@raybase/core 0.0.2 → 0.3.4

package/dist/mcp.d.ts

@@ -0,0 +1,567 @@
+import { z } from "zod";
+import { type RaybaseActionDataClient } from "./data-client.js";
+import { type DoMigration, type SqlExecutor } from "./db.js";
+import { type JsonSchemaObject } from "./json-schema.js";
+import type { RaybaseNotificationsRuntime } from "./notifications.js";
+import type { RaybaseRuntimeScope } from "./platform.js";
+import type { RaybaseJobsRuntime } from "./jobs.js";
+import type { RaybaseUser } from "./policies.js";
+import { type RaybaseSearch } from "./search.js";
+import type { ResolvedRealtimeConfig, RealtimeSchemaSnapshot } from "./realtime.js";
+import { type RaybaseConfig, type RaybaseSchema, type RaybaseSystemTable } from "./schema.js";
+export declare const mcpAppsExtensionId = "io.modelcontextprotocol/ui";
+export declare const mcpAppResourceMimeType = "text/html;profile=mcp-app";
+export type RaybaseMcpAppVisibility = "model" | "app";
+export type RaybaseMcpAppToolMeta = {
+    resourceUri?: string;
+    visibility?: RaybaseMcpAppVisibility[];
+};
+export type RaybaseMcpAppResourceCsp = {
+    connectDomains?: string[];
+    resourceDomains?: string[];
+    frameDomains?: string[];
+    baseUriDomains?: string[];
+};
+export type RaybaseMcpAppResourcePermissions = {
+    camera?: Record<string, never>;
+    microphone?: Record<string, never>;
+    geolocation?: Record<string, never>;
+    clipboardWrite?: Record<string, never>;
+};
+export type RaybaseMcpAppResourceMeta = {
+    csp?: RaybaseMcpAppResourceCsp;
+    permissions?: RaybaseMcpAppResourcePermissions;
+    domain?: string;
+    prefersBorder?: boolean;
+};
+export type RaybaseMcpAppClientCapability = {
+    mimeTypes?: string[];
+    [key: string]: unknown;
+};
+/** A picture in a tool's answer: base64 bytes and their media type, for example "image/png". */
+export type RaybaseMcpImageContent = {
+    type: "image";
+    data: string;
+    mimeType: string;
+    _meta?: Record<string, unknown>;
+};
+export type RaybaseMcpToolResult = {
+    content?: Array<{
+        type: "text";
+        text: string;
+    } | RaybaseMcpImageContent | {
+        type: "resource";
+        resource: RaybaseMcpEmbeddedResource;
+    }>;
+    structuredContent?: unknown;
+    isError?: boolean;
+    _meta?: Record<string, unknown>;
+};
+export type RaybaseMcpActionToolDescriptor = {
+    name: string;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+    };
+    resource?: {
+        name: string;
+        operation?: "create" | "read" | "list" | "search" | "get" | "update" | "delete" | "mutate";
+        inputRefs?: Record<string, {
+            resource?: string;
+            kind: "internal-id" | "external-id" | "context";
+            required?: boolean;
+        }>;
+    };
+    requiredInputKeys?: string[];
+    hasOutputSchema?: boolean;
+};
+export type RaybaseMcpEmbeddedResource = {
+    uri: string;
+    mimeType?: string;
+    text?: string;
+    blob?: string;
+    _meta?: {
+        ui?: RaybaseMcpAppResourceMeta;
+        [key: string]: unknown;
+    };
+};
+export type RaybaseMcpContext = {
+    clientId: string;
+    clientName?: string;
+    grantId: string;
+    scopes: string[];
+    subject: string;
+    /** Host account the grant is bound to, for grants made through `mcp.hostApproval`. */
+    hostAccount?: string;
+    /**
+     * Organization this call is scoped to: the grant's bound organization, or
+     * the one a layered runtime selected for the request. Null in Core.
+     */
+    organizationId?: string | null;
+    auditMetadata: Record<string, unknown>;
+};
+export type RaybaseMcpToolContext<Env = unknown> = {
+    request: Request;
+    env: Env;
+    config: RaybaseConfig;
+    user: RaybaseUser;
+    principal: RaybaseUser;
+    db: RaybaseActionDataClient;
+    control: SqlExecutor;
+    notifications?: RaybaseNotificationsRuntime<Env>;
+    jobs?: RaybaseJobsRuntime;
+    mcp: RaybaseMcpContext;
+    audit: (action: string, metadata?: unknown) => Promise<void>;
+    /**
+     * Organization scope a layered runtime resolved for this operator call.
