@selvajs/server 1.5.0-beta.6 → 1.5.0-beta.7

package/dist/handlers/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEjE,eAAO,MAAM,KAAK,EAAE,UAcnB,CAAC"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEjE,eAAO,MAAM,KAAK,EAAE,UAiBnB,CAAC"}

package/dist/handlers/me.js

@@ -3,6 +3,7 @@
  * holder can see which org their credential resolved into — `actingOrgId` is
  * derived per request from the caller's membership, not frozen at mint time.
  */
+import { formatApiScope } from '@selvajs/platform';
 import { requireCaller } from '../api/index.js';
 export const getMe = async (req) => {
     const { ctx, user } = requireCaller(req);
@@ -14,7 +15,10 @@ export const getMe = async (req) => {
             actingOrgId: ctx.actingOrgId,
             platformPermissions: ctx.platformPermissions,
             orgPermissions: ctx.orgPermissions,
-            starredDefinitions: req.profile?.starredDefinitions ?? []
+            starredDefinitions: req.profile?.starredDefinitions ?? [],
+            ...(ctx.apiScope && {
+                apiToken: { id: ctx.apiScope.tokenId, scopes: ctx.apiScope.scopes.map(formatApiScope) }
+            })
         }
     };
 };

package/dist/handlers/me.js.map

@@ -1 +1 @@
-{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzC,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;YACrC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,EAAE;SACzD;KACD,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzC,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;YACrC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,EAAE;YACzD,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI;gBACnB,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;aACvF,CAAC;SACF;KACD,CAAC;AACH,CAAC,CAAC"}

package/dist/http/csrf.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SvelteKit's form-submission CSRF check, with the two exemptions it can't
+ * express. A host turns the framework's own check off and calls this first.
+ *
+ * - A Selva API key in `Authorization`: a cross-site form can't set the header,
+ *   and a `selva_` bearer never falls back to the cookie. API-token uploads are
+ *   multipart with no `Origin`, which the framework check refuses. Any other
+ *   `Authorization` (a proxy's id token) still gets checked: the request may run
+ *   as the cookie session.
+ * - `exemptPaths`: endpoints that take a form body from servers, which send no
+ *   `Origin` (the OAuth token endpoint, per RFC 6749).
+ */
+export interface CsrfOptions {
+    /** Exact paths that accept cross-site form bodies. */
+    exemptPaths?: readonly string[];
+}
+export declare function isCrossSiteFormSubmission(request: Request, options?: CsrfOptions): boolean;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/http/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/http/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,MAAM,WAAW,WAAW;IAC3B,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAS9F"}

package/dist/http/csrf.js

@@ -0,0 +1,37 @@
+/**
+ * SvelteKit's form-submission CSRF check, with the two exemptions it can't
+ * express. A host turns the framework's own check off and calls this first.
+ *
+ * - A Selva API key in `Authorization`: a cross-site form can't set the header,
+ *   and a `selva_` bearer never falls back to the cookie. API-token uploads are
+ *   multipart with no `Origin`, which the framework check refuses. Any other
+ *   `Authorization` (a proxy's id token) still gets checked: the request may run
+ *   as the cookie session.
+ * - `exemptPaths`: endpoints that take a form body from servers, which send no
+ *   `Origin` (the OAuth token endpoint, per RFC 6749).
+ */
+import { API_TOKEN_PREFIX } from '../tokens/index.js';
+const UNSAFE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+// The content types a browser form can send without a CORS preflight, plus
+// SvelteKit's own binary form encoding.
+const FORM_TYPES = [
+    'application/x-www-form-urlencoded',
+    'multipart/form-data',
+    'text/plain',
+    'application/x-sveltekit-formdata'
+];
+export function isCrossSiteFormSubmission(request, options = {}) {
+    if (!UNSAFE_METHODS.has(request.method))
+        return false;
+    const type = (request.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase();
+    if (!FORM_TYPES.includes(type))
+        return false;
+    const bearer = /^Bearer\s+(\S+)/i.exec(request.headers.get('authorization') ?? '')?.[1];
+    if (bearer?.startsWith(API_TOKEN_PREFIX))
+        return false;
+    const url = new URL(request.url);
+    if (options.exemptPaths?.includes(url.pathname))
+        return false;
+    return request.headers.get('origin') !== url.origin;
+}
+//# sourceMappingURL=csrf.js.map

