The failure may itself be caused by close() aborting the connect;
+            // never record a failure or notify after close.
+            if (this.isAbandoned(connection))
+                return;
+            if (this.isAuthRequired(error)) {
+                this.markAuthRequired(connection);
+                return;
+            }
+            const detail = error instanceof Error ? error.message : String(error);
+            const tail = connection.stderrTail ? ` stderr: ${connection.stderrTail}` : '';
+            this.markFailed(connection, `${detail}${tail}`);
+        }
+    }
+    /**
+     * All three shapes mean the same thing: the server wants a credential this
+     * session does not have.
+     *
+     * The `SdkHttpError` case is not redundant — the transport only raises
+     * `UnauthorizedError` when an auth provider is attached, and one is attached
+     * only once a credential is stored. A server nobody has logged in to yet
+     * therefore reports its 401 as a plain HTTP error, which is precisely the
+     * case that must reach `needs-auth`.
+     */
+    isAuthRequired(error) {
+        if (error instanceof UnauthorizedError || error instanceof McpInteractiveLoginRequiredError)
+            return true;
+        if (error instanceof SdkHttpError && error.status === 401)
+            return true;
+        // The legacy SSE transport reports the same 401 as an `SseError` carrying
+        // the status in `code`, because the refused response arrives on the event
+        // stream rather than from a JSON-RPC POST. Observed against real servers
+        // (Asana, Atlassian), which without this land in `failed` with an opaque
+        // "SSE error: Non-200 status code (401)" instead of an actionable login.
+        return error instanceof SseError && error.code === 401;
+    }
+    /**
+     * Routes a server that asked for a login to the right resting state: an
+     * actionable `needs-auth` interactively, a `failed` that says why when no one
+     * can complete a browser flow (non-interactive) or when a project config is
+     * not allowed to start one (D2).
+     */
+    markAuthRequired(connection) {
+        const { config } = connection;
+        if (!this.oauthEligible(config)) {
+            this.markFailed(connection, projectOAuthOptInError(config.name, realpathOrSelf(this.workspaceRoot ?? ''), this.userConfigPath));
+            return;
+        }
+        if (!this.interactive) {
+            this.markFailed(connection, `requires an OAuth login, which cannot be completed in a non-interactive run: authenticate once with \`/mcp-login ${config.name}\` in an interactive session and the stored token will refresh here`);
+            return;
+        }
+        if (this.isAbandoned(connection))
+            return;
+        connection.state = 'needs-auth';
+        connection.error = mcpNeedsAuthMessage(config.name);
+        connection.tools = [];
+        if (!this.noticedFailures.has(config.name)) {
+            this.noticedFailures.add(config.name);
+            this.onNotice?.(`MCP server "${config.name}": ${mcpNeedsAuthMessage(config.name)}`);
+        }
+        this.rebuildSnapshot();
+    }
+    async connectStdio(connection) {
+        const { config } = connection;
+        const spawned = await this.stdioLauncher({
+            name: config.name,
+            command: config.command ?? '',
+            args: config.args ?? [],
+            env: config.env ?? {},
+            ...(config.cwd !== undefined ? { cwd: config.cwd } : {}),
+        });
+        // The launcher may have resolved after close() started: never spawn then.
+        if (this.isAbandoned(connection))
+            return;
+        const transport = new StdioClientTransport({
+            command: spawned.command,
+            args: [...spawned.args],
+            env: { ...spawned.env },
+            ...(spawned.cwd !== undefined ? { cwd: spawned.cwd } : {}),
+            stderr: 'pipe',
+        });
+        // Registered on the connection before connecting, so a close() that
+        // fires mid-handshake can always reach the transport and kill the child.
+        connection.transport = transport;
+        this.watchStdio(connection, transport);
+        await this.connectClient(connection, transport);
+    }
+    async connectHttp(connection) {
+        const { config } = connection;
+        if (config.url === undefined)
+            throw new Error('http/sse server has no url');
+        const headers = config.headers ?? {};
+        const url = new URL(config.url);
+        // An auth provider is attached only when a credential is already stored, so
+        // startup never runs discovery or dynamic client registration against a URL
+        // nobody has logged in to yet. Present tokens refresh silently; an absent
+        // one falls through to the 401 that `connectOne` maps to `needs-auth`.
