@xurenxiang1219/pingcode-mcp 0.3.1

package/dist/auth/pingcode-oauth-provider.js

@@ -0,0 +1,414 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { InvalidGrantError, InvalidScopeError, InvalidTargetError, InvalidTokenError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { OAuthClientInformationFullSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { z } from "zod";
+const READ_SCOPE = "pingcode:read";
+const WRITE_SCOPE = "pingcode:write";
+const CALLBACK_COOKIE = "pingcode_mcp_oauth_state";
+const AUTH_TRANSACTION_TTL_SECONDS = 10 * 60;
+const AUTHORIZATION_CODE_TTL_SECONDS = 5 * 60;
+const transactionSchema = z.object({
+    clientId: z.string(),
+    redirectUri: z.url(),
+    codeChallenge: z.string(),
+    scopes: z.array(z.string()),
+    resource: z.url(),
+    mcpState: z.string().optional(),
+});
+const pingCodeTokensSchema = z.object({
+    accessToken: z.string().min(1),
+    refreshToken: z.string().min(1),
+    expiresAtMs: z.number().int().positive(),
+});
+const authorizationCodeSchema = transactionSchema.extend({
+    pingCodeTokens: pingCodeTokensSchema,
+});
+const tokenBindingSchema = z.object({
+    sessionId: z.string(),
+    clientId: z.string(),
+    scopes: z.array(z.string()),
+    resource: z.url(),
+    expiresAtSeconds: z.number().int().positive(),
+    pairedTokenHash: z.string(),
+});
+const sessionSchema = z.object({
+    pingCodeTokens: pingCodeTokensSchema,
+});
+export class PingCodeOAuthProvider {
+    clientsStore;
+    scope = READ_SCOPE;
+    scopes;
+    resourceUrl;
+    callbackUrl;
+    supportsCimd;
+    store;
+    pingCodeClient;
+    accessTokenTtlSeconds;
+    refreshTokenTtlSeconds;
+    dcrClientTtlSeconds;
+    logger;
+    cimdClientResolver;
+    now;
+    secureCookies;
+    constructor(options) {
+        this.store = options.store;
+        this.pingCodeClient = options.pingCodeClient;
+        this.resourceUrl = new URL("/mcp", `${options.publicBaseUrl}/`);
+        this.callbackUrl = new URL("/auth/pingcode/callback", `${options.publicBaseUrl}/`);
+        this.accessTokenTtlSeconds = options.accessTokenTtlSeconds;
+        this.refreshTokenTtlSeconds = options.refreshTokenTtlSeconds;
+        this.dcrClientTtlSeconds = options.dcrClientTtlSeconds ?? 365 * 24 * 60 * 60;
+        this.cimdClientResolver = options.cimdClientResolver;
+        this.supportsCimd = options.cimdClientResolver !== undefined;
+        this.logger = options.logger;
+        this.now = options.now ?? Date.now;
+        this.secureCookies = new URL(options.publicBaseUrl).protocol === "https:";
+        this.scopes = [READ_SCOPE, WRITE_SCOPE];
+        this.clientsStore = {
+            getClient: (clientId) => this.getClient(clientId),
+            registerClient: (client) => this.registerClient(client),
+        };
+    }
+    async authorize(client, params, response) {
+        this.validateResource(params.resource);
+        const scopes = this.validateScopes(params.scopes);
+        this.logger.info("開始 PingCode 使用者 OAuth 授權", {
+            clientReference: digest(client.client_id).slice(0, 12),
+            scopeCount: scopes.length,
+        });
+        const transactionId = secureToken();
+        await this.store.set(this.transactionKey(transactionId), {
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            codeChallenge: params.codeChallenge,
+            scopes,
+            resource: this.resourceUrl.href,
+            ...(params.state === undefined ? {} : { mcpState: params.state }),
+        }, AUTH_TRANSACTION_TTL_SECONDS);
+        response.cookie(CALLBACK_COOKIE, transactionId, {
+            httpOnly: true,
+            secure: this.secureCookies,
+            sameSite: "lax",
+            maxAge: AUTH_TRANSACTION_TTL_SECONDS * 1000,
+            path: this.callbackUrl.pathname,
+        });
+        response.redirect(302, this.pingCodeClient.createAuthorizationUrl(transactionId).href);
+    }
+    async handlePingCodeCallback(request, response) {
+        response.setHeader("Cache-Control", "no-store");
+        const queryState = singleQueryValue(request.query.state);
+        const cookieState = parseCookies(request.headers.cookie)[CALLBACK_COOKIE];
+        response.clearCookie(CALLBACK_COOKIE, {
+            httpOnly: true,
