@superblocksteam/gateway 2.0.178-next.3 → 2.0.179-next.0

package/dist/auth/mcp-server-selection.js

@@ -0,0 +1,179 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { MCP_OAUTH_FILE_SUFFIX, McpOAuthStoreReadError, normalizeMcpServerUrl, } from "./mcp-oauth-session.js";
+const PLUGIN_SETTINGS_FILE = "plugin.json";
+/**
+ * The Superblocks server this computer's MCP plugin uses, kept as `serverUrl`
+ * in the plugin settings file the plugin launcher also reads. It is kept apart
+ * from the browser login saved for that server, so a removed, expired, or
+ * unreadable login never sends the plugin back to the default server, and a
+ * server the user writes into the file is used even while the saved login
+ * belongs to another server.
+ */
+export class McpServerSelectionStore {
+    filePath;
+    legacyFilePath;
+    constructor(filePath, legacyFilePath) {
+        this.filePath = filePath;
+        this.legacyFilePath = legacyFilePath;
+    }
+    /**
+     * The plugin settings file in the browser login file's directory. A
+     * selection saved before that file existed is moved into it on first read.
+     */
+    static beside(sessionFilePath) {
+        const base = sessionFilePath.endsWith(MCP_OAUTH_FILE_SUFFIX)
+            ? sessionFilePath.slice(0, -MCP_OAUTH_FILE_SUFFIX.length)
+            : sessionFilePath;
+        return new McpServerSelectionStore(join(dirname(sessionFilePath), PLUGIN_SETTINGS_FILE), `${base}.mcp-server`);
+    }
+    /**
+     * The server in use: the one the user chose, else the saved browser
+     * login's server, which is recorded as the choice unless the environment
+     * pinned it. The record is written under the login's lock so a concurrent
+     * sign-in cannot save a newer login between the read and the write.
+     */
+    async resolve(sessions) {
+        return sessions.withLock(async () => {
+            const chosen = await this.read();
+            if (chosen)
+                return chosen;
+            const login = await sessions.read().catch((error) => {
+                if (error instanceof McpOAuthStoreReadError)
+                    return undefined;
+                throw error;
+            });
+            if (login && !login.pinned)
+                await this.remember(login.serverUrl);
+            return login?.serverUrl;
+        });
+    }
+    /**
+     * The server a sign-in uses once the saved browser login is gone. A login
+     * the user chose is recorded first; one the environment pinned is not.
+     */
+    async withoutLogin(sessions) {
+        await this.resolve(sessions);
+        return this.read();
+    }
+    /** The selected origin, or undefined when none is saved or it is unusable. */
+    async read() {
+        try {
+            const settings = await readSettings(this.filePath);
+            if (settings?.serverUrl !== undefined) {
+                const chosen = McpServerSelectionStore.parse(settings);
+                await this.dropLegacySelection();
+                return chosen;
+            }
+        }
+        catch (error) {
+            logUnreadable(error, this.filePath);
+            return undefined;
+        }
+        return this.moveLegacySelection();
+    }
+    /** Saves the selection without failing the sign-in or switch that made it. */
+    async remember(serverUrl) {
+        try {
+            await this.save(serverUrl);
+        }
+        catch (error) {
+            console.error("MCP server selection was not saved", {
+                errorType: errorType(error),
+                filePath: this.filePath,
+            });
+        }
+    }
+    /** Writes `serverUrl` and keeps every other plugin setting as it was. */
+    async save(serverUrl) {
+        const selected = normalizeMcpServerUrl(serverUrl);
+        const settings = {
+            ...(await readSettings(this.filePath)),
+            serverUrl: selected,
+        };
+        await mkdir(dirname(this.filePath), { mode: 0o700, recursive: true });
+        const temporaryPath = `${this.filePath}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporaryPath, JSON.stringify(settings, null, 2), {
+                flag: "wx",
+                mode: 0o600,
+            });
+            await rename(temporaryPath, this.filePath);
+        }
+        finally {
+            await rm(temporaryPath, { force: true });
+        }
+        await this.dropLegacySelection();
+    }
+    /** Once plugin.json names a server, the old file must not bring back an older one. */
+    async dropLegacySelection() {
+        if (!this.legacyFilePath)
+            return;
+        await rm(this.legacyFilePath, { force: true }).catch((error) => {
+            console.error("Old MCP server selection was not removed", {
+                errorType: errorType(error),
+                filePath: this.legacyFilePath,
+            });
+        });
+    }
+    async moveLegacySelection() {
+        if (!this.legacyFilePath)
+            return undefined;
+        let serverUrl;
+        try {
+            const legacy = await readSettings(this.legacyFilePath);
+            if (!legacy)
+                return undefined;
+            serverUrl = McpServerSelectionStore.parse(legacy);
+        }
+        catch (error) {
+            logUnreadable(error, this.legacyFilePath);
+            return undefined;
+        }
+        await this.remember(serverUrl);
+        return serverUrl;
+    }
+    static parse(settings) {
+        if (typeof settings.serverUrl !== "string")
+            throw new TypeError("MCP server selection names no server.");
+        return normalizeMcpServerUrl(settings.serverUrl);
+    }
+}
+/** The settings object in a file, or undefined when the file does not exist. */
+async function readSettings(filePath) {
+    let contents;
+    try {
+        contents = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (errorType(error) === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    const settings = JSON.parse(contents);
+    if (!isRecord(settings))
+        throw new TypeError("MCP plugin settings are not a JSON object.");
+    return settings;
+}
+function logUnreadable(error, filePath) {
+    console.error("MCP server selection was not read", {
+        errorType: errorType(error),
+        filePath,
+    });
+}
+/**
+ * A system error's code, else the error's name. Never the message, which can
+ * quote the file's contents.
+ */
+function errorType(error) {
+    if (!(error instanceof Error))
+        return typeof error;
+    return "code" in error && typeof error.code === "string"
+        ? error.code
+        : error.name;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=mcp-server-selection.js.map

