@softure-ai/mcp-access 0.2.8 → 0.2.9

package/CHANGELOG.md

@@ -4,6 +4,22 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mcp-access@x.y.z`).
 
+## 0.2.9
+
+- A runtime kill switch for writes (#904): the manifest switch `mcp-access.writes_enabled` (`WRITES_ENABLED_SWITCH`)
+  is read through `readSwitch` on every request. Writes need `allowWrites`, the token's write access and the switch;
+  off, write tools are not served, the `WWW-Authenticate` challenge and the default OAuth scope name only `mcp:read`,
+  the consent page offers no write tick and a decision grants read only. `isWritingEnabled(ctx)` (`/server`) answers
+  the app's side, and `AuthorizationRequest.isWriteOffered` the consent page's. Migrate: nothing; an app that does
+  not define the switch behaves as before. To use it, define it in `@softure-ai/feature-switches` (README §7
+  recommends `failMode: "closed"`, `override: "towards-fail-mode"`) and drop an app-level write switch.
+- The consent page shows where the access code goes as a row of its own (#906): `consent.redirectLabel` and the
+  host (or the whole native-scheme URI) in monospace, with the hint `consent.redirectHint` that the app name is
+  self-declared and the address is not. `ConsentForm` gains the `target` slot; `note` now styles the hint.
+  `OAuthConsentPage` takes `classNames` and `unstyled` and passes them to `ConsentForm` and `ConsentError`.
+  Migrate: `consent.returnsTo` is gone; an app that overrides it moves its text to `consent.redirectLabel`, and an
+  app that recomposed the page to show the host can mount `OAuthConsentPage` again.
+
 ## 0.2.8
 
 - The content of 0.2.7, which was never published: its release stopped at the gates (ESLint ran out of memory in

package/README.md

@@ -15,10 +15,11 @@ limit check made race-free.
   `Authorization: Bearer` token, then hands the request to a **fresh server from the app's factory**
   with `{ userId, canWrite, tokenId }`. Unknown, revoked, expired and malformed tokens all get the
   same `401 invalid_token` with a `WWW-Authenticate: Bearer` challenge. The challenge's `scope` is
-  `mcp:read mcp:write` while `allowWrites` is on and `mcp:read` otherwise, so an OAuth client asks
+  `mcp:read mcp:write` while the app allows writes and `mcp:read` otherwise, so an OAuth client asks
   for what it may get.
-- **Writes need two consents:** the app's `allowWrites` option and a token issued with write
-  access. `canWrite` is decided on every request, so turning `allowWrites` off makes every token
+- **Writes need the app and the token:** the app's `allowWrites` option, the runtime switch
+  `mcp-access.writes_enabled` when the app defines it (§7), and a token issued with write access.
+  `canWrite` is decided on every request, so turning `allowWrites` or the switch off makes every token
   read-only at once.
 - A token page for the signed-in user: the app's tool catalog, an issue form, the new token with its
   setup (a prompt for Claude Code and a `claude-cli://` link, the `claude mcp add` command, an
@@ -30,9 +31,10 @@ limit check made race-free.
   - dynamic client registration (RFC 7591, `POST /api/oauth/register`), public or confidential;
     open to anyone, or closed outside a window an ops script opens (`oauth.registration`);
   - `/oauth/authorize`: authorization code with PKCE `S256` only, on a consent page that shows the
-    app, where the code goes, the signed-in account and the access; writes need the `mcp:write`
-    scope, `allowWrites` and the person's tick. A request without `scope` gets the default scope:
-    both scopes while `allowWrites` is on, `mcp:read` otherwise;
+    app's self-declared name, where the code goes (a row of its own, in monospace: the one part a
+    client cannot fake), the signed-in account and the access; writes need the `mcp:write` scope, the
+    app allowing writes (`allowWrites` and the switch) and the person's tick. A request without `scope`
+    gets the default scope: both scopes while the app allows writes, `mcp:read` otherwise;
   - `POST /api/oauth/token`: `authorization_code` and `refresh_token`. Refresh tokens rotate on
     every use; presenting a rotated one again (`previous_refresh_token_hash`) revokes the whole
     grant, and so does reusing a code (RFC 6749 §4.1.2). `resource` (RFC 8707) must name the
@@ -595,12 +597,41 @@ None of its own. The endpoint URL comes from `appOrigin` in `softure.config.ts`.
 
 ## 7. Switches
 
-None. `allowWrites` is configuration, not a runtime switch: changing who may write is a deploy.
+`mcp-access.writes_enabled` (`WRITES_ENABLED_SWITCH`): a kill switch for writes, read through `readSwitch` of
+`@softure-ai/core` on every MCP request, consent page and decision. `allowWrites` stays the configuration (no
+writes at all without it); the switch takes writes away at once, without a deploy, when a token or a connected
+assistant is suspected of misuse. Off, write tools are not served (the factory gets `canWrite: false`), the
+challenge and the default OAuth scope name only `mcp:read`, and the consent page offers no write tick. Stored
+tokens and grants keep their write access, so turning the switch back on restores it without new consent.
+
+The app defines it in `@softure-ai/feature-switches`. Recommended: on by default, `failMode: "closed"` and
+`override: "towards-fail-mode"`, so the environment variable `SOFTURE_SWITCH_MCP_ACCESS_WRITES_ENABLED=false`
+can pull writes off but never push them back on:
+
+```ts
+featureSwitches({
+  switches: [
+    {
+      name: "mcp-access.writes_enabled",
+      label: { en: "Assistant writes" },
+      description: { en: "Lets AI assistants with write access change data. Off, every assistant reads only." },
+      default: true,
+      failMode: "closed",
+      override: "towards-fail-mode",
+    },
+  ],
+});
+```
+
+An app that does not define it (or has no feature-switches) keeps `allowWrites` alone. A switch read that throws
+counts as off and is logged by the switch's name. The stdio entry reads the switch once, when it starts.
 
 ## 8. Appearance
 
 `TokenManager` slots: `root`, `section`, `heading`, `text`, `list`, `item`, `itemHeader`, `badge`,
-`details`, `snippet`, `code`; `unstyled` renders structure only. Styling comes from
+`details`, `snippet`, `code`; `unstyled` renders structure only. `ConsentForm` and `ConsentError` slots: `root`,
+`details`, `term`, `value`, `target` (where the code goes), `note` (the hint under it), `actions`, `text`, `link`;
+`OAuthConsentPage` takes `classNames` and `unstyled` and passes them to both. Styling comes from
 `@softure-ai/ui` classes on the `--sft-*` tokens; the module ships no CSS of its own.
 
 ## 9. Copy

package/dist/index.d.ts

@@ -1,4 +1,10 @@
 export declare const MODULE_ID = "mcp-access";
+/**
+ * Name of the runtime switch that turns writes off without a deploy. Defined in
+ * `@softure-ai/feature-switches`, writes need it on as well as `allowWrites` and the token's write access;
+ * not defined, `allowWrites` alone decides.
+ */
+export declare const WRITES_ENABLED_SWITCH = "mcp-access.writes_enabled";
 /**
  * The rate limit bucket of `POST /api/mcp`, to spread into `security({ buckets })`: requests per
  * client address, counted before the token is verified. Every request counts, so the limit is for
@@ -104,7 +110,8 @@ export declare const mcpAccess: import("@softure-ai/core").ModuleFactory<{
         title: string;
         lead: string;
         app: string;
-        returnsTo: string;
+        redirectLabel: string;
+        redirectHint: string;
         account: string;
         access: string;
         readAccess: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,SAAS,eAAe,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;IAEjC;;;;OAIG;;;;;;CAE8D,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA4BpB,CAAC;AAEH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACvJ,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,SAAS,eAAe,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;IAEjC;;;;OAIG;;;;;;CAE8D,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA4BpB,CAAC;AAEH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACvJ,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -9,6 +9,12 @@ import { DEFAULT_MCP_ACCESS_ROUTES } from "./routes.js";
 import { checkAccessTokensTable } from "./server/health.js";
 import { mcpAccessPrivacyContributor } from "./server/privacy.js";
 export const MODULE_ID = "mcp-access";
+/**
+ * Name of the runtime switch that turns writes off without a deploy. Defined in
+ * `@softure-ai/feature-switches`, writes need it on as well as `allowWrites` and the token's write access;
+ * not defined, `allowWrites` alone decides.
+ */
+export const WRITES_ENABLED_SWITCH = "mcp-access.writes_enabled";
 /**
  * The rate limit bucket of `POST /api/mcp`, to spread into `security({ buckets })`: requests per
  * client address, counted before the token is verified. Every request counts, so the limit is for
@@ -30,12 +36,12 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.2.8",
+        version: "0.2.9",
         dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
         dbSchema: "mcp",
         tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window"],
         env: [],
-        switches: [],
+        switches: [WRITES_ENABLED_SWITCH],
         routes: { ...DEFAULT_MCP_ACCESS_ROUTES },
         mount: [
             { kind: "page", path: "app/account/mcp/page.tsx", export: "McpAccessPage" },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,kGAAkG;AAClG,kGAAkG;AAClG,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;IACjD;;;;OAIG;IACH,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;CACS,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;IACpC,QAAQ,EAAE;QACR,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;QAClF,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,2BAA2B,CAAC;QACpH,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,GAAG,yBAAyB,EAAE;QACxC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,eAAe,EAAE;YAC3E,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE;YACjF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAClF,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM,EAAE,+BAA+B,EAAE;YAC5G,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAClG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iCAAiC,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACtG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,qDAAqD,EAAE,MAAM,EAAE,qCAAqC,EAAE;YACrI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mDAAmD,EAAE,MAAM,EAAE,mCAAmC,EAAE;YACjI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,2DAA2D,EAAE,MAAM,EAAE,mCAAmC,EAAE;SAC1I;QACD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC1C;IACD,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,sBAAsB;IAC/B,UAAU,EAAE,EAAE,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;IAC5E,OAAO,EAAE,2BAA2B;IACpC,MAAM,EAAE,sBAAsB;CAC/B,CAAC,CAAC;AAEH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAgB3B,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,GASlC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAA0C,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAA0D,MAAM,aAAa,CAAC;AACvJ,OAAO,EAAE,oBAAoB,EAAiC,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,kGAAkG;AAClG,kGAAkG;AAClG,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;IACjD;;;;OAIG;IACH,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;CACS,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;IACpC,QAAQ,EAAE;QACR,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;QAClF,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,2BAA2B,CAAC;QACpH,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,CAAC,qBAAqB,CAAC;QACjC,MAAM,EAAE,EAAE,GAAG,yBAAyB,EAAE;QACxC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,eAAe,EAAE;YAC3E,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE;YACjF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAClF,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM,EAAE,+BAA+B,EAAE;YAC5G,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAClG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iCAAiC,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACtG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,qDAAqD,EAAE,MAAM,EAAE,qCAAqC,EAAE;YACrI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mDAAmD,EAAE,MAAM,EAAE,mCAAmC,EAAE;YACjI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,2DAA2D,EAAE,MAAM,EAAE,mCAAmC,EAAE;SAC1I;QACD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC1C;IACD,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,sBAAsB;IAC/B,UAAU,EAAE,EAAE,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;IAC5E,OAAO,EAAE,2BAA2B;IACpC,MAAM,EAAE,sBAAsB;CAC/B,CAAC,CAAC;AAEH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAgB3B,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,GASlC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAA0C,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAA0D,MAAM,aAAa,CAAC;AACvJ,OAAO,EAAE,oBAAoB,EAAiC,MAAM,mBAAmB,CAAC"}

