@se-studio/contentful-cms 0.0.0-next16-20260822103555

package/dist/hosted/oauth/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAmB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAQ3E,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,wBAAwB,EAAE,4BAA4B;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YAC7E,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,wBAAwB,EAAE,4BAA4B;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACxE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE;YACpF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/hosted/oauth/jwt.d.ts

@@ -0,0 +1,9 @@
+export interface McpAccessTokenClaims {
+    sub: string;
+}
+export declare function signMcpAccessToken(sub: string, audience: string): Promise<{
+    accessToken: string;
+    expiresIn: number;
+}>;
+export declare function verifyMcpAccessToken(token: string, expectedAudience: string): Promise<McpAccessTokenClaims>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/hosted/oauth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/jwt.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAUrD;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAS/B"}

package/dist/hosted/oauth/jwt.js

@@ -0,0 +1,31 @@
+import { createSecretKey } from 'node:crypto';
+import { jwtVerify, SignJWT } from 'jose';
+function getSecretKey() {
+    const secret = process.env['MCP_OAUTH_JWT_SECRET']?.trim();
+    if (!secret) {
+        throw new Error('Missing MCP_OAUTH_JWT_SECRET');
+    }
+    return createSecretKey(Buffer.from(secret, 'utf8'));
+}
+export async function signMcpAccessToken(sub, audience) {
+    const expiresIn = 3600;
+    const accessToken = await new SignJWT({})
+        .setProtectedHeader({ alg: 'HS256' })
+        .setSubject(sub)
+        .setAudience(audience)
+        .setIssuedAt()
+        .setExpirationTime(`${expiresIn}s`)
+        .sign(getSecretKey());
+    return { accessToken, expiresIn };
+}
+export async function verifyMcpAccessToken(token, expectedAudience) {
+    const { payload } = await jwtVerify(token, getSecretKey(), {
+        audience: expectedAudience,
+    });
+    const sub = payload.sub;
+    if (!sub) {
+        throw new Error('Invalid MCP access token: missing subject.');
+    }
+    return { sub };
+}
+//# sourceMappingURL=jwt.js.map

package/dist/hosted/oauth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/hosted/oauth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;SACtC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,GAAG,CAAC;SACf,WAAW,CAAC,QAAQ,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,SAAS,GAAG,CAAC;SAClC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,gBAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE;QACzD,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC"}

package/dist/hosted/oauth/log.d.ts

@@ -0,0 +1,12 @@
+/** OAuth/auth diagnostics for hosted cms-edit — failures always log; verbose with LOG_CMS_OAUTH=1. */
+export declare function isOauthLoggingVerbose(): boolean;
+export declare function oauthLogVerbose(event: string, details?: Record<string, unknown>): void;
+/** Always emitted for hosted MCP handler failures — visible in Vercel runtime logs. */
+export declare function oauthLogMcpHandlerError(message: string, details?: Record<string, unknown>): void;
+/** Always emitted for auth failures — visible in Vercel runtime logs. */
+export declare function oauthLogAuthFailure(route: string, reason: string, details?: Record<string, unknown>): void;
+export declare function authorizationCodeGrantFailureReason(message: string): string;
+export declare function isUnusableContentfulCacheReason(reason: string): boolean;
+export declare function isTransientContentfulFailure(reason: string): boolean;
+export declare function patValidationFailureReason(message: string): string;
+//# sourceMappingURL=log.d.ts.map