package/dist/auth/mcp-server-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-selection.js","sourceRoot":"","sources":["../../src/auth/mcp-server-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,qBAAqB,EAErB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAEvB,QAAQ;IACA,cAAc;IAFjC,YACW,QAAgB,EACR,cAAuB;wBAD/B,QAAQ;8BACA,cAAc;IAC9B,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CAAC,eAAuB;QACnC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC1D,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACzD,CAAC,CAAC,eAAe,CAAC;QACpB,OAAO,IAAI,uBAAuB,CAChC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,EACpD,GAAG,IAAI,aAAa,CACrB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,QAA8B;QAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC3D,IAAI,KAAK,YAAY,sBAAsB;oBAAE,OAAO,SAAS,CAAC;gBAC9D,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACjE,OAAO,KAAK,EAAE,SAAS,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,QAA8B;QAE9B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACvD,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACpC,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBAClD,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBAChE,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACnC,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QACjC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACtE,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACxD,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,QAAQ,EAAE,IAAI,CAAC,cAAc;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,QAAiC;QACpD,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;YACxC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,OAAO,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED,gFAAgF;AAChF,KAAK,UAAU,YAAY,CACzB,QAAgB;IAEhB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrB,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,QAAgB;IACrD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE;QACjD,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;QAC3B,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,OAAO,KAAK,CAAC;IACnD,OAAO,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/native-oauth.d.ts

@@ -0,0 +1,33 @@
+export interface NativeOAuthConfig {
+    audience: string;
+    clientId: string;
+    issuerUrl: string;
+    organization?: string;
+}
+export interface OAuthTokens {
+    accessToken: string;
+    expiresAt: number;
+    refreshToken?: string;
+}
+export declare class OAuthRefreshError extends Error {
+}
+export declare class NativeOAuthClient {
+    private readonly config;
+    private readonly options;
+    constructor(config: NativeOAuthConfig, options?: {
+        fetch?: typeof fetch;
+        now?: () => number;
+    });
+    refresh(refreshToken: string): Promise<OAuthTokens>;
+    authorize({ forceLogin, openBrowser, redirectPort, timeoutMs, signal, }: {
+        forceLogin?: boolean;
+        openBrowser: (url: string) => Promise<void>;
+        redirectPort?: number;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<OAuthTokens>;
+    private configuration;
+    private httpsUrl;
+    private tokens;
+}
+//# sourceMappingURL=native-oauth.d.ts.map

package/dist/auth/native-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-oauth.d.ts","sourceRoot":"","sources":["../../src/auth/native-oauth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAF1B,YACmB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO,EACzE;IAEE,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAYxD;IAEK,SAAS,CAAC,EACd,UAAkB,EAClB,WAAW,EACX,YAAmB,EACnB,SAAmB,EACnB,MAAM,GACP,EAAE;QACD,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,WAAW,CAAC,CAyGvB;YAEa,aAAa;IAsC3B,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,MAAM;CAwBf"}