+        const authProvider = this.refreshOnlyAuthProvider(config);
+        const options = { requestInit: { headers }, ...(authProvider ? { authProvider } : {}) };
+        const transport = config.transport === 'sse'
+            ? new SSEClientTransport(url, options)
+            : new StreamableHTTPClientTransport(url, options);
+        // Stored like stdio so teardown is uniform across transports.
+        connection.transport = transport;
+        // Known gap: HTTP/SSE transports do not observe a dropped remote session
+        // (no onclose signal we can rely on here), so such a server stays `ready`
+        // until a call fails. Not handled in this slice.
+        await this.connectClient(connection, transport);
+    }
+    /**
+     * A provider that refreshes a stored credential but never starts a login, or
+     * `undefined` when there is nothing stored to refresh.
+     *
+     * D2: a project server that has not been opted in gets no provider at all, so
+     * a repository cannot cause even a discovery request to an issuer it chose.
+     */
+    refreshOnlyAuthProvider(config) {
+        if (!this.oauthStore || config.url === undefined)
+            return undefined;
+        if (!this.oauthEligible(config))
+            return undefined;
+        if (this.oauthStore.getTokens(config.url) === undefined)
+            return undefined;
+        return createRefreshOnlyProvider({
+            serverName: config.name,
+            serverUrl: config.url,
+            store: this.oauthStore,
+            ...(config.clientMetadataUrl !== undefined ? { clientMetadataUrl: config.clientMetadataUrl } : {}),
+            ...(config.clientId !== undefined ? { clientId: config.clientId } : {}),
+        });
+    }
+    /** Whether this server's config is allowed to hold or obtain OAuth credentials (D2). */
+    oauthEligible(config) {
+        return config.provenance === 'user' || config.projectEnabledOverride === true;
+    }
+    /** The login details for a server, or undefined when it may not use OAuth. */
+    oauthTarget(name) {
+        const connection = this.connections.get(name);
+        const config = connection?.config;
+        if (!config || config.url === undefined || !this.oauthEligible(config))
+            return undefined;
+        return {
+            serverName: config.name,
+            serverUrl: config.url,
+            ...(config.clientMetadataUrl !== undefined ? { clientMetadataUrl: config.clientMetadataUrl } : {}),
+            ...(config.clientId !== undefined ? { clientId: config.clientId } : {}),
+            ...(config.redirectPorts !== undefined ? { redirectPorts: config.redirectPorts } : {}),
+        };
+    }
+    /**
+     * Re-runs one server's connection, used after `/mcp-login` stores a token.
+     *
+     * Clears the previous failure first so a re-entered failure is noticed (and
+     * announced) again rather than being swallowed as a duplicate.
+     */
+    async reconnect(name) {
+        const connection = this.connections.get(name);
+        if (!connection || this.isAbandoned(connection))
+            return;
+        await this.teardown(connection);
+        if (this.isAbandoned(connection))
+            return;
+        this.noticedFailures.delete(name);
+        connection.state = 'connecting';
+        delete connection.error;
+        connection.tools = [];
+        delete connection.stderrTail;
+        this.rebuildSnapshot();
+        await this.connectOne(connection);
+    }
+    async connectClient(connection, transport) {
+        const client = new Client({ name: 'term2', version: '0.0.0' });
+        client.setNotificationHandler('notifications/tools/list_changed', () => {
+            void this.handleListChanged(connection);
+        });
+        connection.client = client;
+        await client.connect(transport, { timeout: CONNECT_TIMEOUT_MS });
+    }
+    watchStdio(connection, transport) {
+        let tail = '';
+        transport.onclose = () => {
+            if (connection.closing || this.closed)
+                return;
+            // A stdio process exiting is terminal for that connection.
+            this.markFailed(connection, `stdio server process exited${connection.stderrTail ? `. stderr tail: ${connection.stderrTail}` : ''}`);
+        };
+        transport.stderr?.on('data', (chunk) => {
+            tail = (tail + chunk.toString('utf8')).slice(-STDERR_TAIL_CHARS);
+            connection.stderrTail = tail;
+        });
+    }
+    async handleListChanged(connection) {
+        if (connection.state !== 'ready' || this.isAbandoned(connection))
+            return;
+        try {
+            await this.refreshTools(connection, { cache: 'refresh' });
+            if (this.isAbandoned(connection))
+                return;
+            this.rebuildSnapshot();
+        }
+        catch (error) {
+            // close() aborts the in-flight list; that rejection is not a failure.