+     * Addresses agent conversation Durable Objects and refuses conversation
+     * rows stamped for a different organization; undefined keeps the
+     * environment-derived scope.
+     */
+    agentConversationScope?: RaybaseRuntimeScope | null;
+};
+export type RaybaseMcpTool<Args = unknown, Env = unknown> = {
+    name: string;
+    description: string;
+    inputSchema: z.ZodType<Args> | JsonSchemaObject;
+    annotations?: {
+        title?: string;
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+        openWorldHint?: boolean;
+    };
+    _meta?: {
+        ui?: RaybaseMcpAppToolMeta;
+        [key: string]: unknown;
+    };
+    raybase?: {
+        action?: RaybaseMcpActionToolDescriptor;
+        [key: string]: unknown;
+    };
+    scopes?: string[];
+    handler: (args: Args, ctx: RaybaseMcpToolContext<Env>) => Promise<RaybaseMcpToolResult>;
+};
+export type RaybaseMcpResource = {
+    uri: string;
+    name: string;
+    description?: string;
+    mimeType?: string;
+    scopes?: string[];
+    _meta?: {
+        ui?: RaybaseMcpAppResourceMeta;
+        [key: string]: unknown;
+    };
+    read: (ctx: RaybaseMcpToolContext) => Promise<RaybaseMcpEmbeddedResource>;
+};
+export type RaybaseGeneratedMcpToolsConfig = {
+    tables: Record<string, Array<"list" | "get" | "create" | "update" | "delete">>;
+};
+export type RaybaseMcpContextResolver<Env = unknown> = (ctx: {
+    request: Request;
+    env: Env;
+    token: RaybaseMcpAccessContext;
+}) => Promise<Partial<RaybaseMcpContext> | void>;
+export type RaybaseMcpOptions<Env = unknown> = {
+    config: RaybaseConfig;
+    schema: RaybaseSchema;
+    /** Manifest system tables; their secret() column names are kept out of tool-call audit records. */
+    systemTables?: readonly RaybaseSystemTable[];
+    surface?: "app" | "operator";
+    appMigrations?: DoMigration[];
+    search?: RaybaseSearch<Env>;
+    tools?: RaybaseMcpTool<unknown, Env>[];
+    resources?: RaybaseMcpResource[];
+    generatedTools?: RaybaseGeneratedMcpToolsConfig;
+    resolveContext?: RaybaseMcpContextResolver<Env>;
+    scopeOptions?: RaybaseMcpScopeOptions;
+    /**
+     * Lets a layered runtime validate tokens in its identity control plane.
+     * When present, the hook owns any control-plane schema initialization.
+     */
+    validateAccessToken?(input: {
+        request: Request;
+        env: Env;
+        surface: "app" | "operator";
+        expectedResource: string;
+    }): Promise<RaybaseMcpAccessContext | Response>;
+    /** Rebinds the runtime after token validation, for example to its tenant. */
+    resolveRuntimeEnv?(input: {
+        request: Request;
+        env: Env;
+        token: RaybaseMcpAccessContext;
+        surface: "app" | "operator";
+    }): Env | Promise<Env>;
+    /** Records grant usage in the control plane that owns the OAuth grant. */
+    recordEvent?(input: {
+        env: Env;
+        token: RaybaseMcpAccessContext;
+        action: string;
+        toolName?: string;
+        metadata?: unknown;
+    }): Promise<void>;
+    /** Persists Operator MCP evidence in the distribution's control plane. */
+    recordOperatorAudit?(input: {
+        env: Env;
+        token: RaybaseMcpAccessContext;
+        action: string;
+        targetType: string;
+        targetId?: string;
+        metadata?: unknown;
+    }): Promise<void>;
+    toolContext?: (ctx: {
+        request: Request;
+        env: Env;
+        user: RaybaseUser;
+        control: SqlExecutor;
+        mcp: RaybaseMcpContext;
+    }) => Partial<RaybaseMcpToolContext<Env>> | Promise<Partial<RaybaseMcpToolContext<Env>>>;
+    realtime?: {
+        config: ResolvedRealtimeConfig;
+        schema: RealtimeSchemaSnapshot;
+    };
+};
+/** Who a host-account grant acts as. `type` is stored as the grant's subjectType. */
+export type RaybaseMcpHostSubject = {
+    type: string;
+    id: string;
+    email: string;
+};
+/**
+ * The connect-and-approve flow for an app embedded in another platform's
+ * admin: an MCP client's authorization request becomes a pending
+ * authorization, the host's admin shows the app's approval page, the app
+ * (having verified the host's session itself) issues a single-use ticket with
+ * `createMcpApprovalTicket`, and redeeming it at `oauthCompletePath` makes a
+ * grant bound to one of the host's accounts.
