@rudderhq/server 0.6.1 → 0.6.2-canary.0

package/dist/services/mcp/oauth-helpers.js

@@ -0,0 +1,267 @@
+import { createHash } from "node:crypto";
+import { unprocessable } from "../../errors.js";
+import { createManagedMcpClient, resolveMcpHttpCredentials, } from "./managed-client.js";
+import { MCP_PROVIDER_REGISTRY, } from "./provider-registry.js";
+export function oauthActivityValues(input) {
+    return {
+        orgId: input.orgId,
+        actorType: input.actorUserId ? "user" : "system",
+        actorId: input.actorUserId ?? "system",
+        action: input.action,
+        entityType: "mcp_connection",
+        entityId: input.connectionId,
+        details: input.details,
+    };
+}
+export function tokenExpiry(tokens, now = new Date()) {
+    if (typeof tokens?.expires_in !== "number" || !Number.isFinite(tokens.expires_in))
+        return null;
+    return new Date(now.getTime() + Math.max(0, tokens.expires_in) * 1_000);
+}
+export function tokenScopes(tokens) {
+    return typeof tokens?.scope === "string"
+        ? Array.from(new Set(tokens.scope.split(/\s+/u).filter(Boolean)))
+        : [];
+}
+export function accessToken(material) {
+    const value = material.tokens?.access_token;
+    if (!value)
+        throw unprocessable("Managed MCP OAuth credentials are unavailable");
+    return value;
+}
+export function oauthRevocationEndpoint(material) {
+    const metadata = material?.discoveryState?.authorizationServerMetadata;
+    return isRecord(metadata) && typeof metadata.revocation_endpoint === "string"
+        ? metadata.revocation_endpoint
+        : null;
+}
+const SAFE_SCOPE_METADATA_KEYS = new Set([
+    "region",
+    "scopeKind",
+    "status",
+    "workspaceName",
+    "workspace_name",
+    "organizationName",
+    "organization_name",
+]);
+export const MAX_SCOPE_OPTIONS = 500;
+const MAX_SCOPE_METADATA_BYTES = 4_096;
+function safeScopeMetadata(value) {
+    const output = {};
+    for (const [key, raw] of Object.entries(value)) {
+        if (!SAFE_SCOPE_METADATA_KEYS.has(key))
+            continue;
+        const safeValue = typeof raw === "string"
+            ? raw.slice(0, 512)
+            : typeof raw === "number" && Number.isFinite(raw)
+                ? raw
+                : typeof raw === "boolean"
+                    ? raw
+                    : undefined;
+        if (safeValue === undefined)
+            continue;
+        const candidate = { ...output, [key]: safeValue };
+        if (Buffer.byteLength(JSON.stringify(candidate), "utf8") > MAX_SCOPE_METADATA_BYTES) {
+            continue;
+        }
+        output[key] = safeValue;
+    }
+    return output;
+}
+export function safeScopeOption(value) {
+    return {
+        id: value.id.trim().slice(0, 512),
+        displayName: value.displayName.trim().slice(0, 240),
+        metadata: isRecord(value.metadata) ? safeScopeMetadata(value.metadata) : {},
+    };
+}
+export function sanitizeScopeOptions(values) {
+    const output = [];
+    const seen = new Set();
+    for (const value of values) {
+        const safe = safeScopeOption(value);
+        if (!safe.id || !safe.displayName || seen.has(safe.id))
+            continue;
+        seen.add(safe.id);
+        output.push(safe);
+        if (output.length === MAX_SCOPE_OPTIONS)
+            break;
+    }
+    return output;
+}
+function parseToolJson(result) {
+    for (const content of result.content ?? []) {
+        if (content.type !== "text")
+            continue;
+        try {
+            return JSON.parse(content.text);
+        }
+        catch {
+            // Ignore non-JSON provider prose; onboarding never persists it.
