@zackbart/connecta 0.7.8 → 0.8.0

package/dist/routes/mcp.js

@@ -0,0 +1,383 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { registerExecuteTool } from "../execute.js";
+import { ExecutorAdmissionError, } from "../executor-admission.js";
+import { registerMetaTools } from "../meta-tools.js";
+import { ScopedRegistry } from "../registry.js";
+import { CONNECTA_INSTRUCTIONS } from "../skills.js";
+import { TOOLKIT_NAME_RE } from "../toolkits.js";
+import { MAX_ECHOED_TOOLKIT_NAME, authorize, loggableValue, } from "./shared.js";
+export const MCP_CORS_HEADERS = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, mcp-protocol-version, mcp-session-id",
+};
+// Browser-based MCP clients call /mcp cross-origin. Without CORS on every
+// response — errors included — the browser hides the 401, the client cannot
+// read WWW-Authenticate, and OAuth discovery silently never starts.
+function withMcpCors(response) {
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(MCP_CORS_HEADERS)) {
+        headers.set(name, value);
+    }
+    headers.set("Access-Control-Expose-Headers", "WWW-Authenticate, Retry-After, mcp-session-id, mcp-protocol-version");
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+function requestAdmissionFailure(error) {
+    const overloaded = error.code === "executor_overloaded";
+    const data = {
+        code: overloaded ? "server_overloaded" : "server_shutting_down",
+        retryable: overloaded,
+        ...(overloaded && error.retryAfterMs !== undefined
+            ? { retryAfterMs: error.retryAfterMs }
+            : {}),
+    };
+    const headers = new Headers({
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+    });
+    if (overloaded && error.retryAfterMs !== undefined) {
+        headers.set("Retry-After", String(Math.max(1, Math.ceil(error.retryAfterMs / 1_000))));
+    }
+    return new Response(JSON.stringify({
+        jsonrpc: "2.0",
+        id: null,
+        error: {
+            code: overloaded ? -32001 : -32002,
+            message: overloaded
+                ? "Server capacity is exhausted. Retry later."
+                : "Server is shutting down.",
+            data,
+        },
+    }), { status: 503, headers });
+}
+/**
+ * A request owns its permit through the response body, not merely until the
+ * handler returns. This is what makes slow clients and response-stream failure
+ * part of the same bounded lifecycle as success, error, and cancellation.
+ */
+function releaseAdmissionWithResponse(response, lease, signal) {
+    let released = false;
+    let onAbort = () => { };
+    const release = () => {
+        if (released)
+            return;
+        released = true;
+        signal.removeEventListener("abort", onAbort);
+        lease.release();
+    };
+    if (!response.body) {
+        release();
+        return response;
+    }
+    const reader = response.body.getReader();
+    onAbort = () => {
+        // `cancel()` belongs to an operator/auth/SDK-provided stream and may
+        // reject. Consume both outcomes: `.finally(release)` would release the
+        // permit but preserve the rejection as an unhandled promise.
+        void reader.cancel(signal.reason).then(release, release);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted)
+        onAbort();
+    const body = new ReadableStream({
+        async pull(controller) {
+            try {
+                const next = await reader.read();
+                if (next.done) {
+                    release();
+                    controller.close();
+                }
+                else {
+                    controller.enqueue(next.value);
+                }
+            }
+            catch (error) {
+                release();
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            try {
+                await reader.cancel(reason);
+            }
+            finally {
+                release();
+            }
+        },
+    });
+    return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+    });
+}
+/** The one refusal a bound identity ever sees. Constant on purpose — see below. */
+const TOOLKIT_FORBIDDEN_BODY = JSON.stringify({
+    jsonrpc: "2.0",
+    id: null,
+    error: {
+        code: -32600,
+        message: "Not permitted to use the requested toolkit. This credential is bound " +
+            "to a specific toolkit — check the ?toolkit= value in this deployment's " +
+            "MCP endpoint URL with the operator.",
+    },
+});
+/**
+ * 403 for every binding refusal, with a body that does not depend on WHY.
