@zuplo/cli 6.74.2 → 6.74.6

package/node_modules/@zuplo/runtime/out/esm/mcp-gateway/index.js

@@ -22,7 +22,7 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{$b as Ur,$c as Do,Ab as Je,Ac as q,Bb as Fe,Bc as ko,Cb as we,Cc as U,Db as be,Dc as xo,Eb as Gt,Ec as Ce,Fb as uo,Fc as Pr,Gb as re,Gc as Wt,Hb as lo,Hc as Er,Ib as ce,Ic as Vt,Jb as b,Jc as mt,Kb as Jt,Kc as Ke,Lb as N,Lc as Uo,Mb as Re,Mc as ue,Nb as Pc,Nc as Or,Ob as Ec,Oc as Mr,Pb as Oc,Pc as To,Qb as Mc,Qc as Yt,Rb as qc,Rc as qr,Sb as Dc,Sc as Dr,Tb as zc,Tc as Po,U as no,Ub as jc,Uc as z,Vb as Hc,Vc as Eo,Wb as Bc,Wc as Oo,Xb as po,Xc as zr,Yb as mo,Yc as Mo,Zb as fo,Zc as qo,_b as Ft,_c as jr,ac as $t,ad as Ee,bc as Zt,bd as zo,cc as ut,cd as ft,dc as ho,dd as jo,ec as go,ed as Xt,fc as yo,fd as ht,gc as lt,gd as Ho,hc as _o,hd as Bo,ic as $e,id as Lo,jc as wo,jd as No,k as ae,kc as Tr,kd as Go,lc as bo,ld as Jo,mc as pt,md as Fo,nc as Kt,nd as $o,oc as Ro,od as Qt,pc as Co,pd as Zo,qb as oo,qc as So,qd as Ko,r as Pe,rb as K,rc as Io,rd as C,s as Kn,sb as io,sc as ee,sd as A,tb as ao,tc as L,td as J,ub as D,uc as vo,ud as le,vb as so,vc as Ao,vd as P,wb as Ne,wc as S,wd as er,xb as co,xc as de,xd as Lc,y as Vn,yb as Ge,yc as Ze,yd as Nc,z as Lt,zb as y,zc as G}from"../chunk-B5LJC45G.js";import"../chunk-WGENGK72.js";import{a as I}from"../chunk-5BL2UFIS.js";import{a as Wo}from"../chunk-6SNZ4DOC.js";import{a as Wn}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{A as eo,F as to,G as ro,H as d,g as Yn,k as m,m as Xn,n as xr,o as se,q as Qn,s as w,t as _e,u as Nt}from"../chunk-SH5GYJN3.js";import"../chunk-UKQQD2JN.js";import{W as Q,X as h,Y as k,Z as Zn,_ as Bt}from"../chunk-N22BFR2U.js";import{a as o}from"../chunk-TYV53J3B.js";function Gc(e){let t=Zt.safeParse(e);return t.success?t.data.id:void 0}o(Gc,"parseJsonRpcRequestId");function Vo(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return Gc(t)}catch{return}}o(Vo,"readJsonRpcRequestIdFromBody");function tr(e){return ho.parse({jsonrpc:$t,...e.id===void 0?{}:{id:e.id},error:{code:e.error.code,message:e.error.message,...e.error.data===void 0?{}:{data:e.error.data}}})}o(tr,"jsonRpcErrorResponse");function Yo(e){return new yo([go.parse({mode:"url",message:e.message,elicitationId:e.elicitationId,url:e.url})],e.message)}o(Yo,"urlElicitationRequiredError");var nr=d.record(d.string(),d.unknown()),Jc=d.record(d.string(),d.unknown()),Ie=d.array(d.string().min(1)).min(1).optional(),Fc=d.object({name:d.string().min(1),description:d.string().min(1).optional(),annotations:Jc.optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),$c=d.object({name:d.string().min(1),description:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Zc=d.object({uri:d.string().min(1),name:d.string().min(1).optional(),description:d.string().min(1).optional(),mimeType:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Kc=d.object({uriTemplate:d.string().min(1),name:d.string().min(1).optional(),description:d.string().min(1).optional(),mimeType:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Wc=d.array(d.union([d.string(),Fc])),Vc=d.array(d.union([d.string(),$c])),Yc=d.array(d.union([d.string(),Zc])),Xc=d.array(d.union([d.string(),Kc])),Qc=d.object({module:d.unknown(),export:d.string().min(1)}).strict(),ed=d.object({mode:d.enum(["allPublic","rolesAndGroups","function"]).optional(),roleClaim:d.string().min(1).optional(),groupClaim:d.string().min(1).optional(),identifier:Qc.optional()}).strict(),td=d.object({tools:Wc.optional(),prompts:Vc.optional(),resources:Yc.optional(),resourceTemplates:Xc.optional(),accessControl:ed.optional()}).strict(),Se=[{option:"tools",listMethod:"tools/list",resultProperty:"tools",itemProperty:"name",directMethods:["tools/call"]},{option:"prompts",listMethod:"prompts/list",resultProperty:"prompts",itemProperty:"name",directMethods:["prompts/get"]},{option:"resources",listMethod:"resources/list",resultProperty:"resources",itemProperty:"uri",directMethods:["resources/read"]},{option:"resourceTemplates",listMethod:"resources/templates/list",resultProperty:"resourceTemplates",itemProperty:"uriTemplate",directMethods:[]}];function rd(e,t){return io(td,e,`MCP capability filter policy "${t}"`)}o(rd,"parseMcpCapabilityFilterOptions");function $(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}o($,"isRecord");function gt(e){return typeof e.method=="string"?e.method:void 0}o(gt,"messageMethod");function Xo(e){return typeof e=="string"||typeof e=="number"||e===null?JSON.stringify(e):void 0}o(Xo,"correlationKey");function Qo(e){if(!Array.isArray(e))return;let t=e.filter(r=>typeof r=="string");return t.length>0?t:void 0}o(Qo,"asStringArray");function ei(e,t){if(!$(e))return[];let r=t in e?e[t]:t.split(".").reduce((n,i)=>$(n)?n[i]:void 0,e);return Array.isArray(r)?r.filter(n=>typeof n=="string"):typeof r=="string"?r.split(/\s+/).filter(n=>n.length>0):[]}o(ei,"readClaimValues");function Lr(e,t){if(typeof e=="string")return{key:e,public:!1};if(!$(e))return;let r=e[t];if(typeof r=="string")return{key:r,roles:Qo(e.roles),groups:Qo(e.groups),public:e.public===!0}}o(Lr,"normalizeEntry");function nd(e,t,r){if(e.public)return!0;let n=e.roles??[],i=e.groups??[];return n.length===0&&i.length===0?!1:n.some(a=>t.has(a))||i.some(a=>r.has(a))}o(nd,"isCallerAllowed");function rr(e,t,r,n){if(e===void 0)return;let i=[];for(let a of e){let s=Lr(a,t);s!==void 0&&nd(s,r,n)&&i.push(s.key)}return i}o(rr,"allowedKeys");var ni=o((e,t,r)=>{let n=r.accessControl?.roleClaim??"roles",i=r.accessControl?.groupClaim??"groups",a=new Set(ei(e.user?.data,n)),s=new Set(ei(e.user?.data,i));return{tools:rr(r.tools,"name",a,s),prompts:rr(r.prompts,"name",a,s),resources:rr(r.resources,"uri",a,s),resourceTemplates:rr(r.resourceTemplates,"uriTemplate",a,s)}},"claimsCapabilityResolver");function od(e,t){let r=[];for(let n of Se){let i=e[n.option];if(i!==void 0)for(let a of i){let s=Lr(a,n.itemProperty);if(s===void 0)continue;let c=(s.roles?.length??0)>0||(s.groups?.length??0)>0;s.public&&c&&r.push(`${n.option} "${s.key}"`)}}if(r.length>0)throw new k(`MCP capability filter policy "${t}" - with accessControl.mode "rolesAndGroups", a capability cannot set both "public": true and roles/groups ("public" opens it to everyone, roles/groups restrict it). Remove one of the two on: ${r.join(", ")}`)}o(od,"assertNoConflictingMarkup");function id(e,t){let r=[];for(let n of Se){let i=e[n.option];if(i!==void 0)for(let a of i){let s=Lr(a,n.itemProperty);s!==void 0&&((s.roles?.length??0)>0||(s.groups?.length??0)>0||s.public)&&r.push(`${n.option} "${s.key}"`)}}if(r.length>0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode is "allPublic" (the default) but these capabilities set roles/groups/public; set accessControl.mode to "rolesAndGroups" or remove the markup: ${r.join(", ")}`)}o(id,"assertNoMarkup");function ad(e,t){let r=e.identifier;if(r===void 0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);if(r.module===null||typeof r.module!="object")throw new k(`MCP capability filter policy "${t}" - accessControl.identifier.module must reference a module, e.g. $import(./modules/mcp-access-control)`);if(!r.export)throw new k(`MCP capability filter policy "${t}" - accessControl.identifier.export must be specified`);let n=r.module[r.export];if(typeof n!="function")throw new k(`MCP capability filter policy "${t}" - accessControl.identifier must resolve to a valid function`);let i=n;return async(a,s,c)=>{let u=await i(a,s,c);if(u==null)throw new h(`MCP capability filter policy "${t}" - accessControl resolver returned no value; return an AllowedCapabilities object (use empty arrays to deny)`);if(typeof u!="object"||Array.isArray(u))throw new h(`MCP capability filter policy "${t}" - accessControl resolver must return an AllowedCapabilities object`);return u}}o(ad,"buildCustomResolver");function sd(e,t){let r=e.accessControl,n=r?.mode??"allPublic";if(n==="function"){if(r===void 0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);return ad(r,t)}if(n==="rolesAndGroups")return od(e,t),ni;id(e,t)}o(sd,"buildCapabilityResolver");function cd(e){let t={};for(let r of Se){let n=e[r.option];if(n===void 0)continue;let i=new Map;for(let a of n){let s=md(a,r.itemProperty);s!==void 0&&i.set(s.key,s)}t[r.option]=i}return t}o(cd,"buildProjectionMaps");function Hr(e){return e===void 0?void 0:Se.find(t=>t.listMethod===e)}o(Hr,"findListRule");function dd(e){return e===void 0?void 0:Se.find(t=>t.directMethods.includes(e))}o(dd,"findDirectRule");function ud(e){switch(e.method){case"tools/call":return{option:"tools",target:e.params.name};case"prompts/get":return{option:"prompts",target:e.params.name};case"resources/read":return{option:"resources",target:e.params.uri};default:return}}o(ud,"directCapabilityAccess");function ld(e){let t=dd(gt(e));if(t===void 0||!$(e.raw))return;let r=e.raw.params;if(!$(r))return;let n=r[t.itemProperty==="uri"?"uri":"name"];return typeof n=="string"?{option:t.option,target:n}:void 0}o(ld,"rawDirectCapabilityAccess");function pd(e){return Response.json(tr({...e==null?{}:{id:e},error:{code:ut.MethodNotFound,message:"Method not found"}}))}o(pd,"methodNotFoundResponse");function md(e,t){if(typeof e=="string")return{key:e,overlay:{}};if(!$(e))return;let r=e[t];if(typeof r!="string")return;let n={...e};return delete n.roles,delete n.groups,delete n.public,{key:r,overlay:n}}o(md,"buildProjection");function ti(e){let t=e.base[e.property],r=e.overlay[e.property];return $(r)?$(t)?{...t,...r}:r:t}o(ti,"mergeRecordProperty");function fd(e,t){let r={...e,...t.overlay},n=ti({base:e,overlay:t.overlay,property:"annotations"});n!==void 0&&(r.annotations=n);let i=ti({base:e,overlay:t.overlay,property:"_meta"});return i!==void 0&&(r._meta=i),r}o(fd,"applyProjection");function ri(e,t,r,n){if(!$(e))return e;let i=e.result;if(!$(i))return e;let a=i[t.resultProperty];return!Array.isArray(a)||!a.every(s=>$(s)&&typeof s[t.itemProperty]=="string")?e:{...e,result:{...i,[t.resultProperty]:a.flatMap(s=>{if(!$(s))return[];let c=s[t.itemProperty];if(typeof c!="string")return[];if(n!==void 0&&!n.has(c))return[];let u=r.get(c);return u===void 0?[]:[fd(s,u)]})}}}o(ri,"filterAndProjectItems");function hd(e){let{envelope:t,responseBody:r,projectionMaps:n,allowedSets:i}=e;if(Array.isArray(r)){if(t.shape!=="batch")return r;let u=new Map;for(let l of t.messages){let p=Hr(gt(l)),g=p===void 0?void 0:Xo(l.id);p!==void 0&&g!==void 0&&u.set(g,p)}return u.size===0?r:r.map(l=>{if(!$(l)||"error"in l)return l;let p=Xo(l.id),g=p===void 0?void 0:u.get(p),R=g===void 0?void 0:n[g.option];return g===void 0||R===void 0?l:ri(l,g,R,i?.[g.option])})}if(t.shape!=="single"||!$(r)||"error"in r)return r;let a=t.messages[0],s=Hr(a===void 0?void 0:gt(a)),c=s===void 0?void 0:n[s.option];return s===void 0||c===void 0?r:ri(r,s,c,i?.[s.option])}o(hd,"filterResponseBody");function gd(e){return e.headers.get("content-type")?.includes("json")??!1}o(gd,"isJsonResponse");var Br=class extends Lt{static{o(this,"McpCapabilityFilterInboundPolicy")}static policyType="mcp-capability-filter";#e;#r;#t;constructor(t,r){let n=rd(t,r);super(n,r),this.#r=r,this.#e=cd(n),this.#t=sd(n,r)}async handler(t,r){let n=await Wo(t);if(n===null)return t;let i=this.#t!==void 0&&this.#n(n)?await this.#i(t,r):void 0;for(let s of n.messages){let c=s.type==="request"?ud(s):ld(s);if(c===void 0)continue;let u=this.#e[c.option];if(u===void 0)continue;let l=i?.[c.option];if(!u.has(c.target)||l!==void 0&&!l.has(c.target))return pd(s.type==="request"?s.id:s.id??void 0)}if(!this.#o(n))return t;let a=this.#e;return r.addResponseSendingHook(async s=>{if(!gd(s))return s;let c;try{c=await s.clone().json()}catch{return s}let u=hd({envelope:n,responseBody:c,projectionMaps:a,allowedSets:i});if(u===c)return s;let l=new Headers(s.headers);return l.delete("content-length"),new Response(JSON.stringify(u),{status:s.status,statusText:s.statusText,headers:l})}),t}#n(t){return t.messages.some(r=>{let n=gt(r);return n===void 0?!1:Se.some(i=>this.#e[i.option]===void 0?!1:i.listMethod===n||i.directMethods.includes(n))})}#o(t){return t.messages.some(r=>{let n=Hr(gt(r));return n!==void 0&&this.#e[n.option]!==void 0})}async#i(t,r){let n=this.#t;if(n===void 0)return{};let i;try{i=await n(t,r,this.options)}catch(s){r.log.error(`MCP capability filter policy "${this.#r}" - access-control resolver threw; denying configured capabilities`,s);let c={};for(let u of Se)this.#e[u.option]!==void 0&&(c[u.option]=new Set);return c}let a={};for(let s of Se){let c=this.