package/dist/http/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/http/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnE,2EAA2E;AAC3E,wCAAwC;AACxC,MAAM,UAAU,GAAG;IAClB,mCAAmC;IACnC,qBAAqB;IACrB,YAAY;IACZ,kCAAkC;CAClC,CAAC;AAOF,MAAM,UAAU,yBAAyB,CAAC,OAAgB,EAAE,UAAuB,EAAE;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC;AACrD,CAAC"}

package/dist/http/index.d.ts

@@ -1,4 +1,5 @@
 export { safeRedirectTarget } from './redirect.js';
+export { isCrossSiteFormSubmission, type CsrfOptions } from './csrf.js';
 export { declaredBodySizeExceeds, type HeadersLike } from './body-size.js';
 export { applySecurityHeaders, type SecurityHeaderOptions } from './security-headers.js';
 export { createRouteClassifier, type RouteClassifier, type RouteClassifierConfig } from './route-classifier.js';

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EACN,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EACN,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,MAAM,gBAAgB,CAAC"}

package/dist/http/index.js

@@ -1,5 +1,6 @@
 // HTTP hardening helpers — transport-agnostic request/response guards.
 export { safeRedirectTarget } from './redirect.js';
+export { isCrossSiteFormSubmission } from './csrf.js';
 export { declaredBodySizeExceeds } from './body-size.js';
 export { applySecurityHeaders } from './security-headers.js';
 export { createRouteClassifier } from './route-classifier.js';

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAiC,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EACN,eAAe,EAIf,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAoB,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAiC,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EACN,eAAe,EAIf,MAAM,gBAAgB,CAAC"}