package/dist/auth/native-oauth.js

@@ -0,0 +1,181 @@
+import { once } from "node:events";
+import { createServer } from "node:http";
+import * as oidc from "openid-client";
+export class OAuthRefreshError extends Error {
+}
+export class NativeOAuthClient {
+    config;
+    options;
+    constructor(config, options = {}) {
+        this.config = config;
+        this.options = options;
+    }
+    async refresh(refreshToken) {
+        try {
+            const configuration = await this.configuration();
+            const tokens = await oidc.refreshTokenGrant(configuration, refreshToken);
+            return this.tokens(tokens, tokens.refresh_token ?? refreshToken);
+        }
+        catch (error) {
+            console.error("MCP OAuth refresh failed", {
+                errorType: error instanceof Error ? error.name : typeof error,
+                pid: process.pid,
+            });
+            throw new OAuthRefreshError("OAuth refresh failed. Sign in again.");
+        }
+    }
+    async authorize({ forceLogin = false, openBrowser, redirectPort = 8485, timeoutMs = 120_000, signal, }) {
+        const state = oidc.randomState();
+        const callback = Promise.withResolvers();
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        const timeout = setTimeout(abort, timeoutMs);
+        signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted)
+            abort();
+        const interrupted = new Promise((_resolve, reject) => {
+            const rejectAbort = () => reject(new Error("OAuth sign-in interrupted."));
+            if (controller.signal.aborted)
+                rejectAbort();
+            else
+                controller.signal.addEventListener("abort", rejectAbort, {
+                    once: true,
+                });
+        });
+        let redirectUri = "";
+        const server = createServer((request, response) => {
+            const url = URL.parse(request.url ?? "/", redirectUri);
+            if (!url || url.origin !== new URL(redirectUri).origin) {
+                response.writeHead(400).end("Invalid OAuth callback.");
+                return;
+            }
+            if (request.method !== "GET" || url.pathname !== "/callback") {
+                response.writeHead(404).end();
+                return;
+            }
+            if (url.searchParams.getAll("state").length !== 1 ||
+                url.searchParams.get("state") !== state) {
+                response.writeHead(400).end("Invalid OAuth callback.");
+                return;
+            }
+            callback.resolve(url);
+            response.end("Sign-in response received. Return to your MCP client.");
+        });
+        const signIn = async () => {
+            controller.signal.throwIfAborted();
+            const configuration = await this.configuration(controller.signal);
+            const verifier = oidc.randomPKCECodeVerifier();
+            const challenge = await oidc.calculatePKCECodeChallenge(verifier);
+            const nonce = oidc.randomNonce();
+            controller.signal.throwIfAborted();
+            server.listen(redirectPort, "127.0.0.1");
+            await once(server, "listening");
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Unable to start the OAuth callback listener.");
+            }
+            redirectUri = `http://127.0.0.1:${address.port}/callback`;
+            const authorizationUrl = oidc.buildAuthorizationUrl(configuration, {
+                audience: this.config.audience,
+                code_challenge: challenge,
+                code_challenge_method: "S256",
+                nonce,
+                ...(forceLogin ? { prompt: "login" } : {}),
+                redirect_uri: redirectUri,
+                scope: "openid profile email offline_access",
+                state,
+                ...(this.config.organization && {
+                    organization: this.config.organization,
+                }),
+            });
+            await openBrowser(authorizationUrl.href);
+            controller.signal.throwIfAborted();
+            const tokens = await oidc.authorizationCodeGrant(configuration, await callback.promise, {
+                expectedNonce: nonce,
+                expectedState: state,
+                pkceCodeVerifier: verifier,
+            });
+            if (this.config.organization &&
+                tokens.claims()?.org_id !== this.config.organization) {
+                throw new Error("OAuth organization does not match this deployment.");
+            }
+            return tokens;
+        };
+        let tokens;
+        try {
+            tokens = await Promise.race([signIn(), interrupted]);
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw new Error("OAuth sign-in cancelled.");
+            if (controller.signal.aborted)
+                throw new Error("OAuth sign-in timed out.");
+            console.error("MCP OAuth sign-in failed", {
+                errorType: error instanceof Error ? error.name : typeof error,
+                pid: process.pid,
+            });
+            throw new Error("OAuth sign-in failed. Please try again.");
+        }
+        finally {
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", abort);
+            abort();
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+        return this.tokens(tokens);
+    }
+    async configuration(signal) {
+        const issuer = this.httpsUrl(this.config.issuerUrl);
+        if (issuer.search)
+            throw new Error("Invalid OAuth issuer URL.");
+        const configuration = await oidc.discovery(issuer, this.config.clientId, undefined, oidc.None(), {
+            timeout: 30,
+            [oidc.customFetch]: (url, options) => (this.options.fetch ?? fetch)(url, {
+                ...options,
+                // lib.dom's BodyInit rejects Uint8Array<ArrayBufferLike>; Node's fetch accepts it.
+                body: options.body,
+                ...(signal && {
+                    signal: AbortSignal.any([
+                        signal,
+                        ...(options.signal ? [options.signal] : []),
+                    ]),
+                }),
+            }),
+        });
+        const metadata = configuration.serverMetadata();
+        for (const endpoint of [
+            metadata.authorization_endpoint,
+            metadata.token_endpoint,
+            metadata.jwks_uri,
+        ]) {
+            this.httpsUrl(endpoint);
+        }
+        oidc.enableNonRepudiationChecks(configuration);
+        return configuration;
+    }
+    httpsUrl(value) {
+        const url = new URL(value ?? "");
+        if (url.protocol !== "https:" || url.username || url.password || url.hash) {
+            throw new Error("Invalid OAuth provider URL.");
+        }
+        return url;
+    }
+    tokens(tokens, refreshToken = tokens.refresh_token) {
+        if (refreshToken !== undefined && !refreshToken.trim())
+            throw new Error("OAuth response returned an invalid refresh token.");
+        if (!tokens.access_token.trim() || tokens.token_type !== "bearer")
+            throw new Error("OAuth response did not return a usable bearer token.");
+        if (typeof tokens.expires_in !== "number" || tokens.expires_in <= 0)
+            throw new Error("OAuth response is missing a valid access token expiration.");
+        const expiresAt = (this.options.now ?? Date.now)() + tokens.expires_in * 1000;
+        if (!Number.isFinite(expiresAt))
+            throw new Error("OAuth response is missing a valid access token expiration.");
+        return {
+            accessToken: tokens.access_token,
+            expiresAt,
+            ...(refreshToken !== undefined && { refreshToken }),
+        };
+    }
+}
+//# sourceMappingURL=native-oauth.js.map