+ *
+ * A bound identity asking for a toolkit it may not open, for a toolkit that does
+ * not exist, or for no toolkit at all gets byte-identical responses, so a team
+ * credential cannot be used to enumerate the org's other teams — the boundary
+ * would leak the very structure it exists to hide. The operator log below is
+ * where the three cases are told apart.
+ */
+function toolkitForbidden() {
+    return new Response(TOOLKIT_FORBIDDEN_BODY, {
+        status: 403,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+/** How a rejected connection is named in the operator log. */
+function identityLabel(actor) {
+    return actor.id ? `${actor.kind} ${loggableValue(actor.id)}` : actor.kind;
+}
+/**
+ * Resolve `?toolkit=<name>` into the registry view this connection may see,
+ * enforcing the caller's toolkit binding (documentation/toolkits.md) on the way.
+ *
+ * For an UNBOUND identity (no binding configured — the pre-#37 shape):
+ *
+ * - absent → the full registry, byte-identical to a deployment with no toolkits
+ * - known → a `ScopedRegistry` over that toolkit (the one visibility boundary)
+ * - anything else, including `?toolkit=` with an empty value → an explicit
+ *   404. Never a silent fallback to the full registry.
+ *
+ * For a BOUND identity, membership is checked FIRST and refusal is a flat 403:
+ * a toolkit outside the binding, an unknown name, and (without `unscoped`) an
+ * omitted `?toolkit=` are all refused before any `ScopedRegistry` is built, and
+ * all three produce the same response.
+ *
+ * Neither error enumerates the configured toolkits: the name selects a scope, so
+ * a wrong guess gets a flat refusal, not a directory.
+ *
+ * Because of that — and because SDK clients treat a 404/403 on the transport
+ * endpoint as a transport failure and discard the body — every rejection is also
+ * logged operator-side (issue #47), which is the channel that actually reaches a
+ * human. The log line may name the configured or bound toolkits; the response
+ * still may not.
+ */
+function resolveToolkitScope(url, registry, toolkits, logger, identity) {
+    const requested = url.searchParams.get("toolkit");
+    const binding = identity.binding;
+    const scopeFor = (toolkit) => ({
+        ok: true,
+        scope: {
+            registry: new ScopedRegistry(registry, toolkit),
+            toolkitId: toolkit.name,
+        },
+    });
+    if (binding) {
+        const who = identityLabel(identity.actor);
+        const bound = `Bound toolkits: ${binding.toolkits.join(", ") || "(none)"}${binding.unscoped ? ", plus unscoped access" : ""}.`;
+        if (requested === null) {
+            if (binding.unscoped)
+                return { ok: true, scope: { registry } };
+            logger.warn(`[connecta] refused an unscoped /mcp connection from ${who} with 403: ` +
+                "its toolkit binding does not allow the full registry. " +
+                bound +
+                " The client sees a transport-level failure and never the reason, so " +
+                "give it an MCP endpoint URL with a ?toolkit= value it is bound to.");
+            return { ok: false, response: toolkitForbidden() };
+        }
+        const permitted = binding.toolkits.includes(requested);
+        const toolkit = permitted ? toolkits?.get(requested) : undefined;
+        if (toolkit)
+            return scopeFor(toolkit);
+        logger.warn(`[connecta] refused an /mcp connection from ${who} with 403: it asked ` +
+            `for toolkit ${loggableValue(requested)}, which ` +
+            (permitted
+                ? "its binding allows but this deployment does not configure"
+                : "its toolkit binding does not include") +
+            ". " +
+            bound +
+            " The client sees a transport-level failure and never the reason, so " +
+            "check the ?toolkit= value in its MCP endpoint URL.");
+        return { ok: false, response: toolkitForbidden() };
+    }
+    if (requested === null)
+        return { ok: true, scope: { registry } };
+    const toolkit = toolkits?.get(requested);
+    if (toolkit)
+        return scopeFor(toolkit);
+    const configured = toolkits && toolkits.size > 0 ? [...toolkits.keys()] : [];
+    logger.warn("[connecta] rejected an /mcp connection asking for unknown toolkit " +
+        `${loggableValue(requested)} with 404. ` +
+        (configured.length > 0