package/dist/messages/en.d.ts

@@ -70,7 +70,8 @@ export declare const en: {
         title: string;
         lead: string;
         app: string;
-        returnsTo: string;
+        redirectLabel: string;
+        redirectHint: string;
         account: string;
         access: string;
         readAccess: string;

package/dist/messages/en.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkHd,CAAC"}
+{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmHd,CAAC"}

package/dist/messages/en.js

@@ -70,7 +70,8 @@ export const en = {
         title: "{client} wants access to your account",
         lead: "The assistant can answer questions with your data in this app. You can disconnect it at any time on the AI assistant access page.",
         app: "App",
-        returnsTo: "returns to {target}",
+        redirectLabel: "Access code goes to",
+        redirectHint: "The app chose its own name; this address is the one part it cannot fake. Allow only if you recognise it.",
         account: "Account",
         access: "Access",
         readAccess: "Read your data",

package/dist/messages/en.js.map

@@ -1 +1 @@
-{"version":3,"file":"en.js","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,uIAAuI;KAC9I;IACD,KAAK,EAAE;QACL,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,uDAAuD;QACjE,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,0CAA0C;QACxD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,yCAAyC;KACjD;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,uFAAuF;QAC7F,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,2BAA2B;QACrC,SAAS,EAAE,sCAAsC;QACjD,WAAW,EAAE,oCAAoC;QACjD,UAAU,EAAE,iGAAiG;QAC7G,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,gCAAgC;QAC9C,SAAS,EAAE,gDAAgD;QAC3D,YAAY,EAAE,6CAA6C;QAC3D,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,sBAAsB;KAC7B;IACD,KAAK,EAAE;QACL,eAAe,EAAE,6IAA6I;KAC/J;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,eAAe;QAC7B,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,wBAAwB;QACvC,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD,MAAM,EAAE;QACN,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,mHAAmH;QACzH,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,kBAAkB;QAC/B,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,gBAAgB;KAChC;IACD,OAAO,EAAE;QACP,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,mIAAmI;QACzI,GAAG,EAAE,KAAK;QACV,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,oBAAoB;QAChC,cAAc,EAAE,0CAA0C;QAC1D,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,mCAAmC;QAC/C,aAAa,EAAE,oFAAoF;QACnG,gBAAgB,EAAE,oGAAoG;QACtH,cAAc,EAAE,2DAA2D;QAC3E,cAAc,EAAE,wBAAwB;QACxC,SAAS,EAAE,4BAA4B;KACxC;IACD,SAAS,EAAE;QACT,aAAa,EAAE,wDAAwD;QACvE,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,4FAA4F;KAC3G;IACD,cAAc,EAAE;QACd,WAAW,EACT,4PAA4P;KAC/P;IACD,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,aAAa,EAAE,4DAA4D;YAC3E,aAAa,EAAE,uBAAuB;YACtC,mBAAmB,EAAE,sFAAsF;YAC3G,eAAe,EAAE,gEAAgE;YACjF,eAAe,EAAE,kCAAkC;YACnD,aAAa,EAAE,8CAA8C;YAC7D,aAAa,EAAE,wFAAwF;SACxG;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,uCAAuC;SACzD;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,0DAA0D;YAC3E,UAAU,EAAE,0DAA0D;SACvE;KACF;CACF,CAAC"}
+{"version":3,"file":"en.js","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,uIAAuI;KAC9I;IACD,KAAK,EAAE;QACL,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,uDAAuD;QACjE,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,0CAA0C;QACxD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,yCAAyC;KACjD;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,uFAAuF;QAC7F,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,2BAA2B;QACrC,SAAS,EAAE,sCAAsC;QACjD,WAAW,EAAE,oCAAoC;QACjD,UAAU,EAAE,iGAAiG;QAC7G,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,gCAAgC;QAC9C,SAAS,EAAE,gDAAgD;QAC3D,YAAY,EAAE,6CAA6C;QAC3D,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,sBAAsB;KAC7B;IACD,KAAK,EAAE;QACL,eAAe,EAAE,6IAA6I;KAC/J;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,eAAe;QAC7B,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,wBAAwB;QACvC,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD,MAAM,EAAE;QACN,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,mHAAmH;QACzH,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,kBAAkB;QAC/B,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,gBAAgB;KAChC;IACD,OAAO,EAAE;QACP,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,mIAAmI;QACzI,GAAG,EAAE,KAAK;QACV,aAAa,EAAE,qBAAqB;QACpC,YAAY,EAAE,0GAA0G;QACxH,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,oBAAoB;QAChC,cAAc,EAAE,0CAA0C;QAC1D,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,mCAAmC;QAC/C,aAAa,EAAE,oFAAoF;QACnG,gBAAgB,EAAE,oGAAoG;QACtH,cAAc,EAAE,2DAA2D;QAC3E,cAAc,EAAE,wBAAwB;QACxC,SAAS,EAAE,4BAA4B;KACxC;IACD,SAAS,EAAE;QACT,aAAa,EAAE,wDAAwD;QACvE,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,4FAA4F;KAC3G;IACD,cAAc,EAAE;QACd,WAAW,EACT,4PAA4P;KAC/P;IACD,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,aAAa,EAAE,4DAA4D;YAC3E,aAAa,EAAE,uBAAuB;YACtC,mBAAmB,EAAE,sFAAsF;YAC3G,eAAe,EAAE,gEAAgE;YACjF,eAAe,EAAE,kCAAkC;YACnD,aAAa,EAAE,8CAA8C;YAC7D,aAAa,EAAE,wFAAwF;SACxG;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,uCAAuC;SACzD;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,0DAA0D;YAC3E,UAAU,EAAE,0DAA0D;SACvE;KACF;CACF,CAAC"}

package/dist/messages/index.d.ts

@@ -74,7 +74,8 @@ export declare const mcpAccessMessages: {
             title: string;
             lead: string;
             app: string;
-            returnsTo: string;
+            redirectLabel: string;
+            redirectHint: string;
             account: string;
             access: string;
             readAccess: string;

package/dist/messages/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/messages/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAE7B,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAS,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;AAE1C,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAOlG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/messages/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAE7B,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAS,CAAC;AAExC,MAAM,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;AAE1C,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAOlG"}

package/dist/next/oauth-page.d.ts

@@ -1,7 +1,12 @@
+import { type ClassNames } from "@softure-ai/ui";
+import { type ConsentFormSlot } from "../ui/consent-form.js";
 type SearchParams = Promise<Record<string, string | string[] | undefined>>;
 export interface OAuthConsentPageProps {
     readonly searchParams?: SearchParams;
+    /** Restyles the form or the error, passed to `ConsentForm` and `ConsentError`. */
+    readonly classNames?: ClassNames<ConsentFormSlot>;
+    readonly unstyled?: boolean;
 }
-export declare function OAuthConsentPage({ searchParams }: OAuthConsentPageProps): Promise<import("react").JSX.Element>;
+export declare function OAuthConsentPage({ searchParams, classNames, unstyled }: OAuthConsentPageProps): Promise<import("react").JSX.Element>;
 export {};
 //# sourceMappingURL=oauth-page.d.ts.map