package/dist/oauth/index.d.ts

@@ -0,0 +1,135 @@
+/**
+ * OAuth 2.1 for MCP clients, with this instance as its own authorization server.
+ *
+ * The access token is an ordinary API token. The host mints it while the user is
+ * signed in, at consent, through the same path as Settings → API tokens; this
+ * module seals the raw key into the authorization code and hands it over at the
+ * token endpoint. So `/mcp` and `/api/v1` keep one credential type.
+ *
+ * Nothing here is stored. A registered client's id is its own signed metadata,
+ * and a code is its own encrypted grant, bound to the issuing origin. The only
+ * state is the set of redeemed codes, in the host's memory, so on several
+ * replicas a code could be redeemed once per replica within its minute, and only
+ * by whoever holds the PKCE verifier.
+ */
+/** The scopes a grant can carry. Each maps to one org-wide API scope. */
+export declare const OAUTH_SCOPES: readonly ["read", "solve"];
+export type OAuthScope = (typeof OAUTH_SCOPES)[number];
+export declare const MCP_PATH = "/mcp";
+export declare class OAuthError extends Error {
+    /** RFC 6749 / 7591 error code. */
+    readonly error: string;
+    readonly status: number;
+    constructor(
+    /** RFC 6749 / 7591 error code. */
+    error: string, description: string, status?: number);
+    toBody(): {
+        error: string;
+        error_description: string;
+    };
+}
+export interface OAuthClient {
+    clientId: string;
+    /** Shown on the consent page. Unverified for a registered client: whatever it claimed. */
+    name: string;
+    redirectUris: string[];
+}
+/** A validated `/oauth/authorize` request, ready for the consent page. */
+export interface AuthorizeRequest {
+    client: OAuthClient;
+    redirectUri: string;
+    state?: string;
+    codeChallenge: string;
+    scopes: OAuthScope[];
+    resource: string;
+}
+/** What the host minted at consent. `secret` is the raw API key. */
+export interface Grant {
+    tokenId: string;
+    secret: string;
+    scopes: OAuthScope[];
+    expiresAt: string;
+}
+export interface OAuthServerOptions {
+    /** This instance's origin, e.g. `https://selva.example.com`. */
+    origin: string;
+    /** `SELVA_HMAC_KEY`. Rotating it invalidates registered clients and live codes. */
+    secret: string;
+    /**
+     * Fetches a Client ID Metadata Document. The URL comes from an unknown client,
+     * so the host must guard it against SSRF. Without it, URL client ids are refused.
+     */
+    fetchClientMetadata?: (url: string) => Promise<unknown>;
+    /**
+     * Redeemed code hashes and their expiry. Pass one map for the process so a
+     * rebuilt server (a new origin, a rotated secret) still refuses a replay.
+     */
+    redeemedCodes?: Map<string, number>;
+    now?: () => number;
+}
+interface HttpResult {
+    status: number;
+    body: Record<string, unknown>;
+}
+export declare function mcpResourceUrl(origin: string): string;
+export declare function resourceMetadataUrl(origin: string): string;
+/** RFC 9728. Claude uses only the first authorization server. */
+export declare function protectedResourceMetadata(origin: string): {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: ("read" | "solve")[];
+    bearer_methods_supported: string[];
+};
+/**
+ * RFC 8414. Claude picks Client ID Metadata Documents only when both
+ * `client_id_metadata_document_supported` and the `none` auth method appear.
+ */
+export declare function authorizationServerMetadata(origin: string): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    scopes_supported: ("read" | "solve")[];
+    client_id_metadata_document_supported: boolean;
+    authorization_response_iss_parameter_supported: boolean;
+};
+export declare function createOAuthServer(options: OAuthServerOptions): {
+    register: (input: unknown) => HttpResult;
+    resolveClient: (clientId: string) => Promise<OAuthClient>;
+    parseAuthorizeRequest: (query: URLSearchParams) => Promise<AuthorizeRequest>;
+    approve: (request: AuthorizeRequest, grant: Grant) => string;
+    deny: (request: AuthorizeRequest) => string;
+    exchange: (form: URLSearchParams) => HttpResult;
+    protectedResourceMetadata: () => {
+        resource: string;
+        authorization_servers: string[];
+        scopes_supported: ("read" | "solve")[];
+        bearer_methods_supported: string[];
+    };
+    authorizationServerMetadata: () => {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        registration_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        scopes_supported: ("read" | "solve")[];
+        client_id_metadata_document_supported: boolean;
+        authorization_response_iss_parameter_supported: boolean;
+    };
+};
+export type OAuthServer = ReturnType<typeof createOAuthServer>;
+/** OAuth scopes to the API scopes a minted token gets. */
+export declare function apiScopesFor(scopes: readonly OAuthScope[]): string[];
+/** A redirect to a program on the user's own machine, which any local process can claim. */
+export declare function isLoopbackRedirect(uri: string): boolean;
+/** Exact, except a loopback redirect matches on any port (RFC 8252 §7.3). */
+export declare function redirectMatches(registered: string, requested: string): boolean;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,yEAAyE;AACzE,eAAO,MAAM,YAAY,4BAA6B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,QAAQ,SAAS,CAAC;AAY/B,qBAAa,UAAW,SAAQ,KAAK;IAEnC,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAEtB,QAAQ,CAAC,MAAM;;IAHf,kCAAkC;IACzB,KAAK,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACV,MAAM,SAAM;IAMtB,MAAM,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;CAGtD;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,MAAM,WAAW,KAAK;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,UAAU,UAAU;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAMD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,iEAAiE;AACjE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM;;;;;EAOvD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;EAczD;AAMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB;sBAgBnC,OAAO,KAAG,UAAU;8BA2BN,MAAM,KAAG,OAAO,CAAC,WAAW,CAAC;mCAmDxB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAAC;uBA+B7D,gBAAgB,SAAS,KAAK,KAAG,MAAM;oBAW1C,gBAAgB,KAAG,MAAM;qBAYxB,eAAe,KAAG,UAAU;;;;;;;;;;;;;;;;;;;;EAsEpD;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE/D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,EAAE,CAEpE;AAmED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAiB9E"}

