@raybase/core 0.0.2 → 0.3.3

package/dist/agent-remote-mcp-credentials.js

@@ -0,0 +1,287 @@
+import { decryptRemoteMcpEnvelope, encryptRemoteMcpEnvelope, randomRemoteMcpSecret, remoteMcpHash, RemoteMcpCredentialError, RemoteMcpSecret, validateRemoteMcpKey } from "./agent-remote-mcp-crypto.js";
+import { id, integer, longText, raybaseSystemTable, text } from "./schema.js";
+import { nowIso, q, randomId } from "./sql.js";
+export const remoteMcpCredentialsTable = "_agent_remote_mcp_credentials";
+export const remoteMcpOauthPendingTable = "_agent_remote_mcp_oauth_pending";
+export const remoteMcpCredentialUploadsTable = "_agent_remote_mcp_credential_uploads";
+export const remoteMcpCredentialSystemTables = [
+    raybaseSystemTable(remoteMcpCredentialsTable, {
+        id: id(), serverName: text({ required: true }), kind: text({ required: true }), state: text({ required: true }),
+        envelopeJson: longText(), revision: integer({ required: true }), generation: integer({ required: true }),
+        refreshLeaseOwner: text(), refreshLeaseExpiresAt: text(), expiresAt: text(), scopesJson: longText(), subject: text(),
+        scheme: text({ required: true }), createdBy: text({ required: true }), createdAt: text({ required: true }), updatedAt: text({ required: true })
+    }, { indexes: [{ columns: ["serverName"], unique: true }, ["state", "updatedAt"]], operatorVisible: false }),
+    raybaseSystemTable(remoteMcpOauthPendingTable, {
+        id: id(), stateHash: text({ required: true }), serverName: text({ required: true }), generation: integer({ required: true }),
+        envelopeJson: longText({ required: true }), expiresAt: text({ required: true }), claimedAt: text(), consumedAt: text(),
+        createdBy: text({ required: true }), createdAt: text({ required: true }), updatedAt: text({ required: true })
+    }, { indexes: [{ columns: ["stateHash"], unique: true }, ["serverName", "expiresAt"], ["expiresAt"]], operatorVisible: false }),
+    raybaseSystemTable(remoteMcpCredentialUploadsTable, {
+        id: id(), ticketHash: text({ required: true }), serverName: text({ required: true }), scheme: text({ required: true }),
+        createdBy: text({ required: true }), expiresAt: text({ required: true }), consumedAt: text(), createdAt: text({ required: true })
+    }, { indexes: [{ columns: ["ticketHash"], unique: true }, ["serverName", "expiresAt"], ["expiresAt"]], operatorVisible: false })
+];
+export function remoteMcpKeyFromEnv(env) {
+    const value = env && typeof env === "object" ? env.RAYBASE_REMOTE_MCP_KEY : undefined;
+    if (typeof value !== "string")
+        throw new RemoteMcpCredentialError("RAYBASE_REMOTE_MCP_KEY is not configured");
+    validateRemoteMcpKey(value);
+    return value;
+}
+export class RemoteMcpCredentialStore {
+    control;
+    key;
+    constructor(control, key) {
+        this.control = control;
+        this.key = key;
+    }
+    async status(serverName) {
+        const row = await this.row(serverName);
+        return row ? safeStatus(row) : null;
+    }
+    async listStatuses() {
+        const rows = await this.control.all(`SELECT * FROM ${q(remoteMcpCredentialsTable)} ORDER BY "serverName"`);
+        return rows.map(safeStatus);
+    }
+    async setStatic(input) {
+        const token = new RemoteMcpSecret(input.token);
+        return this.writeCredential(input.serverName, { kind: "static", token: token.reveal() }, {
+            kind: "static", scheme: input.scheme ?? "bearer", actor: input.actor, advanceGeneration: true, expectedRevision: input.expectedRevision
+        });
+    }
+    async writeOAuth(input) {
+        new RemoteMcpSecret(input.tokens.accessToken);
+        if (input.tokens.refreshToken)
+            new RemoteMcpSecret(input.tokens.refreshToken);
+        if (input.tokens.clientSecret)
+            new RemoteMcpSecret(input.tokens.clientSecret);
+        return this.writeCredential(input.serverName, { kind: "oauth", ...input.tokens }, {
+            kind: "oauth", scheme: "bearer", actor: input.actor, advanceGeneration: input.refresh !== true,
+            expectedRevision: input.expectedRevision, expiresAt: input.tokens.expiresAt ?? null,
+            scopes: input.tokens.scopes ?? [], subject: input.tokens.subject ?? null
+        });
+    }
+    async clear(serverName, actor) {
+        const current = await this.row(serverName);
+        const now = nowIso();
+        if (!current) {
+            await this.control.run(`INSERT INTO ${q(remoteMcpCredentialsTable)} ("id","serverName","kind","state","envelopeJson","revision","generation","scheme","createdBy","createdAt","updatedAt") VALUES (?,?,?,?,?,?,?,?,?,?,?)`, [randomId("mcp_cred"), serverName, "static", "cleared", null, 1, 1, "bearer", actor, now, now]);