package/dist/next/oauth-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-page.d.ts","sourceRoot":"","sources":["../../src/next/oauth-page.tsx"],"names":[],"mappings":"AAiBA,KAAK,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAID,wBAAsB,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,qBAAqB,wCA0C7E"}
+{"version":3,"file":"oauth-page.d.ts","sourceRoot":"","sources":["../../src/next/oauth-page.tsx"],"names":[],"mappings":"AASA,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAKvD,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxF,KAAK,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAID,wBAAsB,gBAAgB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,qBAAqB,wCA6CnG"}

package/dist/next/oauth-page.js

@@ -12,11 +12,12 @@ import { Card } from "@softure-ai/ui";
 import { notFound } from "next/navigation";
 import { getConsentPath, isOAuthEnabled, readAuthorizationParams, validateAuthorizationRequest } from "../server/oauth-http.js";
 import { describeRedirectUri } from "../server/oauth-validation.js";
-import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
+import { getMcpAccessMessages, getMcpAccessRoutes } from "../server/options.js";
 import { ConsentError, ConsentForm } from "../ui/consent-form.js";
 import { getMcpAccessContext, getRequestOrigins } from "./context.js";
 const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-md sft:px-4 sft:py-4";
-export async function OAuthConsentPage({ searchParams }) {
+export async function OAuthConsentPage({ searchParams, classNames, unstyled }) {
+    const styling = { ...(classNames === undefined ? {} : { classNames }), ...(unstyled === undefined ? {} : { unstyled }) };
     const config = getSoftureConfig();
     if (!isOAuthEnabled(config))
         notFound();
@@ -28,9 +29,9 @@ export async function OAuthConsentPage({ searchParams }) {
     const outcome = await validateAuthorizationRequest(await getMcpAccessContext(config), params, origins);
     if (outcome.kind !== "valid") {
         const message = outcome.kind === "redirect-error" ? messages.consent.invalidRequest : outcome.reason === "unknown_client" ? messages.consent.unknownClient : messages.consent.redirectMismatch;
-        return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: messages.consent.errorTitle, children: _jsx(ConsentError, { message: message, ...(outcome.kind === "redirect-error" ? { backLocation: outcome.location, backTarget: describeRedirectUri(outcome.redirectUri) } : {}), messages: messages }) }) }));
+        return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: messages.consent.errorTitle, children: _jsx(ConsentError, { message: message, ...(outcome.kind === "redirect-error" ? { backLocation: outcome.location, backTarget: describeRedirectUri(outcome.redirectUri) } : {}), messages: messages, ...styling }) }) }));
     }
-    const { client, redirectUri, isWriteRequested } = outcome.request;
-    return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: formatMessage(messages.consent.title, { client: client.clientName }), subtitle: messages.consent.lead, children: _jsx(ConsentForm, { action: getMcpAccessRoutes(config).oauthDecision, params: [...params.entries()], clientName: client.clientName, redirectTarget: describeRedirectUri(redirectUri), accountEmail: user.email, isWriteOffered: isWriteRequested && getMcpAccessOptions(config).allowWrites, messages: messages }) }) }));
+    const { client, redirectUri, isWriteOffered } = outcome.request;
+    return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: formatMessage(messages.consent.title, { client: client.clientName }), subtitle: messages.consent.lead, children: _jsx(ConsentForm, { action: getMcpAccessRoutes(config).oauthDecision, params: [...params.entries()], clientName: client.clientName, redirectTarget: describeRedirectUri(redirectUri), accountEmail: user.email, isWriteOffered: isWriteOffered, messages: messages, ...styling }) }) }));
 }
 //# sourceMappingURL=oauth-page.js.map

package/dist/next/oauth-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-page.js","sourceRoot":"","sources":["../../src/next/oauth-page.tsx"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,+EAA+E;AAC/E,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,mFAAmF;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAChI,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQtE,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAE,YAAY,EAAyB;IAC5E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjL,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,YACtC,KAAC,YAAY,IACX,OAAO,EAAE,OAAO,KACZ,CAAC,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvI,QAAQ,EAAE,QAAQ,GAClB,GACG,GACF,CACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,YAChH,KAAC,WAAW,IACV,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,aAAa,EAChD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,EAC7B,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,cAAc,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAChD,YAAY,EAAE,IAAI,CAAC,KAAK,EACxB,cAAc,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,WAAW,EAC3E,QAAQ,EAAE,QAAQ,GAClB,GACG,GACF,CACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-page.js","sourceRoot":"","sources":["../../src/next/oauth-page.tsx"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,+EAA+E;AAC/E,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,mFAAmF;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAmB,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAChI,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAwB,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAyB;IAClG,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjL,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,YACtC,KAAC,YAAY,IACX,OAAO,EAAE,OAAO,KACZ,CAAC,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvI,QAAQ,EAAE,QAAQ,KACd,OAAO,GACX,GACG,GACF,CACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAChE,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,YAChH,KAAC,WAAW,IACV,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,aAAa,EAChD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,EAC7B,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,cAAc,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAChD,YAAY,EAAE,IAAI,CAAC,KAAK,EACxB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,QAAQ,KACd,OAAO,GACX,GACG,GACF,CACR,CAAC;AACJ,CAAC"}

package/dist/server/endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;CACzC;AAED,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmCnF"}
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;CACzC;AAED,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmCnF"}

package/dist/server/endpoint.js

@@ -7,10 +7,10 @@ import { bearerAuthChallengeResponse, createMcpHandler, OAuthError, OAuthErrorCo
 import { errorLogLabel, getModule } from "@softure-ai/core";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
 import { getProtectedResourceMetadataUrl, isOAuthEnabled } from "./oauth-http.js";
-import { getMcpAccessOptions } from "./options.js";
 import { resolveMcpOrigins } from "./origins.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { verifyAccessToken } from "./tokens.js";
+import { isWritingEnabled } from "./writes-switch.js";
 export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
 /** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
 export const MCP_RATE_LIMIT_BUCKET = "mcp";
@@ -66,8 +66,10 @@ export function createMcpEndpoint({ createServer }) {
 async function authenticate(ctx, request) {
     const header = request.headers.get("authorization");
     // Clients request the challenge's scope first (MCP authorization, scope selection), so it names
-    // `mcp:write` while the app allows writes; the person's tick on the consent page still decides.
-    const requiredScopes = getMcpAccessOptions(ctx.config).allowWrites ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE];
+    // `mcp:write` while the app allows writes (`allowWrites` and the writes switch); the person's tick on
+    // the consent page still decides. Read once per request: the switch can change between requests.
+    const isWriteAllowed = await isWritingEnabled(ctx);
+    const requiredScopes = isWriteAllowed ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE];
     const challenge = isOAuthEnabled(ctx.config)
         ? { requiredScopes, resourceMetadataUrl: getProtectedResourceMetadataUrl(ctx.config, resolveMcpOrigins(ctx.config, request)) }
         : { requiredScopes };
@@ -90,7 +92,7 @@ async function authenticate(ctx, request) {
         token,
         // The client is the token: it is what gets revoked, and its id may be logged.
         clientId: verified.tokenId,
-        scopes: verified.canWrite ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE],
+        scopes: verified.canWrite && isWriteAllowed ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE],
         // AuthInfo counts seconds; Date counts milliseconds.
         expiresAt: Math.floor(verified.expiresAt.getTime() / 1000),
         extra: { [USER_ID_CLAIM]: verified.userId },

package/dist/server/endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,OAAgB;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,gGAAgG;IAChG,gGAAgG;IAChG,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1H,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE;QAC9H,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,OAAgB;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,gGAAgG;IAChG,sGAAsG;IACtG,iGAAiG;IACjG,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE;QAC9H,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAClG,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -1,6 +1,7 @@
 export { createMcpEndpoint, MAX_MCP_REQUEST_BYTES, MCP_RATE_LIMIT_BUCKET, MCP_READ_SCOPE, MCP_WRITE_SCOPE, type McpEndpoint, type McpEndpointOptions, type McpServerFactory, } from "./endpoint.js";
 export { actionTool, toFormData, type ActionToolOptions, type FormActionHandler } from "./action-tool.js";
 export { createMcpAccessContext } from "./context.js";
+export { isWritingEnabled } from "./writes-switch.js";
 export { checkAccessTokensTable } from "./health.js";
 export { closeClientRegistration, findClientRegistrationWindow, isClientRegistrationOpen, MAX_REGISTRATION_WINDOW_MINUTES, openClientRegistration, type ClientRegistrationWindow, type OpenClientRegistrationInput, } from "./registration-window.js";
 export { CONSENT_CODE_PREFIX, CLIENT_SECRET_PREFIX, createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, listOAuthGrants, pruneOAuthRecords, REFRESH_TOKEN_PREFIX, refreshMcpGrant, registerMcpClient, revokeOAuthGrant, type CreateAuthorizationCodeInput, type ExchangeAuthorizationCodeInput, type IssuedOAuthTokens, type OAuthClientRegistration, type PrunedOAuthRecords, type RefreshOAuthGrantInput, type RegisteredOAuthClient, type RevokeOAuthGrantInput, } from "./oauth.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtI,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtI,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC"}

package/dist/server/index.js

@@ -3,6 +3,7 @@
 export { createMcpEndpoint, MAX_MCP_REQUEST_BYTES, MCP_RATE_LIMIT_BUCKET, MCP_READ_SCOPE, MCP_WRITE_SCOPE, } from "./endpoint.js";
 export { actionTool, toFormData } from "./action-tool.js";
 export { createMcpAccessContext } from "./context.js";
+export { isWritingEnabled } from "./writes-switch.js";
 export { checkAccessTokensTable } from "./health.js";
 export { closeClientRegistration, findClientRegistrationWindow, isClientRegistrationOpen, MAX_REGISTRATION_WINDOW_MINUTES, openClientRegistration, } from "./registration-window.js";
 export { CONSENT_CODE_PREFIX, CLIENT_SECRET_PREFIX, createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, listOAuthGrants, pruneOAuthRecords, REFRESH_TOKEN_PREFIX, refreshMcpGrant, registerMcpClient, revokeOAuthGrant, } from "./oauth.js";