package/dist/oauth/index.js

@@ -0,0 +1,415 @@
+/**
+ * OAuth 2.1 for MCP clients, with this instance as its own authorization server.
+ *
+ * The access token is an ordinary API token. The host mints it while the user is
+ * signed in, at consent, through the same path as Settings → API tokens; this
+ * module seals the raw key into the authorization code and hands it over at the
+ * token endpoint. So `/mcp` and `/api/v1` keep one credential type.
+ *
+ * Nothing here is stored. A registered client's id is its own signed metadata,
+ * and a code is its own encrypted grant, bound to the issuing origin. The only
+ * state is the set of redeemed codes, in the host's memory, so on several
+ * replicas a code could be redeemed once per replica within its minute, and only
+ * by whoever holds the PKCE verifier.
+ */
+import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, timingSafeEqual } from 'node:crypto';
+/** The scopes a grant can carry. Each maps to one org-wide API scope. */
+export const OAUTH_SCOPES = ['read', 'solve'];
+export const MCP_PATH = '/mcp';
+const CODE_TTL_MS = 60_000;
+const CLIENT_NAME_MAX = 100;
+const REDIRECT_URIS_MAX = 10;
+const CIMD_TTL_MS = 60 * 60_000;
+// A failing metadata URL is not refetched for this long: each fetch is outbound
+// work an anonymous caller could otherwise trigger at will.
+const CIMD_FAILURE_TTL_MS = 60_000;
+const CIMD_CACHE_MAX = 500;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+export class OAuthError extends Error {
+    error;
+    status;
+    constructor(
+    /** RFC 6749 / 7591 error code. */
+    error, description, status = 400) {
+        super(description);
+        this.error = error;
+        this.status = status;
+        this.name = 'OAuthError';
+    }
+    toBody() {
+        return { error: this.error, error_description: this.message };
+    }
+}
+// ============================================================================
+// Discovery documents
+// ============================================================================
+export function mcpResourceUrl(origin) {
+    return origin + MCP_PATH;
+}
+export function resourceMetadataUrl(origin) {
+    return `${origin}/.well-known/oauth-protected-resource${MCP_PATH}`;
+}
+/** RFC 9728. Claude uses only the first authorization server. */
+export function protectedResourceMetadata(origin) {
+    return {
+        resource: mcpResourceUrl(origin),
+        authorization_servers: [origin],
+        scopes_supported: [...OAUTH_SCOPES],
+        bearer_methods_supported: ['header']
+    };
+}
+/**
+ * RFC 8414. Claude picks Client ID Metadata Documents only when both
+ * `client_id_metadata_document_supported` and the `none` auth method appear.
+ */
+export function authorizationServerMetadata(origin) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/oauth/authorize`,
+        token_endpoint: `${origin}/oauth/token`,
+        registration_endpoint: `${origin}/oauth/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: [...OAUTH_SCOPES],
+        client_id_metadata_document_supported: true,
+        authorization_response_iss_parameter_supported: true
+    };
+}
+// ============================================================================
+// Server
+// ============================================================================
+export function createOAuthServer(options) {
+    const { origin } = options;
+    const now = options.now ?? Date.now;
+    const signKey = derive(options.secret, 'selva-oauth-client');
+    const codeKey = derive(options.secret, `selva-oauth-code:${origin}`);
+    const redeemed = options.redeemedCodes ?? new Map();
+    const metadataCache = new Map();
+    // ==========================================================================
+    // Clients
+    // ==========================================================================
+    /** RFC 7591. The client id carries the metadata, signed, so nothing is stored. */
+    function register(input) {
+        try {
+            const meta = (input ?? {});
+            const redirectUris = checkRedirectUris(meta.redirect_uris);
+            const name = typeof meta.client_name === 'string' ? meta.client_name.trim() : '';
+            const payload = b64(JSON.stringify({ n: name.slice(0, CLIENT_NAME_MAX), r: redirectUris, t: now() }));
+            const clientId = `dcr_${payload}.${sign(signKey, payload)}`;
+            return {
+                status: 201,
+                body: {
+                    client_id: clientId,
+                    client_id_issued_at: Math.floor(now() / 1000),
+                    client_name: name || undefined,
+                    redirect_uris: redirectUris,
+                    grant_types: ['authorization_code'],
+                    response_types: ['code'],
+                    token_endpoint_auth_method: 'none'
+                }
+            };
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return { status: err.status, body: err.toBody() };
+            throw err;
+        }
+    }
+    async function resolveClient(clientId) {
+        if (clientId.startsWith('dcr_'))
+            return registeredClient(clientId);
+        if (clientId.startsWith('https://'))
+            return metadataClient(clientId);
+        throw new OAuthError('invalid_client', 'Unknown client.');
+    }
+    function registeredClient(clientId) {
+        const [payload, signature] = clientId.slice('dcr_'.length).split('.');