+            secure: this.secureCookies,
+            sameSite: "lax",
+            path: this.callbackUrl.pathname,
+        });
+        if (queryState && cookieState && queryState !== cookieState) {
+            response.status(400).send("PingCode OAuth state 驗證失敗");
+            return;
+        }
+        const transactionId = queryState ?? cookieState;
+        if (!transactionId) {
+            response.status(400).send("PingCode OAuth 回調缺少 state");
+            return;
+        }
+        const transactionResult = transactionSchema.safeParse(await this.store.consume(this.transactionKey(transactionId)));
+        if (!transactionResult.success) {
+            response.status(400).send("PingCode OAuth 登入請求已失效，請重新連線");
+            return;
+        }
+        const transaction = transactionResult.data;
+        const upstreamError = singleQueryValue(request.query.error);
+        if (upstreamError) {
+            this.redirectToClient(response, transaction, {
+                error: upstreamError === "access_denied" ? "access_denied" : "server_error",
+            });
+            return;
+        }
+        const code = singleQueryValue(request.query.code);
+        if (!code) {
+            this.redirectToClient(response, transaction, { error: "invalid_request" });
+            return;
+        }
+        try {
+            const pingCodeTokens = await this.pingCodeClient.exchangeAuthorizationCode(code);
+            const authorizationCode = secureToken();
+            await this.store.set(this.authorizationCodeKey(authorizationCode), { ...transaction, pingCodeTokens }, AUTHORIZATION_CODE_TTL_SECONDS);
+            this.redirectToClient(response, transaction, { code: authorizationCode });
+            this.logger.info("PingCode 使用者 OAuth 登入完成", { clientId: transaction.clientId });
+        }
+        catch (error) {
+            this.logger.warn("交換 PingCode 使用者授權碼失敗", {
+                errorName: error instanceof Error ? error.name : typeof error,
+            });
+            this.redirectToClient(response, transaction, { error: "server_error" });
+        }
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const record = authorizationCodeSchema.safeParse(await this.store.get(this.authorizationCodeKey(authorizationCode)));
+        if (!record.success || record.data.clientId !== client.client_id) {
+            throw new InvalidGrantError("授權碼無效或已過期");
+        }
+        return record.data.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
+        const codeKey = this.authorizationCodeKey(authorizationCode);
+        const record = authorizationCodeSchema.safeParse(await this.store.get(codeKey));
+        if (!record.success || record.data.clientId !== client.client_id) {
+            throw new InvalidGrantError("授權碼無效或已過期");
+        }
+        if (redirectUri !== undefined && redirectUri !== record.data.redirectUri) {
+            throw new InvalidGrantError("redirect_uri 與原始授權請求不一致");
+        }
+        this.validateResource(resource, record.data.resource);
+        const consumed = authorizationCodeSchema.safeParse(await this.store.consume(codeKey));
+        if (!consumed.success || consumed.data.clientId !== client.client_id) {
+            throw new InvalidGrantError("授權碼已使用");
+        }
+        return this.issueTokens(randomUUID(), client.client_id, consumed.data.scopes, consumed.data.resource, consumed.data.pingCodeTokens);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const refreshHash = digest(refreshToken);
+        const refreshKey = this.refreshTokenKey(refreshHash);
+        const binding = tokenBindingSchema.safeParse(await this.store.get(refreshKey));
+        if (!binding.success || binding.data.clientId !== client.client_id) {
+            throw new InvalidGrantError("Refresh Token 無效或已過期");
+        }
+        this.validateResource(resource, binding.data.resource);
+        const requestedScopes = scopes ?? binding.data.scopes;
+        if (requestedScopes.some((scope) => !binding.data.scopes.includes(scope))) {
+            throw new InvalidScopeError("Refresh Token 不可擴大原有權限範圍");
+        }
+        const session = sessionSchema.safeParse(await this.store.get(this.sessionKey(binding.data.sessionId)));
+        if (!session.success) {