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAA+B,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAgC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAA6D,MAAM,mBAAmB,CAAC;AACtI,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,GAOf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAA+B,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAgC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAA6D,MAAM,mBAAmB,CAAC;AACtI,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,GAOf,MAAM,YAAY,CAAC"}

package/dist/server/oauth-http.d.ts

@@ -85,6 +85,11 @@ export interface AuthorizationRequest {
     readonly codeChallenge: string;
     /** The client asked for `mcp:write`. */
     readonly isWriteRequested: boolean;
+    /**
+     * Writes are on offer: the client asked for them (or sent no scope while writes are allowed) and the
+     * app allows writes right now (`allowWrites` and the `mcp-access.writes_enabled` switch).
+     */
+    readonly isWriteOffered: boolean;
 }
 /** Why the consent page shows an error instead of sending one back: the client is not confirmed. */
 export type AuthorizationPageError = "unknown_client" | "redirect_mismatch";

package/dist/server/oauth-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIhF,OAAO,EAA6C,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAgBnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAC5F,6FAA6F;AAC7F,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,eAAO,MAAM,YAAY,oCAA6C,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,kIAAmI,CAAC;AA4BrK,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAE/C;AAKD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE7G;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE9H;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D;AAQD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC;;;;;;;;;;;;EAkBpH;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,GAAE,UAAsC,EAC/C,YAAY,GAAE,MAAM,GAAG,IAAW;;;;;;EAWnC;AAED,kGAAkG;AAClG,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAAK,OAAO,CAAC;AAE1H,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,GAAE,gBAAgB,GAAG,IAAW,GAAG,QAAQ,CAG5I;AAED,gHAAgH;AAChH,eAAO,MAAM,gCAAgC,EAAE,iBAC8E,CAAC;AAE9H;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,UAAsC,GAAG,OAAO,CAI7I;AAED,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEnE;AAuED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsCzG;AA2CD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwBnG;AAmCD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EAC/C,OAAO,GAAE,UAAsC,GAC9C,MAAM,CAMR;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,eAAe,CAO/F;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,UAA0C,GAClD,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAErF;AAmCD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgCnI"}
+{"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIhF,OAAO,EAA6C,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAgBnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAC5F,6FAA6F;AAC7F,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,eAAO,MAAM,YAAY,oCAA6C,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,kIAAmI,CAAC;AA4BrK,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAE/C;AAKD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE7G;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE9H;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D;AAQD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC;;;;;;;;;;;;EAkBpH;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,GAAE,UAAsC,EAC/C,YAAY,GAAE,MAAM,GAAG,IAAW;;;;;;EAWnC;AAED,kGAAkG;AAClG,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAAK,OAAO,CAAC;AAE1H,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,GAAE,gBAAgB,GAAG,IAAW,GAAG,QAAQ,CAG5I;AAED,gHAAgH;AAChH,eAAO,MAAM,gCAAgC,EAAE,iBAC8E,CAAC;AAE9H;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,UAAsC,GAAG,OAAO,CAI7I;AAED,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEnE;AAwED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsCzG;AA2CD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwBnG;AAmCD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EAC/C,OAAO,GAAE,UAAsC,GAC9C,MAAM,CAMR;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,eAAe,CAO/F;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,UAA0C,GAClD,OAAO,CAAC,oBAAoB,CAAC,CAuB/B;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAErF;AAmCD;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgCnI"}

package/dist/server/oauth-http.js

@@ -14,6 +14,7 @@ import { getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./op
 import { resolveMcpOrigins } from "./origins.js";
 import { isClientRegistrationOpen } from "./registration-window.js";
 import { isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
+import { isWritingEnabled } from "./writes-switch.js";
 /** The security bucket OAuth registration and token requests count in. */
 export const MCP_OAUTH_RATE_LIMIT_BUCKET = "mcp-oauth";
 /** RFC 8414 §3: the authorization server metadata, at the root of the issuer. */
@@ -137,11 +138,12 @@ export function isWriteScopeRequested(scope) {
 }
 /**
  * Whether the request asks to write, where a missing or blank `scope` is the server's default
- * (RFC 6749 §3.3): both scopes while the app allows writes, `mcp:read` otherwise.
+ * (RFC 6749 §3.3): both scopes while the app allows writes (`allowWrites` and the writes switch),
+ * `mcp:read` otherwise.
  */
-function isWriteRequestedOrDefault(config, scope) {
+function isWriteRequestedOrDefault(isWriteAllowed, scope) {
     if (scope === null || scope.trim() === "")
-        return getMcpAccessOptions(config).allowWrites;
+        return isWriteAllowed;
     return isWriteScopeRequested(scope);
 }
 // ---------------------------------------------------------------------------------------------
@@ -382,7 +384,9 @@ export async function validateAuthorizationRequest(ctx, params, origins = resolv
     }
     if (!isAcceptableResource(ctx.config, params.get("resource"), origins))
         return back("invalid_target", "The resource parameter does not name this MCP server.");
-    return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteRequestedOrDefault(ctx.config, params.get("scope")) } };
+    const isWriteAllowed = await isWritingEnabled(ctx);
+    const isWriteRequested = isWriteRequestedOrDefault(isWriteAllowed, params.get("scope"));
+    return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested, isWriteOffered: isWriteRequested && isWriteAllowed } };
 }
 /** The consent page with the request's parameters: where the decision sends the person back. */
 export function getConsentPath(config, params) {
@@ -449,7 +453,7 @@ export async function handleAuthorizationDecision(ctx, request, userId) {
             return seeOther(consent);
         if (outcome.kind === "redirect-error")
             return seeOther(outcome.location);
-        const { client, redirectUri, state, codeChallenge, isWriteRequested } = outcome.request;
+        const { client, redirectUri, state, codeChallenge, isWriteOffered } = outcome.request;
         if (form.get("decision") !== "allow") {
             return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }, origins));
         }
@@ -458,8 +462,8 @@ export async function handleAuthorizationDecision(ctx, request, userId) {
             userId,
             redirectUri,
             codeChallenge,
-            // Writes need the client's request, the app's allowWrites and the person's tick.
-            canWrite: isWriteRequested && getMcpAccessOptions(ctx.config).allowWrites && form.get("canWrite") !== null,
+            // Writes need the client's request, the app's allowWrites, the writes switch and the person's tick.
+            canWrite: isWriteOffered && form.get("canWrite") !== null,
         });
         return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }, origins));
     }