+ */
+export type RaybaseMcpHostApprovalOptions<Env = unknown> = {
+    enabled?: boolean;
+    /**
+     * Where to send the person to approve: the app's approval page inside the
+     * host's admin for `hostAccount`, carrying `pendingAuthId`. `adminAuthPath`
+     * is the configured path of that page within the app.
+     */
+    approvalUrl(input: {
+        hostAccount: string;
+        pendingAuthId: string;
+        adminAuthPath: string;
+        env: Env;
+    }): string | URL;
+    /** Canonical form of a host account as typed or sent; throws when it is not one. */
+    normalizeHostAccount(input: string): string;
+    /** The identity a grant bound to `hostAccount` acts as. */
+    subject(hostAccount: string): RaybaseMcpHostSubject;
+    /**
+     * Request parameter that carries the host account: on the connect form, on
+     * the authorization request, and on MCP requests, where it must match the
+     * token's host account. Default "host_account".
+     */
+    hostAccountParam?: string;
+    /** Copy for the page that asks which host account to connect. */
+    connectPage?: {
+        title?: string;
+        description?: string;
+        label?: string;
+        placeholder?: string;
+    };
+    /** The app's approval page, rendered inside the host's admin. Default "/auth-mcp". */
+    adminAuthPath?: string;
+    /** Default "/mcp/connect". */
+    connectPath?: string;
+    /** Default "/mcp/oauth/complete". */
+    oauthCompletePath?: string;
+};
+export type RaybaseMcpPendingAuthorization = {
+    id: string;
+    clientId: string;
+    clientName: string;
+    redirectUri: string;
+    scope: string[];
+    resource: string;
+    state: string | null;
+    codeChallenge: string;
+    hostAccount: string | null;
+    expiresAt: string;
+    createdAt: string;
+};
+export type RaybaseMcpAccessContext = {
+    tokenId: string;
+    grantId: string;
+    user: RaybaseUser;
+    subjectType: string;
+    subjectId: string;
+    clientId: string;
+    clientName?: string;
+    scopes: string[];
+    resource: string;
+    /** Host account the grant is bound to, for grants made through `mcp.hostApproval`. */
+    hostAccount?: string;
+    /**
+     * Organization the grant was bound to when it was approved, or null when
+     * the grant follows the subject's active membership. Core has no
+     * organizations of its own; layered runtimes record and honour it.