+        }
+    }
+    return undefined;
+}
+function asProviderScope(value, keys) {
+    if (!isRecord(value))
+        return null;
+    const id = keys.id.map((key) => value[key])
+        .find((item) => typeof item === "string" && item.length > 0);
+    if (!id)
+        return null;
+    const displayName = keys.name.map((key) => value[key])
+        .find((item) => typeof item === "string" && item.length > 0) ?? id;
+    const metadata = Object.fromEntries(["region", "status", "workspaceName", "workspace_name", "organizationName"]
+        .flatMap((key) => value[key] === undefined ? [] : [[key, value[key]]]));
+    return safeScopeOption({ id, displayName, metadata });
+}
+function providerScopeContainer(provider, value) {
+    const definition = MCP_PROVIDER_REGISTRY[provider].scopeIdentity;
+    const candidates = [
+        ...definition.containers.map((key) => value[key]),
+    ];
+    const user = value.user;
+    if (provider === "linear" && isRecord(user)) {
+        candidates.push(...definition.containers.map((key) => user[key]));
+    }
+    const bot = value.bot;
+    if (provider === "notion" && isRecord(bot)) {
+        candidates.push(...definition.containers.map((key) => bot[key]));
+    }
+    const self = value.self;
+    if (provider === "notion" && isRecord(self)) {
+        candidates.push(...definition.containers.map((key) => self[key]));
+    }
+    return candidates.find(isRecord) ?? null;
+}
+export function parseProviderWorkspaceScope(provider, value) {
+    if (!isRecord(value))
+        return null;
+    const container = providerScopeContainer(provider, value);
+    if (container) {
+        return asProviderScope(container, {
+            id: ["workspace_id", "workspaceId", "organization_id", "organizationId", "id"],
+            name: [
+                "workspace_name",
+                "workspaceName",
+                "organization_name",
+                "organizationName",
+                "name",
+            ],
+        });
+    }
+    if (provider === "linear"
+        && typeof value.id === "string"
+        && value.id.length > 0
+        && Array.isArray(value.teams)
+        && value.teams.some((team) => isRecord(team) && typeof team.id === "string")) {
+        const authorizationName = typeof value.name === "string" && value.name.length > 0
+            ? `${value.name}'s Linear authorization`
+            : "Linear authorization";
+        const opaqueSubjectId = createHash("sha256")
+            .update(`linear-authorization-subject:${value.id}`)
+            .digest("hex")
+            .slice(0, 24);
+        return safeScopeOption({
+            id: `linear-authorization-subject-${opaqueSubjectId}`,
+            displayName: authorizationName,
+            metadata: {
+                scopeKind: "authorization_subject",
+            },
+        });
+    }
+    const nested = provider === "notion" && isRecord(value.bot) ? value.bot : value;
+    return asProviderScope(nested, {
+        id: ["workspace_id", "workspaceId", "organization_id", "organizationId"],
+        name: [
+            "workspace_name",
+            "workspaceName",
+            "organization_name",
+            "organizationName",
+        ],
+    });
+}
+export async function defaultDiscoverProviderScope(input) {
+    const curatedOrigin = new URL(MCP_PROVIDER_REGISTRY[input.provider].endpoint).origin;
+    const client = await createManagedMcpClient({
+        transport: "streamable_http",
+        url: input.endpoint,
+        credentials: resolveMcpHttpCredentials({ bearerToken: accessToken(input.material) }),
+        network: {
+            allowedOrigins: input.allowlists.httpOrigins,
+            curatedOrigin,
+            lookup: input.dnsLookup,
+        },
+        startupTimeoutMs: input.connection.startupTimeoutMs,
+        toolTimeoutMs: input.connection.toolTimeoutMs,
+    });
+    try {
+        if (input.provider === "supabase") {
+            const parsed = parseToolJson(await client.callTool("list_projects", {}));
+            const rawProjects = Array.isArray(parsed)
+                ? parsed
+                : isRecord(parsed) && Array.isArray(parsed.projects)
+                    ? parsed.projects
+                    : [];
+            const options = rawProjects
+                .map((project) => asProviderScope(project, {
+                id: ["ref", "id", "project_ref"],
+                name: ["name", "display_name", "ref", "id"],
+            }))