+        }
+        else {
+            await this.control.run(`UPDATE ${q(remoteMcpCredentialsTable)} SET "state"='cleared',"envelopeJson"=NULL,"revision"=?,"generation"=?,"refreshLeaseOwner"=NULL,"refreshLeaseExpiresAt"=NULL,"expiresAt"=NULL,"scopesJson"=NULL,"subject"=NULL,"updatedAt"=? WHERE "serverName"=? AND "revision"=?`, [Number(current.revision) + 1, Number(current.generation) + 1, now, serverName, current.revision]);
+        }
+        const committed = await this.row(serverName);
+        const expectedRevision = Number(current?.revision ?? 0) + 1;
+        const expectedGeneration = Number(current?.generation ?? 0) + 1;
+        if (!committed || committed.state !== "cleared" || Number(committed.revision) !== expectedRevision || Number(committed.generation) !== expectedGeneration) {
+            throw new RemoteMcpCredentialError("Remote MCP credential compare-and-swap failed");
+        }
+        return safeStatus(committed);
+    }
+    async markReauthRequired(serverName, actor = "runtime", expectedRevision) {
+        const current = await this.readPayload(serverName);
+        if (!current || current.payload.kind !== "oauth")
+            throw new RemoteMcpCredentialError("Remote MCP OAuth credential is not connected");
+        if (expectedRevision !== undefined && current.status.revision !== expectedRevision) {
+            throw new RemoteMcpCredentialError("Remote MCP credential revision changed");
+        }
+        const nextGeneration = current.status.generation + 1;
+        const nextRevision = current.status.revision + 1;
+        const reusable = {
+            kind: "oauth", clientId: current.payload.clientId,
+            ...(current.payload.clientSecret ? { clientSecret: current.payload.clientSecret } : {}),
+            tokenEndpoint: current.payload.tokenEndpoint, issuer: current.payload.issuer, resource: current.payload.resource,
+            authMethod: current.payload.authMethod
+        };
+        const envelope = await encryptRemoteMcpEnvelope(this.key, { purpose: "credential", serverName, generation: nextGeneration }, reusable);
+        const now = nowIso();
+        await this.control.run(`UPDATE ${q(remoteMcpCredentialsTable)} SET "state"='reauth_required',"envelopeJson"=?,"revision"=?,"generation"=?,"refreshLeaseOwner"=NULL,"refreshLeaseExpiresAt"=NULL,"expiresAt"=NULL,"scopesJson"=NULL,"subject"=NULL,"updatedAt"=? WHERE "serverName"=? AND "revision"=?`, [JSON.stringify(envelope), nextRevision, nextGeneration, now, serverName, current.status.revision]);
+        const committed = await this.row(serverName);
+        if (!committed || committed.state !== "reauth_required" || Number(committed.revision) !== nextRevision || Number(committed.generation) !== nextGeneration) {
+            throw new RemoteMcpCredentialError("Remote MCP credential compare-and-swap failed");
+        }
+        return safeStatus(committed);
+    }
+    async resolveAuthorization(serverName) {
+        const value = await this.readPayload(serverName);
+        if (!value || value.status.state === "cleared")
+            throw new RemoteMcpCredentialError("Remote MCP credential is not configured");
+        if (value.status.state === "reauth_required")
+            throw new RemoteMcpCredentialError("Remote MCP credential needs reconnection");
+        const token = value.payload.kind === "static" ? value.payload.token : value.payload.accessToken;
+        if (!token)
+            throw new RemoteMcpCredentialError("Remote MCP credential needs reconnection");
+        const header = value.status.scheme === "raw" ? token : `Bearer ${token}`;
+        return { header: new RemoteMcpSecret(header), kind: value.status.kind, revision: value.status.revision, generation: value.status.generation, expiresAt: value.status.expiresAt };
+    }
+    async readOAuth(serverName) {
+        const value = await this.readPayload(serverName);
+        if (!value || value.payload.kind !== "oauth" || !value.payload.accessToken)
+            return null;
+        const { kind: _kind, ...tokens } = value.payload;
+        return { tokens: { ...tokens, accessToken: value.payload.accessToken }, status: value.status };
+    }
+    async acquireRefreshLease(serverName, revision, owner, leaseMs = 15_000) {
+        const now = nowIso();
+        const expires = new Date(Date.now() + leaseMs).toISOString();
+        await this.control.run(`UPDATE ${q(remoteMcpCredentialsTable)} SET "refreshLeaseOwner"=?,"refreshLeaseExpiresAt"=?,"updatedAt"=? WHERE "serverName"=? AND "revision"=? AND ("refreshLeaseOwner" IS NULL OR "refreshLeaseExpiresAt" IS NULL OR "refreshLeaseExpiresAt"<=?)`, [owner, expires, now, serverName, revision, now]);