+     */
+    organizationId?: string | null;
+    /** "client_credentials" for machine credentials, "authorization_code" otherwise. */
+    grantType?: "authorization_code" | "client_credentials";
+};
+export type RaybaseMcpOAuthClientSummary = {
+    clientId: string;
+    clientName: string;
+    grantId: string | null;
+    grantTypes: string[];
+    tokenEndpointAuthMethod: string;
+    scopes: string[];
+    resource: string | null;
+    organizationId: string | null;
+    createdByUserId: string | null;
+    createdAt: string;
+    revokedAt: string | null;
+    lastUsedAt: string | null;
+};
+export declare const raybaseMcpSystemTables: RaybaseSystemTable[];
+export declare function normalizeMcpAppVisibility(value: unknown): RaybaseMcpAppVisibility[];
+export declare function isMcpAppResource(resource: Pick<RaybaseMcpResource, "uri" | "mimeType">): boolean;
+export declare function validateMcpAppResourceMeta(meta: RaybaseMcpResource["_meta"] | RaybaseMcpEmbeddedResource["_meta"] | undefined): void;
+export declare function validateMcpAppResource(resource: RaybaseMcpResource): void;
+export declare function validateMcpAppTool(tool: Pick<RaybaseMcpTool, "name" | "_meta">, resources: readonly RaybaseMcpResource[]): void;
+export declare function withMcpAppUi<Args, Env>(tool: RaybaseMcpTool<Args, Env>, ui: RaybaseMcpAppToolMeta): RaybaseMcpTool<Args, Env>;
+export declare function createMcpAppResource(input: {
+    uri: string;
+    name: string;
+    description?: string;
+    html?: string;
+    blob?: string;
+    scopes?: string[];
+    _meta?: {
+        ui?: RaybaseMcpAppResourceMeta;
+        [key: string]: unknown;
+    };
+    read?: (ctx: RaybaseMcpToolContext) => Promise<RaybaseMcpEmbeddedResource>;
+}): RaybaseMcpResource;
+export declare function canonicalMcpResource(request: Request, config: RaybaseConfig): string;
+export declare function operatorMcpEndpoint(config: RaybaseConfig): string;
+export declare function operatorMcpEnabled(config: RaybaseConfig): boolean;
+export declare function canonicalOperatorMcpResource(request: Request, config: RaybaseConfig): string;
+export declare const operatorMcpScopes: readonly ["operator:read", "operator:health:read", "operator:schema:read", "operator:policy:read", "operator:users:read", "operator:orgs:read", "operator:audit:read", "operator:imports:read", "operator:jobs:read", "operator:retrieval:read", "operator:search:read", "operator:mcp-grants:read", "operator:backups:read", "operator:storage:read", "operator:app-data:read", "operator:app-data:write", "operator:app-data:delete", "operator:settings:write", "operator:users:invite", "operator:users:lifecycle", "operator:findings:read", "operator:feedback:read", "operator:support:read", "operator:agent:read", "operator:agent-skills:read", "operator:agent-skills:write", "operator:agent-remote-mcp:read", "operator:agent-remote-mcp:write", "operator:ai:read", "operator:fleet:read"];
+export type RaybaseMcpScopeOptions = {
+    operatorPermissions?: readonly string[];
+    /**
+     * First-party distributions may authorize their own fleet/scope-qualified
+     * operator grants after projecting a suitable operator identity.
+     */
+    allowExtendedOperatorScopes?: boolean;
+    /**
+     * Resolves the identity persisted on an OAuth grant. Core's default reads
+     * its closed `_auth_users` schema; layered runtimes can project their
+     * control-plane identity without changing the shared OAuth implementation.
+     */
+    resolveOAuthUser?(db: SqlExecutor, userId: string): Promise<RaybaseUser | null>;
+    /**
+     * Set by the runtime when `mcp.hostApproval` is enabled. Grants bound to a
+     * host account resolve through it, and refuse to resolve without it.
+     */
+    hostApproval?: Pick<RaybaseMcpHostApprovalOptions, "normalizeHostAccount" | "subject" | "hostAccountParam">;
+};
+/** The connector's name: `mcp.name`, else the app's name. */
+export declare function mcpConnectorName(config: RaybaseConfig): string;
+/** `mcp.instructions` as `initialize` returns it, or undefined when unset. */
+export declare function mcpInstructions(config: RaybaseConfig): string | undefined;
+export declare function checkMcpRateLimit(request: Request, bucket: string, limit?: number, windowMs?: number): Response | null;
+export declare function isAllowedOrigin(origin: string, request: Request, config: RaybaseConfig): boolean;
+/**
+ * Which connector a metadata request is about, from the path after
+ * `/.well-known/oauth-protected-resource` or `/.well-known/oauth-authorization-server`:
+ * nothing or the app's endpoint is the app connector, the operator endpoint is
+ * the operator connector (when it is on), anything else is no connector.
+ */
+export declare function mcpMetadataSurface(config: RaybaseConfig, suffix: string): "app" | "operator" | null;
+/**
+ * RFC 9728 metadata for one connector. It announces that connector's scopes
+ * and nothing else, so a product that asks for every scope it is told about
+ * asks only for what the connector grants.