package/dist/auth/native-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-oauth.js","sourceRoot":"","sources":["../../src/auth/native-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAetC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,MAAM,OAAO,iBAAiB;IAET,MAAM;IACN,OAAO;IAF1B,YACmB,MAAyB,EACzB,OAAO,GAAiD,EAAE;sBAD1D,MAAM;uBACN,OAAO;IACvB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;gBAC7D,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EACd,UAAU,GAAG,KAAK,EAClB,WAAW,EACX,YAAY,GAAG,IAAI,EACnB,SAAS,GAAG,OAAO,EACnB,MAAM,GAOP;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAO,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YAC1D,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC1E,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,WAAW,EAAE,CAAC;;gBAE3C,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE;oBACvD,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;YACvD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;gBACvD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7D,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IACE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;gBAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EACvC,CAAC;gBACD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtB,QAAQ,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;YACxB,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAC;YAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE;gBACjE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,KAAK;gBACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,qCAAqC;gBAC5C,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI;oBAC9B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;iBACvC,CAAC;aACH,CAAC,CAAC;YACH,MAAM,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzC,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC9C,aAAa,EACb,MAAM,QAAQ,CAAC,OAAO,EACtB;gBACE,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,QAAQ;aAC3B,CACF,CAAC;YACF,IACE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACxB,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,EACpD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,IAAI,MAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACjE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAC3B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;gBAC7D,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CACxC,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,SAAS,EACT,IAAI,CAAC,IAAI,EAAE,EACX;YACE,OAAO,EAAE,EAAE;YACX,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CACnC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;gBACjC,GAAG,OAAO;gBACV,mFAAmF;gBACnF,IAAI,EAAE,OAAO,CAAC,IAA2B;gBACzC,GAAG,CAAC,MAAM,IAAI;oBACZ,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;wBACtB,MAAM;wBACN,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5C,CAAC;iBACH,CAAC;aACH,CAAC;SACL,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI;YACrB,QAAQ,CAAC,sBAAsB;YAC/B,QAAQ,CAAC,cAAc;YACvB,QAAQ,CAAC,QAAQ;SAClB,EAAE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,KAAyB;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,MAAM,CACZ,MAAkC,EAClC,YAAY,GAAG,MAAM,CAAC,aAAa;QAEnC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACpD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ;YAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,MAAM,SAAS,GACb,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,SAAS;YACT,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/branching.d.ts