+                .filter((option) => Boolean(option));
+            return { options };
+        }
+        const identity = MCP_PROVIDER_REGISTRY[input.provider].scopeIdentity;
+        if (!identity)
+            throw new Error("Provider did not define workspace identity discovery");
+        const tools = await client.discoverTools();
+        const identityTool = identity.toolNames.find((name) => (tools.some((tool) => tool.name === name)));
+        if (!identityTool) {
+            throw new Error("Provider did not expose a safe workspace identity tool");
+        }
+        const parsed = parseToolJson(await client.callTool(identityTool, identity.arguments));
+        const selected = parseProviderWorkspaceScope(input.provider, parsed);
+        if (!selected)
+            throw new Error("Provider workspace identity was invalid");
+        return { options: [], selected };
+    }
+    finally {
+        await client.close();
+    }
+}
+export async function defaultValidateProviderTools(input) {
+    const curatedOrigin = new URL(MCP_PROVIDER_REGISTRY[input.provider].endpoint).origin;
+    const client = await createManagedMcpClient({
+        transport: "streamable_http",
+        url: input.endpoint,
+        credentials: resolveMcpHttpCredentials({ bearerToken: accessToken(input.material) }),
+        network: {
+            allowedOrigins: input.allowlists.httpOrigins,
+            curatedOrigin,
+            lookup: input.dnsLookup,
+        },
+        startupTimeoutMs: input.connection.startupTimeoutMs,
+        toolTimeoutMs: input.connection.toolTimeoutMs,
+    });
+    try {
+        await client.discoverTools();
+    }
+    finally {
+        await client.close();
+    }
+}
+export function parseOAuthMaterial(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (!isRecord(parsed))
+            throw new Error("invalid");
+        return parsed;
+    }
+    catch {
+        throw unprocessable("Managed MCP OAuth credentials are unavailable");
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=oauth-helpers.js.map

package/dist/services/mcp/oauth-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-helpers.js","sourceRoot":"","sources":["../../../src/services/mcp/oauth-helpers.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAchC,MAAM,UAAU,mBAAmB,CAAC,KAMnC;IACC,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,QAAiB;QAClE,OAAO,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,KAAK,CAAC,YAAY;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAqC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACjF,IAAI,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAqC;IAC/D,OAAO,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAiC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,MAAM,aAAa,CAAC,+CAA+C,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAwC;IAC9E,MAAM,QAAQ,GAAY,QAAQ,EAAE,cAAc,EAAE,2BAA2B,CAAC;IAChF,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ;QAC3E,CAAC,CAAC,QAAQ,CAAC,mBAAmB;QAC9B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,SAAS,iBAAiB,CAAC,KAA8B;IACvD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjD,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ;YACvC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnB,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC/C,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,OAAO,GAAG,KAAK,SAAS;oBACxB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,wBAAwB,EAAE,CAAC;YACpF,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA6B;IAC3D,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACnD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAgC;IACnE,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB;YAAE,MAAM;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB;IAC3C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,IAAsC;IAEtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxC,IAAI,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACnD,IAAI,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;SACxE,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACzE,CAAC;IACF,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,KAA8B;IAE9B,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;IACjE,MAAM,UAAU,GAAc;QAC5B,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;KAClD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA6B,EAC7B,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,eAAe,CAAC,SAAS,EAAE;YAChC,EAAE,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,IAAI,CAAC;YAC9E,IAAI,