#e[s.option];if(c===void 0)continue;let u=i[s.option];if(u===void 0)continue;let l=new Set;if(Array.isArray(u))for(let p of u)typeof p=="string"&&c.has(p)&&l.add(p);a[s.option]=l}return a}};var Nr;Nr=globalThis.crypto;async function yd(e){return(await Nr).getRandomValues(new Uint8Array(e))}o(yd,"getRandomValues");async function _d(e){let t="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",r=Math.pow(2,8)-Math.pow(2,8)%t.length,n="";for(;n.length<e;){let i=await yd(e-n.length);for(let a of i)a<r&&(n+=t[a%t.length])}return n}o(_d,"random");async function wd(e){return await _d(e)}o(wd,"generateVerifier");async function bd(e){let t=await(await Nr).subtle.digest("SHA-256",new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}o(bd,"generateChallenge");async function Gr(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;let t=await wd(e),r=await bd(t);return{code_verifier:t,code_challenge:r}}o(Gr,"pkceChallenge");var H=Xn().superRefine((e,t)=>{if(!URL.canParse(e))return t.addIssue({code:to.custom,message:"URL must be parseable",fatal:!0}),Yn}).refine(e=>{let t=new URL(e);return t.protocol!=="javascript:"&&t.protocol!=="data:"&&t.protocol!=="vbscript:"},{message:"URL cannot use javascript:, data:, or vbscript: scheme"}),or=Nt({resource:m().url(),authorization_servers:w(H).optional(),jwks_uri:m().url().optional(),scopes_supported:w(m()).optional(),bearer_methods_supported:w(m()).optional(),resource_signing_alg_values_supported:w(m()).optional(),resource_name:m().optional(),resource_documentation:m().optional(),resource_policy_uri:m().url().optional(),resource_tos_uri:m().url().optional(),tls_client_certificate_bound_access_tokens:se().optional(),authorization_details_types_supported:w(m()).optional(),dpop_signing_alg_values_supported:w(m()).optional(),dpop_bound_access_tokens_required:se().optional()}),yt=Nt({issuer:m(),authorization_endpoint:H,token_endpoint:H,registration_endpoint:H.optional(),scopes_supported:w(m()).optional(),response_types_supported:w(m()),response_modes_supported:w(m()).optional(),grant_types_supported:w(m()).optional(),token_endpoint_auth_methods_supported:w(m()).optional(),token_endpoint_auth_signing_alg_values_supported:w(m()).optional(),service_documentation:H.optional(),revocation_endpoint:H.optional(),revocation_endpoint_auth_methods_supported:w(m()).optional(),revocation_endpoint_auth_signing_alg_values_supported:w(m()).optional(),introspection_endpoint:m().optional(),introspection_endpoint_auth_methods_supported:w(m()).optional(),introspection_endpoint_auth_signing_alg_values_supported:w(m()).optional(),code_challenge_methods_supported:w(m()).optional(),client_id_metadata_document_supported:se().optional()}),Rd=Nt({issuer:m(),authorization_endpoint:H,token_endpoint:H,userinfo_endpoint:H.optional(),jwks_uri:H,registration_endpoint:H.optional(),scopes_supported:w(m()).optional(),response_types_supported:w(m()),response_modes_supported:w(m()).optional(),grant_types_supported:w(m()).optional(),acr_values_supported:w(m()).optional(),subject_types_supported:w(m()),id_token_signing_alg_values_supported:w(m()),id_token_encryption_alg_values_supported:w(m()).optional(),id_token_encryption_enc_values_supported:w(m()).optional(),userinfo_signing_alg_values_supported:w(m()).optional(),userinfo_encryption_alg_values_supported:w(m()).optional(),userinfo_encryption_enc_values_supported:w(m()).optional(),request_object_signing_alg_values_supported:w(m()).optional(),request_object_encryption_alg_values_supported:w(m()).optional(),request_object_encryption_enc_values_supported:w(m()).optional(),token_endpoint_auth_methods_supported:w(m()).optional(),token_endpoint_auth_signing_alg_values_supported:w(m()).optional(),display_values_supported:w(m()).optional(),claim_types_supported:w(m()).optional(),claims_supported:w(m()).optional(),service_documentation:m().optional(),claims_locales_supported:w(m()).optional(),ui_locales_supported:w(m()).optional(),claims_parameter_supported:se().optional(),request_parameter_supported:se().optional(),request_uri_parameter_supported:se().optional(),require_request_uri_registration:se().optional(),op_policy_uri:H.optional(),op_tos_uri:H.optional(),client_id_metadata_document_supported:se().optional()}),ir=_e({...Rd.shape,...yt.pick({code_challenge_methods_supported:!0}).shape}),We=_e({access_token:m(),id_token:m().optional(),token_type:m(),expires_in:ro.number().optional(),scope:m().optional(),refresh_token:m().optional()}).strip(),ii=_e({error:m(),error_description:m().optional(),error_uri:m().optional()}),oi=H.optional().or(eo("").transform(()=>{})),Cd=_e({redirect_uris:w(H),token_endpoint_auth_method:m().optional(),grant_types:w(m()).optional(),response_types:w(m()).optional(),client_name:m().optional(),client_uri:H.optional(),logo_uri:oi,scope:m().optional(),contacts:w(m()).optional(),tos_uri:oi,policy_uri:m().optional(),jwks_uri:H.optional(),jwks:Qn().optional(),software_id:m().optional(),software_version:m().optional(),software_statement:m().optional()}).strip(),ar=_e({client_id:m(),client_secret:m().optional(),client_id_issued_at:xr().optional(),client_secret_expires_at:xr().optional()}).strip(),_t=Cd.merge(ar),hg=_e({error:m(),error_description:m().optional()}).strip(),gg=_e({token:m(),token_type_hint:m().optional()}).strip();function ai(e){let t=typeof e=="string"?new URL(e):new URL(e.href);return t.hash="",t}o(ai,"resourceUrlFromServerUrl");function si({requestedResource:e,configuredResource:t}){let r=typeof e=="string"?new URL(e):new URL(e.href),n=typeof t=="string"?new URL(t):new URL(t.href);if(r.origin!==n.origin||r.pathname.length<n.pathname.length)return!1;let i=r.pathname.endsWith("/")?r.pathname:r.pathname+"/",a=n.pathname.endsWith("/")?n.pathname:n.pathname+"/";return i.startsWith(a)}o(si,"checkResourceAllowed");var x=class extends Error{static{o(this,"OAuthError")}constructor(t,r){super(t),this.errorUri=r,this.name=this.constructor.name}toResponseObject(){let t={error:this.errorCode,error_description:this.message};return this.errorUri&&(t.error_uri=this.errorUri),t}get errorCode(){return this.constructor.errorCode}},wt=class extends x{static{o(this,"InvalidRequestError")}};wt.errorCode="invalid_request";var Oe=class extends x{static{o(this,"InvalidClientError")}};Oe.errorCode="invalid_client";var Me=class extends x{static{o(this,"InvalidGrantError")}};Me.errorCode="invalid_grant";var qe=class extends x{static{o(this,"UnauthorizedClientError")}};qe.errorCode="unauthorized_client";var bt=class extends x{static{o(this,"UnsupportedGrantTypeError")}};bt.errorCode="unsupported_grant_type";var Rt=class extends x{static{o(this,"InvalidScopeError")}};Rt.errorCode="invalid_scope";var Ct=class extends x{static{o(this,"AccessDeniedError")}};Ct.errorCode="access_denied";var pe=class extends x{static{o(this,"ServerError")}};pe.errorCode="server_error";var St=class extends x{static{o(this,"TemporarilyUnavailableError")}};St.errorCode="temporarily_unavailable";var It=class extends x{static{o(this,"UnsupportedResponseTypeError")}};It.errorCode="unsupported_response_type";var vt=class extends x{static{o(this,"UnsupportedTokenTypeError")}};vt.errorCode="unsupported_token_type";var At=class extends x{static{o(this,"InvalidTokenError")}};At.errorCode="invalid_token";var kt=class extends x{static{o(this,"MethodNotAllowedError")}};kt.errorCode="method_not_allowed";var xt=class extends x{static{o(this,"TooManyRequestsError")}};xt.errorCode="too_many_requests";var De=class extends x{static{o(this,"InvalidClientMetadataError")}};De.errorCode="invalid_client_metadata";var Ut=class extends x{static{o(this,"InsufficientScopeError")}};Ut.errorCode="insufficient_scope";var Tt=class extends x{static{o(this,"InvalidTargetError")}};Tt.errorCode="invalid_target";var ci={[wt.errorCode]:wt,[Oe.errorCode]:Oe,[Me.errorCode]:Me,[qe.errorCode]:qe,[bt.errorCode]:bt,[Rt.errorCode]:Rt,[Ct.errorCode]:Ct,[pe.errorCode]:pe,[St.errorCode]:St,[It.errorCode]:It,[vt.errorCode]:vt,[At.errorCode]:At,[kt.errorCode]:kt,[xt.errorCode]:xt,[De.errorCode]:De,[Ut.errorCode]:Ut,[Tt.errorCode]:Tt};function Sd(e){return["client_secret_basic","client_secret_post","none"].includes(e)}o(Sd,"isClientAuthMethod");var Jr="code",Fr="S256";function Id(e,t){let r=e.client_secret!==void 0;return"token_endpoint_auth_method"in e&&e.token_endpoint_auth_method&&Sd(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?r?"client_secret_basic":"none":r&&t.includes("client_secret_basic")?"client_secret_basic":r&&t.includes("client_secret_post")?"client_secret_post":t.includes("none")?"none":r?"client_secret_post":"none"}o(Id,"selectClientAuthMethod");function vd(e,t,r,n){let{client_id:i,client_secret:a}=t;switch(e){case"client_secret_basic":Ad(i,a,r);return;case"client_secret_post":kd(i,a,n);return;case"none":xd(i,n);return;default:throw new Error(`Unsupported client authentication method: ${e}`)}}o(vd,"applyClientAuthentication");function Ad(e,t,r){if(!t)throw new Error("client_secret_basic authentication requires a client_secret");let n=btoa(`${e}:${t}`);r.set("Authorization",`Basic ${n}`)}o(Ad,"applyBasicAuth");function kd(e,t,r){r.set("client_id",e),t&&r.set("client_secret",t)}o(kd,"applyPostAuth");function xd(e,t){t.set("client_id",e)}o(xd,"applyPublicAuth");async function ui(e){let t=e instanceof Response?e.status:void 0,r=e instanceof Response?await e.text():e;try{let n=ii.parse(JSON.parse(r)),{error:i,error_description:a,error_uri:s}=n,c=ci[i]||pe;return new c(a||"",s)}catch(n){let i=`${t?`HTTP ${t}: `:""}Invalid OAuth error response: ${n}. Raw body: ${r}`;return new pe(i)}}o(ui,"parseErrorResponse");async function Kr(e,t){try{return await $r(e,t)}catch(r){if(r instanceof Oe||r instanceof qe)return await e.invalidateCredentials?.("all"),await $r(e,t);if(r instanceof Me)return await e.invalidateCredentials?.("tokens"),await $r(e,t);throw r}}o(Kr,"auth");async function $r(e,{serverUrl:t,authorizationCode:r,scope:n,resourceMetadataUrl:i,fetchFn:a}){let s=await e.discoveryState?.(),c,u,l,p=i;if(!p&&s?.resourceMetadataUrl&&(p=new URL(s.resourceMetadataUrl)),s?.authorizationServerUrl){if(u=s.authorizationServerUrl,c=s.resourceMetadata,l=s.authorizationServerMetadata??await mi(u,{fetchFn:a}),!c)try{c=await pi(t,{resourceMetadataUrl:p},a)}catch{}(l!==s.authorizationServerMetadata||c!==s.resourceMetadata)&&await e.saveDiscoveryState?.({authorizationServerUrl:String(u),resourceMetadataUrl:p?.toString(),resourceMetadata:c,authorizationServerMetadata:l})}else{let M=await Md(t,{resourceMetadataUrl:p,fetchFn:a});u=M.authorizationServerUrl,l=M.authorizationServerMetadata,c=M.resourceMetadata,await e.saveDiscoveryState?.({authorizationServerUrl:String(u),resourceMetadataUrl:p?.toString(),resourceMetadata:c,authorizationServerMetadata:l})}let g=await Ud(t,e,c),R=n||c?.scopes_supported?.join(" ")||e.clientMetadata.scope,_=await Promise.resolve(e.clientInformation());if(!_){if(r!==void 0)throw new Error("Existing OAuth client information is required when exchanging an authorization code");let M=l?.client_id_metadata_document_supported===!0,j=e.clientMetadataUrl;if(j&&!Wr(j))throw new De(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${j}`);if(M&&j)_={client_id:j},await e.saveClientInformation?.(_);else{if(!e.saveClientInformation)throw new Error("OAuth client information must be saveable for dynamic registration");let $n=await Hd(u,{metadata:l,clientMetadata:e.clientMetadata,scope:R,fetchFn:a});await e.saveClientInformation($n),_=$n}}let O=!e.redirectUrl;if(r!==void 0||O){let M=await jd(e,u,{metadata:l,resource:g,authorizationCode:r,fetchFn:a});return await e.saveTokens(M),"AUTHORIZED"}let T=await e.tokens();if(T?.refresh_token)try{let M=await zd(u,{metadata:l,clientInformation:_,refreshToken:T.refresh_token,resource:g,addClientAuthentication:e.addClientAuthentication,fetchFn:a});return await e.saveTokens(M),"AUTHORIZED"}catch(M){if(!(!(M instanceof x)||M instanceof pe))throw M}let B=e.state?await e.state():void 0,{authorizationUrl:Le,codeVerifier:X}=await qd(u,{metadata:l,clientInformation:_,state:B,redirectUrl:e.redirectUrl,scope:R,resource:g});return await e.saveCodeVerifier(X),await e.redirectToAuthorization(Le),"REDIRECT"}o($r,"authInternal");function Wr(e){if(!e)return!1;try{let t=new URL(e);return t.protocol==="https:"&&t.pathname!=="/"}catch{return!1}}o(Wr,"isHttpsUrl");async function Ud(e,t,r){let n=ai(e);if(t.validateResourceURL)return await t.validateResourceURL(n,r?.resource);if(r){if(!si({requestedResource:n,configuredResource:r.resource}))throw new Error(`Protected resource ${r.resource} does not match expected ${n} (or origin)`);return new URL(r.resource)}}o(Ud,"selectResourceURL");function li(e){let t=e.headers.get("WWW-Authenticate");if(!t)return{};let[r,n]=t.split(" ");if(r.toLowerCase()!