+        const row = await this.row(serverName);
+        return row?.refreshLeaseOwner === owner && Number(row.revision) === revision;
+    }
+    async releaseRefreshLease(serverName, revision, owner) {
+        await this.control.run(`UPDATE ${q(remoteMcpCredentialsTable)} SET "refreshLeaseOwner"=NULL,"refreshLeaseExpiresAt"=NULL,"updatedAt"=? WHERE "serverName"=? AND "revision"=? AND "refreshLeaseOwner"=?`, [nowIso(), serverName, revision, owner]);
+    }
+    async waitForRevisionChange(serverName, revision, attempts = 30, intervalMs = 50) {
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            const status = await this.status(serverName);
+            if (!status || status.revision !== revision)
+                return status;
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        }
+        return this.status(serverName);
+    }
+    async createPendingOAuth(input) {
+        const state = randomRemoteMcpSecret(32);
+        const stateHash = await remoteMcpHash(state);
+        const expiresAt = new Date(Date.now() + Math.min(Math.max(input.ttlMs ?? 10 * 60_000, 60_000), 30 * 60_000)).toISOString();
+        const envelope = await encryptRemoteMcpEnvelope(this.key, { purpose: "oauth-pending", serverName: input.serverName, stateHash }, input.pending);
+        const now = nowIso();
+        await this.control.run(`INSERT INTO ${q(remoteMcpOauthPendingTable)} ("id","stateHash","serverName","generation","envelopeJson","expiresAt","createdBy","createdAt","updatedAt") VALUES (?,?,?,?,?,?,?,?,?)`, [randomId("mcp_oauth"), stateHash, input.serverName, input.generation, JSON.stringify(envelope), expiresAt, input.actor, now, now]);
+        return { state, expiresAt };
+    }
+    async consumePendingOAuth(state) {
+        const stateHash = await remoteMcpHash(state);
+        const row = await this.control.first(`SELECT * FROM ${q(remoteMcpOauthPendingTable)} WHERE "stateHash"=?`, [stateHash]);
+        const now = nowIso();
+        const claimMarker = `${now}:${randomId("mcp_state_claim")}`;
+        if (!row || row.consumedAt || row.claimedAt || row.expiresAt <= now)
+            throw new RemoteMcpCredentialError("Remote MCP OAuth state is invalid, expired, or already used");
+        await this.control.run(`UPDATE ${q(remoteMcpOauthPendingTable)} SET "claimedAt"=?,"consumedAt"=?,"updatedAt"=? WHERE "stateHash"=? AND "claimedAt" IS NULL AND "consumedAt" IS NULL AND "expiresAt">?`, [claimMarker, now, now, stateHash, now]);
+        const claimed = await this.control.first(`SELECT * FROM ${q(remoteMcpOauthPendingTable)} WHERE "stateHash"=?`, [stateHash]);
+        if (!claimed || claimed.claimedAt !== claimMarker || claimed.consumedAt !== now)
+            throw new RemoteMcpCredentialError("Remote MCP OAuth state is invalid, expired, or already used");
+        const pending = await decryptRemoteMcpEnvelope(this.key, { purpose: "oauth-pending", serverName: row.serverName, stateHash }, JSON.parse(row.envelopeJson));
+        return { serverName: row.serverName, generation: Number(row.generation), pending };
+    }
+    async issueUploadTicket(input) {
+        const ticket = randomRemoteMcpSecret(32);
+        const ticketHash = await remoteMcpHash(ticket);
+        const expiresAt = new Date(Date.now() + Math.min(Math.max(input.ttlMs ?? 5 * 60_000, 30_000), 15 * 60_000)).toISOString();
+        await this.control.run(`INSERT INTO ${q(remoteMcpCredentialUploadsTable)} ("id","ticketHash","serverName","scheme","createdBy","expiresAt","createdAt") VALUES (?,?,?,?,?,?,?)`, [randomId("mcp_upload"), ticketHash, input.serverName, input.scheme, input.actor, expiresAt, nowIso()]);
+        return { ticket, expiresAt };
+    }
+    async redeemUploadTicket(input) {
+        const ticketHash = await remoteMcpHash(input.ticket);
+        const now = nowIso();
+        const consumeMarker = `${now}:${randomId("mcp_ticket_claim")}`;
+        const row = await this.control.first(`SELECT "serverName","scheme","expiresAt","consumedAt" FROM ${q(remoteMcpCredentialUploadsTable)} WHERE "ticketHash"=?`, [ticketHash]);
+        if (!row || row.consumedAt || row.expiresAt <= now)
+            throw new RemoteMcpCredentialError("Remote MCP credential upload ticket is invalid, expired, or already used");
+        await this.control.run(`UPDATE ${q(remoteMcpCredentialUploadsTable)} SET "consumedAt"=? WHERE "ticketHash"=? AND "consumedAt" IS NULL AND "expiresAt">?`, [consumeMarker, ticketHash, now]);
+        const consumed = await this.control.first(`SELECT "consumedAt" FROM ${q(remoteMcpCredentialUploadsTable)} WHERE "ticketHash"=?`, [ticketHash]);
+        if (consumed?.consumedAt !== consumeMarker)