EAAE;gBACJ,gBAAgB;gBAChB,eAAe;gBACf,mBAAmB;gBACnB,kBAAkB;gBAClB,MAAM;aACP;SACF,CAAC,CAAC;IACL,CAAC;IACD,IACE,QAAQ,KAAK,QAAQ;WAClB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;WAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;WACnB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;WAC1B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAC5E,CAAC;QACD,MAAM,iBAAiB,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAC/E,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,yBAAyB;YACxC,CAAC,CAAC,sBAAsB,CAAC;QAC3B,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,gCAAgC,KAAK,CAAC,EAAE,EAAE,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO,eAAe,CAAC;YACrB,EAAE,EAAE,gCAAgC,eAAe,EAAE;YACrD,WAAW,EAAE,iBAAiB;YAC9B,QAAQ,EAAE;gBACR,SAAS,EAAE,uBAAuB;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,eAAe,CAAC,MAAM,EAAE;QAC7B,EAAE,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;QACxE,IAAI,EAAE;YACJ,gBAAgB;YAChB,eAAe;YACf,mBAAmB;YACnB,kBAAkB;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,WAAW,EAAE,yBAAyB,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;YAC5C,aAAa;YACb,MAAM,EAAE,KAAK,CAAC,SAAS;SACxB;QACD,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;QACnD,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;YACzE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAClD,CAAC,CAAC,MAAM,CAAC,QAAQ;oBACjB,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,WAAW;iBACxB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE;gBACzC,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC;gBAChC,IAAI,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC;aAC5C,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,MAAM,EAAoC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACrD,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CACzC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;QAC1C,SAAS,EAAE,iBAAiB;QAC5B,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,WAAW,EAAE,yBAAyB,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE;YACP,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;YAC5C,aAAa;YACb,MAAM,EAAE,KAAK,CAAC,SAAS;SACxB;QACD,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;QACnD,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/services/mcp/oauth.d.ts

@@ -2,21 +2,19 @@ import { type AuthOptions, type AuthResult, type OAuthClientProvider } from "@mo
 import type { Db } from "@rudderhq/db";
 import { mcpConnections, mcpOAuthGrants } from "@rudderhq/db";
 import { type McpConnectionSummary, type McpExternalScopeOption, type McpOAuthCallback, type McpOAuthCallbackResult, type McpOAuthGrantSummary, type McpOAuthStartResponse, type McpScopeSelection } from "@rudderhq/shared";
+import { type ManagedMcpProviderScopeResult } from "./oauth-helpers.js";
 import { type ManagedMcpOAuthMaterial } from "./oauth-provider.js";
 import { type McpDeploymentAllowlists, type McpDnsLookup } from "./security-policy.js";
+export { parseProviderWorkspaceScope, type ManagedMcpProviderScopeResult } from "./oauth-helpers.js";
 type McpConnectionRow = typeof mcpConnections.$inferSelect;
 type McpOAuthGrantRow = typeof mcpOAuthGrants.$inferSelect;
+type McpDbTransaction = Parameters<Parameters<Db["transaction"]>[0]>[0];
 type OAuthAuth = (provider: OAuthClientProvider, options: AuthOptions) => Promise<AuthResult>;
 export interface ManagedMcpOAuthActor {
     userId?: string | null;
     isInstanceAdmin?: boolean;
     localImplicit?: boolean;
 }
-export interface ManagedMcpProviderScopeResult {
-    options: McpExternalScopeOption[];
-    selected?: McpExternalScopeOption;
-    providerSubject?: string | null;
-}
 export interface ManagedMcpOAuthServiceOptions {
     deploymentMode: "local_trusted" | "authenticated";
     serverPort: number;
@@ -30,18 +28,21 @@ export interface ManagedMcpOAuthServiceOptions {
         material: ManagedMcpOAuthMaterial;
         endpoint: string;
     }) => Promise<ManagedMcpProviderScopeResult>;
+    validateProviderTools?: (input: {
+        provider: "supabase" | "linear" | "notion";
+        connection: McpConnectionRow;
+        material: ManagedMcpOAuthMaterial;
+        endpoint: string;
+    }) => Promise<void>;
     refreshConnectionTools?: (orgId: string, connectionId: string, actor: {
         userId?: string | null;
         agentId?: string | null;
     }) => Promise<unknown>;
 }
-/**
- * Official identity tools return an actor plus an explicit workspace or
- * organization. The actor id is never a valid Rudder connection scope.