=="bearer"||!n)return{};let i=Zr(e,"resource_metadata")||void 0,a;if(i)try{a=new URL(i)}catch{}let s=Zr(e,"scope")||void 0,c=Zr(e,"error")||void 0;return{resourceMetadataUrl:a,scope:s,error:c}}o(li,"extractWWWAuthenticateParams");function Zr(e,t){let r=e.headers.get("WWW-Authenticate");if(!r)return null;let n=new RegExp(`${t}=(?:"([^"]+)"|([^\\s,]+))`),i=r.match(n);return i?i[1]||i[2]:null}o(Zr,"extractFieldFromWwwAuth");async function pi(e,t,r=fetch){let n=await Ed(e,"oauth-protected-resource",r,{protocolVersion:t?.protocolVersion,metadataUrl:t?.resourceMetadataUrl});if(!n||n.status===404)throw await n?.body?.cancel(),new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");if(!n.ok)throw await n.body?.cancel(),new Error(`HTTP ${n.status} trying to load well-known OAuth protected resource metadata.`);return or.parse(await n.json())}o(pi,"discoverOAuthProtectedResourceMetadata");async function Vr(e,t,r=fetch){try{return await r(e,{headers:t})}catch(n){if(n instanceof TypeError)return t?Vr(e,void 0,r):void 0;throw n}}o(Vr,"fetchWithCorsRetry");function Td(e,t="",r={}){return t.endsWith("/")&&(t=t.slice(0,-1)),r.prependPathname?`${t}/.well-known/${e}`:`/.well-known/${e}${t}`}o(Td,"buildWellKnownPath");async function di(e,t,r=fetch){return await Vr(e,{"MCP-Protocol-Version":t},r)}o(di,"tryMetadataDiscovery");function Pd(e,t){return!e||e.status>=400&&e.status<500&&t!=="/"}o(Pd,"shouldAttemptFallback");async function Ed(e,t,r,n){let i=new URL(e),a=n?.protocolVersion??Ur,s;if(n?.metadataUrl)s=new URL(n.metadataUrl);else{let u=Td(t,i.pathname);s=new URL(u,n?.metadataServerUrl??i),s.search=i.search}let c=await di(s,a,r);if(!n?.metadataUrl&&Pd(c,i.pathname)){let u=new URL(`/.well-known/${t}`,i);c=await di(u,a,r)}return c}o(Ed,"discoverMetadataWithFallback");function Od(e){let t=typeof e=="string"?new URL(e):e,r=t.pathname!=="/",n=[];if(!r)return n.push({url:new URL("/.well-known/oauth-authorization-server",t.origin),type:"oauth"}),n.push({url:new URL("/.well-known/openid-configuration",t.origin),type:"oidc"}),n;let i=t.pathname;return i.endsWith("/")&&(i=i.slice(0,-1)),n.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:"oauth"}),n.push({url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:"oidc"}),n.push({url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:"oidc"}),n}o(Od,"buildDiscoveryUrls");async function mi(e,{fetchFn:t=fetch,protocolVersion:r=Ur}={}){let n={"MCP-Protocol-Version":r,Accept:"application/json"},i=Od(e);for(let{url:a,type:s}of i){let c=await Vr(a,n,t);if(c){if(!c.ok){if(await c.body?.cancel(),c.status>=400&&c.status<500)continue;throw new Error(`HTTP ${c.status} trying to load ${s==="oauth"?"OAuth":"OpenID provider"} metadata from ${a}`)}return s==="oauth"?yt.parse(await c.json()):ir.parse(await c.json())}}}o(mi,"discoverAuthorizationServerMetadata");async function Md(e,t){let r,n;try{r=await pi(e,{resourceMetadataUrl:t?.resourceMetadataUrl},t?.fetchFn),r.authorization_servers&&r.authorization_servers.length>0&&(n=r.authorization_servers[0])}catch{}n||(n=String(new URL("/",e)));let i=await mi(n,{fetchFn:t?.fetchFn});return{authorizationServerUrl:n,authorizationServerMetadata:i,resourceMetadata:r}}o(Md,"discoverOAuthServerInfo");async function qd(e,{metadata:t,clientInformation:r,redirectUrl:n,scope:i,state:a,resource:s}){let c;if(t){if(c=new URL(t.authorization_endpoint),!t.response_types_supported.includes(Jr))throw new Error(`Incompatible auth server: does not support response type ${Jr}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(Fr))throw new Error(`Incompatible auth server: does not support code challenge method ${Fr}`)}else c=new URL("/authorize",e);let u=await Gr(),l=u.code_verifier,p=u.code_challenge;return c.searchParams.set("response_type",Jr),c.searchParams.set("client_id",r.client_id),c.searchParams.set("code_challenge",p),c.searchParams.set("code_challenge_method",Fr),c.searchParams.set("redirect_uri",String(n)),a&&c.searchParams.set("state",a),i&&c.searchParams.set("scope",i),i?.includes("offline_access")&&c.searchParams.append("prompt","consent"),s&&c.searchParams.set("resource",s.href),{authorizationUrl:c,codeVerifier:l}}o(qd,"startAuthorization");function Dd(e,t,r){return new URLSearchParams({grant_type:"authorization_code",code:e,code_verifier:t,redirect_uri:String(r)})}o(Dd,"prepareAuthorizationCodeRequest");async function fi(e,{metadata:t,tokenRequestParams:r,clientInformation:n,addClientAuthentication:i,resource:a,fetchFn:s}){let c=t?.token_endpoint?new URL(t.token_endpoint):new URL("/token",e),u=new Headers({"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"});if(a&&r.set("resource",a.href),i)await i(u,r,c,t);else if(n){let p=t?.token_endpoint_auth_methods_supported??[],g=Id(n,p);vd(g,n,u,r)}let l=await(s??fetch)(c,{method:"POST",headers:u,body:r});if(!l.ok)throw await ui(l);return We.parse(await l.json())}o(fi,"executeTokenRequest");async function zd(e,{metadata:t,clientInformation:r,refreshToken:n,resource:i,addClientAuthentication:a,fetchFn:s}){let c=new URLSearchParams({grant_type:"refresh_token",refresh_token:n}),u=await fi(e,{metadata:t,tokenRequestParams:c,clientInformation:r,addClientAuthentication:a,resource:i,fetchFn:s});return{refresh_token:n,...u}}o(zd,"refreshAuthorization");async function jd(e,t,{metadata:r,resource:n,authorizationCode:i,fetchFn:a}={}){let s=e.clientMetadata.scope,c;if(e.prepareTokenRequest&&(c=await e.prepareTokenRequest(s)),!c){if(!i)throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");if(!e.redirectUrl)throw new Error("redirectUrl is required for authorization_code flow");let l=await e.codeVerifier();c=Dd(i,l,e.redirectUrl)}let u=await e.clientInformation();return fi(t,{metadata:r,tokenRequestParams:c,clientInformation:u??void 0,addClientAuthentication:e.addClientAuthentication,resource:n,fetchFn:a})}o(jd,"fetchToken");async function Hd(e,{metadata:t,clientMetadata:r,scope:n,fetchFn:i}){let a;if(t){if(!t.registration_endpoint)throw new Error("Incompatible auth server: does not support dynamic client registration");a=new URL(t.registration_endpoint)}else a=new URL("/register",e);let s=await(i??fetch)(a,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({...r,...n!==void 0?{scope:n}:{}})});if(!s.ok)throw await ui(s);return _t.parse(await s.json())}o(Hd,"registerClient");var Yr="zuplo.com",Bd=new Set(["co.jp","co.kr","co.nz","co.uk","com.au","com.br","com.cn","com.mx","com.sg","co.in"]),Ld=[".example.test",".example.com",".example.org",".invalid",".localhost",".test"];function hi(e){return`https://www.google.com/s2/favicons?domain=${e}&sz=128`}o(hi,"s2FaviconHref");function Nd(e){return`https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&drop_404_icon=true&fallback_opts=TYPE,SIZE,URL&url=http://${e}&size=128`}o(Nd,"strictFaviconHref");var sr=hi(Yr);function Xr(e){let t=e.toLowerCase();return t===Yr||t==="zuplo.app"||t==="zuplo.dev"||t.endsWith(".zuplo.app")||t.endsWith(".zuplo.dev")?hi(Yr):Nd(e)}o(Xr,"resolveIconHref");function Gd(e){try{return new URL(`http://${e}`).hostname}catch{return e}}o(Gd,"hostnameFromHost");function Jd(e){return e==="localhost"||e.includes(":")||/^\d{1,3}(?:\.\d{1,3}){3}$/.test(e)}o(Jd,"isLocalOrAddressHost");function Fd(e){let t=Gd(e).toLowerCase().replace(/\.$/,"");if(Jd(t)||Ld.some(a=>t===a.slice(1)||t.endsWith(a)))return t;let r=t.split(".").filter(Boolean);if(r.length<=2)return t;let n=r.slice(-2).join("."),i=Bd.has(n)?3:2;return r.slice(-i).join(".")}o(Fd,"inferFaviconDomain");function Qr(e){return{src:Xr(Fd(e)),mimeType:"image/png",sizes:["128x128"]}}o(Qr,"resolveMcpFaviconIcon");function cr(e){try{return Qr(new URL(e).host)}catch{return}}o(cr,"resolveMcpFaviconIconFromUrl");function ve(e){let t=ee().connectionsById.get(e);if(!t)throw new k(`Unknown upstream server "${e}". Check the route's MCP upstream policy and ensure policies.json declares a matching upstream connection.`);return{displayName:t.displayName,description:t.description,serverInfo:t.serverInfo,transport:{baseUrl:t.mcpUrl,resourceMetadataUrl:t.protectedResourceMetadataUrl}}}o(ve,"getUpstreamServerConfig");function dr(e){let t=ee().connectionsById.get(e.upstreamServerId);if(!t||t.authProfileId!==e.authProfileId)throw new k(`Unknown auth profile "${String(e.authProfileId)}" for upstream server "${e.upstreamServerId}". Check the route's MCP upstream policy and ensure policies.json declares a matching auth mode for that upstream connection.`);return t.authConfig}o(dr,"getUpstreamAuthConfig");function Ve(e,t){let r=dr({upstreamServerId:e,authProfileId:t});if(r.mode!=="shared-oauth"&&r.mode!=="user-oauth")throw new k(`Upstream server "${e}" does not use upstream OAuth. Select authMode "shared-oauth" or "user-oauth" before starting an upstream OAuth connection flow.`);return r.oauth}o(Ve,"requireUpstreamOAuthConfig");function gi(e,t){let r=dr({upstreamServerId:e,authProfileId:t});if(r.mode!=="id-jag")throw new k(`Upstream server "${e}" does not use upstream ID-JAG. Select authMode "id-jag" before requesting an upstream XAA token exchange.`);return r.idJag}o(gi,"requireUpstreamIdJagConfig");function yi(e,t){if(!t)return;if(t.aborted){e.abort(t.reason);return}let r=o(()=>e.abort(t.reason),"abort");return t.addEventListener("abort",r,{once:!0}),()=>t.removeEventListener("abort",r)}o(yi,"mergeAbortSignals");async function $d(e){try{await e.cancel()}catch{}}o($d,"cancelReader");async function ur(e,t){if(!e)return new Uint8Array;let r=e.getReader(),n=[],i=0,a=await r.read();for(;!a.done;){let u=a.value;if(i+=u.byteLength,i>t.maxBytes)throw await $d(r),t.createLimitError();n.push(u),a=await r.read()}let s=new Uint8Array(i),c=0;for(let u of n)s.set(u,c),c+=u.byteLength;return s}o(ur,"readBoundedByteStream");var Zd=2,Kd=1024*1024,Wd=1e4,Vd=new Set([301,302,303,307,308]),Yd=["authorization","proxy-authorization","cookie","cookie2"];function en(e){return typeof e=="string"?e:e instanceof URL?e.toString():e.url}o(en,"readRequestUrl");function Ye(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}o(Ye,"readRequestMethod");function Xd(e,t,r){let n=e.headers.get("content-length");if(!n)return;let i=Number.parseInt(n,10);if(Number.isFinite(i)&&i>t)throw new h({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[y]:r}})}o(Xd,"assertContentLengthWithinLimit");async function Qd(e,t,r){return Xd(e,t,r),ur(e.body,{maxBytes:t,createLimitError:o(()=>new h({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[y]:r}}),"createLimitError")})}o(Qd,"readBoundedResponseBody");function eu(e,t){let r=new ArrayBuffer(t.byteLength);return new Uint8Array(r).set(t),new Response(r,{status:e.status,statusText:e.statusText,headers:e.headers})}o(eu,"responseFromBufferedBody");function tu(e,t){if(!Vd.has(e.status))return;let r=e.headers.get("location");if(r)return new URL(r,t).toString()}o(tu,"resolveRedirectUrl");function _i(e,t){try{return t.validateUrl(e)}catch(r){throw new h({message:"Outbound URL was not allowed.",extensionMembers:{[y]:t.problemCode}},{cause:r})}}o(_i,"validateOutboundUrl");function ru(e,t){throw e instanceof h&&Gt(e.extensionMembers?.[y])?e:new h({message:"Outbound fetch failed.",extensionMembers:{[y]:t}},{cause:e})}o(ru,"normalizeFetchError");function Pt(e,t){if(e===void 0)return;let r={event:t.event,code:t.problemCode,method:t.method};if(t.host!==void 0&&(r.host=t.host),t.extra!==void 0)for(let[n,i]of Object.entries(t.extra))i!==void 0&&(r[n]=i);t.error!==void 0&&G(r,"error",t.error),e.log.warn(r,"Outbound HTTP exchange rejected")}o(Pt,"logOutboundFailure");async function nu(e,t,r,n,i,a,s){let c=Ye(r,n);try{return await t(r,n)}catch(u){let l=u instanceof DOMException&&u.name==="AbortError";Pt(e,{event:l?"outbound_fetch_aborted":"outbound_fetch_failed",problemCode:i,method:c,host:q(a),error:u,extra:{abortReason:s()}}),ru(u,i)}}o(nu,"fetchWithNormalizedError");function ou(e){if(e.redirects>=e.maxRedirects)throw new h({message:"Outbound redirects exceeded the maximum allowed depth.",extensionMembers:{[y]:e.problemCode}});if(e.method!=="GET"&&e.method!=="HEAD")throw new h({message:"Outbound redirect after a non-idempotent request was blocked.",extensionMembers:{[y]:e.problemCode}})}o(ou,"assertRedirectAllowed");function iu(e,t){let r=new Headers(e);for(let n of Yd)r.delete(n);for(let n of t)r.delete(n);return r}o(iu,"stripCrossOriginHeaders");function au(e,t,r,n,i){let a={...e,method:t,redirect:"manual",signal:r};return n&&(a.headers=iu(e.headers,i)),a}o(au,"buildRedirectInit");function su(e,t,r){let n={...t,redirect:"manual",signal:r};return n.headers===void 0&&e instanceof Request&&(n.headers=e.headers),n}o(su,"buildInitialRequestInit");function cu(e){let t=Ye(e.currentInput,e.currentInit);ou({redirects:e.redirects,maxRedirects:e.maxRedirects,method:t,problemCode:e.problemCode});let r=_i(e.redirectUrl,{problemCode:e.problemCode,validateUrl:e.validateUrl}),n=new URL(e.currentUrl),i=r.origin!