+            throw new InvalidGrantError("OAuth Session 已失效");
+        }
+        const consumed = tokenBindingSchema.safeParse(await this.store.consume(refreshKey));
+        if (!consumed.success || consumed.data.clientId !== client.client_id) {
+            throw new InvalidGrantError("Refresh Token 已使用");
+        }
+        await this.store.delete(this.accessTokenKey(binding.data.pairedTokenHash));
+        return this.issueTokens(binding.data.sessionId, client.client_id, requestedScopes, binding.data.resource, session.data.pingCodeTokens);
+    }
+    async verifyAccessToken(token) {
+        const binding = tokenBindingSchema.safeParse(await this.store.get(this.accessTokenKey(digest(token))));
+        const nowSeconds = Math.floor(this.now() / 1000);
+        if (!binding.success || binding.data.expiresAtSeconds <= nowSeconds) {
+            throw new InvalidTokenError("Access Token 無效或已過期");
+        }
+        if (binding.data.resource !== this.resourceUrl.href) {
+            throw new InvalidTokenError("Access Token 不適用於此 MCP Resource");
+        }
+        return {
+            token,
+            clientId: binding.data.clientId,
+            scopes: binding.data.scopes,
+            expiresAt: binding.data.expiresAtSeconds,
+            resource: new URL(binding.data.resource),
+            extra: { sessionId: binding.data.sessionId },
+        };
+    }
+    async revokeToken(client, request) {
+        const tokenHash = digest(request.token);
+        const accessKey = this.accessTokenKey(tokenHash);
+        const refreshKey = this.refreshTokenKey(tokenHash);
+        const [access, refresh] = await Promise.all([
+            this.store.get(accessKey),
+            this.store.get(refreshKey),
+        ]);
+        const accessBinding = tokenBindingSchema.safeParse(access);
+        const refreshBinding = tokenBindingSchema.safeParse(refresh);
+        await Promise.all([
+            accessBinding.success && accessBinding.data.clientId === client.client_id
+                ? this.store.delete(accessKey)
+                : Promise.resolve(),
+            refreshBinding.success && refreshBinding.data.clientId === client.client_id
+                ? this.store.delete(refreshKey)
+                : Promise.resolve(),
+        ]);
+    }
+    async getPingCodeAccessToken(mcpAccessToken, forceRefresh = false) {
+        const authInfo = await this.verifyAccessToken(mcpAccessToken);
+        const sessionId = authInfo.extra?.sessionId;
+        if (typeof sessionId !== "string") {
+            throw new InvalidTokenError("OAuth Session 綁定無效");
+        }
+        return this.store.withLock(this.sessionKey(sessionId), async () => {
+            const session = sessionSchema.safeParse(await this.store.get(this.sessionKey(sessionId)));
+            if (!session.success) {
+                throw new InvalidTokenError("OAuth Session 已失效");
+            }
+            const current = session.data.pingCodeTokens;
+            if (!forceRefresh && current.expiresAtMs > this.now() + 60_000) {
+                return current.accessToken;
+            }
+            const refreshed = await this.pingCodeClient.refresh(current.refreshToken);
+            await this.store.set(this.sessionKey(sessionId), { pingCodeTokens: refreshed }, this.refreshTokenTtlSeconds);
+            this.logger.info("已刷新 PingCode 使用者 Token", { sessionId });
+            return refreshed.accessToken;
+        });
+    }
+    async getClient(clientId) {
+        const result = OAuthClientInformationFullSchema.safeParse(await this.store.get(this.clientKey(clientId)));
+        if (result.success) {
+            this.logClientRegistrationMethod(clientId, "DCR");
+            return result.data;
+        }
+        const cimdClient = await this.cimdClientResolver?.resolve(clientId);
+        if (cimdClient) {
+            this.logClientRegistrationMethod(clientId, "CIMD");
+            return cimdClient;
+        }
+        this.logger.warn("找不到 MCP OAuth Client 註冊", {
+            clientReference: digest(clientId).slice(0, 12),
+        });
+        return undefined;
+    }
+    logClientRegistrationMethod(clientId, method) {
+        this.logger.info("已識別 MCP OAuth Client 註冊方式", {
+            clientRegistrationMethod: method,