+            ? `Configured toolkits: ${configured.join(", ")}.`
+            : "This deployment configures no toolkits, so no ?toolkit= value is accepted.") +
+        " The client sees a transport-level failure and never the reason, so " +
+        "check the ?toolkit= value in its MCP endpoint URL.");
+    const label = requested.length <= MAX_ECHOED_TOOLKIT_NAME &&
+        TOOLKIT_NAME_RE.test(requested)
+        ? `"${requested}"`
+        : "requested";
+    return {
+        ok: false,
+        response: new Response(JSON.stringify({
+            jsonrpc: "2.0",
+            id: null,
+            error: {
+                code: -32600,
+                message: `Unknown toolkit ${label}. Check the ?toolkit= value in this ` +
+                    "deployment's MCP endpoint URL with the operator.",
+            },
+        }), {
+            status: 404,
+            headers: {
+                "Content-Type": "application/json",
+                "Cache-Control": "no-store",
+            },
+        }),
+    };
+}
+async function serveMcp(request, opts, baseUrl, actor, scope, runtimeContext) {
+    // Fresh McpServer + transport per request (SDK ≥1.26 requirement), stateless.
+    const server = new McpServer(opts.serverInfo, {
+        instructions: CONNECTA_INSTRUCTIONS,
+    });
+    const activity = opts.activity
+        ? {
+            sink: opts.activity,
+            actor,
+            requestId: crypto.randomUUID(),
+            serverInfo: opts.serverInfo,
+            ...(opts.activityDeploymentId
+                ? { deploymentId: opts.activityDeploymentId }
+                : {}),
+            ...(scope.toolkitId ? { toolkitId: scope.toolkitId } : {}),
+            ...(runtimeContext?.waitUntil
+                ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
+                : {}),
+            logger: opts.logger,
+        }
+        : undefined;
+    // `scope.registry` is the connection's VIEW — the full registry, or one
+    // toolkit's ScopedRegistry. Nothing below may reach for `opts.registry`.
+    const registry = scope.registry;
+    registerMetaTools(server, registry, {
+        baseUrl,
+        ...(activity ? { activity } : {}),
+        ...(opts.defaultToolTimeoutMs !== undefined
+            ? { defaultToolTimeoutMs: opts.defaultToolTimeoutMs }
+            : {}),
+        ...(opts.probeTimeoutMs !== undefined
+            ? { probeTimeoutMs: opts.probeTimeoutMs }
+            : {}),
+        ...(opts.discoveryConcurrency !== undefined
+            ? { discoveryConcurrency: opts.discoveryConcurrency }
+            : {}),
+        requestSignal: request.signal,
+        ...(runtimeContext
+            ? { defer: runtimeContext.waitUntil.bind(runtimeContext) }
+            : {}),
+    });
+    if (opts.executor) {
+        registerExecuteTool(server, registry, {
+            baseUrl,
+            executor: opts.executor,
+            logger: opts.logger,
+            ...(activity ? { activity } : {}),
+            requestSignal: request.signal,
+            ...(opts.discoveryConcurrency !== undefined
+                ? { discoveryConcurrency: opts.discoveryConcurrency }
+                : {}),
+        });
+    }
+    const transport = new WebStandardStreamableHTTPServerTransport({
+        enableJsonResponse: true,
+    });
+    await server.connect(transport);
+    return transport.handleRequest(request);
+}
+export function createMcpRoute(opts) {
+    let lastAdmissionWarningAt = 0;
+    let suppressedAdmissionWarnings = 0;
+    const warnAdmissionRejected = (error) => {
+        const now = Date.now();
+        if (now - lastAdmissionWarningAt < 1_000) {
+            suppressedAdmissionWarnings++;
+            return;
+        }
+        opts.logger.warn("[connecta] MCP request admission rejected", {
+            retryAfterMs: error.retryAfterMs,
+            active: opts.requestAdmission.activeCount,
+            queued: opts.requestAdmission.queuedCount,
+            suppressedSinceLastWarning: suppressedAdmissionWarnings,
+        });
+        lastAdmissionWarningAt = now;
+        suppressedAdmissionWarnings = 0;
+    };
+    return async function routeMcp(context) {
+        const { path, request, url, baseUrl, runtimeContext, sweepCredentials, } = context;
+        if (path !== "/mcp")
+            return null;
+        let admission;
+        try {