==n.origin,a=r.toString();return{currentInput:a,currentUrl:a,currentInit:au(e.currentInit,t,e.signal,i,e.additionalCrossOriginStrippedHeaders),redirects:e.redirects+1}}o(cu,"followRedirect");async function tn(e,t,r){let n=r.problemCode??"invalid_request",i=r.maxRedirects??Zd,a=r.maxResponseBytes??Kd,s=r.timeoutMs??Wd,c=r.fetchImpl??fetch,u=r.additionalCrossOriginStrippedHeaders??[],l=r.context,p=new AbortController,g=yi(p,t.signal),R=!1,_=setTimeout(()=>{R=!0,p.abort()},s),O=e,T=su(e,t,p.signal),B;try{B=_i(en(e),{problemCode:n,validateUrl:r.validateUrl}).toString()}catch(X){throw Pt(l,{event:"outbound_url_blocked",problemCode:n,method:Ye(e,t),host:q(en(e)),error:X}),clearTimeout(_),g?.(),X}let Le=0;try{for(;;){let X=await nu(l,c,O,T,n,B,()=>R?`timeout_after_${s}ms`:void 0),M=tu(X,B);if(M!==void 0)try{let j=cu({currentInput:O,currentInit:T,currentUrl:B,redirectUrl:M,redirects:Le,maxRedirects:i,problemCode:n,validateUrl:r.validateUrl,signal:p.signal,additionalCrossOriginStrippedHeaders:u});O=j.currentInput,T=j.currentInit,B=j.currentUrl,Le=j.redirects;continue}catch(j){throw Pt(l,{event:"outbound_redirect_blocked",problemCode:n,method:Ye(O,T),host:q(B),error:j,extra:{redirects:Le,maxRedirects:i,redirectTargetHost:q(M)}}),j}try{return eu(X,await Qd(X,a,n))}catch(j){throw Pt(l,{event:"outbound_response_size_exceeded",problemCode:n,method:Ye(O,T),host:q(B),error:j,extra:{maxResponseBytes:a,status:X.status}}),j}}}finally{clearTimeout(_),g?.()}}o(tn,"runSafeOutboundExchange");async function Et(e,t,r){let n=await tn(e,t,r);try{return{response:n,json:await n.clone().json()}}catch(i){throw Pt(r.context,{event:"outbound_json_parse_failed",problemCode:r.problemCode??"invalid_request",method:Ye(e,t),host:q(en(e)),error:i,extra:{status:n.status,contentType:n.headers.get("content-type")??void 0}}),new h({message:"Outbound JSON response could not be parsed.",extensionMembers:{[y]:r.problemCode??"invalid_request"}},{cause:i})}}o(Et,"runSafeOutboundJsonExchange");function wi(e,t={},r={}){return tn(e,t,{...r,validateUrl:ft})}o(wi,"fetchConfiguredOutbound");function bi(e,t={},r={}){return Et(e,t,{...r,validateUrl:ft})}o(bi,"fetchConfiguredOutboundJson");function lr(e,t={},r={}){return Et(e,t,{...r,validateUrl:jo})}o(lr,"fetchIdentityProviderJson");function Ri(e,t={},r={}){return Et(e,t,{...r,validateUrl:Xt})}o(Ri,"fetchCimdClientMetadataJson");function Ci(e,t={},r={}){return Et(e,t,{...r,validateUrl:ht})}o(Ci,"fetchCimdClientJwksJson");import{errors as xi,jwtVerify as Ui,SignJWT as Ti}from"jose";var Z="zuplo-mcp-gateway",W=Z,V="HS256";import{base64url as du}from"jose";var uu=new TextEncoder,lu="MCP gateway could not initialize secure key material.",pu=32,Si=new Map,Ii=new Map,mu;function fu(){return mu??Zn.instance.authPrivateKey}o(fu,"readAuthPrivateKey");function vi(e){return new Q(lu,e===void 0?void 0:{cause:e})}o(vi,"createGeneratedKeyMaterialError");function Ai(e,t){let r=du.decode(t);if(r.byteLength!==pu)throw new Error(`Generated deployment auth key ${e} is invalid.`);return r}o(Ai,"decodeJwkKeyField");function hu(e){let t=fu();if(!t)throw vi();try{let r=JSON.parse(t);if(r.kty!=="OKP"||r.crv!=="Ed25519"||typeof r.d!="string"||typeof r.x!="string")throw new Error("Generated deployment auth key is not an Ed25519 JWK.");let n=Ai("d",r.d);Ai("x",r.x);let i=uu.encode(`zuplo-mcp-gateway:${e}:Ed25519:`),a=new Uint8Array(i.byteLength+n.byteLength);return a.set(i),a.set(n,i.byteLength),a}catch(r){throw vi(r)}}o(hu,"decodeGeneratedKeyMaterial");function gu(e){let t=Si.get(e);return t||(t=hu(e),Si.set(e,t)),t}o(gu,"getMasterKeyMaterial");async function oe(e){let t=Ii.get(e.purpose);if(t!==void 0)return t;let r=await e.derive(gu(e.keyMaterialPurpose));return Ii.set(e.purpose,r),r}o(oe,"readCachedDerivedKey");var yu="SHA-256",_u=32,wu="zuplo-mcp-gateway:",bu=new TextEncoder,ki=new WeakMap;async function Ae(e,t){let r=ki.get(e);r||(r=new Map,ki.set(e,r));let n=r.get(t);if(n)return n;let i=await Ru(e,t);return r.set(t,i),i}o(Ae,"deriveGatewaySigningKey");async function Ru(e,t){let r=J(e),n=await crypto.subtle.importKey("raw",r,{name:"HKDF"},!1,["deriveBits"]),i=bu.encode(`${wu}${t}`),a=await crypto.subtle.deriveBits({name:"HKDF",hash:yu,salt:new Uint8Array,info:J(i)},n,_u*8);return new Uint8Array(a)}o(Ru,"hkdfExpand");var Pi=900,Cu=900,Su=bo.extend({id:Go}),Iu=Su.extend({exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Ei=Tr.extend({id:Jo,purpose:d.literal("browser_connect")}),vu=Tr.extend({purpose:d.literal("browser_connect")}),Au=Ei.extend({exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Oi=Pi*1e3;async function Mi(){return oe({purpose:"oauth-state",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"oauth-state"),"derive")})}o(Mi,"getOAuthStateKey");async function qi(){return oe({purpose:"browser-connect",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"browser-connect"),"derive")})}o(qi,"getBrowserConnectKey");async function Di(e){let t=Math.floor(Date.now()/1e3)+Pi;return new Ti(e).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(t).sign(await Mi())}o(Di,"signOAuthState");async function pr(e){try{let{payload:t}=await Ui(e,await Mi(),{algorithms:[V],issuer:Z,audience:W});return Iu.parse(t)}catch(t){throw t instanceof xi.JWTExpired?new h({message:"OAuth state has expired",extensionMembers:{[y]:"oauth_state_expired"}},{cause:t}):new h({message:"OAuth state could not be verified",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:t})}}o(pr,"verifyOAuthState");async function zi(e){let t=Math.floor(Date.now()/1e3)+Cu,r=vu.parse(e),n=Ei.parse({...r,id:Ko()});return new Ti(n).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(t).sign(await qi())}o(zi,"signBrowserConnectTicket");async function ji(e){try{let{payload:t}=await Ui(e,await qi(),{algorithms:[V],issuer:Z,audience:W});return Au.parse(t)}catch(t){throw t instanceof xi.JWTExpired?new h({message:"Browser connect ticket has expired",extensionMembers:{[y]:"oauth_state_expired"}},{cause:t}):new h({message:"Browser connect ticket could not be verified",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:t})}}o(ji,"verifyBrowserConnectTicket");async function Hi(e){if((await C().consumeBrowserConnectTicket({id:e.id,expiresAt:S(new Date(e.exp*1e3)),now:S(new Date)})).kind==="consumed")throw new h({message:"Browser connect ticket has already been used",extensionMembers:{[y]:"oauth_state_reused"}})}o(Hi,"consumeBrowserConnectTicket");function ku(e,t,r=!1){return r?`${e} authorization must be renewed before this ${t} can be used.`:`${e} authorization is required before this ${t} can be used.`}o(ku,"buildConnectRequiredMessage");async function xu(e){let t=D(e.requestUrl,e.requestHeaders),r=new URL(e.path,t);return e.redirect&&r.searchParams.set("redirect","true"),r.searchParams.set("operationId",e.operationId),r.searchParams.set("browserTicket",await zi({...pt(e),purpose:"browser_connect"})),r.toString()}o(xu,"buildGatewayBrowserTicketUrl");function Uu(e){return L().actionPath(`/auth/connections/${encodeURIComponent(e)}/connect`)}o(Uu,"buildGatewayConnectPath");async function rn(e){return xu({...e,path:Uu(e.upstreamServerId),redirect:!0})}o(rn,"buildGatewayConnectUrl");async function mr(e){let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return{state:e.requiresReconsent?"reconsent_required":"authenticating",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},authUrl:await rn(t),message:ku(e.upstreamDisplayName,e.subject,e.requiresReconsent),nextAction:"redirect"}}o(mr,"buildRedirectConnectRequiredResponse");function Bi(e){return Tu({...e,message:e.requiresReconsent?`An administrator must reconnect ${e.upstreamDisplayName} before this tool can be used.`:`An administrator must connect ${e.upstreamDisplayName} before this tool can be used.`})}o(Bi,"buildAdminConnectRequiredResponse");function Tu(e){return{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},message:e.message,nextAction:"admin_setup_required"}}o(Tu,"buildAdminSetupRequiredResponse");var Li=12;async function Ni(e){let t=await crypto.subtle.digest("SHA-256",J(new TextEncoder().encode(e)));return Array.from(new Uint8Array(t)).map(r=>r.toString(16).padStart(2,"0")).join("")}o(Ni,"sha256Hex");async function ze(e){if(e)return(await Ni(e)).slice(0,Li)}o(ze,"fingerprintSecret");async function Xe(e){let t=JSON.stringify([e.owner.mode,e.owner.mode==="user"?e.owner.subjectId:"",e.upstreamServerId,e.authProfileId]);return(await Ni(t)).slice(0,Li)}o(Xe,"fingerprintConnectionIdentity");var Pu=6e4;function Qe(e,t){return e===void 0?!0:e.status!==t.status||e.encryptedAccessToken!==t.encryptedAccessToken||e.encryptedRefreshToken!==t.encryptedRefreshToken||e.expiresAt!==t.expiresAt||e.scopes.length!==t.scopes.length||e.scopes.some((r,n)=>t.scopes[n]!==r)}o(Qe,"credentialGenerationChanged");function F(e){if(!e)return"no_connection";if(e.status!=="active")return"inactive";if(!e.encryptedAccessToken)return"no_access_token";if(e.expiresAt){let t=new Date(e.expiresAt).getTime();if(t<=Date.now())return"expired";if(t<=Date.now()+Pu)return"near_expiry"}return"usable"}o(F,"describeAccessTokenState");var Gi=new Set(["client_id","code_challenge","code_challenge_method","display","login_hint","nonce","prompt","redirect_uri","response_mode","response_type","state"]);function Eu(e,t){return e&&e.length>0?e.join(t):void 0}o(Eu,"joinOAuthScopes");function Ou(e){if(e?.authorization_endpoint===void 0)return e;let t=new URL(e.authorization_endpoint);for(let r of Gi)t.searchParams.delete(r);return{...e,authorization_endpoint:t.toString()}}o(Ou,"sanitizeAuthorizationServerMetadata");function Ji(e){let t=Ou(e.authorizationServerMetadata);return t===e.authorizationServerMetadata?e:{...e,authorizationServerMetadata:t}}o(Ji,"sanitizeOAuthDiscoveryState");function Fi(e){let t=new URL(e);for(let r of Gi){let n=t.searchParams.getAll(r);n.length<=1||(t.searchParams.delete(r),t.searchParams.set(r,n.at(-1)??""))}return t}o(Fi,"dedupeSingletonAuthorizationRequestParams");function fr(e){let t=new URL(e);return K(t)&&oo(t.hostname)!=="localhost"&&(t.hostname="localhost"),t}o(fr,"normalizeLoopbackOAuthRedirectUri");function $i(e){return Eu(e.state?.resourceMetadata?.scopes_supported,e.delimiter)}o($i,"readProtectedResourceMetadataScope");function Mu(e){return`Zuplo MCP Gateway - ${e}`}o(Mu,"buildGatewayOAuthClientName");function qu(e,t){return e&&e.length>0?e.join(t):void 0}o(qu,"joinOAuthScopeList");function Du(e){if(e.clientRegistration.mode!=="auto")return qu(e.scopes,e.scopeDelimiter)}o(Du,"readPublicClientMetadataScope");function nn(e){return new URL(L().actionPath(`/.well-known/oauth-client/${encodeURIComponent(e.upstreamServerId)}`),e.origin).toString()}o(nn,"buildOAuthClientMetadataDocumentUrl");function on(e){let t=ve(e.upstreamServerId);return{client_name:Mu(t.displayName),client_uri:new URL("/",e.origin).toString(),redirect_uris:[e.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],application_type:"web",...e.scope===void 0?