+            clientReference: digest(clientId).slice(0, 12),
+        });
+    }
+    async registerClient(client) {
+        const fullClient = OAuthClientInformationFullSchema.parse({
+            ...client,
+            client_id: randomUUID(),
+            client_id_issued_at: Math.floor(this.now() / 1000),
+        });
+        await this.store.set(this.clientKey(fullClient.client_id), fullClient, this.dcrClientTtlSeconds);
+        this.logger.info("已註冊 MCP OAuth Client", {
+            clientReference: digest(fullClient.client_id).slice(0, 12),
+            redirectUriCount: fullClient.redirect_uris.length,
+            tokenEndpointAuthMethod: fullClient.token_endpoint_auth_method ?? "none",
+        });
+        return fullClient;
+    }
+    async issueTokens(sessionId, clientId, scopes, resource, pingCodeTokens) {
+        const accessToken = secureToken();
+        const refreshToken = secureToken();
+        const accessHash = digest(accessToken);
+        const refreshHash = digest(refreshToken);
+        const nowSeconds = Math.floor(this.now() / 1000);
+        const common = { sessionId, clientId, scopes, resource };
+        await Promise.all([
+            this.store.set(this.sessionKey(sessionId), { pingCodeTokens }, this.refreshTokenTtlSeconds),
+            this.store.set(this.accessTokenKey(accessHash), {
+                ...common,
+                expiresAtSeconds: nowSeconds + this.accessTokenTtlSeconds,
+                pairedTokenHash: refreshHash,
+            }, this.accessTokenTtlSeconds),
+            this.store.set(this.refreshTokenKey(refreshHash), {
+                ...common,
+                expiresAtSeconds: nowSeconds + this.refreshTokenTtlSeconds,
+                pairedTokenHash: accessHash,
+            }, this.refreshTokenTtlSeconds),
+        ]);
+        return {
+            access_token: accessToken,
+            token_type: "Bearer",
+            expires_in: this.accessTokenTtlSeconds,
+            refresh_token: refreshToken,
+            scope: scopes.join(" "),
+        };
+    }
+    validateScopes(scopes) {
+        const requested = scopes && scopes.length > 0 ? scopes : [READ_SCOPE];
+        if (requested.some((scope) => !this.scopes.includes(scope))) {
+            throw new InvalidScopeError(`目前只支援 ${this.scopes.join(" ")}`);
+        }
+        if (!requested.includes(READ_SCOPE)) {
+            throw new InvalidScopeError(`${READ_SCOPE} 是 MCP 存取的必要 scope`);
+        }
+        return requested;
+    }
+    validateResource(resource, expected = this.resourceUrl.href) {
+        if (!resource || normalizeUrl(resource) !== normalizeUrl(new URL(expected))) {
+            throw new InvalidTargetError(`resource 必須是 ${expected}`);
+        }
+    }
+    redirectToClient(response, transaction, result) {
+        const target = new URL(transaction.redirectUri);
+        if ("code" in result) {
+            target.searchParams.set("code", result.code);
+        }
+        else {
+            target.searchParams.set("error", result.error);
+        }
+        if (transaction.mcpState) {
+            target.searchParams.set("state", transaction.mcpState);
+        }
+        response.redirect(302, target.href);
+    }
+    clientKey(clientId) {
+        return `client:${digest(clientId)}`;
+    }
+    transactionKey(transactionId) {
+        return `transaction:${digest(transactionId)}`;
+    }
+    authorizationCodeKey(code) {
+        return `authorization-code:${digest(code)}`;
+    }
+    accessTokenKey(tokenHash) {
+        return `access-token:${tokenHash}`;
+    }
+    refreshTokenKey(tokenHash) {
+        return `refresh-token:${tokenHash}`;
+    }
+    sessionKey(sessionId) {
+        return `session:${digest(sessionId)}`;
+    }
+}
+export class UserOAuthTokenProvider {
+    provider;
+    mcpAccessToken;
+    forceRefresh = false;
+    constructor(provider, mcpAccessToken) {
+        this.provider = provider;
+        this.mcpAccessToken = mcpAccessToken;
+    }
+    async getAccessToken() {
+        const forceRefresh = this.forceRefresh;
+        this.forceRefresh = false;
+        return this.provider.getPingCodeAccessToken(this.mcpAccessToken, forceRefresh);
+    }
+    invalidate() {
+        this.forceRefresh = true;