+ */
+export declare function protectedResourceMetadata(request: Request, config: RaybaseConfig, options?: RaybaseMcpScopeOptions, authorizationServer?: string, surface?: "app" | "operator"): {
+    resource: string;
+    resource_name: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported: string[];
+    resource_documentation: string;
+};
+/**
+ * RFC 8414 metadata. `scopes_supported` is the app connector's unless the
+ * request names the operator connector (`/.well-known/oauth-authorization-server/mcp/operator`).
+ */
+export declare function authorizationServerMetadata(request: Request, options?: RaybaseMcpScopeOptions, authorizationServer?: string, surface?: "app" | "operator", config?: RaybaseConfig): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    revocation_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    scopes_supported: string[];
+    client_id_metadata_document_supported: boolean;
+    authorization_response_iss_parameter_supported: boolean;
+};
+export declare function wwwAuthenticate(request: Request, config: RaybaseConfig, surface?: "app" | "operator"): string;
+export declare function validateRedirectUri(uri: string, allowedHosts?: readonly string[]): string;
+export declare function validateClientMetadataUrl(raw: string, allowedHosts?: readonly string[]): string;
+type ClientMetadataDocument = {
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    [key: string]: unknown;
+};
+export declare function fetchClientMetadataDocument(raw: string, options?: {
+    allowedHosts?: readonly string[];
+    fetcher?: typeof fetch;
+    timeoutMs?: number;
+    maxBytes?: number;
+    maxRedirects?: number;
+}): Promise<ClientMetadataDocument>;
+export type RaybaseMcpConfidentialClientBinding = {
+    /**
+     * Organization the machine credential is bound to. Layered runtimes pass the
+     * organization the registering session is acting in; Core leaves it null.
+     */
+    organizationId?: string | null;
+};
+export type RaybaseMcpMachineCredential = {
+    clientId: string;
+    /** Shown once: only its hash is stored. */
+    clientSecret: string;
+    grantId: string;
+    scopes: string[];
+    resource: string;
+    organizationId: string | null;
+};
+/**
+ * Makes a machine credential (a confidential `client_credentials` client and
+ * its grant) that acts as `user`, without a browser: for an app's own server
+ * code to hand a command-line tool or another service a way in. `resource` is
+ * the connector's absolute address (the app's `/mcp`, or `/mcp/operator`);
+ * `scope` defaults to that connector's default. The secret is returned once.
+ * Revoke with `revokeMcpOAuthClient`.
+ */
+export declare function createMcpMachineCredential(db: SqlExecutor, config: RaybaseConfig, input: {
+    user: RaybaseUser;
+    clientName: string;
+    resource: string;
+    scope?: string;
+    /** The organization the credential is pinned to (a layered runtime's); null in Core. */
+    organizationId?: string | null;
+    tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post";
+    metadata?: Record<string, unknown>;
+}, options?: RaybaseMcpScopeOptions): Promise<RaybaseMcpMachineCredential>;
+export declare function listMcpOAuthClientsForUser(db: SqlExecutor, userId: string): Promise<RaybaseMcpOAuthClientSummary[]>;
+/**
+ * Revokes a confidential client and its grant family. When `ownerUserId` is
+ * given only that user's clients are revoked; admins pass null.
+ */
+export declare function revokeMcpOAuthClient(db: SqlExecutor, clientId: string, actor: {
+    userId: string | null;
+    ownerUserId: string | null;
+}): Promise<boolean>;
+/**
+ * RFC 7591 registration. Public PKCE clients register anonymously as before.
+ * A body whose `grant_types` is `["client_credentials"]` registers a
+ * confidential client instead: it needs the signed-in `user`, takes `scope`
+ * (and optionally `resource`), and answers with a one-time `client_secret`.
+ */
+export declare function registerMcpOAuthClient(request: Request, config: RaybaseConfig, db: SqlExecutor, user?: RaybaseUser | null, options?: RaybaseMcpScopeOptions, binding?: RaybaseMcpConfidentialClientBinding): Promise<Response>;
+/**
+ * A choice the person makes on the consent page, posted back as the form
+ * field `name`. A layered runtime offers one when the grant could go to more
+ * than one place (Pro: which organization) and reads the posted value back.