+            throw new RemoteMcpCredentialError("Remote MCP credential upload ticket is invalid, expired, or already used");
+        return this.setStatic({ serverName: row.serverName, token: input.token, scheme: row.scheme === "raw" ? "raw" : "bearer", actor: input.actor });
+    }
+    async pruneExpired() {
+        const now = nowIso();
+        await this.control.run(`DELETE FROM ${q(remoteMcpOauthPendingTable)} WHERE "expiresAt"<=?`, [now]);
+        await this.control.run(`DELETE FROM ${q(remoteMcpCredentialUploadsTable)} WHERE "expiresAt"<=?`, [now]);
+    }
+    async readPayload(serverName) {
+        const row = await this.row(serverName);
+        if (!row || !row.envelopeJson)
+            return null;
+        const payload = await decryptRemoteMcpEnvelope(this.key, { purpose: "credential", serverName, generation: Number(row.generation) }, JSON.parse(row.envelopeJson));
+        return { payload, status: safeStatus(row) };
+    }
+    async writeCredential(serverName, payload, meta) {
+        const current = await this.row(serverName);
+        const currentRevision = Number(current?.revision ?? 0);
+        if (meta.expectedRevision !== undefined && meta.expectedRevision !== currentRevision)
+            throw new RemoteMcpCredentialError("Remote MCP credential revision changed");
+        const revision = currentRevision + 1;
+        const generation = Number(current?.generation ?? 0) + (meta.advanceGeneration || !current ? 1 : 0);
+        const envelope = await encryptRemoteMcpEnvelope(this.key, { purpose: "credential", serverName, generation }, payload);
+        const envelopeJson = JSON.stringify(envelope);
+        const now = nowIso();
+        if (current) {
+            await this.control.run(`UPDATE ${q(remoteMcpCredentialsTable)} SET "kind"=?,"state"='ready',"envelopeJson"=?,"revision"=?,"generation"=?,"refreshLeaseOwner"=NULL,"refreshLeaseExpiresAt"=NULL,"expiresAt"=?,"scopesJson"=?,"subject"=?,"scheme"=?,"updatedAt"=? WHERE "serverName"=? AND "revision"=?`, [meta.kind, envelopeJson, revision, generation, meta.expiresAt ?? null, JSON.stringify(meta.scopes ?? []), meta.subject ?? null, meta.scheme, now, serverName, current.revision]);
+        }
+        else {
+            await this.control.run(`INSERT INTO ${q(remoteMcpCredentialsTable)} ("id","serverName","kind","state","envelopeJson","revision","generation","expiresAt","scopesJson","subject","scheme","createdBy","createdAt","updatedAt") VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`, [randomId("mcp_cred"), serverName, meta.kind, "ready", envelopeJson, revision, generation, meta.expiresAt ?? null, JSON.stringify(meta.scopes ?? []), meta.subject ?? null, meta.scheme, meta.actor, now, now]);
+        }
+        const committed = await this.row(serverName);
+        if (!committed || committed.envelopeJson !== envelopeJson || Number(committed.revision) !== revision || Number(committed.generation) !== generation) {
+            throw new RemoteMcpCredentialError("Remote MCP credential compare-and-swap failed");
+        }
+        return safeStatus(committed);
+    }
+    row(serverName) {
+        return this.control.first(`SELECT * FROM ${q(remoteMcpCredentialsTable)} WHERE "serverName"=? LIMIT 1`, [serverName]);
+    }
+}
+export async function remoteMcpCredentialStatus(control, serverName) {
+    const row = await control.first(`SELECT * FROM ${q(remoteMcpCredentialsTable)} WHERE "serverName"=? LIMIT 1`, [serverName]);
+    return row ? safeStatus(row) : null;
+}
+export async function listRemoteMcpCredentialStatuses(control) {
+    return (await control.all(`SELECT * FROM ${q(remoteMcpCredentialsTable)} ORDER BY "serverName"`)).map(safeStatus);
+}
+/** Owner-action service: every read is safe and every mutation is actor-stamped. */
+export function createRemoteMcpCredentialService(input) {
+    const store = () => new RemoteMcpCredentialStore(input.control, remoteMcpKeyFromEnv(input.env));
+    return {
+        status: (serverName) => remoteMcpCredentialStatus(input.control, serverName),
+        listStatuses: () => listRemoteMcpCredentialStatuses(input.control),
+        setStatic: (serverName, token, scheme = "bearer") => store().setStatic({ serverName, token, scheme, actor: input.actor }),
+        clear: (serverName) => store().clear(serverName, input.actor),
+        disconnectOAuth: (serverName) => store().clear(serverName, input.actor),
+        beginConnect: async (serverName, discovery, client) => {
+            const { beginRemoteMcpOAuthConnect } = await import("./agent-remote-mcp-oauth.js");
+            return beginRemoteMcpOAuthConnect({
+                control: input.control,
+                key: remoteMcpKeyFromEnv(input.env),