+    }
+}
+function secureToken() {
+    return randomBytes(32).toString("base64url");
+}
+function digest(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function normalizeUrl(url) {
+    const normalized = new URL(url.href);
+    normalized.hash = "";
+    return normalized.href.replace(/\/$/, "");
+}
+function singleQueryValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function parseCookies(header) {
+    if (!header) {
+        return {};
+    }
+    const entries = header.split(";").flatMap((part) => {
+        const separator = part.indexOf("=");
+        if (separator < 1) {
+            return [];
+        }
+        const key = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        try {
+            return [[key, decodeURIComponent(value)]];
+        }
+        catch {
+            return [];
+        }
+    });
+    return Object.fromEntries(entries);
+}
+//# sourceMappingURL=pingcode-oauth-provider.js.map

package/dist/auth/pingcode-oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pingcode-oauth-provider.js","sourceRoot":"","sources":["../../src/auth/pingcode-oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,UAAU,GAAG,eAAe,CAAC;AACnC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7C,MAAM,8BAA8B,GAAG,CAAC,GAAG,EAAE,CAAC;AAE9C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACvD,cAAc,EAAE,oBAAoB;CACrC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,cAAc,EAAE,oBAAoB;CACrC,CAAC,CAAC;AAcH,MAAM,OAAO,qBAAqB;IACvB,YAAY,CAA8B;IAC1C,KAAK,GAAG,UAAU,CAAC;IACnB,MAAM,CAAW;IACjB,WAAW,CAAM;IACjB,WAAW,CAAM;IACjB,YAAY,CAAU;IACd,KAAK,CAAa;IAClB,cAAc,CAAsB;IACpC,qBAAqB,CAAS;IAC9B,sBAAsB,CAAS;IAC/B,mBAAmB,CAAS;IAC5B,MAAM,CAAS;IACf,kBAAkB,CAAqC;IACvD,GAAG,CAAe;IAClB,aAAa,CAAU;IAExC,YAAY,OAAqC;QAC/C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC7E,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG;YAClB,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjD,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,QAAkB;QAElB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtD,UAAU,EAAE,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAClC;YACE,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SAClE,EACD,4BAA4B,CAC7B,CAAC;QAEF,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,aAAa,EAAE;YAC9C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,4BAA4B,GAAG,IAAI;YAC3C,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAgB,EAAE,QAAkB;QAC/D,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC1E,QAAQ,CAAC,WAAW,CAAC,eAAe,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SAChC,CAAC,CAAC;QAEH,IAAI,UAAU,IAAI,WAAW,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC5D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,IAAI,WAAW,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,SAAS,CACnD,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAC7D,CAAC;QACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC;QAC3C,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE;gBAC3C,KAAK,EAAE,aAAa,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;aAC5E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,iBAAiB,GAAG,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAC5C,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,EAClC,8BAA8B,CAC/B,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBACvC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAC9D,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,iBAAyB;QAEzB,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC,CACnE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAC9B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACzE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CACrB,UAAU,EAAE,EACZ,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,IAAI,CAAC,MAAM,EACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EACtB,QAAQ,CAAC,IAAI,CAAC,cAAc,CAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QACtD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,WAAW,CACrB,OAAO,CAAC,IAAI,CAAC,SAAS,EACtB,MAAM,CAAC,SAAS,EAChB,eAAe,EACf,OAAO,CAAC,IAAI,CAAC,QAAQ,EACrB,OAAO,CAAC,IAAI,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACzD,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,gBAAgB,IAAI,UAAU,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;YAC3B