+ */
+export type RaybaseMcpConsentChoice = {
+    name: string;
+    label: string;
+    options: Array<{
+        value: string;
+        label: string;
+    }>;
+    /** The option chosen to begin with. Defaults to the first. */
+    selected?: string;
+};
+export type RaybaseMcpConsentOptions = {
+    choice?: RaybaseMcpConsentChoice | null;
+};
+/**
+ * The `org` hint an authorization request carries: the query string on GET,
+ * the form or JSON body on POST. Consumes the body, so callers that go on to
+ * call `authorizeMcpOAuthRequest` pass `request.clone()`. Core records
+ * nothing for it; a layered runtime resolves it to an organization the
+ * signed-in user belongs to and passes that as the grant binding.
+ */
+export declare function mcpAuthorizationOrganizationHint(request: Request): Promise<string | null>;
+export type RaybaseMcpGrantBinding = {
+    /**
+     * Organization the grant is pinned to. Null leaves the grant following the
+     * subject's active membership, which a layered runtime may switch per
+     * request; a pinned grant refuses any other organization.
+     */
+    organizationId?: string | null;
+};
+export declare function authorizeMcpOAuthRequest(request: Request, config: RaybaseConfig, db: SqlExecutor, user: RaybaseUser | null, options?: RaybaseMcpScopeOptions, binding?: RaybaseMcpGrantBinding, consent?: RaybaseMcpConsentOptions): Promise<Response>;
+/**
+ * `GET /api/auth/oauth/consent`: what an app's own consent page (`mcp.consent.path`)
+ * shows, for the authorization request in the query. Answers 401 with
+ * `signIn` when nobody is signed in.
+ */
+export declare function mcpOAuthConsentContext(request: Request, config: RaybaseConfig, db: SqlExecutor, user: RaybaseUser | null, options?: RaybaseMcpScopeOptions, consent?: RaybaseMcpConsentOptions): Promise<Response>;
+/** The page that asks which host account to connect (GET), and its submit (POST) back into authorization. */
+export declare function handleMcpHostConnect<Env>(request: Request, config: RaybaseConfig, options: RaybaseMcpHostApprovalOptions<Env>): Promise<Response>;
+/**
+ * The authorization endpoint when host approval is on: records a pending
+ * authorization for the requested host account and sends the person to the
+ * host's admin to approve it. With no host account, sends them to the connect
+ * page first.
+ */
+export declare function beginMcpHostAuthorization<Env>(request: Request, config: RaybaseConfig, db: SqlExecutor, env: Env, options: RaybaseMcpHostApprovalOptions<Env>): Promise<Response>;
+export declare function getMcpPendingAuthorization(db: SqlExecutor, pendingAuthId: string): Promise<RaybaseMcpPendingAuthorization | null>;
+/** The app's `mcp.hostApproval` as the host-account helpers below need it. */
+export type RaybaseMcpHostAccountNormalizer = Pick<RaybaseMcpHostApprovalOptions, "normalizeHostAccount">;
+/**
+ * Issues the single-use ticket that completes a pending authorization. Call it
+ * from the app's approval page only after verifying the host's own session;
+ * `hostAccount` is the account that session proves, in any form the app's
+ * `normalizeHostAccount` accepts: it is normalised here and must then equal
+ * the pending authorization's account. Pass the same `hostApproval` options
+ * the app gives `mcp.hostApproval`.
+ */
+export declare function createMcpApprovalTicket(db: SqlExecutor, hostApproval: RaybaseMcpHostAccountNormalizer, input: {
+    pendingAuthId: string;
+    hostAccount: string;
+}): Promise<{
+    ticket: string;
+    expiresAt: string;
+}>;
+export declare function topLevelMcpApprovalRedirectHtml(url: string): string;
+export declare function redirectMcpPendingAuthorizationError(pending: RaybaseMcpPendingAuthorization, error: string): Response;
+/** Redeems an approval ticket (once) and makes the grant bound to its host account. */
+export declare function completeMcpHostApproval<Env>(request: Request, config: RaybaseConfig, db: SqlExecutor, options: RaybaseMcpHostApprovalOptions<Env>): Promise<Response>;
+export declare function exchangeMcpOAuthToken(request: Request, config: RaybaseConfig, db: SqlExecutor, options?: RaybaseMcpScopeOptions): Promise<Response>;
+export declare function revokeMcpOAuthToken(request: Request, db: SqlExecutor): Promise<Response>;
+export declare function validateMcpBearerToken(request: Request, config: RaybaseConfig, db: SqlExecutor, expectedSurface?: "app" | "operator", options?: RaybaseMcpScopeOptions, resourceOverride?: string): Promise<RaybaseMcpAccessContext | Response>;
+export declare function generatedMcpTools<Env>(schema: RaybaseSchema, config?: RaybaseGeneratedMcpToolsConfig): RaybaseMcpTool<unknown, Env>[];
+export declare function createMcpHandler<Env>(options: RaybaseMcpOptions<Env>): (request: Request, env: Env) => Promise<Response>;
+export declare function listMcpGrants(db: SqlExecutor): Promise<Record<string, unknown>[]>;
+export declare function revokeMcpGrant(db: SqlExecutor, grantId: string, actorId: string | null): Promise<void>;
+/**
+ * Revokes every live grant bound to a host account, and their tokens, for
+ * example when the host reports that the account uninstalled the app.