@@ -0,0 +1,139 @@
+import { type CapabilityContext } from "./lifecycle.js";
+import type { CapabilityResult } from "./types.js";
+export declare function listBranches(ctx: CapabilityContext, input: {
+    applicationId?: string;
+}): Promise<CapabilityResult<{
+    applicationId: string;
+    branch: string;
+    branchingEnabled: boolean;
+    mainHead: string | null;
+    mode: import("@superblocksteam/shared").WorkspaceMode;
+    branches: {
+        name: string;
+        ownerId: string | null;
+        ownerName: string | null;
+        holderId: string | null;
+        holderName: string | null;
+        upstream: string | null;
+        ahead: number;
+        behind: number;
+        merged: boolean;
+        heldByTeammate: boolean;
+    }[];
+}>>;
+export declare function getBranchStatus(ctx: CapabilityContext, input: {
+    applicationId?: string;
+}): Promise<CapabilityResult<{
+    branch: string;
+    branchHead: string | null;
+    mainHead: string | null;
+    branchingEnabled: boolean;
+    upstream: string | null;
+    ahead: number;
+    behind: number;
+    behindMain: number;
+    pendingMerge: boolean;
+    conflictCount: number;
+    conflictPaths: string[];
+    landPending: boolean;
+    hasUncommittedChanges: boolean;
+    upToDateTargets: string[];
+    mode: import("@superblocksteam/shared").WorkspaceMode;
+    applicationId: string;
+    agentInstructions?: string | undefined;
+}>>;
+export declare function enableBranching(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    name: string;
+}): Promise<CapabilityResult<{
+    applicationId: string;
+    created: string;
+    branch: string;
+}>>;
+export declare function createBranch(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    base: string;
+    name: string;
+}): Promise<CapabilityResult<{
+    applicationId: string;
+    created: string;
+    upstream: string;
+    branch: string;
+}>>;
+export declare function pullBranch(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    target?: string;
+}): Promise<CapabilityResult<{
+    outcome: 'up-to-date' | 'clean' | 'conflict';
+    commitId?: string;
+    contextNote: string;
+    incomingCount: number;
+    conflicts: string[];
+    applicationId: string;
+    branch: string;
+    agentInstructions?: string | undefined;
+}>>;
+export declare function mergeBranch(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    source?: string;
+    target?: string;
+}): Promise<CapabilityResult<Record<string, unknown>>>;
+export declare function deleteBranch(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    force: boolean;
+    name: string;
+}): Promise<CapabilityResult<{
+    applicationId: string;
+    deleted: string;
+    branch: string;
+}>>;
+export declare function switchBranch(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    branch: string;
+}): Promise<CapabilityResult<Record<string, unknown>>>;
+export declare function compareBranches(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    other?: string;
+}): Promise<CapabilityResult<Record<string, unknown>>>;
+export declare function getCurrentPublish(ctx: CapabilityContext, input: {
+    applicationId?: string;
+}): Promise<CapabilityResult<{
+    applicationId: string;
+    active: {
+        commitId: string;
+        branch: string | null;
+        message: string | null;
+        by: string | null;
+        byTheUser: boolean;
+        at: string;
+        status: import("@superblocksteam/shared").ActivePublishStatus;
+    } | null;
+    last: {
+        commitId: string;
+        branch: string | null;
+        message: string | null;
+        by: string | null;
+        byTheUser: boolean;
+        at: string;
+        isLive: boolean;
+    } | null;
+}>>;
+export declare function listVersions(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    limit: number;
+}): Promise<CapabilityResult<{
+    applicationId: string;
+    branch: string;
+    versions: {
+        commitId: string;
+        message: string;
+        author: string;
+        at: string;
+        kind: string;
+    }[];
+}>>;
+export declare function restoreVersion(ctx: CapabilityContext, input: {
+    applicationId?: string;
+    commitId: string;
+}): Promise<CapabilityResult<Record<string, unknown>>>;
+//# sourceMappingURL=branching.d.ts.map

package/dist/capabilities/branching.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branching.d.ts","sourceRoot":"","sources":["../../src/capabilities/branching.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,iBAAiB,EAIvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,YAAY,CAAC;AA4HtE,wBAAgB,YAAY,CAC1B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;IAyBlC;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;IA+BlC;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;;;;IAoBhD;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;;;;;IAyB9D;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;IAmCnD;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,sDA2GpE;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;;;;IA8BhE;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,sDAmDlD;AAID,wBAAgB,eAAe,CAC7B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,sDAwFlD;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;IA2BlC;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;IAsBjD;AAED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,sDAmDpD"}