+            admission = await opts.requestAdmission.acquire({
+                signal: request.signal,
+            });
+            if (admission.waitMs > 0) {
+                opts.logger.debug("[connecta] MCP request admitted after queue wait", {
+                    waitMs: admission.waitMs,
+                    active: opts.requestAdmission.activeCount,
+                    queued: opts.requestAdmission.queuedCount,
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof ExecutorAdmissionError &&
+                error.code === "executor_cancelled") {
+                throw request.signal.reason ?? error;
+            }
+            if (error instanceof ExecutorAdmissionError) {
+                if (error.code === "executor_overloaded") {
+                    warnAdmissionRejected(error);
+                }
+                return withMcpCors(requestAdmissionFailure(error));
+            }
+            throw error;
+        }
+        try {
+            // Authenticate BEFORE resolving ?toolkit=: an unauthenticated caller
+            // must not be able to probe which toolkit names exist.
+            const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+            if (!authz.ok) {
+                return releaseAdmissionWithResponse(withMcpCors(authz.response), admission, request.signal);
+            }
+            const selected = resolveToolkitScope(url, opts.registry, opts.toolkits, opts.logger, {
+                actor: authz.actor,
+                ...(authz.toolkitBinding
+                    ? { binding: authz.toolkitBinding }
+                    : {}),
+            });
+            if (!selected.ok) {
+                return releaseAdmissionWithResponse(withMcpCors(selected.response), admission, request.signal);
+            }
+            sweepCredentials();
+            return releaseAdmissionWithResponse(withMcpCors(await serveMcp(request, opts, baseUrl, authz.actor, selected.scope, runtimeContext)), admission, request.signal);
+        }
+        catch (error) {
+            admission.release();
+            throw error;
+        }
+    };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/routes/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/routes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AAEzH,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,sBAAsB,GAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAoC,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAgB,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EACL,uBAAuB,EACvB,SAAS,EACT,aAAa,GAId,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAC5B,mEAAmE;CACtE,CAAC;AAEF,0EAA0E;AAC1E,4EAA4E;AAC5E,oEAAoE;AACpE,SAAS,WAAW,CAAC,QAAkB;IACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,CACT,+BAA+B,EAC/B,qEAAqE,CACtE,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA6B;IAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;IACxD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB;QAC/D,SAAS,EAAE,UAAU;QACrB,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CACT,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;YAClC,OAAO,EAAE,UAAU;gBACjB,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,0BAA0B;YAC9B,IAAI;SACL;KACF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,QAAkB,EAClB,KAAqB,EACrB,MAAmB;IAEnB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,KAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,OAAO,GAAG,GAAG,EAAE;QACb,qEAAqE;QACrE,uEAAuE;QACvE,6DAA6D;QAC7D,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,cAAc,CAAa;QAC1C,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,OAAO,EAAE,CAAC;oBACV,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC;AASD,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5C,OAAO,EAAE,KAAK;IACd,EAAE,EAAE,IAAI;IACR,KAAK,EAAE;QACL,IAAI,EAAE,CAAC,KAAK;QACZ,OAAO,EACL,uEAAuE;YACvE,yEAAyE;YACzE,qCAAqC;KACxC;CACF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,gBAAgB;IACvB,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,KAAoB;IACzC,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,mBAAmB,CAC1B,GAAQ,EACR,QAAkB,EAClB,QAAkD,EAClD,MAAc,EACd,QAA4D;IAI5D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC;QACtC,EAAE,EAAE,IAAa;QACjB,KAAK,EAAE;YACL,QAAQ,EAAE,IAAI,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC/C,SAAS,EAAE,OAAO,CAAC,IAAI;SACxB;KACF,CAAC,CAAC;IAEH,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,mBAAmB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