+        if (!payload || !signature || !safeEqual(signature, sign(signKey, payload))) {
+            throw new OAuthError('invalid_client', 'Unknown client.');
+        }
+        const meta = JSON.parse(unb64(payload));
+        return { clientId, name: meta.n || 'An MCP client', redirectUris: meta.r };
+    }
+    async function metadataClient(url) {
+        const cached = metadataCache.get(url);
+        if (cached) {
+            if ('client' in cached && now() - cached.at < CIMD_TTL_MS)
+                return cached.client;
+            if ('failure' in cached && now() - cached.at < CIMD_FAILURE_TTL_MS)
+                throw cached.failure;
+        }
+        if (!options.fetchClientMetadata) {
+            throw new OAuthError('invalid_client', 'This server does not accept URL client ids.');
+        }
+        try {
+            const client = await readMetadata(url, options.fetchClientMetadata);
+            remember(url, { at: now(), client });
+            return client;
+        }
+        catch (err) {
+            if (!(err instanceof OAuthError))
+                throw err;
+            remember(url, { at: now(), failure: err });
+            throw err;
+        }
+    }
+    function remember(url, entry) {
+        if (metadataCache.size >= CIMD_CACHE_MAX) {
+            metadataCache.delete(metadataCache.keys().next().value);
+        }
+        metadataCache.set(url, entry);
+    }
+    // ==========================================================================
+    // Authorization
+    // ==========================================================================
+    /**
+     * Validates the query `/oauth/authorize` arrives with. An `OAuthError` from a
+     * bad client or redirect URI must be shown, not redirected: the redirect target
+     * is exactly what can't be trusted.
+     */
+    async function parseAuthorizeRequest(query) {
+        const client = await resolveClient(query.get('client_id') ?? '');
+        const redirectUri = query.get('redirect_uri') ?? '';
+        if (!client.redirectUris.some((r) => redirectMatches(r, redirectUri))) {
+            throw new OAuthError('invalid_request', 'The redirect URI is not registered for this client.');
+        }
+        if (query.get('response_type') !== 'code') {
+            throw new OAuthError('unsupported_response_type', 'Only response_type=code is supported.');
+        }
+        const codeChallenge = query.get('code_challenge') ?? '';
+        if (!codeChallenge || query.get('code_challenge_method') !== 'S256') {
+            throw new OAuthError('invalid_request', 'PKCE with code_challenge_method=S256 is required.');
+        }
+        const resource = query.get('resource') ?? mcpResourceUrl(origin);
+        if (!isThisResource(resource)) {
+            throw new OAuthError('invalid_target', 'The resource is not this server.');
+        }
+        return {
+            client,
+            redirectUri,
+            state: query.get('state') ?? undefined,
+            codeChallenge,
+            scopes: parseScopes(query.get('scope')),
+            resource
+        };
+    }
+    /** Where to send the browser after consent: the client's redirect URI with a code. */
+    function approve(request, grant) {
+        const code = seal(codeKey, {
+            c: request.client.clientId,
+            r: request.redirectUri,
+            p: request.codeChallenge,
+            x: now() + CODE_TTL_MS,
+            g: grant
+        });
+        return withParams(request.redirectUri, { code, state: request.state, iss: origin });
+    }
+    function deny(request) {
+        return withParams(request.redirectUri, {
+            error: 'access_denied',
+            state: request.state,
+            iss: origin
+        });
+    }
+    // ==========================================================================
+    // Token endpoint
+    // ==========================================================================
+    function exchange(form) {
+        try {
+            if (form.get('grant_type') !== 'authorization_code') {
+                throw new OAuthError('unsupported_grant_type', 'Only authorization_code is supported.');
+            }
+            const code = form.get('code') ?? '';
+            const sealed = open(codeKey, code);
+            if (!sealed || sealed.x < now()) {
+                throw new OAuthError('invalid_grant', 'The code is invalid or expired.');
+            }
+            if (sealed.c !== form.get('client_id') || sealed.r !== form.get('redirect_uri')) {
+                throw new OAuthError('invalid_grant', 'The code was issued to another client.');
+            }
+            const verifier = form.get('code_verifier') ?? '';
+            if (!safeEqual(createHash('sha256').update(verifier).digest('base64url'), sealed.p)) {
+                throw new OAuthError('invalid_grant', 'The code_verifier does not match.');
+            }
+            const resource = form.get('resource');
+            if (resource !== null && !isThisResource(resource)) {
+                throw new OAuthError('invalid_target', 'The resource is not this server.');
+            }
+            if (!markRedeemed(code, sealed.x)) {
+                throw new OAuthError('invalid_grant', 'The code was already used.');
+            }
+            const { g } = sealed;
+            return {
+                status: 200,
+                body: {
+                    access_token: g.secret,