{}:{scope:e.scope},token_endpoint_auth_method:"none"}}o(on,"buildGatewayOAuthClientMetadata");function Zi(e,t,r){let n=Ve(t,r),i=Du(n);return{client_id:nn({origin:e,upstreamServerId:t}),...on({origin:e,upstreamServerId:t,redirectUri:fr(new URL(n.redirectPath,e)).toString(),scope:i})}}o(Zi,"buildOAuthClientMetadataDocument");import{base64url as ke}from"jose";var zu="SHA-256",et="AES-GCM",ju=12,sn="zuplo-secret",cn=1,Ki="generated:auth_private_key:token-encryption",Hu=d.object({version:d.literal(cn),keyId:d.literal(Ki),algorithm:d.literal(et),iv:d.string().min(1),ciphertext:d.string().min(1)}).strict();async function an(){return oe({purpose:"token-encryption",keyMaterialPurpose:"token-encryption",derive:o(async e=>{let t=await crypto.subtle.digest(zu,J(e));return crypto.subtle.importKey("raw",t,{name:et},!1,["encrypt","decrypt"])},"derive")})}o(an,"getEncryptionKey");function Wi(e){return J(new TextEncoder().encode(`${sn}:v${e.version}:${e.keyId}`))}o(Wi,"getAssociatedData");function Bu(e){return`${sn}:v${e.version}:${ke.encode(new TextEncoder().encode(JSON.stringify(e)))}`}o(Bu,"encodeEnvelope");function Lu(e){let t=`${sn}:v${cn}:`;if(!e.startsWith(t))return;let r=e.slice(t.length),n=new TextDecoder().decode(ke.decode(r));return Hu.parse(JSON.parse(n))}o(Lu,"decodeEnvelope");async function me(e){let t=await an(),r=crypto.getRandomValues(new Uint8Array(ju)),n={version:cn,keyId:Ki},i=await crypto.subtle.encrypt({name:et,iv:r,additionalData:Wi(n)},t,new TextEncoder().encode(e));return Bu({...n,algorithm:et,iv:ke.encode(r),ciphertext:ke.encode(new Uint8Array(i))})}o(me,"encryptSecret");async function fe(e){let t=Lu(e);if(t){let s=await an(),c=await crypto.subtle.decrypt({name:et,iv:J(ke.decode(t.iv)),additionalData:Wi(t)},s,J(ke.decode(t.ciphertext)));return new TextDecoder().decode(c)}let[r,n]=e.split(".");if(!r||!n)throw new Q("Encrypted payload is malformed");let i=await an(),a=await crypto.subtle.decrypt({name:et,iv:J(ke.decode(r))},i,J(ke.decode(n)));return new TextDecoder().decode(a)}o(fe,"decryptSecret");var Nu=d.union([_t,ar]),Gu=d.object({authorizationServerUrl:d.url(),resourceMetadataUrl:d.url().optional(),resourceMetadata:or.optional(),authorizationServerMetadata:d.union([yt,ir]).optional()}).passthrough(),Ju="Bearer",Fu="__zuplo_refresh_only_upstream_access_token__";function dn(e){return e?e.split(/[,\s]+/).filter(Boolean):[]}o(dn,"splitScopes");function un(e,t){let r=new Set(e);return t.every(n=>r.has(n))}o(un,"scopesCover");function $u(e){return Ge.parse(e)}o($u,"parsePkceCodeVerifier");function Zu(e){if(typeof e.expires_in=="number")return S(new Date(Date.now()+e.expires_in*1e3))}o(Zu,"readTokenExpiry");async function Ku(e){if(e!==void 0)return me(JSON.stringify(e))}o(Ku,"encryptJson");async function Wu(e,t){if(!e)return;let r=await fe(e);try{return t.parse(JSON.parse(r))}catch(n){throw new h({message:"Stored upstream OAuth JSON state is invalid.",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:n})}}o(Wu,"decryptJson");function Vu(e,t){return"redirect_uris"in e?e.redirect_uris.includes(t):!0}o(Vu,"clientInformationAllowsRedirectUri");function Yu(e){return e.clientMetadataUrl===void 0?"redirect_uris"in e.clientInformation:"redirect_uris"in e.clientInformation||e.clientInformation.client_id===e.clientMetadataUrl}o(Yu,"clientInformationMatchesCurrentClientMetadataUrl");function Xu(e){return e.clientMetadataUrl!==void 0&&!("redirect_uris"in e.clientInformation)&&e.clientInformation.client_id===e.clientMetadataUrl}o(Xu,"isUrlBasedClientInformation");function Qu(e,t){return t===void 0?e:{...e,scope:t}}o(Qu,"applyOAuthClientMetadataScope");function el(e,t){return $i({state:e,delimiter:t})}o(el,"readResourceMetadataScope");function tl(e,t){return e&&e.length>0?e.join(t):void 0}o(tl,"joinOAuthScopeList");function rl(e){let t;if(e.registration.tokenEndpointAuthMethod!=="none"&&(t=e.registration.clientSecret,!t))throw new k(`Manual OAuth registration for upstream "${e.upstreamServerId}" requires clientSecret. Set the env var that backs the client secret or use tokenEndpointAuthMethod "none".`);return _t.parse({...e.clientMetadata,client_id:e.registration.clientId,token_endpoint_auth_method:e.registration.tokenEndpointAuthMethod,...t===void 0?{}:{client_secret:t}})}o(rl,"buildManualOAuthClientInformation");function nl(e,t){let r=nn({origin:new URL(t).origin,upstreamServerId:e});return Wr(r)?r:void 0}o(nl,"buildClientMetadataUrl");function ol(e){for(let t of e)if(t!==void 0)return t}o(ol,"firstDefined");function il(e){let t=Ve(e.target.upstreamServerId,e.target.authProfileId),r=tl(t.scopes,t.scopeDelimiter),n=on({origin:new URL(e.redirectUri).origin,upstreamServerId:e.target.upstreamServerId,redirectUri:e.redirectUri,scope:r});if(t.clientRegistration.mode==="manual")return{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,configuredClientInformation:rl({clientMetadata:n,registration:t.clientRegistration,upstreamServerId:e.target.upstreamServerId})};let i=nl(e.target.upstreamServerId,e.redirectUri);return i===void 0?{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt}:{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,clientMetadataUrl:i}}o(il,"buildInitialOAuthClientSetup");function al(e,t){if(t===void 0)return ol([e.pendingState?.encryptedClientInformation,e.connectionMetadata?.encryptedClientInformation,e.connection?.metadata?.encryptedClientInformation])}o(al,"readEncryptedClientInformation");var xe=class{static{o(this,"UpstreamOAuthProvider")}clientMetadataUrl;target;redirectUriValue;returnOrigin;clientMetadataValue;configuredScope;scopeDelimiter;promptOverride;configuredClientInformation;challengeScope;inferredScope;authorizationUrlValue;credentialState;pendingState;encryptedClientInformation;cachedClientInformation;clientInformationLoaded=!1;cachedDiscoveryState;discoveryStateLoaded=!1;tokensLoaded=!1;tokenPersistenceOutcome;connectionFingerprintValue;usedRefreshTokenFingerprintValue;constructor(t){let r=il({target:t.target,redirectUri:t.redirectUri});this.target=t.target,this.redirectUriValue=t.redirectUri,this.returnOrigin=t.returnOrigin,this.clientMetadataValue=r.clientMetadata,this.configuredScope=r.configuredScope,this.scopeDelimiter=r.scopeDelimiter,this.promptOverride=r.promptOverride,this.configuredClientInformation=r.configuredClientInformation,r.clientMetadataUrl!==void 0&&(this.clientMetadataUrl=r.clientMetadataUrl),this.credentialState={sourceConnection:t.connection,currentConnection:t.connection},this.pendingState=t.pendingState?{...t.pendingState}:void 0,this.encryptedClientInformation=al(t,this.configuredClientInformation)}get authorizationUrl(){return this.authorizationUrlValue}get configuredAuthorizationScope(){return this.configuredScope}get usedRefreshTokenFingerprint(){return this.usedRefreshTokenFingerprintValue}get currentConnection(){return this.credentialState.currentConnection}get tokenWriteWasPersisted(){return this.tokenPersistenceOutcome==="persisted"}connectionSatisfiesRequestedScope(t,r){let n=dn(this.configuredScope??r??this.readEffectiveScope());return un(t.scopes,n)}readUsablePeerAdoption(t){let r=this.credentialState.peerAdoption?.connection;return r!==void 0&&F(r)==="usable"&&this.connectionSatisfiesRequestedScope(r,t)?r:void 0}async adoptConnectionForDirectResolution(t,r){this.adoptPeerConnection(t,r),this.tokensLoaded=!1,this.credentialState.sdkTokenMemo=void 0;let n=U();n&&n.info({event:"upstream_oauth_peer_credential_adopted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,adoptionReason:r,sourceUpdatedAt:this.credentialState.sourceConnection?.updatedAt,resultingUpdatedAt:t.updatedAt,sourceScopeCount:this.credentialState.sourceConnection?.scopes.length,resultingScopeCount:t.scopes.length,accessTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedAccessToken),refreshTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedRefreshToken)},"Adopted a concurrent upstream OAuth credential")}adoptPeerConnection(t,r){this.credentialState.currentConnection=t,this.credentialState.peerAdoption={connection:t,reason:r}}async connectionFingerprint(){return this.connectionFingerprintValue===void 0&&(this.connectionFingerprintValue=await Xe({owner:this.target.owner,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId})),this.connectionFingerprintValue}async storedSecretFingerprint(t){if(t!==void 0)try{return await ze(await fe(t))}catch{return}}async conditionalUpsertCredential(t,r){try{return await C().conditionalUpsertUpstreamConnection(t,r)}catch(n){let i=U();if(i){let a=Object.assign(new Error("Upstream OAuth conditional storage write failed",{cause:n}),{event:"upstream_oauth_conditional_write_failed",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),sourceUpdatedAt:"expectedUpdatedAt"in r?r.expectedUpdatedAt:void 0,expectAbsent:"expectAbsent"in r,scopeCount:t.scopes.length});i.error(a,"Upstream OAuth conditional storage write failed")}throw n}}get redirectUrl(){return this.redirectUriValue}get clientMetadata(){return Qu(this.clientMetadataValue,this.readEffectiveScope())}async state(){let t=await this.createPendingState();return Di({id:t.id,...pt({owner:this.target.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId})})}async clientInformation(){return this.configuredClientInformation?this.configuredClientInformation:this.loadPersistedClientInformation()}async saveClientInformation(t){this.configuredClientInformation||(this.cachedClientInformation=t,this.clientInformationLoaded=!0,U()?.info({event:"upstream_oauth_client_registered",upstreamServerId:this.target.upstreamServerId,clientId:"client_id"in t?t.client_id:void 0,redirectUriCount:"redirect_uris"in t?t.redirect_uris.length:void 0},"Upstream OAuth client registered for the gateway"),!Xu({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl})&&(this.encryptedClientInformation=await Ku(t),await this.syncPendingState(!1)))}async discoveryState(){return this.readCachedDiscoveryState()}applyChallengeScope(t){this.challengeScope=t}async saveDiscoveryState(t){let r=Ji(Gu.parse(t));this.cachedDiscoveryState=r,this.discoveryStateLoaded=!0,U()?.info({event:"upstream_oauth_discovery_resolved",upstreamServerId:this.target.upstreamServerId,authorizationServerHost:q(r.authorizationServerUrl),resourceMetadataHost:q(r.resourceMetadataUrl),resource:r.resourceMetadata?.resource,scopesSupportedCount:r.resourceMetadata?.scopes_supported?.length,hasResourceMetadata:r.resourceMetadata!==void 0},"Upstream OAuth discovery resolved authorization server and resource"),this.inferredScope=el(r,this.scopeDelimiter);let n=r.resourceMetadata?.scopes_supported;if(this.configuredScope!==void 0&&n!==void 0){let i=dn(this.configuredScope).filter(a=>!n.includes(a));i.length>0&&U()?.debug({event:"upstream_oauth_configured_scopes_not_advertised",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,unadvertisedScopes:i,scopesSupported:n},"Configured upstream OAuth scopes include values the resource metadata does not advertise")}}async tokens(){return this.loadStoredTokens()}async saveTokens(t){let r=We.parse(t),n=this.target.owner.mode==="user"?this.target.owner.subjectId:void 0,i=this.credentialState.sourceConnection,a=!r.refresh_token&&!!i?.encryptedRefreshToken,s=r.refresh_token?await me(r.refresh_token):i?.encryptedRefreshToken;this.credentialState.sdkTokenMemo=r.refresh_token||!i?.encryptedRefreshToken?r:We.parse({...r,refresh_token:await fe(i.encryptedRefreshToken)}),this.tokensLoaded=!0;let c={id:i?.id??Qt(),ownerMode:this.target.owner.mode,subjectId:n,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,status:"active",encryptedAccessToken:await me(r.access_token),encryptedRefreshToken:s,scopes:dn(r.scope??this.readEffectiveScope()),expiresAt:Zu(r),metadata:this.readStoredOAuthPersistence(this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0)},u=i?{expectedUpdatedAt:i.updatedAt}:{expectAbsent:!0},l=await this.conditionalUpsertCredential(c,u),p=!1;if(l.kind==="precondition_failed"&&l.connection!==void 0&&(F(l.connection)!=="usable"||!un(l.connection.scopes,c.scopes)||!Qe(i,l.connection))){p=!0;let R=l.connection,_={id:R.id,ownerMode:R.ownerMode,subjectId:R.subjectId,upstreamServerId:R.upstreamServerId,authProfileId:R.authProfileId,status:"active",encryptedAccessToken:c.encryptedAccessToken,encryptedRefreshToken:r.refresh_token===void 0?R.encryptedRefreshToken:c.encryptedRefreshToken,scopes:c.scopes,expiresAt:c.expiresAt,metadata:R.metadata};U()?.info({event:"upstream_oauth_bounded_rebase_attempted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:R.id,sourceUpdatedAt:i?.updatedAt,winnerUpdatedAt:R.updatedAt,sourceScopeCount:i?.scopes.length,winnerScopeCount:R.scopes.length,resultingScopeCount:_.scopes.length},"Retrying an upstream OAuth token write against the CAS winner"),l=await this.conditionalUpsertCredential(_,{expectedUpdatedAt:R.updatedAt})}if(l.kind!=="persisted"&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),this.tokenPersistenceOutcome=l.kind,l.kind==="persisted"?(this.credentialState.currentConnection=l.connection,this.credentialState.peerAdoption=void 0):l.kind==="precondition_failed"&&l.connection!==void 0?