GACtE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAChD,GAAG,CAAC;QACJ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CACT,uDAAuD,GAAG,aAAa;gBACrE,wDAAwD;gBACxD,KAAK;gBACL,sEAAsE;gBACtE,oEAAoE,CACvE,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAC;QACrD,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,OAAO;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CACT,8CAA8C,GAAG,sBAAsB;YACrE,eAAe,aAAa,CAAC,SAAS,CAAC,UAAU;YACjD,CAAC,SAAS;gBACR,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,sCAAsC,CAAC;YAC3C,IAAI;YACJ,KAAK;YACL,sEAAsE;YACtE,oDAAoD,CACvD,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,CAAC,IAAI,CACT,oEAAoE;QAClE,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa;QACxC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAClD,CAAC,CAAC,4EAA4E,CAAC;QACjF,sEAAsE;QACtE,oDAAoD,CACvD,CAAC;IACF,MAAM,KAAK,GACT,SAAS,CAAC,MAAM,IAAI,uBAAuB;QAC3C,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,CAAC,IAAI,SAAS,GAAG;QAClB,CAAC,CAAC,WAAW,CAAC;IAClB,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,IAAI,EAAE,CAAC,KAAK;gBACZ,OAAO,EACL,mBAAmB,KAAK,sCAAsC;oBAC9D,kDAAkD;aACrD;SACF,CAAC,EACF;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU;aAC5B;SACF,CACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,IAAmB,EACnB,OAAe,EACf,KAAoB,EACpB,KAAe,EACf,cAAwC;IAExC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE;QAC5C,YAAY,EAAE,qBAAqB;KACpC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAuC,IAAI,CAAC,QAAQ;QAChE,CAAC,CAAC;YACE,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;YAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,oBAAoB;gBAC3B,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,cAAc,EAAE,SAAS;gBAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB;QACH,CAAC,CAAC,SAAS,CAAC;IACd,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE;QAClC,OAAO;QACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE;YACpC,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAmB;IAEnB,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,IAAI,2BAA2B,GAAG,CAAC,CAAC;IACpC,MAAM,qBAAqB,GAAG,CAAC,KAA6B,EAAQ,EAAE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,sBAAsB,GAAG,KAAK,EAAE,CAAC;YACzC,2BAA2B,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YAC5D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW;YACzC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW;YACzC,0BAA0B,EAAE,2BAA2B;SACxD,CAAC,CAAC;QACH,sBAAsB,GAAG,GAAG,CAAC;QAC7B,2BAA2B,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,QAAQ,CAC5B,OAAqB;QAErB,MAAM,EACJ,IAAI,EACJ,OAAO,EACP,GAAG,EACH,OAAO,EACP,cAAc,EACd,gBAAgB,GACjB,GAAG,OAAO,CAAC;QACZ,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;oBACpE,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW;oBACzC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,sBAAsB;gBACvC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EACnC,CAAC;gBACD,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YACvC,CAAC;YACD,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBACzC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;gBACD,OAAO,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,4BAA4B,CACjC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC3B,SAAS,EACT,OAAO,CAAC,MAAM,CACf,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAClC,GAAG,EACH,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,cAAc;oBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;aACR,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,4BAA4B,CACjC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC9B,SAAS,EACT,OAAO,CAAC,MAAM,CACf,CAAC;YACJ,CAAC;YACD,gBAAgB,EAAE,CAAC;YACnB,OAAO,4BAA4B,CACjC,WAAW,CACT,MAAM,QAAQ,CACZ,OAAO,EACP,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,KAAK,EACd,cAAc,CACf,CACF,EACD,SAAS,EACT,OAAO,CAAC,MAAM,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/oauth.d.ts

@@ -0,0 +1,4 @@
+import { type RouteContext } from "./shared.js";
+export declare function routeOAuthManagement(context: RouteContext): Promise<Response | null>;
+export declare function routeOAuthCallback(context: RouteContext): Promise<Response | null>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/routes/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAQA,OAAO,EAML,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAkGrB,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAS1B;AAyHD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgF1B"}