package/dist/server/oauth-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAA4B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAA0C,MAAM,eAAe,CAAC;AAElH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,2FAA2F;AAC3F,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;AAEtH,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnG,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACpH,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxI,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,SAA2C,EAAE,OAAmB;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACzF,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,OAA4B,EAC5B,UAAsB,iBAAiB,CAAC,MAAM,CAAC,EAC/C,eAA8B,IAAI;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;QACrD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACvF,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAChG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA2B,EAAE,UAAmC,IAAI;IAChI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC9F,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAClI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC1J,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,MAAqB,EAAE,KAAoB;IAC5E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAC1F,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,iBAAiB;AAEjB,iIAAiI;AACjI,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAgB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,aAAa,CAAC,iBAAiB,EAAE,mCAAmC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACnJ,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf,qGAAqG;AACrG,KAAK,UAAU,wBAAwB,CAAC,GAAqB;IAC3D,IAAI,CAAC;QACH,IAAI,MAAM,wBAAwB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0EAA0E,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,eAAe,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,yBAAyB,EAAE,CAAC;QACzD,kFAAkF;QAClF,OAAO,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAgB;IACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,WAAmB,EACnB,MAA+C,EAC/C,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,MAAuB,EACvB,UAAsB,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAC/J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,yBAAyB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;AACjK,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1G,OAAO,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,OAAgB;IACrE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,iFAAiF;YACjF,QAAQ,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC3G,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAA4B,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAA0C,MAAM,eAAe,CAAC;AAElH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAExF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAErK,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;CACpF,CAAC;AACF,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrE,2FAA2F;AAC3F,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;AAEtH,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG,EAAE,QAA0C,EAAE;IACnH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,YAAY;AAEZ;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnG,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACpH,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gCAAgC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxI,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,SAA2C,EAAE,OAAmB;IACrF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAqB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACzF,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE;QACzD,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE;QAC/C,qBAAqB,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE;QACzD,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QAC5F,sEAAsE;QACtE,gCAAgC,EAAE,CAAC,WAAW,CAAC;QAC/C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,OAA4B,EAC5B,UAAsB,iBAAiB,CAAC,MAAM,CAAC,EAC/C,eAA8B,IAAI;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;QACrD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACvF,QAAQ,EAAE,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAChG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAA2B,EAAE,UAAmC,IAAI;IAChI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC9F,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9H;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,QAAuB,EAAE,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAClI,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC1J,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,cAAuB,EAAE,KAAoB;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,cAAc,CAAC;IACjE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,gGAAgG;AAChG,aAAa;AAEb,qGAAqG;AACrG,SAAS,0BAA0B,CAAC,MAAqB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,uDAAuD,2BAA2B,oEAAoE,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAqB,EAAE,OAAgB,EAAE,WAA0B,IAAI;IACzG,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,aAAa,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,iBAAiB;AAEjB,iIAAiI;AACjI,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAgB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,aAAa,CAAC,iBAAiB,EAAE,mCAAmC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACnJ,CAAC;AAED,gGAAgG;AAChG,eAAe;AAEf,qGAAqG;AACrG,KAAK,UAAU,wBAAwB,CAAC,GAAqB;IAC3D,IAAI,CAAC;QACH,IAAI,MAAM,wBAAwB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0EAA0E,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,aAAa,CAAC,yBAAyB,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,eAAe,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAqB,EAAE,OAAgB;IACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,YAAY,CACjB;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;YAC1D,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;SAC/F,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,aAAa,CAAC,cAAc,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,mHAAmH;AACnH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,IAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,YAAY,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,cAAc;KACjF,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,aAAa,GAAG,kFAAkF,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgB;IAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,aAAa,CAAC,WAAW,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,yBAAyB,EAAE,CAAC;QACzD,kFAAkF;QAClF,OAAO,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACvH,OAAO,aAAa,CAAC,gBAAgB,EAAE,6CAA6C,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4DAA4D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,aAAa,CAAC,cAAc,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW,CAAC,GAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAgB;IACvF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACjF,OAAO,aAAa,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3H,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,aAAa,CAAC,wBAAwB,EAAE,8DAA8D,CAAC,CAAC;AACjH,CAAC;AA2BD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,WAAmB,EACnB,MAA+C,EAC/C,UAAsB,iBAAiB,CAAC,MAAM,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC5E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAqB,EACrB,MAAuB,EACvB,UAAsB,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAwB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,gBAAgB;QACtB,WAAW;QACX,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC;KAClH,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC1H,OAAO,IAAI,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;IAC/J,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,cAAc,EAAE,EAAE,CAAC;AACzJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,MAAuB;IAC3E,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAmB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;IAC1G,OAAO,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,OAAgB;IACrE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAqB,EAAE,OAAgB,EAAE,MAAqB;IAC9G,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEzE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACtF,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;YAC9C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM;YACN,WAAW;YACX,aAAa;YACb,oGAAoG;YACpG,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI;SAC1D,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+DAA+D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/server/writes-switch.d.ts

@@ -0,0 +1,8 @@
+import type { McpAccessContext } from "./tokens.js";
+/**
+ * Whether the app lets anyone write right now: `allowWrites` and the switch (on when the app does not
+ * define it). Without `allowWrites` the switch is not read. A read that throws counts as off (writes
+ * are the risky side) and is logged by the switch's name.
+ */
+export declare function isWritingEnabled(ctx: McpAccessContext): Promise<boolean>;
+//# sourceMappingURL=writes-switch.d.ts.map

package/dist/server/writes-switch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writes-switch.d.ts","sourceRoot":"","sources":["../../src/server/writes-switch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAS9E"}

package/dist/server/writes-switch.js

@@ -0,0 +1,25 @@
+// The runtime kill switch for writes. `mcp-access.writes_enabled` is read through the switch-reader
+// contract of `@softure-ai/core` on every request: when the app defines it in
+// `@softure-ai/feature-switches`, turning it off takes writes away at once, without a deploy. An app that
+// does not define it keeps `allowWrites` alone.
+import { errorLogLabel, readSwitch } from "@softure-ai/core";
+import { WRITES_ENABLED_SWITCH } from "../index.js";
+import { getMcpAccessOptions } from "./options.js";
+/**
+ * Whether the app lets anyone write right now: `allowWrites` and the switch (on when the app does not
+ * define it). Without `allowWrites` the switch is not read. A read that throws counts as off (writes
+ * are the risky side) and is logged by the switch's name.
+ */
+export async function isWritingEnabled(ctx) {
+    if (!getMcpAccessOptions(ctx.config).allowWrites)
+        return false;
+    try {
+        const reading = await readSwitch(ctx, WRITES_ENABLED_SWITCH);
+        return reading.kind === "undeclared" || reading.isEnabled;
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: reading the ${WRITES_ENABLED_SWITCH} switch failed, writes are off: ${errorLogLabel(error)}`);
+        return false;
+    }
+}
+//# sourceMappingURL=writes-switch.js.map

package/dist/server/writes-switch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writes-switch.js","sourceRoot":"","sources":["../../src/server/writes-switch.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,8EAA8E;AAC9E,0GAA0G;AAC1G,gDAAgD;AAChD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAqB;IAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,qBAAqB,mCAAmC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrI,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/stdio/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG,8BAA8B,GAAG,6BAA6B,GAAG,oCAAoC,GAAG,kCAAkC,CAAC;AAE3K,8GAA8G;AAC9G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3I,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACvF;AAED,uGAAuG;AACvG,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoD1F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG,8BAA8B,GAAG,6BAA6B,GAAG,oCAAoC,GAAG,kCAAkC,CAAC;AAE3K,8GAA8G;AAC9G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3I,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACvF;AAED,uGAAuG;AACvG,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkD1F"}

package/dist/stdio/serve.js

@@ -1,8 +1,8 @@
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { resolveOnlyAccount } from "@softure-ai/auth/server";
-import { errorLogLabel } from "@softure-ai/core";
+import { errorLogLabel, systemClock } from "@softure-ai/core";
 import { openCommandDatabase } from "@softure-ai/db";
-import { getMcpAccessOptions } from "../server/options.js";
+import { isWritingEnabled } from "../server/writes-switch.js";
 /** The variable naming the account to serve, unless the entry is told another one. */
 export const DEFAULT_MCP_USER_ID_ENV = "MCP_USER_ID";
 /** The token id the factory receives over stdio, where there is no token. */
@@ -27,11 +27,9 @@ export async function serveMcpStdio(options) {
         await database.close();
         return { ok: false, error: userId };
     }
-    const identity = {
-        userId,
-        canWrite: (options.allowWrites ?? false) && getMcpAccessOptions(config).allowWrites,
-        tokenId: STDIO_TOKEN_ID,
-    };
+    // The writes switch is read once, at start: a stdio server serves one local session.
+    const canWrite = (options.allowWrites ?? false) && (await isWritingEnabled({ db: database.handle.db, clock: systemClock, config }));
+    const identity = { userId, canWrite, tokenId: STDIO_TOKEN_ID };
     let closed = false;
     const closeDatabase = async () => {
         if (closed)

package/dist/stdio/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAkD,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAkCtC,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,8BAA8B,EAAE,yDAAyD,CAAC,CAAC;IACvI,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5H,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAsB;QAClC,MAAM;QACN,QAAQ,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,WAAW;QACnF,OAAO,EAAE,cAAc;KACxB,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;QAC9D,SAAS;QACT,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0DAA0D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KACpH,CAAC,CAAC;IACH,mGAAmG;IACnG,8DAA8D;IAC9D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC;IACxC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;QACvB,aAAa,EAAE,EAAE,CAAC;QAClB,KAAK,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,cAAc,CAAC,QAAyB,EAAE,GAAgC,EAAE,SAAiB;IAC1G,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IACvC,QAAQ,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,2BAA2B,SAAS,mBAAmB,EAAE,CAAC;QACxH,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;QAC1H,KAAK,wBAAwB;YAC3B,OAAO;gBACL,IAAI,EAAE,oCAAoC;gBAC1C,OAAO,EAAE,kEAAkE,SAAS,gCAAgC;aACrH,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAuB,EAAE,MAAc;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,MAAM,EAAE,EAAE,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAkD,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAkCtC,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,8BAA8B,EAAE,yDAAyD,CAAC,CAAC;IACvI,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5H,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,qFAAqF;IACrF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACpI,MAAM,QAAQ,GAAsB,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAClF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;QAC9D,SAAS;QACT,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0DAA0D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KACpH,CAAC,CAAC;IACH,mGAAmG;IACnG,8DAA8D;IAC9D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC;IACxC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;QACvB,aAAa,EAAE,EAAE,CAAC;QAClB,KAAK,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,cAAc,CAAC,QAAyB,EAAE,GAAgC,EAAE,SAAiB;IAC1G,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IACvC,QAAQ,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,2BAA2B,SAAS,mBAAmB,EAAE,CAAC;QACxH,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;QAC1H,KAAK,wBAAwB;YAC3B,OAAO;gBACL,IAAI,EAAE,oCAAoC;gBAC1C,OAAO,EAAE,kEAAkE,SAAS,gCAAgC;aACrH,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAuB,EAAE,MAAc;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,MAAM,EAAE,EAAE,EAAE,CAAC;AACtF,CAAC"}