(this.credentialState.currentConnection=l.connection,Qe(i,l.connection)&&F(l.connection)==="usable"&&un(l.connection.scopes,c.scopes)?this.adoptPeerConnection(l.connection,"cas_loss"):this.credentialState.peerAdoption=void 0):(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0),p){let R=l.kind==="persisted"?"succeeded":l.kind==="precondition_failed"?"lost":"exhausted";U()?.info({event:`upstream_oauth_bounded_rebase_${R}`,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:this.credentialState.currentConnection?.id,sourceUpdatedAt:i?.updatedAt,resultingUpdatedAt:this.credentialState.currentConnection?.updatedAt,sourceScopeCount:i?.scopes.length,resultingScopeCount:this.credentialState.currentConnection?.scopes.length},`Upstream OAuth bounded rebase ${R}`)}let g=l.kind==="persisted"?l.connection:void 0;U()?.info({event:"upstream_oauth_tokens_persisted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:g?.id??this.credentialState.currentConnection?.id,hasRefreshToken:!!s,sourceScopeCount:i?.scopes.length,priorStatus:i?.status,priorUpdatedAt:i?.updatedAt,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,newRefreshTokenFingerprint:await ze(r.refresh_token),reusedSnapshotRefreshToken:a,scopeCount:c.scopes.length,expiresAt:c.expiresAt,outcome:l.kind,rebaseAttempted:p,resultingUpdatedAt:g?.updatedAt??this.credentialState.currentConnection?.updatedAt,resultingScopeCount:g?.scopes.length??this.credentialState.currentConnection?.scopes.length},g?"Upstream OAuth tokens persisted; upstream connection is active":"Upstream OAuth token persistence yielded to concurrent storage state")}async redirectToAuthorization(t){let r=Fi(t);this.promptOverride===!1?r.searchParams.delete("prompt"):this.promptOverride!==void 0&&r.searchParams.set("prompt",this.promptOverride),this.authorizationUrlValue=r.toString()}async saveCodeVerifier(t){let r=await this.createPendingState();await this.persistPendingState({...r,codeVerifier:$u(t)})}async codeVerifier(){if(!this.pendingState?.codeVerifier)throw new h({message:"OAuth code verifier is missing",extensionMembers:{[y]:"oauth_state_invalid"}});return this.pendingState.codeVerifier}async invalidateCredentials(t){let r=t==="all"||t==="client"||t==="tokens",n=t==="all"||t==="client",i=t==="all"||t==="discovery",a=t==="all"||t==="verifier";n&&(this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,this.encryptedClientInformation=void 0),i&&(this.cachedDiscoveryState=void 0,this.discoveryStateLoaded=!0,this.challengeScope=void 0,this.inferredScope=void 0),r&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),await this.syncPendingState(a),await this.persistCredentialInvalidation(r)}async createPendingState(){if(this.pendingState)return this.pendingState;let t={id:Zo(),...pt({owner:this.target.owner,initiatedBySubjectId:this.target.initiatedBySubjectId,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,operationId:this.target.operationId,...this.target.returnTo===void 0?{}:{returnTo:this.target.returnTo}}),callbackPath:new URL(this.redirectUriValue).pathname,expiresAt:S(new Date(Date.now()+Oi)),redirectUri:this.redirectUriValue,...this.returnOrigin===void 0?{}:{returnOrigin:this.returnOrigin},encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0};return await this.persistPendingState(t),t}async persistPendingState(t){await C().saveUpstreamOAuthState({record:t}),this.pendingState=t}async syncPendingState(t){this.pendingState&&await this.persistPendingState({...this.pendingState,codeVerifier:t?void 0:this.pendingState.codeVerifier,encryptedClientInformation:this.encryptedClientInformation})}async loadPersistedClientInformation(){if(this.clientInformationLoaded)return this.cachedClientInformation;let t;try{t=await Wu(this.encryptedClientInformation,Nu)}catch{this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}if(t&&(!Vu(t,this.redirectUriValue)||!Yu({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl}))){this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}return t===void 0&&this.pendingState?.codeVerifier!==void 0&&this.clientMetadataUrl!==void 0&&(t=ar.parse({client_id:this.clientMetadataUrl})),this.cachedClientInformation=t,this.clientInformationLoaded=!0,this.cachedClientInformation}async readCachedDiscoveryState(){if(this.discoveryStateLoaded)return this.cachedDiscoveryState;this.discoveryStateLoaded=!0}readEffectiveScope(){return this.configuredScope??this.challengeScope??this.inferredScope}async loadStoredTokens(){if(this.tokensLoaded)return this.credentialState.sdkTokenMemo;this.tokensLoaded=!0;let t=this.credentialState.currentConnection;if(!t||t.status!=="active"){U()?.debug({event:"upstream_oauth_tokens_not_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t?.id,status:t?.status??"not_connected"},"Upstream OAuth tokens not loaded; connection is not active");return}let r=t.encryptedAccessToken?await fe(t.encryptedAccessToken):void 0,n=t.encryptedRefreshToken?await fe(t.encryptedRefreshToken):void 0;if(!r&&!n)return;let i=U();this.usedRefreshTokenFingerprintValue=i?await ze(n):void 0,i?.debug({event:"upstream_oauth_tokens_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,hasAccessToken:!!r,hasRefreshToken:!!n,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,expiresAt:t.expiresAt},"Upstream OAuth tokens loaded from stored connection");let a=We.parse({access_token:r??Fu,token_type:Ju,refresh_token:n,scope:t.scopes.length>0?t.scopes.join(" "):void 0});return this.credentialState.sdkTokenMemo=a,a}async persistCredentialInvalidation(t){let r=this.credentialState.sourceConnection;if(!r)return;let n=r.status,i=r.updatedAt,a={id:r.id,ownerMode:r.ownerMode,subjectId:r.subjectId,upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,status:r.status,encryptedAccessToken:r.encryptedAccessToken,encryptedRefreshToken:r.encryptedRefreshToken,scopes:[...r.scopes],expiresAt:r.expiresAt,metadata:r.metadata?{...r.metadata}:void 0};t&&(a.status="reconsent_required",a.encryptedAccessToken=void 0,a.encryptedRefreshToken=void 0,a.scopes=[],a.expiresAt=void 0),a.metadata=this.readStoredOAuthPersistence(r.metadata?.connectedBySubjectId);let s=await this.conditionalUpsertCredential(a,{expectedUpdatedAt:r.updatedAt});s.kind==="persisted"?(this.credentialState.currentConnection=s.connection,this.credentialState.peerAdoption=void 0):s.kind==="missing"?(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0):s.connection!==void 0&&(this.credentialState.currentConnection=s.connection,Qe(r,s.connection)&&F(s.connection)==="usable"&&this.connectionSatisfiesRequestedScope(s.connection)?this.adoptPeerConnection(s.connection,"cas_loss"):this.credentialState.peerAdoption=void 0);let c=U();if(c){let u=s.kind==="missing"?void 0:s.connection,l={event:"upstream_oauth_credentials_invalidated",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:u?.id,clearedTokens:t,priorStatus:n,newStatus:u?.status,priorUpdatedAt:i,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,outcome:s.kind};s.kind==="precondition_failed"?c.warn({...l,event:"upstream_oauth_invalidation_precondition_lost"},"Upstream OAuth credential invalidation yielded to concurrent storage state"):t?c.warn(l,"Upstream OAuth credentials invalidated; connection now requires reconsent"):c.debug(l,"Upstream OAuth credential metadata rewritten")}}readStoredOAuthPersistence(t){if(!(!this.encryptedClientInformation&&!t))return{encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:t}}};var sl=3e4,cl=256*1024,dl=2,ul="does not support dynamic client registration",ll=["Resource server does not implement OAuth 2.0 Protected Resource Metadata","trying to load well-known OAuth protected resource metadata"],pl=["HTTP 403 Forbidden","Access Denied","permission to access"],ml=new Set(["access_denied","invalid_client","invalid_grant","invalid_request","invalid_scope","invalid_target","unauthorized_client","unsupported_grant_type"]);function fl(e){return e instanceof Error&&e.message.includes(ul)}o(fl,"isDynamicClientRegistrationUnsupported");function hl(e){return e instanceof Error&&ll.some(t=>e.message.includes(t))}o(hl,"isProtectedResourceMetadataUnavailable");function gl(e){return e instanceof Error&&pl.some(t=>e.message.includes(t))}o(gl,"isUpstreamProviderAccessDenied");function yl(e){return e instanceof x&&ml.has(e.errorCode)}o(yl,"isStoredConnectionReconsentError");function _l(e){if(e.error instanceof h&&e.error.extensionMembers?.[y]!==void 0)return e.error;if(fl(e.error))return new h({message:`The authorization server for ${e.upstreamServerId} does not advertise Client ID Metadata Document support and does not support Dynamic Client Registration. Register an OAuth client for the gateway manually before retrying.`,extensionMembers:{[y]:"upstream_client_registration_required"}},{cause:e.error});if(hl(e.error))return new h({message:`The upstream MCP server "${e.upstreamServerId}" does not publish OAuth protected resource metadata at "${e.resourceMetadataUrl}". Configure protectedResourceMetadataUrl to a working metadata document, use a provider-supported legacy client, or contact the provider to approve/allowlist this gateway OAuth client before retrying.`,extensionMembers:{[y]:"upstream_oauth_discovery_unavailable"}},{cause:e.error});if(gl(e.error))return new h({message:`The upstream provider denied access while connecting ${e.upstreamServerId}. Confirm the provider allows this gateway and its OAuth client, then retry.`,extensionMembers:{[y]:"upstream_provider_access_denied"}},{cause:e.error})}o(_l,"mapUpstreamOAuthSetupError");function wl(e){return typeof e=="string"||e instanceof URL?{url:new URL(e.toString())}:{method:e.method,url:new URL(e.url)}}o(wl,"readOAuthFetchRequest");function bl(e,t){return(e.headers.get("content-type")??"").includes("json")||t.trimStart().startsWith("{")||t.trimStart().startsWith("[")}o(bl,"responseLooksJson");function Rl(e,t){let r=e.headers.get("content-type")??"",n=t.trimStart().toLowerCase();return r.includes("html")||n.startsWith("<!doctype html")||n.startsWith("<html")}o(Rl,"responseLooksHtml");function Cl(e){let t=e.response.statusText?` ${e.response.statusText}`:"",r=e.response.headers.get("content-type")??"text/html";throw new h({message:`The upstream provider returned ${e.response.status}${t} (${r}) from ${e.request.url.toString()} while connecting ${e.upstreamServerId}.`,extensionMembers:{[y]:e.response.status===403?"upstream_provider_access_denied":"upstream_token_exchange_failed",[we]:e.response.status,[Je]:r,[be]:e.request.url.toString(),[Fe]:e.body}})}o(Cl,"throwUpstreamHtmlError");function Sl(e){try{let t=JSON.parse(e);if(typeof t!="object"||t===null)return{};let r=t;return{error:typeof r.error=="string"?r.error:void 0,errorDescription:typeof r.error_description=="string"?r.error_description:void 0}}catch{return{}}}o(Sl,"readUpstreamOAuthErrorBody");function Il(e){let{error:t,errorDescription:r}=Sl(e.body);e.log?.warn({event:"upstream_oauth_http_error",upstreamServerId:e.upstreamServerId,method:e.request.method??"GET",host:q(e.request.url),path:e.request.url.pathname,status:e.response.status,oauthError:t,oauthErrorDescription:r?.slice(0,256)},"Upstream OAuth HTTP request returned an error response")}o(Il,"logUpstreamOAuthHttpError");function Yi(e){return async(t,r)=>{let n=wl(t),i=U(),a=Date.now(),s=await wi(t,r,{maxRedirects:dl,maxResponseBytes:cl,problemCode:"upstream_token_exchange_failed",timeoutMs:sl}),c=await s.clone().text();if(i?.debug({event:"upstream_oauth_http_request",upstreamServerId:e,method:n.method??"GET",host:q(n.url),path:n.url.pathname,status:s.status,durationMs:Date.now()-a,responseChars:c.length},"Upstream OAuth HTTP request completed"),s.ok||Il({log:i,upstreamServerId:e,request:n,response:s,body:c}),!s.ok&&Rl(s,c)&&Cl({upstreamServerId:e,request:n,response:s,body:c}),!bl(s,c))return s;try{JSON.parse(c)}catch(u){throw new h({message:`Upstream OAuth fetch ${n.url.origin}${n.url.pathname} for ${e} returned invalid JSON.`,extensionMembers:{[y]:"upstream_token_exchange_failed"}},{cause:u})}return s}}o(Yi,"createUpstreamOAuthFetch");function Xi(e){U()?.debug({event:e.phase==="authorize"?"upstream_oauth_authorize_started":"upstream_oauth_token_exchange_started",upstreamServerId:e.upstreamServerId,serverHost:q(e.serverUrl),resourceMetadataHost:q(e.resourceMetadataUrl),hasRequestedScope:e.requestedScope!==void 0},e.phase==="authorize"?"Upstream OAuth authorization flow started":"Upstream OAuth authorization-code exchange started")}o(Xi,"logUpstreamOAuthFlowStarted");function Qi(e){let t={event:"upstream_oauth_flow_failed",phase:e.phase,upstreamServerId:e.upstreamServerId},r=q(e.serverUrl);r!==void 0&&(t.serverHost=r);let n=e.error instanceof h?e.error.extensionMembers?.[y]:void 0;typeof n=="string"&&(t.code=n),G(t,"error",e.error),U()?.warn(t,"Upstream OAuth flow failed before a connection was established")}o(Qi,"logUpstreamOAuthFlowFailed");function ea(e,t){return e.configuredAuthorizationScope??t.requestedScope}o(ea,"readAuthorizationRequestScope");async function ta(e,t){e.applyChallengeScope(t.requestedScope),Xi({phase:"authorize",...t});try{let r={serverUrl:t.serverUrl,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Yi(t.upstreamServerId)},n=ea(e,t);return n!==void 0&&(r.scope=n),await Kr(e,r)}catch(r){Qi({phase:"authorize",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:r});let n=_l({upstreamServerId:t.upstreamServerId,resourceMetadataUrl:t.resourceMetadataUrl,error:r});throw n!