+                    token_type: 'Bearer',
+                    expires_in: Math.max(0, Math.floor((Date.parse(g.expiresAt) - now()) / 1000)),
+                    scope: g.scopes.join(' ')
+                }
+            };
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return { status: err.status, body: err.toBody() };
+            throw err;
+        }
+    }
+    function markRedeemed(code, expiresAt) {
+        const t = now();
+        for (const [k, x] of redeemed)
+            if (x < t)
+                redeemed.delete(k);
+        const id = createHash('sha256').update(code).digest('base64url');
+        if (redeemed.has(id))
+            return false;
+        redeemed.set(id, expiresAt);
+        return true;
+    }
+    function isThisResource(resource) {
+        const r = resource.replace(/\/$/, '');
+        return r === origin || r === mcpResourceUrl(origin);
+    }
+    return {
+        register,
+        resolveClient,
+        parseAuthorizeRequest,
+        approve,
+        deny,
+        exchange,
+        protectedResourceMetadata: () => protectedResourceMetadata(origin),
+        authorizationServerMetadata: () => authorizationServerMetadata(origin)
+    };
+}
+/** OAuth scopes to the API scopes a minted token gets. */
+export function apiScopesFor(scopes) {
+    return scopes.map((s) => `${s}:all`);
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+async function readMetadata(url, fetchClientMetadata) {
+    let doc;
+    try {
+        doc = (await fetchClientMetadata(url));
+    }
+    catch {
+        throw new OAuthError('invalid_client', 'The client metadata document could not be read.');
+    }
+    if (doc?.client_id !== url) {
+        throw new OAuthError('invalid_client', 'The metadata document names a different client_id.');
+    }
+    return {
+        clientId: url,
+        name: typeof doc.client_name === 'string' && doc.client_name.trim()
+            ? doc.client_name.trim().slice(0, CLIENT_NAME_MAX)
+            : new URL(url).host,
+        redirectUris: checkRedirectUris(doc.redirect_uris)
+    };
+}
+/**
+ * Every scope when the client asks for none; unknown scopes are dropped. `read`
+ * is always in: `solve` includes it at /api/v1, and a grant without it is empty.
+ */
+function parseScopes(raw) {
+    const asked = (raw ?? '').split(' ').filter(Boolean);
+    if (!OAUTH_SCOPES.some((s) => asked.includes(s)))
+        return [...OAUTH_SCOPES];
+    return OAUTH_SCOPES.filter((s) => s === 'read' || asked.includes(s));
+}
+function checkRedirectUris(value) {
+    if (!Array.isArray(value) || !value.length || value.length > REDIRECT_URIS_MAX) {
+        throw new OAuthError('invalid_redirect_uri', 'Give between 1 and 10 redirect_uris.');
+    }
+    for (const uri of value) {
+        if (typeof uri !== 'string' || !isAllowedRedirect(uri)) {
+            throw new OAuthError('invalid_redirect_uri', 'Redirect URIs must be https, or http on a loopback address.');
+        }
+    }
+    return value;
+}
+function isAllowedRedirect(uri) {
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash)
+        return false;
+    return (url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname)));
+}
+/** A redirect to a program on the user's own machine, which any local process can claim. */
+export function isLoopbackRedirect(uri) {
+    try {
+        return LOOPBACK_HOSTS.has(new URL(uri).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/** Exact, except a loopback redirect matches on any port (RFC 8252 §7.3). */
+export function redirectMatches(registered, requested) {
+    if (registered === requested)
+        return true;
+    let a, b;
+    try {
+        a = new URL(registered);
+        b = new URL(requested);
+    }
+    catch {
+        return false;
+    }
+    return (a.protocol === 'http:' &&
+        b.protocol === 'http:' &&
+        LOOPBACK_HOSTS.has(a.hostname) &&
+        a.hostname === b.hostname &&
+        a.pathname === b.pathname &&
+        a.search === b.search);
+}
+function withParams(uri, params) {
+    const url = new URL(uri);
+    for (const [k, v] of Object.entries(params))
+        if (v !== undefined)
+            url.searchParams.set(k, v);
+    return url.toString();
+}
+function derive(secret, info) {
+    return Buffer.from(hkdfSync('sha256', secret, '', info, 32));
+}
+function sign(key, data) {
+    return createHmac('sha256', key).update(data).digest('base64url');
+}
+function seal(key, value) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const body = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), body]).toString('base64url');
+}
+function open(key, sealed) {
+    try {
+        const raw = Buffer.from(sealed, 'base64url');
+        const decipher = createDecipheriv('aes-256-gcm', key, raw.subarray(0, 12));
+        decipher.setAuthTag(raw.subarray(12, 28));
+        const body = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);
+        return JSON.parse(body.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function b64(text) {
+    return Buffer.from(text).toString('base64url');
+}
+function unb64(text) {
+    return Buffer.from(text, 'base64url').toString('utf8');
+}