+                serverName,
+                discovery,
+                client,
+                actor: input.actor,
+                fetcher: input.fetcher
+            });
+        },
+        rediscover: async (name, confirm = false) => {
+            const { rediscoverRemoteMcpServer } = await import("./agent-remote-mcp-install.js");
+            return rediscoverRemoteMcpServer({
+                control: input.control,
+                name,
+                confirm,
+                actor: input.actor,
+                env: input.env,
+                fetcher: input.fetcher
+            });
+        }
+    };
+}
+function safeStatus(row) {
+    return {
+        serverName: row.serverName,
+        kind: row.kind === "oauth" ? "oauth" : "static",
+        state: row.state === "reauth_required" ? "reauth_required" : row.state === "cleared" ? "cleared" : "ready",
+        scheme: row.scheme === "raw" ? "raw" : "bearer",
+        revision: Number(row.revision), generation: Number(row.generation), expiresAt: row.expiresAt ?? null,
+        scopes: parseStringArray(row.scopesJson), subject: row.subject ?? null,
+        createdBy: row.createdBy, createdAt: row.createdAt, updatedAt: row.updatedAt
+    };
+}
+function parseStringArray(value) {
+    if (!value)
+        return [];
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=agent-remote-mcp-credentials.js.map

package/dist/agent-remote-mcp-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-remote-mcp-credentials.js","sourceRoot":"","sources":["../src/agent-remote-mcp-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,oBAAoB,EAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAA2B,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,sCAAsC,CAAC;AAEtF,MAAM,CAAC,MAAM,+BAA+B,GAAyB;IACnE,kBAAkB,CAAC,yBAAyB,EAAE;QAC5C,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/G,YAAY,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACxG,iBAAiB,EAAE,IAAI,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACpH,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAChJ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC5G,kBAAkB,CAAC,0BAA0B,EAAE;QAC7C,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5H,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QACtH,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAC9G,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC/H,kBAAkB,CAAC,+BAA+B,EAAE;QAClD,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtH,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAClI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;CACjI,CAAC;AA+DF,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA+B,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnH,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,wBAAwB,CAAC,0CAA0C,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,wBAAwB;IACN;IAAuC;IAApE,YAA6B,OAAoB,EAAmB,GAAW;QAAlD,YAAO,GAAP,OAAO,CAAa;QAAmB,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEnF,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAgB,iBAAiB,CAAC,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA0H;QACxI,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE;YACvF,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACxI,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAwH;QACvI,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE;YAChF,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;YAC9F,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI;YACnF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI;SACzE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,KAAa;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,eAAe,CAAC,CAAC,yBAAyB,CAAC,wJAAwJ,EACnM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC/F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,yBAAyB,CAAC,oOAAoO,EAC1Q,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,gBAAgB,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC1J,MAAM,IAAI,wBAAwB,CAAC,+CAA+C,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB,EAAE,KAAK,GAAG,SAAS,EAAE,gBAAyB;QACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,wBAAwB,CAAC,8CAA8C,CAAC,CAAC;QACrI,IAAI,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YACnF,MAAM,IAAI,wBAAwB,CAAC,wCAAwC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAkB;YAC9B,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YACjD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAChH,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;SACvC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvI,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,yBAAyB,CAAC,yOAAyO,EAC/Q,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnG,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