==void 0?n:r}}o(ta,"runUpstreamOAuth");async function vl(e,t){e.applyChallengeScope(t.requestedScope),Xi({phase:"token_exchange",...t});let r={serverUrl:t.serverUrl,authorizationCode:t.authorizationCode,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Yi(t.upstreamServerId)},n=ea(e,t);n!==void 0&&(r.scope=n);try{return await Kr(e,r)}catch(i){throw Qi({phase:"token_exchange",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:i}),i}}o(vl,"exchangeUpstreamAuthorizationCode");async function Vi(e){let t=e.provider.readUsablePeerAdoption(e.requestedScope);if(t!==void 0)return await e.provider.adoptConnectionForDirectResolution(t,"cas_loss"),!0;let[r]=await C().batchGetUpstreamConnections([{owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}]);return r===void 0||F(r)!=="usable"||!Qe(e.connection,r)||!e.provider.connectionSatisfiesRequestedScope(r,e.requestedScope)?!1:(await e.provider.adoptConnectionForDirectResolution(r,"boundary_reread"),!0)}o(Vi,"adoptPeerCredentialAtResolutionBoundary");async function ra(e,t){let r=await ta(e,t);if(r==="REDIRECT"&&e.authorizationUrl)return e.authorizationUrl;throw r==="AUTHORIZED"?new h({message:`OAuth connect flow reused existing credentials instead of producing a redirect for ${t.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}}):new h({message:`Unexpected OAuth result for ${t.upstreamServerId}: ${r}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}})}o(ra,"requireUpstreamAuthorizationRedirect");async function na(e){let t=F(e.connection),r=!!e.forceRefresh,n=!r&&t==="usable"&&e.connection!==void 0&&e.provider.connectionSatisfiesRequestedScope(e.connection,e.requestedScope),i=U(),a=i?await Xe({owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}):void 0;if(i?.debug({event:"upstream_oauth_refresh_decision",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,ownerMode:e.target.owner.mode,connectionFingerprint:a,connectionId:e.connection?.id,accessTokenState:t,forceRefresh:r,willRefresh:!n,expiresAt:e.connection?.expiresAt,connectionUpdatedAt:e.connection?.updatedAt},n?"Reusing stored upstream access token":"Refreshing upstream credential"),n)return{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}};let s;try{s=await ta(e.provider,{upstreamServerId:e.target.upstreamServerId,serverUrl:e.serverUrl,resourceMetadataUrl:e.resourceMetadataUrl,...e.requestedScope===void 0?{}:{requestedScope:e.requestedScope}})}catch(c){if(e.connection===void 0||!yl(c))throw c;return i?.warn({event:"upstream_oauth_connection_reconsent_required",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,oauthError:c.errorCode,connectionFingerprint:a,connectionId:e.connection.id,rejectedRefreshTokenFingerprint:e.provider.usedRefreshTokenFingerprint,connectionUpdatedAt:e.connection.updatedAt,connectionExpiresAt:e.connection.expiresAt},"Stored upstream OAuth connection was rejected by the upstream provider"),await e.provider.invalidateCredentials("all"),await Vi({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}if(s==="AUTHORIZED"){let c=e.provider.readUsablePeerAdoption(e.requestedScope);return c!==void 0&&await e.provider.adoptConnectionForDirectResolution(c,"cas_loss"),!e.provider.tokenWriteWasPersisted&&c===void 0?{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:void 0,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}:{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}}if(s!=="REDIRECT")throw new h({message:`Unexpected OAuth result for ${e.target.upstreamServerId}: ${s}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});if(!e.provider.authorizationUrl)throw new h({message:`OAuth connect-required flow did not produce a redirect for ${e.target.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});return await Vi({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}o(na,"authorizeUpstreamOAuthSession");async function Al(e){let t=await pr(e.stateToken),r=await C().consumeUpstreamOAuthState({id:t.id,now:S(new Date)}),n=kl(r);return xl({storedState:n,signedState:t,upstreamServerId:e.upstreamServerId,callbackPath:new URL(e.request.url).pathname}),Ul(n),n}o(Al,"consumeStoredCallbackState");function kl(e){switch(e.kind){case"consumed":throw new h({message:"OAuth state has already been used",extensionMembers:{[y]:"oauth_state_reused"}});case"missing":throw new h({message:"OAuth state is missing or expired",extensionMembers:{[y]:"oauth_state_expired"}});case"available":return e.record}}o(kl,"readConsumedCallbackState");function xl(e){if(![e.storedState.ownerMode===e.signedState.ownerMode,e.storedState.initiatedBySubjectId===e.signedState.initiatedBySubjectId,e.storedState.ownerSubjectId===e.signedState.ownerSubjectId,e.storedState.upstreamServerId===e.signedState.upstreamServerId,e.storedState.authProfileId===e.signedState.authProfileId,e.storedState.operationId===e.signedState.operationId,e.storedState.upstreamServerId===e.upstreamServerId,e.storedState.callbackPath===e.callbackPath].every(Boolean))throw new h({message:"OAuth callback did not match the initiating request",extensionMembers:{[y]:"oauth_callback_mismatch"}})}o(xl,"assertStoredCallbackStateMatches");function Ul(e){if(new Date(e.expiresAt).getTime()<=Date.now())throw new h({message:"OAuth state has expired",extensionMembers:{[y]:"oauth_state_expired"}})}o(Ul,"assertStoredCallbackStateFresh");async function ln(e){if(e.owner.mode==="shared"){let r={upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,requiresReconsent:!!e.connection};return e.connection!==void 0&&(r.connectionId=e.connection.id),Bi(r)}let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,subject:"tool",requiresReconsent:!!e.connection,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return e.connection!==void 0&&(t.connectionId=e.connection.id),mr(t)}o(ln,"buildOAuthConnectRequiredResponse");async function oa(e){let t=await Al({request:e.request,upstreamServerId:e.upstreamServerId,stateToken:e.stateToken}),r=Kt(t),[n]=await C().batchGetUpstreamConnections([{owner:r,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId}]),i={target:{owner:r,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,...t.returnTo===void 0?{}:{returnTo:t.returnTo}},redirectUri:t.redirectUri,pendingState:t};n!==void 0&&(i.connection=n);let a=new xe(i),s=await vl(a,{upstreamServerId:e.upstreamServerId,serverUrl:e.upstreamServerConfig.transport.baseUrl,authorizationCode:e.authorizationCode,resourceMetadataUrl:e.upstreamServerConfig.transport.resourceMetadataUrl});if(s==="AUTHORIZED"){let c=a.readUsablePeerAdoption();if(c!==void 0&&await a.adoptConnectionForDirectResolution(c,"cas_loss"),!a.tokenWriteWasPersisted&&c===void 0)throw new h({message:`OAuth callback storage changed while connecting ${e.upstreamServerId}. Restart the connection flow and try again.`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});return t}throw s!=="REDIRECT"?new h({message:`Unexpected OAuth result for ${e.upstreamServerId}: ${s}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}}):new h({message:`OAuth callback flow did not finish authorization for ${e.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}})}o(oa,"finishUpstreamOAuthCallback");import{importPKCS8 as Tl,SignJWT as Pl}from"jose";var aa=1e4,sa=64*1024,ca=2,El=300,ne=d.string().min(1),Ol=d.object({access_token:ne,issued_token_type:d.literal(Er),token_type:d.string().optional(),expires_in:d.number().int().positive().optional(),scope:ne.optional()}).passthrough(),Ml=d.object({id_token:ne,token_type:ne.optional(),expires_in:d.number().int().positive().optional(),refresh_token:ne.optional(),scope:ne.optional()}).passthrough(),ql=d.object({access_token:ne,token_type:ne,expires_in:d.number().int().positive().optional(),scope:ne.optional(),resource:ne.optional(),refresh_token:ne.optional()}).passthrough();function ia(e){return encodeURIComponent(e).replace(/%20/g,"+")}o(ia,"formEncodeClientCredential");function Dl(e){return e.replaceAll("\\n",`
+import{$b as Ur,$c as Do,Ab as Je,Ac as q,Bb as Fe,Bc as ko,Cb as we,Cc as U,Db as be,Dc as xo,Eb as Gt,Ec as Ce,Fb as uo,Fc as Pr,Gb as re,Gc as Wt,Hb as lo,Hc as Er,Ib as ce,Ic as Vt,Jb as b,Jc as mt,Kb as Jt,Kc as Ke,Lb as N,Lc as Uo,Mb as Re,Mc as ue,Nb as Pc,Nc as Or,Ob as Ec,Oc as Mr,Pb as Oc,Pc as To,Qb as Mc,Qc as Yt,Rb as qc,Rc as qr,Sb as Dc,Sc as Dr,Tb as zc,Tc as Po,U as no,Ub as jc,Uc as z,Vb as Hc,Vc as Eo,Wb as Bc,Wc as Oo,Xb as po,Xc as zr,Yb as mo,Yc as Mo,Zb as fo,Zc as qo,_b as Ft,_c as jr,ac as $t,ad as Ee,bc as Zt,bd as zo,cc as ut,cd as ft,dc as ho,dd as jo,ec as go,ed as Xt,fc as yo,fd as ht,gc as lt,gd as Ho,hc as _o,hd as Bo,ic as $e,id as Lo,jc as wo,jd as No,k as ae,kc as Tr,kd as Go,lc as bo,ld as Jo,mc as pt,md as Fo,nc as Kt,nd as $o,oc as Ro,od as Qt,pc as Co,pd as Zo,qb as oo,qc as So,qd as Ko,r as Pe,rb as K,rc as Io,rd as C,s as Kn,sb as io,sc as ee,sd as A,tb as ao,tc as L,td as J,ub as D,uc as vo,ud as le,vb as so,vc as Ao,vd as P,wb as Ne,wc as S,wd as er,xb as co,xc as de,xd as Lc,y as Vn,yb as Ge,yc as Ze,yd as Nc,z as Lt,zb as y,zc as G}from"../chunk-CKGECOOJ.js";import"../chunk-WGENGK72.js";import{a as I}from"../chunk-5BL2UFIS.js";import{a as Wo}from"../chunk-6SNZ4DOC.js";import{a as Wn}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{A as eo,F as to,G as ro,H as d,g as Yn,k as m,m as Xn,n as xr,o as se,q as Qn,s as w,t as _e,u as Nt}from"../chunk-SH5GYJN3.js";import"../chunk-UKQQD2JN.js";import{W as Q,X as h,Y as k,Z as Zn,_ as Bt}from"../chunk-N22BFR2U.js";import{a as o}from"../chunk-TYV53J3B.js";function Gc(e){let t=Zt.safeParse(e);return t.success?t.data.id:void 0}o(Gc,"parseJsonRpcRequestId");function Vo(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return Gc(t)}catch{return}}o(Vo,"readJsonRpcRequestIdFromBody");function tr(e){return ho.parse({jsonrpc:$t,...e.id===void 0?{}:{id:e.id},error:{code:e.error.code,message:e.error.message,...e.error.data===void 0?{}:{data:e.error.data}}})}o(tr,"jsonRpcErrorResponse");function Yo(e){return new yo([go.parse({mode:"url",message:e.message,elicitationId:e.elicitationId,url:e.url})],e.message)}o(Yo,"urlElicitationRequiredError");var nr=d.record(d.string(),d.unknown()),Jc=d.record(d.string(),d.unknown()),Ie=d.array(d.string().min(1)).min(1).optional(),Fc=d.object({name:d.string().min(1),description:d.string().min(1).optional(),annotations:Jc.optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),$c=d.object({name:d.string().min(1),description:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Zc=d.object({uri:d.string().min(1),name:d.string().min(1).optional(),description:d.string().min(1).optional(),mimeType:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Kc=d.object({uriTemplate:d.string().min(1),name:d.string().min(1).optional(),description:d.string().min(1).optional(),mimeType:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Wc=d.array(d.union([d.string(),Fc])),Vc=d.array(d.union([d.string(),$c])),Yc=d.array(d.union([d.string(),Zc])),Xc=d.array(d.union([d.string(),Kc])),Qc=d.object({module:d.unknown(),export:d.string().min(1)}).strict(),ed=d.object({mode:d.enum(["allPublic","rolesAndGroups","function"]).optional(),roleClaim:d.string().min(1).optional(),groupClaim:d.string().min(1).optional(),identifier:Qc.optional()}).strict(),td=d.object({tools:Wc.optional(),prompts:Vc.optional(),resources:Yc.optional(),resourceTemplates:Xc.optional(),accessControl:ed.optional()}).strict(),Se=[{option:"tools",listMethod:"tools/list",resultProperty:"tools",itemProperty:"name",directMethods:["tools/call"]},{option:"prompts",listMethod:"prompts/list",resultProperty:"prompts",itemProperty:"name",directMethods:["prompts/get"]},{option:"resources",listMethod:"resources/list",resultProperty:"resources",itemProperty:"uri",directMethods:["resources/read"]},{option:"resourceTemplates",listMethod:"resources/templates/list",resultProperty:"resourceTemplates",itemProperty:"uriTemplate",directMethods:[]}];function rd(e,t){return io(td,e,`MCP capability filter policy "${t}"`)}o(rd,"parseMcpCapabilityFilterOptions");function $(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}o($,"isRecord");function gt(e){return typeof e.method=="string"?e.method:void 0}o(gt,"messageMethod");function Xo(e){return typeof e=="string"||typeof e=="number"||e===null?JSON.stringify(e):void 0}o(Xo,"correlationKey");function Qo(e){if(!Array.isArray(e))return;let t=e.filter(r=>typeof r=="string");return t.length>0?t:void 0}o(Qo,"asStringArray");function ei(e,t){if(!