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,eAAe,EACf,MAAM,aAAa,CAAC;AAErB,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAGvD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAG1B;IAEA;IAJV;IACC,kCAAkC;IACzB,KAAa,EACtB,WAAmB,EACV,SAAS,GAAG;QAErB,KAAK,CAAC,WAAW,CAAC,CAAC;QAJV,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAM;QAGrB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;CACD;AAkDD,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC5C,OAAO,MAAM,GAAG,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,OAAO,GAAG,MAAM,wCAAwC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;QAChC,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACzD,OAAO;QACN,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACpD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IAEJ,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAE7E,kFAAkF;IAClF,SAAS,QAAQ,CAAC,KAAc;QAC/B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAuD,CAAC;YACjF,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,GAAG,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAChF,CAAC;YACF,MAAM,QAAQ,GAAG,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,SAAS,EAAE,QAAQ;oBACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAC7C,WAAW,EAAE,IAAI,IAAI,SAAS;oBAC9B,aAAa,EAAE,YAAY;oBAC3B,WAAW,EAAE,CAAC,oBAAoB,CAAC;oBACnC,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,0BAA0B,EAAE,MAAM;iBAClC;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAAgB;QAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS,gBAAgB,CAAC,QAAgB;QACzC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAA+B,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,GAAW;QACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YAChF,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,mBAAmB;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpE,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,QAAQ,CAAC,GAAW,EAAE,KAA8C;QAC5E,IAAI,aAAa,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAC1C,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAC1D,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,gBAAgB;IAChB,6EAA6E;IAE7E;;;;OAIG;IACH,KAAK,UAAU,qBAAqB,CAAC,KAAsB;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,qDAAqD,CACrD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,UAAU,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;YACrE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACN,MAAM;YACN,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YACtC,aAAa;YACb,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ;SACR,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,SAAS,OAAO,CAAC,OAAyB,EAAE,KAAY;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE;YAC1B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YAC1B,CAAC,EAAE,OAAO,CAAC,WAAW;YACtB,CAAC,EAAE,OAAO,CAAC,aAAa;YACxB,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW;YACtB,CAAC,EAAE,KAAK;SACR,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,IAAI,CAAC,OAAyB;QACtC,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;YACtC,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;SACX,CAAC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAE7E,SAAS,QAAQ,CAAC,IAAqB;QACtC,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAMzB,CAAC;YACT,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;YACrB,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,YAAY,EAAE,CAAC,CAAC,MAAM;oBACtB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBACzB;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;QACpD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,cAAc,CAAC,QAAgB;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACN,QAAQ;QACR,aAAa;QACb,qBAAqB;QACrB,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,yBAAyB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClE,2BAA2B,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC;KACtE,CAAC;AACH,CAAC;AAID,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,mBAAsD;IAEtD,IAAI,GAA4E,CAAC;IACjF,IAAI,CAAC;QACJ,GAAG,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAe,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,EAAE,SAAS,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,GAAG;QACb,IAAI,EACH,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAC5D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAClD,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;QACrB,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;KAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAkB;IACtC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACrC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAAiB;IACpE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAM,EAAE,CAAM,CAAC;IACnB,IAAI,CAAC;QACJ,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAA0C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,KAAc;IACxC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,MAAc;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.5.0-beta.6",
+  "version": "1.5.0-beta.7",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -41,6 +41,11 @@
       "types": "./dist/providers/index.d.ts",
       "import": "./dist/providers/index.js"
     },
+    "./oauth": {
+      "selva-source": "./src/oauth/index.ts",
+      "types": "./dist/oauth/index.d.ts",
+      "import": "./dist/oauth/index.js"
+    },
     "./tokens": {
       "selva-source": "./src/tokens/index.ts",
       "types": "./dist/tokens/index.d.ts",
@@ -111,8 +116,8 @@
   "dependencies": {
     "zod": "^4.6.5",
     "@selvajs/compute": "^4.2.2-beta.0",
-    "@selvajs/platform": "^0.21.0-beta.2",
     "@selvajs/notifications": "^0.3.0-beta.2",
+    "@selvajs/platform": "^0.21.0-beta.2",
     "@selvajs/schemas": "^5.2.0"
   },
   "peerDependencies": {