package/dist/ui/consent-form.d.ts

@@ -1,6 +1,6 @@
 import { type ClassNames } from "@softure-ai/ui";
 import type { McpAccessMessages } from "../messages/index.js";
-export type ConsentFormSlot = "root" | "details" | "term" | "value" | "note" | "actions" | "text" | "link";
+export type ConsentFormSlot = "root" | "details" | "term" | "value" | "target" | "note" | "actions" | "text" | "link";
 export interface ConsentFormProps {
     /** The decision route the form posts to. */
     readonly action: string;
@@ -10,7 +10,7 @@ export interface ConsentFormProps {
     /** Where the code goes: the host for http(s), the whole URI for a native scheme. */
     readonly redirectTarget: string;
     readonly accountEmail: string;
-    /** Offer the change checkbox: the client asked for `mcp:write` and the app allows writes. */
+    /** Offer the change checkbox: the client asked for `mcp:write` and the app allows writes right now. */
     readonly isWriteOffered: boolean;
     readonly messages: McpAccessMessages;
     readonly classNames?: ClassNames<ConsentFormSlot>;

package/dist/ui/consent-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-form.d.ts","sourceRoot":"","sources":["../../src/ui/consent-form.tsx"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,UAAU,EAAyB,MAAM,gBAAgB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQ9D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3G,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAaD,wBAAgB,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,gBAAgB,+BAmCzJ;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,iBAAiB,+BAepH"}
+{"version":3,"file":"consent-form.d.ts","sourceRoot":"","sources":["../../src/ui/consent-form.tsx"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,UAAU,EAAyB,MAAM,gBAAgB,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQ9D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uGAAuG;IACvG,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAcD,wBAAgB,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,gBAAgB,+BAsCzJ;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,iBAAiB,+BAepH"}

package/dist/ui/consent-form.js

@@ -6,7 +6,8 @@ const DEFAULT_CLASSES = {
     details: "sft:m-0 sft:flex sft:flex-col sft:gap-3 sft:text-sm",
     term: "sft:text-muted",
     value: "sft:m-0 sft:font-medium sft:text-foreground",
-    note: "sft:font-normal sft:text-muted",
+    target: "sft:m-0 sft:font-mono sft:font-medium sft:text-foreground sft:break-words",
+    note: "sft:m-0 sft:mt-1 sft:text-xs sft:font-normal sft:text-muted",
     actions: "sft:flex sft:flex-col sft:gap-3",
     text: "sft:m-0 sft:text-sm sft:text-muted",
     link: "sft:font-medium sft:text-accent",
@@ -14,7 +15,7 @@ const DEFAULT_CLASSES = {
 export function ConsentForm({ action, params, clientName, redirectTarget, accountEmail, isWriteOffered, messages, classNames, unstyled }) {
     const slot = createSlotClassGetter({ defaults: DEFAULT_CLASSES, classNames, unstyled });
     const copy = messages.consent;
-    return (_jsxs("form", { method: "post", action: action, className: slot("root"), children: [params.map(([name, value]) => (_jsx("input", { type: "hidden", name: name, value: value }, name))), _jsxs("dl", { className: slot("details"), children: [_jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.app }), _jsxs("dd", { className: slot("value"), children: [clientName, " ", _jsxs("span", { className: slot("note"), children: ["(", formatMessage(copy.returnsTo, { target: redirectTarget }), ")"] })] })] }), _jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.account }), _jsx("dd", { className: slot("value"), children: accountEmail })] }), _jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.access }), _jsx("dd", { className: slot("value"), children: copy.readAccess })] })] }), isWriteOffered ? _jsx(Checkbox, { name: "canWrite", label: copy.allowWrite, description: copy.allowWriteHint, unstyled: unstyled }) : null, _jsxs("div", { className: slot("actions"), children: [_jsx(Button, { type: "submit", name: "decision", value: "allow", variant: "primary", size: "lg", fullWidth: true, unstyled: unstyled, children: copy.allow }), _jsx(Button, { type: "submit", name: "decision", value: "deny", variant: "secondary", size: "lg", fullWidth: true, unstyled: unstyled, children: copy.deny })] })] }));
+    return (_jsxs("form", { method: "post", action: action, className: slot("root"), children: [params.map(([name, value]) => (_jsx("input", { type: "hidden", name: name, value: value }, name))), _jsxs("dl", { className: slot("details"), children: [_jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.app }), _jsx("dd", { className: slot("value"), children: clientName })] }), _jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.redirectLabel }), _jsx("dd", { className: slot("target"), children: redirectTarget }), _jsx("dd", { className: slot("note"), children: copy.redirectHint })] }), _jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.account }), _jsx("dd", { className: slot("value"), children: accountEmail })] }), _jsxs("div", { children: [_jsx("dt", { className: slot("term"), children: copy.access }), _jsx("dd", { className: slot("value"), children: copy.readAccess })] })] }), isWriteOffered ? _jsx(Checkbox, { name: "canWrite", label: copy.allowWrite, description: copy.allowWriteHint, unstyled: unstyled }) : null, _jsxs("div", { className: slot("actions"), children: [_jsx(Button, { type: "submit", name: "decision", value: "allow", variant: "primary", size: "lg", fullWidth: true, unstyled: unstyled, children: copy.allow }), _jsx(Button, { type: "submit", name: "decision", value: "deny", variant: "secondary", size: "lg", fullWidth: true, unstyled: unstyled, children: copy.deny })] })] }));
 }
 /** Why the request cannot go on. Nothing was granted; going back to the client is the person's click. */
 export function ConsentError({ message, backLocation, backTarget, messages, classNames, unstyled }) {

package/dist/ui/consent-form.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-form.js","sourceRoot":"","sources":["../../src/ui/consent-form.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAmB,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA2B1F,MAAM,eAAe,GAA8C;IACjE,IAAI,EAAE,+CAA+C;IACrD,OAAO,EAAE,qDAAqD;IAC9D,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,6CAA6C;IACpD,IAAI,EAAE,gCAAgC;IACtC,OAAO,EAAE,iCAAiC;IAC1C,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,iCAAiC;CACxC,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAoB;IACxJ,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,OAAO,CACL,gBAAM,MAAM,EAAC,MAAM,EAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACxD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAC7B,gBAAkB,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAA5C,IAAI,CAA4C,CAC7D,CAAC,EACF,cAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAC5B,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,GAAG,GAAM,EAC5C,cAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,aACzB,UAAU,OAAE,gBAAM,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAI,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,SAAS,IAC7G,IACD,EACN,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,OAAO,GAAM,EAChD,aAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,YAAY,GAAM,IAC7C,EACN,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,MAAM,GAAM,EAC/C,aAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,IAAI,CAAC,UAAU,GAAM,IAChD,IACH,EACJ,cAAc,CAAC,CAAC,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,EACnI,eAAK,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAC7B,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAC,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,IAAI,EAAC,IAAI,EAAC,SAAS,QAAC,QAAQ,EAAE,QAAQ,YACzG,IAAI,CAAC,KAAK,GACJ,EACT,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,SAAS,QAAC,QAAQ,EAAE,QAAQ,YAC1G,IAAI,CAAC,IAAI,GACH,IACL,IACD,CACR,CAAC;AACJ,CAAC;AAYD,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAqB;IACnH,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,OAAO,CACL,eAAK,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC1B,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,OAAO,GAAK,EACzC,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAK,EAChE,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAC/D,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,YAAG,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAC3C,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAChE,GACF,CACL,IACG,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"consent-form.js","sourceRoot":"","sources":["../../src/ui/consent-form.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAmB,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA2B1F,MAAM,eAAe,GAA8C;IACjE,IAAI,EAAE,+CAA+C;IACrD,OAAO,EAAE,qDAAqD;IAC9D,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,2EAA2E;IACnF,IAAI,EAAE,6DAA6D;IACnE,OAAO,EAAE,iCAAiC;IAC1C,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,iCAAiC;CACxC,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAoB;IACxJ,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,OAAO,CACL,gBAAM,MAAM,EAAC,MAAM,EAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aACxD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAC7B,gBAAkB,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAA5C,IAAI,CAA4C,CAC7D,CAAC,EACF,cAAI,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAC5B,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,GAAG,GAAM,EAC5C,aAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,UAAU,GAAM,IAC3C,EACN,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,aAAa,GAAM,EACtD,aAAI,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAG,cAAc,GAAM,EACpD,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,YAAY,GAAM,IACjD,EACN,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,OAAO,GAAM,EAChD,aAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,YAAY,GAAM,IAC7C,EACN,0BACE,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,CAAC,MAAM,GAAM,EAC/C,aAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAG,IAAI,CAAC,UAAU,GAAM,IAChD,IACH,EACJ,cAAc,CAAC,CAAC,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,EACnI,eAAK,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAC7B,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAC,OAAO,EAAC,OAAO,EAAC,SAAS,EAAC,IAAI,EAAC,IAAI,EAAC,SAAS,QAAC,QAAQ,EAAE,QAAQ,YACzG,IAAI,CAAC,KAAK,GACJ,EACT,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,EAAC,SAAS,QAAC,QAAQ,EAAE,QAAQ,YAC1G,IAAI,CAAC,IAAI,GACH,IACL,IACD,CACR,CAAC;AACJ,CAAC;AAYD,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAqB;IACnH,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,OAAO,CACL,eAAK,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC1B,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,OAAO,GAAK,EACzC,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAK,EAChE,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAC/D,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,YAAG,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAC3C,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAChE,GACF,CACL,IACG,CACP,CAAC;AACJ,CAAC"}