+            if (this.isAbandoned(connection))
+                return;
+            const detail = error instanceof Error ? error.message : String(error);
+            this.markFailed(connection, `tools/list after list_changed failed: ${detail}`);
+        }
+    }
+    async refreshTools(connection, options) {
+        const client = connection.client;
+        if (!client)
+            throw new Error('no client');
+        // No cursor: the client walks every page and returns the merged catalog.
+        const result = await client.listTools(undefined, { ...options, timeout: LIST_TIMEOUT_MS });
+        connection.tools = result.tools.map((tool) => ({
+            name: tool.name,
+            ...(tool.title !== undefined ? { title: tool.title } : {}),
+            ...(tool.description !== undefined ? { description: tool.description } : {}),
+            inputSchema: (tool.inputSchema ?? {}),
+            ...(tool.outputSchema !== undefined ? { outputSchema: tool.outputSchema } : {}),
+            ...(tool.annotations !== undefined ? { annotations: tool.annotations } : {}),
+        }));
+    }
+    markFailed(connection, error) {
+        // A closed manager never changes state or notifies listeners.
+        if (this.isAbandoned(connection))
+            return;
+        connection.state = 'failed';
+        connection.error = error;
+        connection.tools = [];
+        if (!this.noticedFailures.has(connection.config.name)) {
+            this.noticedFailures.add(connection.config.name);
+            this.onNotice?.(`MCP server "${connection.config.name}" failed: ${error}`);
+        }
+        this.rebuildSnapshot();
+    }
+    rebuildSnapshot() {
+        const next = Array.from(this.connections.values(), (connection) => ({
+            name: connection.config.name,
+            provenance: connection.config.provenance,
+            transport: connection.config.transport,
+            state: connection.state,
+            ...(connection.error !== undefined ? { error: connection.error } : {}),
+            tools: connection.tools,
+        }));
+        if (JSON.stringify(next) === JSON.stringify(this.snapshotCache))
+            return;
+        this.snapshotCache = next;
+        for (const listener of this.listeners)
+            listener();
+    }
+}
+//# sourceMappingURL=mcp-connection-manager.js.map

package/dist/services/mcp/mcp-connection-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-connection-manager.js","sourceRoot":"","sources":["../../../source/services/mcp/mcp-connection-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,OAAO,EAAE,cAAc,EAAgC,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAsB,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGxH,MAAM,uBAAuB,GAAG,OAAO,CAAC;AACxC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAuC/B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,CACxB,IAAY,EACZ,aAAiC,EACjC,cAAkC,EAC1B,EAAE,CACV,4GACE,aAAa,IAAI,kBACnB,SAAS,IAAI,mCAAmC,cAAc,IAAI,mBAAmB,EAAE,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAC7B,IAAY,EACZ,aAAiC,EACjC,cAAkC,EAC1B,EAAE,CACV,2IACE,aAAa,IAAI,kBACnB,SAAS,IAAI,mCAAmC,cAAc,IAAI,mBAAmB,yBAAyB,IAAI,EAAE,CAAC;AAWvH,MAAM,OAAO,oBAAoB;IACd,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAClC,aAAa,CAAgB;IAC7B,cAAc,CAAU;IACxB,aAAa,CAAU;IACvB,QAAQ,CAA6B;IACrC,UAAU,CAAiB;IAC3B,WAAW,CAAU;IACrB,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,aAAa,GAAiC,EAAE,CAAC;IACjD,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAAG,KAAK,CAAC;IACf,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEzD,YAAY,OAAoC;QAC9C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,wBAAwB,CAAC;QACvE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;oBAChC,MAAM;oBACN,KAAK,EAAE,QAAQ;oBACf,KAAK,EAAE,EAAE;oBACT,KAAK,EAAE,0BAA0B,MAAM,CAAC,IAAI,sBAAsB;iBACnE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,iFAAiF;IACjF,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACpG,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,6EAA6E;IAC7E,WAAW;QACT,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,QAAoB;QACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,IAAY,EACZ,IAA6B,EAC7B,OAAoD;QAEpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,wBAAwB,MAAM,GAAG,CAAC,CAAC;QAC7F,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,WAAW,MAAM,QAAQ,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,WAAW,MAAM,iCAAiC,IAAI,GAAG,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QAEjG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAC7C,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAC/B,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,EAAE,CAClF,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YACzD,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC1B,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,KAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACzB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAC5B,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;wBAC9C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;oBAClB,CAAC,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,cAAc,CAAC,OAA2C;QAC9D,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,UAAU,GAAe,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC1E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CAAC,UAAsB;QAC3C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;QACzC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC;QAC9B,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;