,iBAAiB,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,cAAc,EAAE,CAAC;YAC1J,MAAM,IAAI,wBAAwB,CAAC,+CAA+C,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,wBAAwB,CAAC,yCAAyC,CAAC,CAAC;QAC9H,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,iBAAiB;YAAE,MAAM,IAAI,wBAAwB,CAAC,0CAA0C,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAChG,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,wBAAwB,CAAC,0CAA0C,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACnL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACxF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAO,GAAG,MAAM;QAC7F,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,yBAAyB,CAAC,6MAA6M,EACnP,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,GAAG,EAAE,iBAAiB,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,QAAgB,EAAE,KAAa;QAC3E,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,yBAAyB,CAAC,0IAA0I,EAChL,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,UAAkB,EAAE,QAAgB,EAAE,QAAQ,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE;QAC9F,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC3D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAgH;QACvI,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3H,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChJ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,eAAe,CAAC,CAAC,0BAA0B,CAAC,yIAAyI,EACrL,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACnI,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAa,iBAAiB,CAAC,CAAC,0BAA0B,CAAC,sBAAsB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACpI,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;YAAE,MAAM,IAAI,wBAAwB,CAAC,6DAA6D,CAAC,CAAC;QACvK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,0BAA0B,CAAC,wIAAwI,EAC/K,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CACxC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAa,iBAAiB,CAAC,CAAC,0BAA0B,CAAC,sBAAsB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG;YAAE,MAAM,IAAI,wBAAwB,CAAC,6DAA6D,CAAC,CAAC;QACnL,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAwB,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAA+B,CAAC,CAAC;QACjN,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA+F;QACrH,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1H,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,eAAe,CAAC,CAAC,+BAA+B,CAAC,uGAAuG,EACxJ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CACvG,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAuD;QAC9E,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAClC,8DAA8D,CAAC,CAAC,+BAA+B,CAAC,uBAAuB,EAAE,CAAC,UAAU,CAAC,CACtI,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;YAAE,MAAM,IAAI,wBAAwB,CAAC,0EAA0E,CAAC,CAAC;QACnK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,+BAA+B,CAAC,qFAAqF,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,CACpK,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAgC,4BAA4B,CAAC,CAAC,+BAA+B,CAAC,uBAAuB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9K,IAAI,QAAQ,EAAE,UAAU,KAAK,aAAa;YAAE,MAAM,IAAI,wBAAwB,CAAC,0EAA0E,CAAC,CAAC;QAC3J,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACjJ,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,0BAA0B,CAAC,uBAAuB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,+BAA+B,CAAC,uBAAuB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,UAAkB;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAA+B,CAChJ,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,UAAkB,EAClB,OAAsB,EACtB,IAAuN;QAEvN,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,eAAe;YAAE,MAAM,IAAI,wBAAwB,CAAC,wCAAwC,CAAC,CAAC;QACnK,MAAM,QAAQ,GAAG,eAAe,GAAG,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACtH,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,CAAC,yBAAyB,CAAC,0OAA0O,EAChR,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CACjL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,eAAe,CAAC,CAAC,yBAAyB,CAAC,iMAAiM,EAC5O,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC/M,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YACpJ,MAAM,IAAI,wBAAwB,CAAC,+CAA+C,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAEO,GAAG,CAAC,UAAkB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAgB,iBAAiB,CAAC,CAAC,yBAAyB,CAAC,+BAA+B,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACvI,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAoB,EAAE,UAAkB;IACtF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAgB,iBAAiB,CAAC,CAAC,yBAAyB,CAAC,+BAA+B,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAAoB;IACxE,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAgB,iBAAiB,CAAC,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gCAAgC,CAAC,KAAoF;IACnI