package/module.json

@@ -1,11 +1,11 @@
 {
   "id": "mcp-access",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "dependsOn": { "security": "^0.2.0", "auth": "^0.2.0", "jobs": "^0.1.1?", "ops": "^0.2.0?" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window"],
   "env": [],
-  "switches": [],
+  "switches": ["mcp-access.writes_enabled"],
   "routes": {
     "page": "/account/mcp",
     "endpoint": "/api/mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js; tool result helpers with a safe error boundary, a stdio entry, a catalog parity check and the softure-mcp prune command.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -12,6 +12,13 @@ import { mcpAccessPrivacyContributor } from "./server/privacy.js";
 
 export const MODULE_ID = "mcp-access";
 
+/**
+ * Name of the runtime switch that turns writes off without a deploy. Defined in
+ * `@softure-ai/feature-switches`, writes need it on as well as `allowWrites` and the token's write access;
+ * not defined, `allowWrites` alone decides.
+ */
+export const WRITES_ENABLED_SWITCH = "mcp-access.writes_enabled";
+
 /**
  * The rate limit bucket of `POST /api/mcp`, to spread into `security({ buckets })`: requests per
  * client address, counted before the token is verified. Every request counts, so the limit is for
@@ -34,12 +41,12 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.2.8",
+    version: "0.2.9",
     dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window"],
     env: [],
-    switches: [],
+    switches: [WRITES_ENABLED_SWITCH],
     routes: { ...DEFAULT_MCP_ACCESS_ROUTES },
     mount: [
       { kind: "page", path: "app/account/mcp/page.tsx", export: "McpAccessPage" },

package/src/messages/en.ts

@@ -70,7 +70,8 @@ export const en = {
     title: "{client} wants access to your account",
     lead: "The assistant can answer questions with your data in this app. You can disconnect it at any time on the AI assistant access page.",
     app: "App",
-    returnsTo: "returns to {target}",
+    redirectLabel: "Access code goes to",
+    redirectHint: "The app chose its own name; this address is the one part it cannot fake. Allow only if you recognise it.",
     account: "Account",
     access: "Access",
     readAccess: "Read your data",

package/src/next/oauth-page.tsx

@@ -7,23 +7,27 @@
 import { requireUser } from "@softure-ai/auth/next";
 import { formatMessage } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
-import { Card } from "@softure-ai/ui";
+import { Card, type ClassNames } from "@softure-ai/ui";
 import { notFound } from "next/navigation";
 import { getConsentPath, isOAuthEnabled, readAuthorizationParams, validateAuthorizationRequest } from "../server/oauth-http.js";
 import { describeRedirectUri } from "../server/oauth-validation.js";
-import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
-import { ConsentError, ConsentForm } from "../ui/consent-form.js";
+import { getMcpAccessMessages, getMcpAccessRoutes } from "../server/options.js";
+import { ConsentError, ConsentForm, type ConsentFormSlot } from "../ui/consent-form.js";
 import { getMcpAccessContext, getRequestOrigins } from "./context.js";
 
 type SearchParams = Promise<Record<string, string | string[] | undefined>>;
 
 export interface OAuthConsentPageProps {
   readonly searchParams?: SearchParams;
+  /** Restyles the form or the error, passed to `ConsentForm` and `ConsentError`. */
+  readonly classNames?: ClassNames<ConsentFormSlot>;
+  readonly unstyled?: boolean;
 }
 
 const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-md sft:px-4 sft:py-4";
 
-export async function OAuthConsentPage({ searchParams }: OAuthConsentPageProps) {
+export async function OAuthConsentPage({ searchParams, classNames, unstyled }: OAuthConsentPageProps) {
+  const styling = { ...(classNames === undefined ? {} : { classNames }), ...(unstyled === undefined ? {} : { unstyled }) };
   const config = getSoftureConfig();
   if (!isOAuthEnabled(config)) notFound();
   const query = (await searchParams) ?? {};
@@ -43,13 +47,14 @@ export async function OAuthConsentPage({ searchParams }: OAuthConsentPageProps)
             message={message}
             {...(outcome.kind === "redirect-error" ? { backLocation: outcome.location, backTarget: describeRedirectUri(outcome.redirectUri) } : {})}
             messages={messages}
+            {...styling}
           />
         </Card>
       </main>
     );
   }
 
-  const { client, redirectUri, isWriteRequested } = outcome.request;
+  const { client, redirectUri, isWriteOffered } = outcome.request;
   return (
     <main className={LAYOUT_CLASS}>
       <Card title={formatMessage(messages.consent.title, { client: client.clientName })} subtitle={messages.consent.lead}>
@@ -59,8 +64,9 @@ export async function OAuthConsentPage({ searchParams }: OAuthConsentPageProps)
           clientName={client.clientName}
           redirectTarget={describeRedirectUri(redirectUri)}
           accountEmail={user.email}
-          isWriteOffered={isWriteRequested && getMcpAccessOptions(config).allowWrites}
+          isWriteOffered={isWriteOffered}
           messages={messages}
+          {...styling}
         />
       </Card>
     </main>

package/src/server/endpoint.ts

@@ -16,10 +16,10 @@ import { errorLogLabel, getModule } from "@softure-ai/core";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
 import type { McpServerIdentity } from "../contract.js";
 import { getProtectedResourceMetadataUrl, isOAuthEnabled } from "./oauth-http.js";
-import { getMcpAccessOptions } from "./options.js";
 import { resolveMcpOrigins } from "./origins.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { verifyAccessToken, type McpAccessContext } from "./tokens.js";
+import { isWritingEnabled } from "./writes-switch.js";
 
 export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
 
@@ -97,8 +97,10 @@ export function createMcpEndpoint({ createServer }: McpEndpointOptions): McpEndp
 async function authenticate(ctx: McpAccessContext, request: Request): Promise<AuthInfo | Response> {
   const header = request.headers.get("authorization");
   // Clients request the challenge's scope first (MCP authorization, scope selection), so it names
-  // `mcp:write` while the app allows writes; the person's tick on the consent page still decides.
-  const requiredScopes = getMcpAccessOptions(ctx.config).allowWrites ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE];
+  // `mcp:write` while the app allows writes (`allowWrites` and the writes switch); the person's tick on
+  // the consent page still decides. Read once per request: the switch can change between requests.
+  const isWriteAllowed = await isWritingEnabled(ctx);
+  const requiredScopes = isWriteAllowed ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE];
   const challenge = isOAuthEnabled(ctx.config)
     ? { requiredScopes, resourceMetadataUrl: getProtectedResourceMetadataUrl(ctx.config, resolveMcpOrigins(ctx.config, request)) }
     : { requiredScopes };
@@ -121,7 +123,7 @@ async function authenticate(ctx: McpAccessContext, request: Request): Promise<Au
     token,
     // The client is the token: it is what gets revoked, and its id may be logged.
     clientId: verified.tokenId,
-    scopes: verified.canWrite ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE],
+    scopes: verified.canWrite && isWriteAllowed ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE],
     // AuthInfo counts seconds; Date counts milliseconds.
     expiresAt: Math.floor(verified.expiresAt.getTime() / 1000),
     extra: { [USER_ID_CLAIM]: verified.userId },

package/src/server/index.ts

@@ -12,6 +12,7 @@ export {
 } from "./endpoint.js";
 export { actionTool, toFormData, type ActionToolOptions, type FormActionHandler } from "./action-tool.js";
 export { createMcpAccessContext } from "./context.js";
+export { isWritingEnabled } from "./writes-switch.js";
 export { checkAccessTokensTable } from "./health.js";
 export {
   closeClientRegistration,

package/src/server/oauth-http.ts

@@ -25,6 +25,7 @@ import { resolveMcpOrigins } from "./origins.js";
 import { isClientRegistrationOpen } from "./registration-window.js";
 import { isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 import type { McpAccessContext } from "./tokens.js";
+import { isWritingEnabled } from "./writes-switch.js";
 
 /** The security bucket OAuth registration and token requests count in. */
 export const MCP_OAUTH_RATE_LIMIT_BUCKET = "mcp-oauth";
@@ -175,10 +176,11 @@ export function isWriteScopeRequested(scope: string | null): boolean {
 