package/dist/hosted/oauth/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}

package/dist/hosted/oauth/log.js

@@ -0,0 +1,71 @@
+/** OAuth/auth diagnostics for hosted cms-edit — failures always log; verbose with LOG_CMS_OAUTH=1. */
+function writeOauthLog(line) {
+    process.stderr.write(`${line}\n`);
+}
+export function isOauthLoggingVerbose() {
+    const value = process.env['LOG_CMS_OAUTH'];
+    return value === '1' || value === 'true';
+}
+export function oauthLogVerbose(event, details) {
+    if (!isOauthLoggingVerbose())
+        return;
+    writeOauthLog(`[cms-edit:oauth] ${event}${details ? ` ${JSON.stringify(details)}` : ''}`);
+}
+/** Always emitted for hosted MCP handler failures — visible in Vercel runtime logs. */
+export function oauthLogMcpHandlerError(message, details) {
+    writeOauthLog(`[cms-edit:mcp] handler_error message=${message}${details ? ` ${JSON.stringify(details)}` : ''}`);
+}
+/** Always emitted for auth failures — visible in Vercel runtime logs. */
+export function oauthLogAuthFailure(route, reason, details) {
+    writeOauthLog(`[cms-edit:oauth] auth_failure route=${route} reason=${reason}${details ? ` ${JSON.stringify(details)}` : ''}`);
+}
+export function authorizationCodeGrantFailureReason(message) {
+    if (message.includes('Invalid or expired authorization code')) {
+        return 'invalid_authorization_code';
+    }
+    if (message.includes('Authorization request expired')) {
+        return 'authorization_request_expired';
+    }
+    if (message.includes('Invalid client_id')) {
+        return 'invalid_client_id';
+    }
+    if (message.includes('Invalid redirect_uri')) {
+        return 'invalid_redirect_uri';
+    }
+    if (message.includes('Invalid code_verifier')) {
+        return 'invalid_code_verifier';
+    }
+    if (message.includes('Contentful session')) {
+        return 'missing_contentful_token';
+    }
+    return 'invalid_grant';
+}
+export function isUnusableContentfulCacheReason(reason) {
+    return (reason === 'invalid_contentful_token' ||
+        reason === 'space_access_denied' ||
+        reason === 'missing_contentful_token');
+}
+export function isTransientContentfulFailure(reason) {
+    return (reason === 'contentful_api_error' ||
+        reason === 'space_check_failed' ||
+        reason === 'pat_validation_failed');
+}
+export function patValidationFailureReason(message) {
+    if (message.includes('does not have access to the configured Contentful space')) {
+        return 'space_access_denied';
+    }
+    if (message.includes('Invalid Contentful management token')) {
+        return 'invalid_contentful_token';
+    }
+    if (message.includes('Contentful management token is required')) {
+        return 'missing_contentful_token';
+    }
+    if (message.includes('Contentful API error')) {
+        return 'contentful_api_error';
+    }
+    if (message.includes('Contentful space check failed')) {
+        return 'space_check_failed';
+    }
+    return 'pat_validation_failed';
+}
+//# sourceMappingURL=log.js.map

package/dist/hosted/oauth/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,OAAO,CACL,MAAM,KAAK,0BAA0B;QACrC,MAAM,KAAK,qBAAqB;QAChC,MAAM,KAAK,0BAA0B,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CACL,MAAM,KAAK,sBAAsB;QACjC,MAAM,KAAK,oBAAoB;QAC/B,MAAM,KAAK,uBAAuB,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/hosted/oauth/pat-cache.d.ts

@@ -0,0 +1,11 @@
+import type { HostedDeploymentConfig, ValidatePatResult } from '../../config/hosted.js';
+import type { CachedContentfulToken, OAuthStore } from './store.js';
+export declare const DEFAULT_PAT_REVALIDATE_SECONDS: number;
+export declare function getPatRevalidateSeconds(): number;
+export declare function isCachedPatFresh(record: CachedContentfulToken, now?: number): boolean;
+/**
+ * Use a cached PAT identity when still fresh; otherwise live-validate against CMA
+ * and rewrite the Redis envelope.
+ */
+export declare function resolvePatForDeployment(store: OAuthStore, sub: string, token: string, deployment: HostedDeploymentConfig): Promise<ValidatePatResult>;
+//# sourceMappingURL=pat-cache.d.ts.map

package/dist/hosted/oauth/pat-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pat-cache.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/pat-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAExF,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,8BAA8B,QAAU,CAAC;AAItD,wBAAgB,uBAAuB,IAAI,MAAM,CAMhD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,SAAa,GAAG,OAAO,CAKzF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,sBAAsB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAkB5B"}