QACjC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,mEAAmE;IAC3D,WAAW,CAAC,UAAsB;QACxC,OAAO,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC;IACpD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,MAAmB,EAAE,KAAc;QACpF,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,WAAW,MAAM,IAAI,IAAI,cAAc,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,cAAc,EAAE,CAAC;YAC5E,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,WAAW,MAAM,IAAI,IAAI,uBAAuB,CAAC,CAAC;QACvF,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACjH,MAAM,eAAe,GACnB,KAAK,YAAY,QAAQ;YACzB,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7F,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,YAAY,CACrB,oBAAoB,EACpB,WAAW,MAAM,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,YAAY,CAAC,UAAU,EAAE,WAAW,MAAM,IAAI,IAAI,YAAY,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,UAAsB;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;gBAC9G,IAAI,CAAC,UAAU,CACb,UAAU,EACV,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAC9F,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;YACD,mEAAmE;YACnE,uEAAuE;YACvE,4DAA4D;YAC5D,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;YAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,oEAAoE;YACpE,gDAAgD;YAChD,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;gBAAE,OAAO;YACzC,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CAAC,KAAc;QACnC,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,gCAAgC;YAAE,OAAO,IAAI,CAAC;QACzG,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,OAAO,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,UAAsB;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CACb,UAAU,EACV,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CACnG,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,UAAU,CACb,UAAU,EACV,oHAAoH,MAAM,CAAC,IAAI,qEAAqE,CACrM,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,UAAU,CAAC,KAAK,GAAG,YAAY,CAAC;QAChC,UAAU,CAAC,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC,eAAe,MAAM,CAAC,IAAI,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAsB;QAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,0EAA0E;QAC1E,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YACvB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,oEAAoE;QACpE,yEAAyE;QACzE,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,UAAsB;QAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QAC9B,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACxF,MAAM,SAAS,GACb,MAAM,CAAC,SAAS,KAAK,KAAK;YACxB,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC;YACtC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtD,8DAA8D;QAC9D,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;QACjC,yEAAyE;QACzE,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB,CAC7B,MAA+B;QAE/B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1E,OAAO,yBAAyB,CAAC;YAC/B,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,KAAK,EAAE,IAAI,CAAC,UAAU;YACtB,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IAChF,aAAa,CAAC,MAA+B;QACnD,OAAO,MAAM,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,sBAAsB,KAAK,IAAI,CAAC;IAChF,CAAC;IAED,8EAA8E;IAC9E,WAAW,CAAC,IAAY;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACxD,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,UAAU,CAAC,KAAK,GAAG,YAAY,CAAC;QAChC,OAAO,UAAU,CAAC,KAAK,CAAC;QACxB,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,UAAsB,EACtB,SAAoF;QAEpF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,sBAAsB,CAAC,kCAAkC,EAAE,GAAG,EAAE;YACrE,KAAK,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,CAAC;IAEO,UAAU,CAAC,UAAsB,EAAE,SAA+B;QACxE,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAC9C,2DAA2D;YAC3D,IAAI,CAAC,UAAU,CACb,UAAU,EACV,8BAA8B,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvG,CAAC;QACJ,CAAC,CAAC;QACF,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7C,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACjE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,UAAsB;QACpD,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;gBAAE,OAAO;YACzC,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;gBAAE,OAAO;YACzC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,yCAAyC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAsB,EAAE,OAAqC;QACtF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3F,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,WAAW,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAA4B;YAChE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAuC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,UAAU,CAAC,UAAsB,EAAE,KAAa;QACtD,8DAA8D;QAC9D,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC5B,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;QACzB,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC,eAAe,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,MAAM,IAAI,GAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACvF,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;YAC5B,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU;YACxC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS;YACtC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC,CAAC;QACJ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO;QACxE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/services/mcp/mcp-oauth-login.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The interactive half of MCP OAuth: bind a loopback redirect, drive the SDK's
+ * `auth()` through both legs, and persist the result via {@linkcode McpOAuthProvider}.