 /**
  * Whether the request asks to write, where a missing or blank `scope` is the server's default
- * (RFC 6749 §3.3): both scopes while the app allows writes, `mcp:read` otherwise.
+ * (RFC 6749 §3.3): both scopes while the app allows writes (`allowWrites` and the writes switch),
+ * `mcp:read` otherwise.
  */
-function isWriteRequestedOrDefault(config: SoftureConfig, scope: string | null): boolean {
-  if (scope === null || scope.trim() === "") return getMcpAccessOptions(config).allowWrites;
+function isWriteRequestedOrDefault(isWriteAllowed: boolean, scope: string | null): boolean {
+  if (scope === null || scope.trim() === "") return isWriteAllowed;
   return isWriteScopeRequested(scope);
 }
 
@@ -399,6 +401,11 @@ export interface AuthorizationRequest {
   readonly codeChallenge: string;
   /** The client asked for `mcp:write`. */
   readonly isWriteRequested: boolean;
+  /**
+   * Writes are on offer: the client asked for them (or sent no scope while writes are allowed) and the
+   * app allows writes right now (`allowWrites` and the `mcp-access.writes_enabled` switch).
+   */
+  readonly isWriteOffered: boolean;
 }
 
 /** Why the consent page shows an error instead of sending one back: the client is not confirmed. */
@@ -467,7 +474,9 @@ export async function validateAuthorizationRequest(
     return back("invalid_request", "PKCE is required: code_challenge with code_challenge_method S256.");
   }
   if (!isAcceptableResource(ctx.config, params.get("resource"), origins)) return back("invalid_target", "The resource parameter does not name this MCP server.");
-  return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteRequestedOrDefault(ctx.config, params.get("scope")) } };
+  const isWriteAllowed = await isWritingEnabled(ctx);
+  const isWriteRequested = isWriteRequestedOrDefault(isWriteAllowed, params.get("scope"));
+  return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested, isWriteOffered: isWriteRequested && isWriteAllowed } };
 }
 
 /** The consent page with the request's parameters: where the decision sends the person back. */
@@ -531,7 +540,7 @@ export async function handleAuthorizationDecision(ctx: McpAccessContext, request
     if (outcome.kind === "show-error") return seeOther(consent);
     if (outcome.kind === "redirect-error") return seeOther(outcome.location);
 
-    const { client, redirectUri, state, codeChallenge, isWriteRequested } = outcome.request;
+    const { client, redirectUri, state, codeChallenge, isWriteOffered } = outcome.request;
     if (form.get("decision") !== "allow") {
       return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }, origins));
     }
@@ -540,8 +549,8 @@ export async function handleAuthorizationDecision(ctx: McpAccessContext, request
       userId,
       redirectUri,
       codeChallenge,
-      // Writes need the client's request, the app's allowWrites and the person's tick.
-      canWrite: isWriteRequested && getMcpAccessOptions(ctx.config).allowWrites && form.get("canWrite") !== null,
+      // Writes need the client's request, the app's allowWrites, the writes switch and the person's tick.
+      canWrite: isWriteOffered && form.get("canWrite") !== null,
     });
     return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }, origins));
   } catch (error) {

package/src/server/writes-switch.ts

@@ -0,0 +1,24 @@
+// The runtime kill switch for writes. `mcp-access.writes_enabled` is read through the switch-reader
+// contract of `@softure-ai/core` on every request: when the app defines it in
+// `@softure-ai/feature-switches`, turning it off takes writes away at once, without a deploy. An app that
+// does not define it keeps `allowWrites` alone.
+import { errorLogLabel, readSwitch } from "@softure-ai/core";
+import { WRITES_ENABLED_SWITCH } from "../index.js";
+import { getMcpAccessOptions } from "./options.js";
+import type { McpAccessContext } from "./tokens.js";
+
+/**
+ * Whether the app lets anyone write right now: `allowWrites` and the switch (on when the app does not
+ * define it). Without `allowWrites` the switch is not read. A read that throws counts as off (writes
+ * are the risky side) and is logged by the switch's name.
+ */
+export async function isWritingEnabled(ctx: McpAccessContext): Promise<boolean> {
+  if (!getMcpAccessOptions(ctx.config).allowWrites) return false;
+  try {
+    const reading = await readSwitch(ctx, WRITES_ENABLED_SWITCH);
+    return reading.kind === "undeclared" || reading.isEnabled;
+  } catch (error) {
+    console.error(`@softure-ai/mcp-access: reading the ${WRITES_ENABLED_SWITCH} switch failed, writes are off: ${errorLogLabel(error)}`);
+    return false;
+  }
+}

package/src/stdio/serve.ts

@@ -8,11 +8,11 @@
 import type { Transport } from "@modelcontextprotocol/server";
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { resolveOnlyAccount } from "@softure-ai/auth/server";
-import { errorLogLabel, type SoftureConfig, type SoftureDatabaseConfig } from "@softure-ai/core";
+import { errorLogLabel, systemClock, type SoftureConfig, type SoftureDatabaseConfig } from "@softure-ai/core";
 import { openCommandDatabase, type CommandDatabase } from "@softure-ai/db";
 import type { McpServerIdentity } from "../contract.js";
 import type { McpServerFactory } from "../server/endpoint.js";
-import { getMcpAccessOptions } from "../server/options.js";
+import { isWritingEnabled } from "../server/writes-switch.js";
 
 /** The variable naming the account to serve, unless the entry is told another one. */
 export const DEFAULT_MCP_USER_ID_ENV = "MCP_USER_ID";
@@ -72,11 +72,9 @@ export async function serveMcpStdio(options: ServeMcpStdioOptions): Promise<McpS
     return { ok: false, error: userId };
   }
 
-  const identity: McpServerIdentity = {
-    userId,
-    canWrite: (options.allowWrites ?? false) && getMcpAccessOptions(config).allowWrites,
-    tokenId: STDIO_TOKEN_ID,
-  };
+  // The writes switch is read once, at start: a stdio server serves one local session.
+  const canWrite = (options.allowWrites ?? false) && (await isWritingEnabled({ db: database.handle.db, clock: systemClock, config }));
+  const identity: McpServerIdentity = { userId, canWrite, tokenId: STDIO_TOKEN_ID };
   let closed = false;
   const closeDatabase = async () => {
     if (closed) return;

package/src/ui/consent-form.tsx

@@ -2,13 +2,13 @@ import { formatMessage } from "@softure-ai/core";
 import { Button, Checkbox, type ClassNames, createSlotClassGetter } from "@softure-ai/ui";
 import type { McpAccessMessages } from "../messages/index.js";
 
-// The OAuth consent screen's body: which app (its registered name and where the code goes, which
-// the app cannot fake), which account (two accounts in one browser happen) and what access (read
+// The OAuth consent screen's body: which app (its self-declared name), where the code goes (its own
+// row: the one part the app cannot fake), which account (two accounts in one browser happen) and what access (read
 // always, change only when the client asked, the app allows it and the person ticks it). A plain
 // HTML form posting to the decision route, so the `303` to the client works without JavaScript and
 // with native app schemes. Server-safe: no hooks.
 
-export type ConsentFormSlot = "root" | "details" | "term" | "value" | "note" | "actions" | "text" | "link";
+export type ConsentFormSlot = "root" | "details" | "term" | "value" | "target" | "note" | "actions" | "text" | "link";
 
 export interface ConsentFormProps {
   /** The decision route the form posts to. */
@@ -19,7 +19,7 @@ export interface ConsentFormProps {
   /** Where the code goes: the host for http(s), the whole URI for a native scheme. */
   readonly redirectTarget: string;
   readonly accountEmail: string;
-  /** Offer the change checkbox: the client asked for `mcp:write` and the app allows writes. */
+  /** Offer the change checkbox: the client asked for `mcp:write` and the app allows writes right now. */
   readonly isWriteOffered: boolean;
   readonly messages: McpAccessMessages;
   readonly classNames?: ClassNames<ConsentFormSlot>;
@@ -31,7 +31,8 @@ const DEFAULT_CLASSES: Readonly<Record<ConsentFormSlot, string>> = {
   details: "sft:m-0 sft:flex sft:flex-col sft:gap-3 sft:text-sm",
   term: "sft:text-muted",
   value: "sft:m-0 sft:font-medium sft:text-foreground",
-  note: "sft:font-normal sft:text-muted",
+  target: "sft:m-0 sft:font-mono sft:font-medium sft:text-foreground sft:break-words",
+  note: "sft:m-0 sft:mt-1 sft:text-xs sft:font-normal sft:text-muted",
   actions: "sft:flex sft:flex-col sft:gap-3",
   text: "sft:m-0 sft:text-sm sft:text-muted",
   link: "sft:font-medium sft:text-accent",
@@ -48,9 +49,12 @@ export function ConsentForm({ action, params, clientName, redirectTarget, accoun
       <dl className={slot("details")}>
         <div>
           <dt className={slot("term")}>{copy.app}</dt>
-          <dd className={slot("value")}>
-            {clientName} <span className={slot("note")}>({formatMessage(copy.returnsTo, { target: redirectTarget })})</span>
-          </dd>
+          <dd className={slot("value")}>{clientName}</dd>
+        </div>
+        <div>
+          <dt className={slot("term")}>{copy.redirectLabel}</dt>
+          <dd className={slot("target")}>{redirectTarget}</dd>
+          <dd className={slot("note")}>{copy.redirectHint}</dd>
         </div>
         <div>
           <dt className={slot("term")}>{copy.account}</dt>