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB;YACxC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxC,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACrB,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACzE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,cAAsB,EAAE,YAAY,GAAG,KAAK;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;QAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;YAC5C,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC,WAAW,CAAC;YAC7B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1E,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,EAAE,cAAc,EAAE,SAAS,EAAE,EAC7B,IAAI,CAAC,sBAAsB,CAC5B,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CACvD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAC/C,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,2BAA2B,CAAC,QAAgB,EAAE,MAAsB;QAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC5C,wBAAwB,EAAE,MAAM;YAChC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA6E;QAE7E,MAAM,UAAU,GAAG,gCAAgC,CAAC,KAAK,CAAC;YACxD,GAAG,MAAM;YACT,SAAS,EAAE,UAAU,EAAE;YACvB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EACpC,UAAU,EACV,IAAI,CAAC,mBAAmB,CACzB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YACvC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1D,gBAAgB,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM;YACjD,uBAAuB,EAAE,UAAU,CAAC,0BAA0B,IAAI,MAAM;SACzE,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,SAAiB,EACjB,QAAgB,EAChB,MAAgB,EAChB,QAAgB,EAChB,cAAkC;QAElC,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,EAAE,cAAc,EAAE,EAClB,IAAI,CAAC,sBAAsB,CAC5B;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAC/B;gBACE,GAAG,MAAM;gBACT,gBAAgB,EAAE,UAAU,GAAG,IAAI,CAAC,qBAAqB;gBACzD,eAAe,EAAE,WAAW;aAC7B,EACD,IAAI,CAAC,qBAAqB,CAC3B;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,EACjC;gBACE,GAAG,MAAM;gBACT,gBAAgB,EAAE,UAAU,GAAG,IAAI,CAAC,sBAAsB;gBAC1D,eAAe,EAAE,UAAU;aAC5B,EACD,IAAI,CAAC,sBAAsB,CAC5B;SACF,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;YACtC,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,MAA4B;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,iBAAiB,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,GAAG,UAAU,oBAAoB,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,gBAAgB,CAAC,QAAyB,EAAE,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI;QAClF,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,gBAAgB,CACtB,QAAkB,EAClB,WAA8C,EAC9C,MAA4C;QAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,SAAS,CAAC,QAAgB;QAChC,OAAO,UAAU,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtC,CAAC;IAEO,cAAc,CAAC,aAAqB;QAC1C,OAAO,eAAe,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAChD,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACvC,OAAO,sBAAsB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9C,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,OAAO,gBAAgB,SAAS,EAAE,CAAC;IACrC,CAAC;IAEO,eAAe,CAAC,SAAiB;QACvC,OAAO,iBAAiB,SAAS,EAAE,CAAC;IACtC,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,OAAO,WAAW,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IAId;IACA;IAJX,YAAY,GAAG,KAAK,CAAC;IAE7B,YACmB,QAA+B,EAC/B,cAAsB;QADtB,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,mBAAc,GAAd,cAAc,CAAQ;IACtC,CAAC;IAEJ,KAAK,CAAC,cAAc;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACjF,CAAC;IAED,UAAU;QACR,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;IACrB,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAU,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/auth/redis-store.d.ts

@@ -0,0 +1,16 @@
+import type { RawOAuthStore } from "./store.js";
+export declare class RedisOAuthStore implements RawOAuthStore {
+    private readonly client;
+    constructor(redisUrl: string);
+    connect(): Promise<void>;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+    consume(key: string): Promise<string | undefined>;
+    delete(key: string): Promise<void>;
+    setIfAbsent(key: string, value: string, ttlSeconds: number): Promise<boolean>;
+    compareAndDelete(key: string, expectedValue: string): Promise<void>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+    private key;
+}
+//# sourceMappingURL=redis-store.d.ts.map