+ *
+ * This module owns the *mechanics* of a login, never the *policy* of when one
+ * may start. Plan decision D1 (2026-09-18) puts the trigger behind an explicit
+ * `/mcp-login <server>`: nothing here runs on its own, so a server returning 401
+ * mid-session can never pop a browser window. The connection manager only ever
+ * refreshes silently (see {@linkcode McpInteractiveLoginRequiredError}).
+ *
+ * Redirect ports follow D3: an ephemeral port first (RFC 8252), falling back to
+ * the server's configured `redirectPorts` for authorization servers that match
+ * the redirect against a registered allow-list.
+ */
+import { auth as sdkAuth } from '@modelcontextprotocol/client';
+import { McpOAuthProvider } from './mcp-oauth-provider.js';
+import { McpOAuthStore } from './mcp-oauth-store.js';
+/**
+ * Thrown by a refresh-only provider when the SDK concludes the user must visit
+ * an authorization server. The connection manager turns this into the
+ * `needs-auth` state rather than a browser window.
+ */
+export declare class McpInteractiveLoginRequiredError extends Error {
+    readonly serverName: string;
+    constructor(serverName: string);
+}
+/** The exact text a user acts on when a server is waiting for a login. */
+export declare const mcpNeedsAuthMessage: (serverName: string) => string;
+export interface McpOAuthLoginOptions {
+    /** Config key of the server, used only in user-facing text. */
+    serverName: string;
+    /** The MCP server URL; the credential storage key. */
+    serverUrl: string;
+    store: McpOAuthStore;
+    /** CIMD document URL, when the server config names one. Skips DCR. */
+    clientMetadataUrl?: string;
+    /** Pre-registered client id, for servers offering neither DCR nor CIMD. */
+    clientId?: string;
+    /**
+     * Registered redirect ports to fall back to when the ephemeral port is not
+     * acceptable to the authorization server (D3). Tried in order after port 0.
+     */
+    redirectPorts?: readonly number[];
+    signal?: AbortSignal;
+    /** Receives the authorization URL so the caller can show it (headless hosts). */
+    onAuthorizationUrl?: (url: string) => void;
+    /** Injectable for tests; defaults to really launching a browser. */
+    openBrowser?: (url: string) => void;
+    /** Injectable for tests; defaults to the SDK's `auth()`. */
+    auth?: typeof sdkAuth;
+}
+export interface McpOAuthLoginResult {
+    /** True when a browser round trip happened; false when a refresh sufficed. */
+    readonly interactive: boolean;
+    /** The issuer the credential was filed under, when the SDK reported one. */
+    readonly issuer?: string;
+}
+/**
+ * Runs a full OAuth login for one MCP server and stores the tokens.
+ *
+ * Resolves without opening a browser when the stored refresh token still works,
+ * so re-running `/mcp-login` on a healthy server is cheap and safe.
+ */
+export declare function runMcpOAuthLogin(options: McpOAuthLoginOptions): Promise<McpOAuthLoginResult>;
+/**
+ * A provider that persists and refreshes but refuses to send the user anywhere.
+ *
+ * Handed to HTTP transports so an expired access token is renewed silently
+ * mid-session, while a genuinely unauthenticated server surfaces as `needs-auth`
+ * instead of hijacking the terminal with a browser launch.
+ */
+export declare function createRefreshOnlyProvider(options: {
+    serverName: string;
+    serverUrl: string;
+    store: McpOAuthStore;
+    clientMetadataUrl?: string;
+    clientId?: string;
+}): McpOAuthProvider;
+//# sourceMappingURL=mcp-oauth-login.d.ts.map

package/dist/services/mcp/mcp-oauth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-login.d.ts","sourceRoot":"","sources":["../../../source/services/mcp/mcp-oauth-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,IAAI,IAAI,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAQhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD;;;;GAIG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAvC,YAAqB,UAAU,EAAE,MAAM,EAGtC;CACF;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,eAAgB,MAAM,KAAG,MAAwD,CAAC;AAElH,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,oEAAoE;IACpE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+DlG;AAOD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,gBAAgB,CAanB"}