+ * `hostAccount` may be in any form the app's `normalizeHostAccount` accepts;
+ * it is normalised here (pass the same `hostApproval` options the app gives
+ * `mcp.hostApproval`), and a value it rejects throws. Returns how many grants
+ * were revoked.
+ */
+export declare function revokeMcpGrantsForHostAccount(db: SqlExecutor, hostApproval: RaybaseMcpHostAccountNormalizer, hostAccountInput: string, actorId?: string | null): Promise<number>;
+export {};
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,KAAK,uBAAuB,EAAyC,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAA6B,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAExF,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAA8B,sBAAsB,EAAwB,MAAM,eAAe,CAAC;AACtI,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAExB,MAAM,aAAa,CAAC;AAKrB,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAC/D,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,KAAK,CAAC;AAEtD,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,CAAC,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,gCAAgC,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,gGAAgG;AAChG,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB,GAAG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IACtI,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3F,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACxH,CAAC;IACF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,yBAAyB,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CACpE,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,GAAG,GAAG,OAAO,IAAI;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,EAAE,EAAE,uBAAuB,CAAC;IAC5B,OAAO,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,GAAG,EAAE,iBAAiB,CAAC;IACvB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,IAAI,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC;IAChD,WAAW,CAAC,EAAE;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,qBAAqB,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC/D,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,8BAA8B,CAAC;QACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACzF,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,EAAE,CAAC,EAAE,yBAAyB,CAAC;QAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC3E,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC;CAChF,CAAC;AAEF,MAAM,MAAM,yBAAyB,CAAC,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE,uBAAuB,CAAC;CAChC,KAAK,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC;AAEjD,MAAM,MAAM,iBAAiB,CAAC,GAAG,GAAG,OAAO,IAAI;IAC7C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,mGAAmG;IACnG,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,OAAO,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IAChD,cAAc,CAAC,EAAE,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC;;;OAGG;IACH,mBAAmB,CAAC,CAAC,KAAK,EAAE;QAC1B,OAAO,EAAE,OAAO,CAAC;QACjB,GAAG,EAAE,GAAG,CAAC;QACT,OAAO,EAAE,KAAK,GAAG,UAAU,CAAC;QAC5B,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,uBAAuB,GAAG,QAAQ,CAAC,CAAC;IAChD,6EAA6E;IAC7E,iBAAiB,CAAC,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,OAAO,CAAC;QACjB,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,uBAAuB,CAAC;QAC/B,OAAO,EAAE,KAAK,GAAG,UAAU,CAAC;KAC7B,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,0EAA0E;IAC1E,WAAW,CAAC,CAAC,KAAK,EAAE;QAClB,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,uBAAuB,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,0EAA0E;IAC1E,mBAAmB,CAAC,CAAC,KAAK,EAAE;QAC1B,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,uBAAuB,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,WAAW,CAAC;QAClB,OAAO,EAAE,WAAW,CAAC;QACrB,GAAG,EAAE,iBAAiB,CAAC;KACxB,KAAK,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,sBAAsB,CAAC;QAC/B,MAAM,EAAE,sBAAsB,CAAC;KAChC,CAAC;CACH,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,CAAC,GAAG,GAAG,OAAO,IAAI;IACzD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,MAAM,GAAG,GAAG,CAAC;IAClH,oFAAoF;IACpF,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5C,2DAA2D;IAC3D,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,CAAC;IACpD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,CAAC,EAAE;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAgBF,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oFAAoF;IACpF,SAAS,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAUF,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EA+ItD,CAAC;AAuBF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,EAAE,CASnF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,UAAU,CAAC,GAAG,OAAO,CAEhG;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,0BAA0B,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CA6BpI;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAQzE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