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,OAAO;QACL,MAAM,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;QACpF,YAAY,EAAE,GAAG,EAAE,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC;QAClE,SAAS,EAAE,CAAC,UAAkB,EAAE,KAAa,EAAE,SAAoC,QAAQ,EAAE,EAAE,CAC7F,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtE,KAAK,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC;QACrE,eAAe,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC;QAC/E,YAAY,EAAE,KAAK,EAAE,UAAkB,EAAE,SAAkC,EAAE,MAAiC,EAAE,EAAE;YAChH,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACnF,OAAO,0BAA0B,CAAC;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnC,UAAU;gBACV,SAAS;gBACT,MAAM;gBACN,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,IAAY,EAAE,OAAO,GAAG,KAAK,EAAE,EAAE;YAClD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YACpF,OAAO,yBAAyB,CAAC;gBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAkB;IACpC,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAC/C,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QAC1G,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QAC/C,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QACpG,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QACtE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;KAC7E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC"}

package/dist/agent-remote-mcp-crypto.d.ts

@@ -0,0 +1,32 @@
+export type RemoteMcpEncryptedEnvelope = {
+    version: 1;
+    keyVersion: 1;
+    nonce: string;
+    ciphertext: string;
+};
+export type RemoteMcpEnvelopeScope = {
+    purpose: "credential";
+    serverName: string;
+    generation: number;
+} | {
+    purpose: "oauth-pending";
+    serverName: string;
+    stateHash: string;
+};
+export declare class RemoteMcpCredentialError extends Error {
+    constructor(message: string);
+}
+/** A deliberately unhelpful JSON/string projection for ephemeral secrets. */
+export declare class RemoteMcpSecret {
+    #private;
+    constructor(value: string);
+    reveal(): string;
+    toString(): string;
+    toJSON(): string;
+}
+export declare function validateRemoteMcpKey(secret: string | undefined): Uint8Array;
+export declare function encryptRemoteMcpEnvelope(secret: string, scope: RemoteMcpEnvelopeScope, value: unknown): Promise<RemoteMcpEncryptedEnvelope>;
+export declare function decryptRemoteMcpEnvelope<T>(secret: string, scope: RemoteMcpEnvelopeScope, envelope: RemoteMcpEncryptedEnvelope): Promise<T>;
+export declare function remoteMcpHash(value: string): Promise<string>;
+export declare function randomRemoteMcpSecret(bytes?: number): string;
+//# sourceMappingURL=agent-remote-mcp-crypto.d.ts.map

package/dist/agent-remote-mcp-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-remote-mcp-crypto.d.ts","sourceRoot":"","sources":["../src/agent-remote-mcp-crypto.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,CAAC,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAKxE,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,qBAAa,eAAe;;gBAGd,KAAK,EAAE,MAAM;IAKzB,MAAM,IAAI,MAAM;IAChB,QAAQ,IAAI,MAAM;IAClB,MAAM,IAAI,MAAM;CACjB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAoB3E;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,sBAAsB,EAC7B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,0BAA0B,CAAC,CAQrC;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,sBAAsB,EAC7B,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,SAAK,GAAG,MAAM,CAExD"}

package/dist/agent-remote-mcp-crypto.js

@@ -0,0 +1,101 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+export class RemoteMcpCredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RemoteMcpCredentialError";
+    }
+}
+/** A deliberately unhelpful JSON/string projection for ephemeral secrets. */
+export class RemoteMcpSecret {
+    #value;
+    constructor(value) {
+        if (!value.trim())
+            throw new RemoteMcpCredentialError("Remote MCP credential value is empty");
+        this.#value = value.trim();
+    }
+    reveal() { return this.#value; }
+    toString() { return "[REDACTED]"; }
+    toJSON() { return "[REDACTED]"; }
+}
+export function validateRemoteMcpKey(secret) {
+    if (!secret?.trim())
+        throw new RemoteMcpCredentialError("RAYBASE_REMOTE_MCP_KEY is not configured");
+    const normalized = secret.trim().replace(/-/g, "+").replace(/_/g, "/");
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) {
+        throw new RemoteMcpCredentialError("RAYBASE_REMOTE_MCP_KEY must be base64 or base64url encoded");
+    }
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+    let bytes;
+    try {
+        bytes = Uint8Array.from(atob(padded), (value) => value.charCodeAt(0));
+    }
+    catch {
+        throw new RemoteMcpCredentialError("RAYBASE_REMOTE_MCP_KEY is not valid base64");