package/dist/hosted/oauth/pat-cache.js

@@ -0,0 +1,42 @@
+import { validatePatForDeployment } from '../../config/hosted.js';
+export const DEFAULT_PAT_REVALIDATE_SECONDS = 15 * 60;
+const MIN_PAT_REVALIDATE_SECONDS = 60;
+const MAX_PAT_REVALIDATE_SECONDS = 24 * 60 * 60;
+export function getPatRevalidateSeconds() {
+    const raw = process.env['CMS_EDIT_PAT_REVALIDATE_SECONDS']?.trim();
+    if (!raw)
+        return DEFAULT_PAT_REVALIDATE_SECONDS;
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isNaN(parsed))
+        return DEFAULT_PAT_REVALIDATE_SECONDS;
+    return Math.min(MAX_PAT_REVALIDATE_SECONDS, Math.max(MIN_PAT_REVALIDATE_SECONDS, parsed));
+}
+export function isCachedPatFresh(record, now = Date.now()) {
+    if (!record.userId || !record.email || !record.lastValidatedAt)
+        return false;
+    const validatedAt = Date.parse(record.lastValidatedAt);
+    if (Number.isNaN(validatedAt))
+        return false;
+    return now - validatedAt < getPatRevalidateSeconds() * 1000;
+}
+/**
+ * Use a cached PAT identity when still fresh; otherwise live-validate against CMA
+ * and rewrite the Redis envelope.
+ */
+export async function resolvePatForDeployment(store, sub, token, deployment) {
+    const record = await store.getContentfulTokenRecord(sub, deployment.spaceId);
+    if (record &&
+        record.token === token &&
+        isCachedPatFresh(record) &&
+        record.userId &&
+        record.email) {
+        return { token, userId: record.userId, email: record.email };
+    }
+    const user = await validatePatForDeployment(token, deployment);
+    await store.storeContentfulToken(sub, user.token, deployment.spaceId, {
+        userId: user.userId,
+        email: user.email,
+    });
+    return user;
+}
+//# sourceMappingURL=pat-cache.js.map

package/dist/hosted/oauth/pat-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pat-cache.js","sourceRoot":"","sources":["../../../src/hosted/oauth/pat-cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,CAAC;AACtD,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,8BAA8B,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA6B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,GAAG,GAAG,WAAW,GAAG,uBAAuB,EAAE,GAAG,IAAI,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAiB,EACjB,GAAW,EACX,KAAa,EACb,UAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7E,IACE,MAAM;QACN,MAAM,CAAC,KAAK,KAAK,KAAK;QACtB,gBAAgB,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,KAAK,EACZ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE;QACpE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hosted/oauth/pkce.d.ts

@@ -0,0 +1,3 @@
+export declare function generateAuthCode(): string;
+export declare function verifyPkce(codeVerifier: string, codeChallenge: string): boolean;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/hosted/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/pkce.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAG/E"}

package/dist/hosted/oauth/pkce.js

@@ -0,0 +1,9 @@
+import { createHash, randomBytes } from 'node:crypto';
+export function generateAuthCode() {
+    return randomBytes(32).toString('base64url');
+}
+export function verifyPkce(codeVerifier, codeChallenge) {
+    const digest = createHash('sha256').update(codeVerifier).digest('base64url');
+    return digest === codeChallenge;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/hosted/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/hosted/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,aAAqB;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7E,OAAO,MAAM,KAAK,aAAa,CAAC;AAClC,CAAC"}

package/dist/hosted/oauth/redirect-uri.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Canonicalize loopback redirect URIs so 127.0.0.1 and localhost compare equal.
+ * Non-loopback URIs are returned unchanged.
+ */
+export declare function normalizeLoopbackRedirectUri(uri: string): string;
+/** True when requested matches any registered URI (exact or loopback-equivalent). */
+export declare function redirectUriMatchesRegistered(registered: string[], requested: string): boolean;
+/** True when two redirect URIs are equivalent for OAuth token exchange. */
+export declare function redirectUrisEquivalent(stored: string, requested: string): boolean;
+//# sourceMappingURL=redirect-uri.d.ts.map

package/dist/hosted/oauth/redirect-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/redirect-uri.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQhE;AA+BD,qFAAqF;AACrF,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7F;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKjF"}