package/dist/auth/redis-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.d.ts","sourceRoot":"","sources":["../../src/auth/redis-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAShD,qBAAa,eAAgB,YAAW,aAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAE7C,QAAQ,EAAE,MAAM;IAOtB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,OAAO,CAAC,GAAG;CAGZ"}

package/dist/auth/redis-store.js

@@ -0,0 +1,54 @@
+import { createClient } from "redis";
+const RELEASE_LOCK_SCRIPT = `
+if redis.call("GET", KEYS[1]) == ARGV[1] then
+  return redis.call("DEL", KEYS[1])
+end
+return 0
+`;
+export class RedisOAuthStore {
+    client;
+    constructor(redisUrl) {
+        this.client = createClient({ url: redisUrl });
+        this.client.on("error", () => {
+            // Redis 錯誤會由當次操作傳回；此處不得輸出可能包含連線資訊的內容。
+        });
+    }
+    async connect() {
+        if (!this.client.isOpen) {
+            await this.client.connect();
+        }
+    }
+    async get(key) {
+        return (await this.client.get(this.key(key))) ?? undefined;
+    }
+    async set(key, value, ttlSeconds) {
+        await this.client.set(this.key(key), value, { EX: ttlSeconds });
+    }
+    async consume(key) {
+        return (await this.client.getDel(this.key(key))) ?? undefined;
+    }
+    async delete(key) {
+        await this.client.del(this.key(key));
+    }
+    async setIfAbsent(key, value, ttlSeconds) {
+        return (await this.client.set(this.key(key), value, { EX: ttlSeconds, NX: true })) === "OK";
+    }
+    async compareAndDelete(key, expectedValue) {
+        await this.client.eval(RELEASE_LOCK_SCRIPT, {
+            keys: [this.key(key)],
+            arguments: [expectedValue],
+        });
+    }
+    async ping() {
+        await this.client.ping();
+    }
+    async close() {
+        if (this.client.isOpen) {
+            await this.client.quit();
+        }
+    }
+    key(key) {
+        return `pingcode-mcp:oauth:${key}`;
+    }
+}
+//# sourceMappingURL=redis-store.js.map

package/dist/auth/redis-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.js","sourceRoot":"","sources":["../../src/auth/redis-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,MAAM,mBAAmB,GAAG;;;;;CAK3B,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,MAAM,CAAkC;IAEzD,YAAY,QAAgB;QAC1B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC3B,sCAAsC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QACtD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QAC9D,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,aAAqB;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;YAC1C,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,GAAW;QACrB,OAAO,sBAAsB,GAAG,EAAE,CAAC;IACrC,CAAC;CACF"}

package/dist/auth/runtime.d.ts

@@ -0,0 +1,10 @@
+import type { AppConfig } from "../config.js";
+import type { Logger } from "../logger.js";
+import { PingCodeOAuthProvider } from "./pingcode-oauth-provider.js";
+export interface UserOAuthRuntime {
+    provider: PingCodeOAuthProvider;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare function createUserOAuthRuntime(config: AppConfig, logger: Logger): Promise<UserOAuthRuntime>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/auth/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,CAAC,CAwD3B"}

package/dist/auth/runtime.js

@@ -0,0 +1,57 @@
+import { CimdClientResolver } from "./cimd-client-resolver.js";
+import { MemoryOAuthStore } from "./memory-store.js";
+import { PingCodeOAuthClient } from "./pingcode-oauth-client.js";
+import { PingCodeOAuthProvider } from "./pingcode-oauth-provider.js";
+import { RedisOAuthStore } from "./redis-store.js";
+import { EncryptedOAuthStore } from "./store.js";
+import { TokenCipher } from "./token-cipher.js";
+export async function createUserOAuthRuntime(config, logger) {
+    const credentials = config.pingcode.credentials;
+    const publicBaseUrl = config.server.publicBaseUrl;
+    const encryptionKey = config.oauth.encryptionKey;
+    if (config.pingcode.authMode !== "user_oauth" || !credentials || !publicBaseUrl || !encryptionKey) {
+        throw new Error("user_oauth 配置不完整，無法建立 OAuth Runtime");
+    }
+    let rawStore;
+    if (config.oauth.store === "redis") {
+        if (!config.oauth.redisUrl) {
+            throw new Error("尚未配置 MCP_OAUTH_REDIS_URL");
+        }