,kBAAkB,EAAE,GAAG,IAAI,CAS/H;AAqDD,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,qBAAqB,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAe7H;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,yBAAyB,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC5E,GAAG,kBAAkB,CAuBrB;AAwCD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAEpF;AAOD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAEjE;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAE5F;AAMD,eAAO,MAAM,iBAAiB,0wBA+BpB,CAAC;AAUX,MAAM,MAAM,sBAAsB,GAAG;IACnC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;OAGG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChF;;;OAGG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC,6BAA6B,EAAE,sBAAsB,GAAG,SAAS,GAAG,kBAAkB,CAAC,CAAC;CAC7G,CAAC;AAEF,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE9D;AAID,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAQzE;AA8DD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK,EAAE,QAAQ,SAAS,GAAG,QAAQ,GAAG,IAAI,CAWlH;AAeD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAehG;AAcD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,IAAI,CAKnG;AAMD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,OAAO,GAAE,sBAA2B,EACpC,mBAAmB,CAAC,EAAE,MAAM,EAC5B,OAAO,GAAE,KAAK,GAAG,UAAkB;;;;;;;EAYpC;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,sBAA2B,EACpC,mBAAmB,CAAC,EAAE,MAAM,EAC5B,OAAO,GAAE,KAAK,GAAG,UAAkB,EACnC,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;EAqBvB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,KAAK,GAAG,UAAkB,GAAG,MAAM,CAKpH;AAsFD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAgB7F;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAYnG;AAED,KAAK,sBAAsB,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,OAAO,CAAC,sBAAsB,CAAC,CA6CjC;AAoHD,MAAM,MAAM,mCAAmC,GAAG;IAChD;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAyEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAQF;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE;IACL,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,uBAAuB,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,CAAC;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,EACD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA8DtC;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAWzH;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAU5J;AAsBD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,IAAI,GAAE,WAAW,GAAG,IAAW,EAC/B,OAAO,GAAE,sBAA2B,EACpC,OAAO,GAAE,mCAAwC,GAChD,OAAO,CAAC,QAAQ,CAAC,CA6CnB;AA2BD;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACzC,CAAC;AAoJF;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI/F;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAyKF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,GAAE,sBAA2B,EACpC,OAAO,GAAE,sBAA2B,EACpC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAwBnB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,OAAO,GAAE,sBAA2B,EACpC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAwCD,6GAA6G;AAC7G,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,6BAA6B,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAavJ;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EACjD,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,6BAA6B,CAAC,GAAG,CAAC,GAC1C,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAuBvI;AAED,8EAA8E;AAC9E,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAAC,6BAA6B,EAAE,sBAAsB,CAAC,CAAC;AAmB1G;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,WAAW,EACf,YAAY,EAAE,+BAA+B,EAC7C,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAehD;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUnE;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAErH;AAED,uFAAuF;AACvF,wBAAsB,uBAAuB,CAAC,GAAG,EAC/C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,6BAA6B,CAAC,GAAG,CAAC,GAC1C,OAAO,CAAC,QAAQ,CAAC,CAmCnB;AA+BD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,QAAQ,CAAC,CAgBnB;AA+KD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAW9F;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,WAAW,EACf,eAAe,GAAE,KAAK,GAAG,UAAkB,EAC3C,OAAO,GAAE,sBAA2B,EACpC,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,uBAAuB,GAAG,QAAQ,CAAC,CA0E7C;AAmED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,8BAA8B,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAgFrI;AAuFD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAanC,SAAS,OAAO,EAAE,KAAK,GAAG,KAAG,OAAO,CAAC,QAAQ,CAAC,CAwJ/E;AA0KD,wBAAsB,aAAa,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAMvF;AAgBD,wBAAsB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5G;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,WAAW,EACf,YAAY,EAAE,+BAA+B,EAC7C,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,MAAM,GAAG,IAAW,GAC5B,OAAO,CAAC,MAAM,CAAC,CASjB"}