package/dist/hosted/oauth/redirect-uri.js

@@ -0,0 +1,61 @@
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);
+function parseRedirectUri(uri) {
+    try {
+        return new URL(uri);
+    }
+    catch {
+        return null;
+    }
+}
+function isLoopbackHost(hostname) {
+    return LOOPBACK_HOSTS.has(hostname);
+}
+/**
+ * Canonicalize loopback redirect URIs so 127.0.0.1 and localhost compare equal.
+ * Non-loopback URIs are returned unchanged.
+ */
+export function normalizeLoopbackRedirectUri(uri) {
+    const parsed = parseRedirectUri(uri);
+    if (!parsed || !isLoopbackHost(parsed.hostname)) {
+        return uri;
+    }
+    parsed.hostname = '127.0.0.1';
+    return parsed.toString();
+}
+function redirectUriPartsMatch(a, b) {
+    const left = parseRedirectUri(a);
+    const right = parseRedirectUri(b);
+    if (!left || !right) {
+        return false;
+    }
+    if (left.protocol !== right.protocol) {
+        return false;
+    }
+    if (left.pathname !== right.pathname) {
+        return false;
+    }
+    if (left.search !== right.search) {
+        return false;
+    }
+    if (left.port !== right.port) {
+        return false;
+    }
+    const leftLoopback = isLoopbackHost(left.hostname);
+    const rightLoopback = isLoopbackHost(right.hostname);
+    if (leftLoopback && rightLoopback) {
+        return true;
+    }
+    return left.hostname === right.hostname;
+}
+/** True when requested matches any registered URI (exact or loopback-equivalent). */
+export function redirectUriMatchesRegistered(registered, requested) {
+    return registered.some((uri) => redirectUriPartsMatch(uri, requested));
+}
+/** True when two redirect URIs are equivalent for OAuth token exchange. */
+export function redirectUrisEquivalent(stored, requested) {
+    if (stored === requested) {
+        return true;
+    }
+    return redirectUriPartsMatch(stored, requested);
+}
+//# sourceMappingURL=redirect-uri.js.map

package/dist/hosted/oauth/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../../src/hosted/oauth/redirect-uri.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC;IAC9B,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,4BAA4B,CAAC,UAAoB,EAAE,SAAiB;IAClF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,SAAiB;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC"}

package/dist/hosted/oauth/refresh.d.ts

@@ -0,0 +1,22 @@
+import type { OAuthStore } from './store.js';
+export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token' | 'invalid_contentful_token';
+export declare class RefreshTokenGrantError extends Error {
+    readonly reason: RefreshTokenGrantFailureReason;
+    constructor(reason: RefreshTokenGrantFailureReason, message?: string);
+}
+export declare function isRefreshTokenGrantError(error: unknown): error is RefreshTokenGrantError;
+export declare function completeRefreshTokenGrant(store: OAuthStore, input: {
+    refreshToken: string;
+    clientId?: string;
+    resource?: string;
+    /** Host Contentful space — refresh must not mint a JWT if the CMA cache is gone. */
+    spaceId?: string;
+    /** When set, refuse refresh if Contentful rejects the cached CMA token. */
+    validateContentfulToken?: (token: string) => Promise<void>;
+}): Promise<{
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken: string;
+}>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/hosted/oauth/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAyCD"}

package/dist/hosted/oauth/refresh.js

@@ -0,0 +1,46 @@
+import { isCachedContentfulTokenError, loadAndValidateContentfulToken } from './cached-cma.js';
+import { signMcpAccessToken } from './jwt.js';
+export class RefreshTokenGrantError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message ?? reason);
+        this.name = 'RefreshTokenGrantError';
+        this.reason = reason;
+    }
+}
+export function isRefreshTokenGrantError(error) {
+    return error instanceof RefreshTokenGrantError;
+}
+export async function completeRefreshTokenGrant(store, input) {
+    const record = await store.getRefreshToken(input.refreshToken);
+    if (!record) {
+        throw new RefreshTokenGrantError('invalid_refresh_token', 'Invalid or expired refresh token.');
+    }
+    if (input.clientId && input.clientId !== record.clientId) {
+        throw new RefreshTokenGrantError('refresh_client_mismatch', 'Invalid client_id.');
+    }
+    if (input.resource && input.resource !== record.resource) {
+        throw new RefreshTokenGrantError('refresh_resource_mismatch', 'Invalid resource.');
+    }
+    try {
+        await loadAndValidateContentfulToken(store, record.sub, input.spaceId, input.validateContentfulToken);
+    }
+    catch (error) {
+        if (isCachedContentfulTokenError(error)) {
+            await store.revokeRefreshToken(input.refreshToken);
+            throw new RefreshTokenGrantError(error.reason, error.message);
+        }
+        throw error;
+    }
+    // Reuse the UUID; save to slide Redis TTL. Rotation breaks clients that retry
+    // with the old token.
+    await store.saveRefreshToken(input.refreshToken, record);
+    const { accessToken, expiresIn } = await signMcpAccessToken(record.sub, record.resource);
+    return {
+        accessToken,
+        tokenType: 'Bearer',
+        expiresIn,
+        refreshToken: input.refreshToken,
+    };
+}
+//# sourceMappingURL=refresh.js.map