+        const redisStore = new RedisOAuthStore(config.oauth.redisUrl);
+        await redisStore.connect();
+        rawStore = redisStore;
+    }
+    else {
+        rawStore = new MemoryOAuthStore();
+    }
+    const store = new EncryptedOAuthStore(rawStore, new TokenCipher(encryptionKey));
+    await store.ping();
+    const cimdClientResolver = config.oauth.cimdEnabled
+        ? new CimdClientResolver({
+            logger,
+            allowedHosts: config.oauth.cimdAllowedHosts,
+        })
+        : undefined;
+    const pingCodeClient = new PingCodeOAuthClient(config.pingcode.oauthBaseUrl, config.pingcode.apiBaseUrl, credentials, config.pingcode.requestTimeoutMs, logger);
+    const provider = new PingCodeOAuthProvider({
+        store,
+        pingCodeClient,
+        publicBaseUrl,
+        accessTokenTtlSeconds: config.oauth.accessTokenTtlSeconds,
+        refreshTokenTtlSeconds: config.oauth.refreshTokenTtlSeconds,
+        dcrClientTtlSeconds: config.oauth.dcrClientTtlSeconds,
+        cimdClientResolver,
+        logger,
+    });
+    logger.info("已啟用 PingCode 使用者 OAuth", {
+        oauthStore: config.oauth.store,
+        cimdEnabled: provider.supportsCimd,
+        callbackPath: provider.callbackUrl.pathname,
+    });
+    return {
+        provider,
+        ping: () => store.ping(),
+        close: () => store.close(),
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/auth/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAiB,EACjB,MAAc;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;IACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,QAAuB,CAAC;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3B,QAAQ,GAAG,UAAU,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW;QACjD,CAAC,CAAC,IAAI,kBAAkB,CAAC;YACrB,MAAM;YACN,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB;SAC5C,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAAG,IAAI,mBAAmB,CAC5C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,EAC1B,WAAW,EACX,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAChC,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC;QACzC,KAAK;QACL,cAAc;QACd,aAAa;QACb,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,qBAAqB;QACzD,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB;QAC3D,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB;QACrD,kBAAkB;QAClB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC9B,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ;KAC5C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;KAC3B,CAAC;AACJ,CAAC"}

package/dist/auth/store.d.ts

@@ -0,0 +1,35 @@
+import { TokenCipher } from "./token-cipher.js";
+export interface RawOAuthStore {
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+    consume(key: string): Promise<string | undefined>;
+    delete(key: string): Promise<void>;
+    setIfAbsent(key: string, value: string, ttlSeconds: number): Promise<boolean>;
+    compareAndDelete(key: string, expectedValue: string): Promise<void>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+export interface OAuthStore {
+    get(key: string): Promise<unknown | undefined>;
+    set(key: string, value: unknown, ttlSeconds: number): Promise<void>;
+    consume(key: string): Promise<unknown | undefined>;
+    delete(key: string): Promise<void>;
+    withLock<T>(key: string, action: () => Promise<T>): Promise<T>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare class EncryptedOAuthStore implements OAuthStore {
+    private readonly rawStore;
+    private readonly cipher;
+    constructor(rawStore: RawOAuthStore, cipher: TokenCipher);
+    get(key: string): Promise<unknown | undefined>;
+    set(key: string, value: unknown, ttlSeconds: number): Promise<void>;
+    consume(key: string): Promise<unknown | undefined>;
+    delete(key: string): Promise<void>;
+    withLock<T>(key: string, action: () => Promise<T>): Promise<T>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+    private encode;
+    private decode;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,qBAAa,mBAAoB,YAAW,UAAU;IAElD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,WAAW;IAGhC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAKxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAgBpE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,MAAM;CAGf"}