+    }
+    if (bytes.byteLength < 32) {
+        throw new RemoteMcpCredentialError("RAYBASE_REMOTE_MCP_KEY must contain at least 256 bits of random key material");
+    }
+    if (new Set(bytes).size < 16) {
+        throw new RemoteMcpCredentialError("RAYBASE_REMOTE_MCP_KEY does not contain enough entropy");
+    }
+    return bytes;
+}
+export async function encryptRemoteMcpEnvelope(secret, scope, value) {
+    const nonce = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: bufferSource(nonce), additionalData: bufferSource(aad(scope)) }, await deriveKey(validateRemoteMcpKey(secret)), bufferSource(encoder.encode(JSON.stringify(value))));
+    return { version: 1, keyVersion: 1, nonce: base64Url(nonce), ciphertext: base64Url(new Uint8Array(ciphertext)) };
+}
+export async function decryptRemoteMcpEnvelope(secret, scope, envelope) {
+    if (envelope.version !== 1 || envelope.keyVersion !== 1) {
+        throw new RemoteMcpCredentialError("Unsupported remote MCP credential envelope version");
+    }
+    try {
+        const plaintext = await crypto.subtle.decrypt({
+            name: "AES-GCM",
+            iv: bufferSource(fromBase64Url(envelope.nonce)),
+            additionalData: bufferSource(aad(scope))
+        }, await deriveKey(validateRemoteMcpKey(secret)), bufferSource(fromBase64Url(envelope.ciphertext)));
+        return JSON.parse(decoder.decode(plaintext));
+    }
+    catch (error) {
+        if (error instanceof RemoteMcpCredentialError && error.message.startsWith("RAYBASE_REMOTE_MCP_KEY"))
+            throw error;
+        throw new RemoteMcpCredentialError("Remote MCP credential could not be decrypted for this server");
+    }
+}
+export async function remoteMcpHash(value) {
+    const digest = await crypto.subtle.digest("SHA-256", bufferSource(encoder.encode(value)));
+    return base64Url(new Uint8Array(digest));
+}
+export function randomRemoteMcpSecret(bytes = 32) {
+    return base64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function aad(scope) {
+    return encoder.encode(JSON.stringify({ subsystem: "raybase-remote-mcp", envelopeVersion: 1, ...scope }));
+}
+async function deriveKey(secret) {
+    const source = await crypto.subtle.importKey("raw", bufferSource(secret), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: bufferSource(encoder.encode("raybase/remote-mcp/aes-256-gcm/v1")),
+        info: bufferSource(encoder.encode("credential-envelope"))
+    }, source, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function fromBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error("invalid base64url");
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
+}
+function bufferSource(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+//# sourceMappingURL=agent-remote-mcp-crypto.js.map

package/dist/agent-remote-mcp-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-remote-mcp-crypto.js","sourceRoot":"","sources":["../src/agent-remote-mcp-crypto.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,eAAe;IACjB,MAAM,CAAS;IAExB,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,QAAQ,KAAa,OAAO,YAAY,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAa,OAAO,YAAY,CAAC,CAAC,CAAC;CAC1C;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,wBAAwB,CAAC,0CAA0C,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAAC,4DAA4D,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,wBAAwB,CAAC,8EAA8E,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAwB,CAAC,wDAAwD,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,KAA6B,EAC7B,KAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EACtF,MAAM,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAC7C,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,KAA6B,EAC7B,QAAoC;IAEpC,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,wBAAwB,CAAC,oDAAoD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/C,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACzC,EACD,MAAM,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAC7C,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACjD,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;YAAE,MAAM,KAAK,CAAC;QACjH,MAAM,IAAI,wBAAwB,CAAC,8DAA8D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAG,EAAE;IAC9C,OAAO,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,GAAG,CAAC,KAA6B;IACxC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAkB;IACzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACxG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACvE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;KAC1D,EACD,MAAM,EACN,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxG,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC"}