package/dist/hosted/oauth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAU9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAQC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,8BAA8B,CAClC,KAAK,EACL,MAAM,CAAC,GAAG,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEzD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/store.d.ts

@@ -0,0 +1,75 @@
+import type { RedisClient } from '../../session/session-store.js';
+/** Match MCP refresh lifetime so CMA cache does not die while Grok can still refresh JWTs. */
+export declare const CONTENTFUL_TOKEN_TTL_SECONDS: number;
+export interface OAuthClientRegistration {
+    clientId: string;
+    redirectUris: string[];
+    clientName?: string;
+}
+export interface PendingAuthRequest {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state?: string;
+    resource: string;
+}
+export interface AuthCodeRecord {
+    authRequestId: string;
+    sub: string;
+}
+export interface RefreshTokenRecord {
+    sub: string;
+    clientId: string;
+    resource: string;
+}
+/** Redis value for a cached CMA PAT. Legacy keys store the raw token string. */
+export interface CachedContentfulToken {
+    token: string;
+    userId?: string;
+    email?: string;
+    lastValidatedAt?: string;
+}
+export declare function parseCachedContentfulToken(raw: unknown): CachedContentfulToken | null;
+/**
+ * Contentful CMA token cache key — space-scoped for shared Redis across hosts.
+ */
+export declare function contentfulTokenKey(sub: string, spaceId: string): string;
+/**
+ * Pre-3.4.5 key (not space-scoped). Read as fallback; migrate to space-scoped on hit.
+ */
+export declare function legacyContentfulTokenKey(sub: string): string;
+/**
+ * Host space for OAuth token isolation.
+ * Prefer explicit spaceId (deployment); fall back to CONTENTFUL_SPACE_ID.
+ * Returns undefined when neither is set — callers treat as missing token / store error.
+ */
+export declare function resolveOAuthSpaceId(explicit?: string): string | undefined;
+export declare function refreshTokenKey(token: string): string;
+export interface OAuthStore {
+    registerOAuthClient(input: {
+        redirectUris: string[];
+        clientName?: string;
+    }): Promise<OAuthClientRegistration>;
+    getOAuthClient(clientId: string): Promise<OAuthClientRegistration | null>;
+    savePendingAuthRequest(request: PendingAuthRequest): Promise<{
+        authRequestId: string;
+    }>;
+    getPendingAuthRequest(authRequestId: string): Promise<PendingAuthRequest | null>;
+    saveAuthCode(code: string, record: AuthCodeRecord): Promise<void>;
+    peekAuthCode(code: string): Promise<AuthCodeRecord | null>;
+    consumeAuthCode(code: string): Promise<AuthCodeRecord | null>;
+    storeContentfulToken(sub: string, token: string, spaceId?: string, identity?: {
+        userId: string;
+        email: string;
+    }): Promise<void>;
+    getContentfulToken(sub: string, spaceId?: string): Promise<string | null>;
+    getContentfulTokenRecord(sub: string, spaceId?: string): Promise<CachedContentfulToken | null>;
+    /** Slide CMA TTL only after Contentful accepted the token. */
+    touchContentfulToken(sub: string, spaceId?: string): Promise<void>;
+    deleteContentfulToken(sub: string, spaceId?: string): Promise<void>;
+    saveRefreshToken(token: string, record: RefreshTokenRecord): Promise<void>;
+    getRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
+    revokeRefreshToken(token: string): Promise<void>;
+}
+export declare function createOAuthStore(redis: RedisClient): OAuthStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/hosted/oauth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgBD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAerF;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAcD,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC/F,8DAA8D;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAmJ/D"}