- */
-export declare function parseProviderWorkspaceScope(provider: "linear" | "notion", value: unknown): McpExternalScopeOption | null;
 export declare function managedMcpOAuthService(db: Db, options: ManagedMcpOAuthServiceOptions): {
-    start: (orgId: string, connectionId: string, actor: ManagedMcpOAuthActor) => Promise<McpOAuthStartResponse>;
+    start: (orgId: string, connectionId: string, actor: ManagedMcpOAuthActor, request?: {
+        requestedAccessMode?: "read_only" | "read_write";
+    }) => Promise<McpOAuthStartResponse>;
     callback: (rawInput: McpOAuthCallback) => Promise<McpOAuthCallbackResult>;
     getGrantSummary: (orgId: string, connectionId: string) => Promise<McpOAuthGrantSummary>;
     listScopeOptions: (orgId: string, connectionId: string) => Promise<McpExternalScopeOption[]>;
@@ -52,10 +53,9 @@ export declare function managedMcpOAuthService(db: Db, options: ManagedMcpOAuthS
         refresh(): Promise<void>;
         markNeedsReauth(): Promise<void>;
     };
-    requireUsableGrant: (orgId: string, connectionId: string) => Promise<McpOAuthGrantRow>;
+    requireUsableGrant: (orgId: string, connectionId: string, executor?: McpDbTransaction) => Promise<McpOAuthGrantRow>;
     resolveProviderEndpoint: (row: McpConnectionRow) => string;
     cleanupExpiredSessions: (orgId?: string, limit?: number) => Promise<number>;
 };
 export declare function isInvalidGrantOAuthError(error: unknown): boolean;
-export {};
 //# sourceMappingURL=oauth.d.ts.map

package/dist/services/mcp/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,mBAAmB,EAEzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAGL,cAAc,EACd,cAAc,EAKf,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAuB1B,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE7G,KAAK,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAC3D,KAAK,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAG3D,KAAK,SAAS,GAAG,CACf,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,eAAe,GAAG,eAAe,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,uBAAuB,CAAC;IACpC,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3C,UAAU,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC7C,sBAAsB,CAAC,EAAE,CACvB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KACvD,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA8RD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,IAAI,CA+C/B;AAmHD,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,6BAA6B;mBA2X7B,MAAM,gBACC,MAAM,SACb,oBAAoB,KAC1B,OAAO,CAAC,qBAAqB,CAAC;yBAoJC,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;6BA6a3E,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,oBAAoB,CAAC;8BAKvB,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAoB3B,MAAM,gBACC,MAAM,gBACN,iBAAiB,SACxB,oBAAoB,KAC1B,OAAO,CAAC,oBAAoB,CAAC;oBAmIvB,MAAM,gBACC,MAAM,SACb,oBAAoB,sBAE1B,OAAO,CAAC,oBAAoB,CAAC;8BAmdC,MAAM,gBAAgB,MAAM;iBAE1C,OAAO,CAAC,MAAM,CAAC;mBAGb,OAAO,CAAC,IAAI,CAAC;2BAeL,OAAO,CAAC,IAAI,CAAC;;gCAr9CjC,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,gBAAgB,CAAC;mCA4+CU,gBAAgB,KAAG,MAAM;qCA31CrD,MAAM,qBAEb,OAAO,CAAC,MAAM,CAAC;EA82CnB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAIL,cAAc,EACd,cAAc,EAKf,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAWL,KAAK,6BAA6B,EACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE7G,OAAO,EACL,2BAA2B,EAC3B,KAAK,6BAA6B,EACnC,MAAM,oBAAoB,CAAC;AAE5B,KAAK,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAC3D,KAAK,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAE3D,KAAK,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,KAAK,SAAS,GAAG,CACf,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,eAAe,GAAG,eAAe,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,uBAAuB,CAAC;IACpC,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3C,UAAU,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC7C,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3C,UAAU,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,sBAAsB,CAAC,EAAE,CACvB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KACvD,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAiMD,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,6BAA6B;mBAuZ7B,MAAM,gBACC,MAAM,SACb,oBAAoB,YAClB;QACP,mBAAmB,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;KAClD,KACA,OAAO,CAAC,qBAAqB,CAAC;yBA4LC,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;6BA+iB3E,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,oBAAoB,CAAC;8BAKvB,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAoB3B,MAAM,gBACC,MAAM,gBACN,iBAAiB,SACxB,oBAAoB,KAC1B,OAAO,CAAC,oBAAoB,CAAC;oBAmIvB,MAAM,gBACC,MAAM,SACb,oBAAoB,sBAE1B,OAAO,CAAC,oBAAoB,CAAC;8BAmdC,MAAM,gBAAgB,MAAM;iBAE1C,OAAO,CAAC,MAAM,CAAC;mBAGb,OAAO,CAAC,IAAI,CAAC;2BAeL,OAAO,CAAC,IAAI,CAAC;;gCA9pDjC,MAAM,gBACC,MAAM,aACT,gBAAgB,KAC1B,OAAO,CAAC,gBAAgB,CAAC;mCAorDU,gBAAgB,KAAG,MAAM;qCAxgDrD,MAAM,qBAEb,OAAO,CAAC,MAAM,CAAC;EA2hDnB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE"}