$(e))return[];let r=t in e?e[t]:t.split(".").reduce((n,i)=>$(n)?n[i]:void 0,e);return Array.isArray(r)?r.filter(n=>typeof n=="string"):typeof r=="string"?r.split(/\s+/).filter(n=>n.length>0):[]}o(ei,"readClaimValues");function Lr(e,t){if(typeof e=="string")return{key:e,public:!1};if(!$(e))return;let r=e[t];if(typeof r=="string")return{key:r,roles:Qo(e.roles),groups:Qo(e.groups),public:e.public===!0}}o(Lr,"normalizeEntry");function nd(e,t,r){if(e.public)return!0;let n=e.roles??[],i=e.groups??[];return n.length===0&&i.length===0?!1:n.some(a=>t.has(a))||i.some(a=>r.has(a))}o(nd,"isCallerAllowed");function rr(e,t,r,n){if(e===void 0)return;let i=[];for(let a of e){let s=Lr(a,t);s!==void 0&&nd(s,r,n)&&i.push(s.key)}return i}o(rr,"allowedKeys");var ni=o((e,t,r)=>{let n=r.accessControl?.roleClaim??"roles",i=r.accessControl?.groupClaim??"groups",a=new Set(ei(e.user?.data,n)),s=new Set(ei(e.user?.data,i));return{tools:rr(r.tools,"name",a,s),prompts:rr(r.prompts,"name",a,s),resources:rr(r.resources,"uri",a,s),resourceTemplates:rr(r.resourceTemplates,"uriTemplate",a,s)}},"claimsCapabilityResolver");function od(e,t){let r=[];for(let n of Se){let i=e[n.option];if(i!==void 0)for(let a of i){let s=Lr(a,n.itemProperty);if(s===void 0)continue;let c=(s.roles?.length??0)>0||(s.groups?.length??0)>0;s.public&&c&&r.push(`${n.option} "${s.key}"`)}}if(r.length>0)throw new k(`MCP capability filter policy "${t}" - with accessControl.mode "rolesAndGroups", a capability cannot set both "public": true and roles/groups ("public" opens it to everyone, roles/groups restrict it). Remove one of the two on: ${r.join(", ")}`)}o(od,"assertNoConflictingMarkup");function id(e,t){let r=[];for(let n of Se){let i=e[n.option];if(i!==void 0)for(let a of i){let s=Lr(a,n.itemProperty);s!==void 0&&((s.roles?.length??0)>0||(s.groups?.length??0)>0||s.public)&&r.push(`${n.option} "${s.key}"`)}}if(r.length>0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode is "allPublic" (the default) but these capabilities set roles/groups/public; set accessControl.mode to "rolesAndGroups" or remove the markup: ${r.join(", ")}`)}o(id,"assertNoMarkup");function ad(e,t){let r=e.identifier;if(r===void 0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);if(r.module===null||typeof r.module!="object")throw new k(`MCP capability filter policy "${t}" - accessControl.identifier.module must reference a module, e.g. $import(./modules/mcp-access-control)`);if(!r.export)throw new k(`MCP capability filter policy "${t}" - accessControl.identifier.export must be specified`);let n=r.module[r.export];if(typeof n!="function")throw new k(`MCP capability filter policy "${t}" - accessControl.identifier must resolve to a valid function`);let i=n;return async(a,s,c)=>{let u=await i(a,s,c);if(u==null)throw new h(`MCP capability filter policy "${t}" - accessControl resolver returned no value; return an AllowedCapabilities object (use empty arrays to deny)`);if(typeof u!="object"||Array.isArray(u))throw new h(`MCP capability filter policy "${t}" - accessControl resolver must return an AllowedCapabilities object`);return u}}o(ad,"buildCustomResolver");function sd(e,t){let r=e.accessControl,n=r?.mode??"allPublic";if(n==="function"){if(r===void 0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);return ad(r,t)}if(n==="rolesAndGroups")return od(e,t),ni;id(e,t)}o(sd,"buildCapabilityResolver");function cd(e){let t={};for(let r of Se){let n=e[r.option];if(n===void 0)continue;let i=new Map;for(let a of n){let s=md(a,r.itemProperty);s!==void 0&&i.set(s.key,s)}t[r.option]=i}return t}o(cd,"buildProjectionMaps");function Hr(e){return e===void 0?void 0:Se.find(t=>t.listMethod===e)}o(Hr,"findListRule");function dd(e){return e===void 0?void 0:Se.find(t=>t.directMethods.includes(e))}o(dd,"findDirectRule");function ud(e){switch(e.method){case"tools/call":return{option:"tools",target:e.params.name};case"prompts/get":return{option:"prompts",target:e.params.name};case"resources/read":return{option:"resources",target:e.params.uri};default:return}}o(ud,"directCapabilityAccess");function ld(e){let t=dd(gt(e));if(t===void 0||!$(e.raw))return;let r=e.raw.params;if(!$(r))return;let n=r[t.itemProperty==="uri"?"uri":"name"];return typeof n=="string"?{option:t.option,target:n}:void 0}o(ld,"rawDirectCapabilityAccess");function pd(e){return Response.json(tr({...e==null?{}:{id:e},error:{code:ut.MethodNotFound,message:"Method not found"}}))}o(pd,"methodNotFoundResponse");function md(e,t){if(typeof e=="string")return{key:e,overlay:{}};if(!$(e))return;let r=e[t];if(typeof r!="string")return;let n={...e};return delete n.roles,delete n.groups,delete n.public,{key:r,overlay:n}}o(md,"buildProjection");function ti(e){let t=e.base[e.property],r=e.overlay[e.property];return $(r)?$(t)?{...t,...r}:r:t}o(ti,"mergeRecordProperty");function fd(e,t){let r={...e,...t.overlay},n=ti({base:e,overlay:t.overlay,property:"annotations"});n!==void 0&&(r.annotations=n);let i=ti({base:e,overlay:t.overlay,property:"_meta"});return i!==void 0&&(r._meta=i),r}o(fd,"applyProjection");function ri(e,t,r,n){if(!$(e))return e;let i=e.result;if(!$(i))return e;let a=i[t.resultProperty];return!Array.isArray(a)||!a.every(s=>$(s)&&typeof s[t.itemProperty]=="string")?e:{...e,result:{...i,[t.resultProperty]:a.flatMap(s=>{if(!$(s))return[];let c=s[t.itemProperty];if(typeof c!="string")return[];if(n!==void 0&&!n.has(c))return[];let u=r.get(c);return u===void 0?[]:[fd(s,u)]})}}}o(ri,"filterAndProjectItems");function hd(e){let{envelope:t,responseBody:r,projectionMaps:n,allowedSets:i}=e;if(Array.isArray(r)){if(t.shape!=="batch")return r;let u=new Map;for(let l of t.messages){let p=Hr(gt(l)),g=p===void 0?void 0:Xo(l.id);p!==void 0&&g!==void 0&&u.set(g,p)}return u.size===0?r:r.map(l=>{if(!$(l)||"error"in l)return l;let p=Xo(l.id),g=p===void 0?void 0:u.get(p),R=g===void 0?void 0:n[g.option];return g===void 0||R===void 0?l:ri(l,g,R,i?.[g.option])})}if(t.shape!=="single"||!$(r)||"error"in r)return r;let a=t.messages[0],s=Hr(a===void 0?void 0:gt(a)),c=s===void 0?void 0:n[s.option];return s===void 0||c===void 0?r:ri(r,s,c,i?.[s.option])}o(hd,"filterResponseBody");function gd(e){return e.headers.get("content-type")?.includes("json")??!1}o(gd,"isJsonResponse");var Br=class extends Lt{static{o(this,"McpCapabilityFilterInboundPolicy")}static policyType="mcp-capability-filter";#e;#r;#t;constructor(t,r){let n=rd(t,r);super(n,r),this.#r=r,this.#e=cd(n),this.#t=sd(n,r)}async handler(t,r){let n=await Wo(t);if(n===null)return t;let i=this.#t!==void 0&&this.#n(n)?await this.#i(t,r):void 0;for(let s of n.messages){let c=s.type==="request"?ud(s):ld(s);if(c===void 0)continue;let u=this.#e[c.option];if(u===void 0)continue;let l=i?.[c.option];if(!u.has(c.target)||l!==void 0&&!l.has(c.target))return pd(s.type==="request"?s.id:s.id??void 0)}if(!this.#o(n))return t;let a=this.#e;return r.addResponseSendingHook(async s=>{if(!gd(s))return s;let c;try{c=await s.clone().json()}catch{return s}let u=hd({envelope:n,responseBody:c,projectionMaps:a,allowedSets:i});if(u===c)return s;let l=new Headers(s.headers);return l.delete("content-length"),new Response(JSON.stringify(u),{status:s.status,statusText:s.statusText,headers:l})}),t}#n(t){return t.messages.some(r=>{let n=gt(r);return n===void 0?!1:Se.some(i=>this.#e[i.option]===void 0?!1:i.listMethod===n||i.directMethods.includes(n))})}#o(t){return t.messages.some(r=>{let n=Hr(gt(r));return n!==void 0&&this.#e[n.option]!==void 0})}async#i(t,r){let n=this.#t;if(n===void 0)return{};let i;try{i=await n(t,r,this.options)}catch(s){r.log.error(`MCP capability filter policy "${this.#r}" - access-control resolver threw; denying configured capabilities`,s);let c={};for(let u of Se)this.#e[u.option]!==void 0&&(c[u.option]=new Set);return c}let a={};for(let s of Se){let c=this.#e[s.option];if(c===void 0)continue;let u=i[s.option];if(u===void 0)continue;let l=new Set;if(Array.isArray(u))for(let p of u)typeof p=="string"&&c.has(p)&&l.add(p);a[s.option]=l}return a}};var Nr;Nr=globalThis.crypto;async function yd(e){return(await Nr).getRandomValues(new Uint8Array(e))}o(yd,"getRandomValues");async function _d(e){let t="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",r=Math.pow(2,8)-Math.pow(2,8)%t.length,n="";for(;n.length<e;){let i=await yd(e-n.length);for(let a of i)a<r&&(n+=t[a%t.length])}return n}o(_d,"random");async function wd(e){return await _d(e)}o(wd,"generateVerifier");async function bd(e){let t=await(await Nr).subtle.digest("SHA-256",new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}o(bd,"generateChallenge");async function Gr(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;let t=await wd(e),r=await bd(t);return{code_verifier:t,code_challenge:r}}o(Gr,"pkceChallenge");var H=Xn().superRefine((e,t)=>{if(!URL.canParse(e))return t.addIssue({code:to.custom,message:"URL must be parseable",fatal:!0}),Yn}).refine(e=>{let t=new URL(e);return t.protocol!=="javascript:"&&t.protocol!=="data:"&&t.protocol!=="vbscript:"},{message:"URL cannot use javascript:, data:, or vbscript: scheme"}),or=Nt({resource:m().url(),authorization_servers:w(H).optional(),jwks_uri:m().url().optional(),scopes_supported:w(m()).optional(),bearer_methods_supported:w(m()).optional(),resource_signing_alg_values_supported:w(m()).optional(),resource_name:m().optional(),resource_documentation:m().optional(),resource_policy_uri:m().url().optional(),resource_tos_uri:m().url().optional(),tls_client_certificate_bound_access_tokens:se().optional(),authorization_details_types_supported:w(m()).optional(),dpop_signing_alg_values_supported:w(m()).optional(),dpop_bound_access_tokens_required:se().optional()}),yt=Nt({issuer:m(),authorization_endpoint:H,token_endpoint:H,registration_endpoint:H.optional(),scopes_supported:w(m()).optional(),response_types_supported:w(m()),response_modes_supported:w(m()).optional(),grant_types_supported:w(m()).optional(),token_endpoint_auth_methods_supported:w(m()).optional(),token_endpoint_auth_signing_alg_values_supported:w(m()).optional(),service_documentation:H.optional(),revocation_endpoint:H.optional(),revocation_endpoint_auth_methods_supported:w(m()).optional(),revocation_endpoint_auth_signing_alg_values_supported:w(m()).optional(),introspection_endpoint:m().optional(),introspection_endpoint_auth_methods_supported:w(m()).optional(),introspection_endpoint_auth_signing_alg_values_supported:w(m()).optional(),code_challenge_methods_supported:w(m()).optional(),client_id_metadata_document_supported:se().optional()}),Rd=Nt({issuer:m(),authorization_endpoint:H,token_endpoint:H,userinfo_endpoint:H.optional(),jwks_uri:H,registration_endpoint:H.optional(),scopes_supported:w(m()).optional(),response_types_supported:w(m()),response_modes_supported:w(m()).optional(),grant_types_supported:w(m()).optional(),acr_values_supported:w(m()).optional(),subject_types_supported:w(m()),id_token_signing_alg_values_supported:w(m()),id_token_encryption_alg_values_supported:w(m()).optional(),id_token_encryption_enc_values_supported:w(m()).optional(),userinfo_signing_alg_values_supported:w(m()).optional(),userinfo_encryption_alg_values_supported:w(m()).optional(),userinfo_encryption_enc_values_supported:w(m()).optional(),request_object_signing_alg_values_supported:w(m()).optional(),request_object_encryption_alg_values_supported:w(m()).optional(),request_object_encryption_enc_values_supported:w(m()).optional(),token_endpoint_auth_methods_supported:w(m()).optional(),token_endpoint_auth_signing_alg_values_supported:w(m()).optional(),display_values_supported:w(m()).optional(),claim_types_supported:w(m()).optional(),claims_supported:w(m()).optional(),service_documentation:m().optional(),claims_locales_supported:w(m()).optional(),ui_locales_supported:w(m()).optional(),claims_parameter_supported:se().optional(),request_parameter_supported:se().optional(),request_uri_parameter_supported:se().optional(),require_request_uri_registration:se().optional(),op_policy_uri:H.optional(),op_tos_uri:H.optional(),client_id_metadata_document_supported:se().optional()}),ir=_e({...Rd.shape,...yt.pick({code_challenge_methods_supported:!0}).shape}),We=_e({access_token:m(),id_token:m().optional(),token_type:m(),expires_in:ro.number().optional(),scope:m().optional(),refresh_token:m().optional()}).strip(),ii=_e({error:m(),error_description:m().optional(),error_uri:m().optional()}),oi=H.optional().or(eo("").transform(()=>{})),Cd=_e({redirect_uris:w(H),token_endpoint_auth_method:m().optional(),grant_types:w(m()).optional(),response_types:w(m()).optional(),client_name:m().optional(),client_uri:H.optional(),logo_uri:oi,scope:m().optional(),contacts:w(m()).optional(),tos_uri:oi,policy_uri:m().optional(),jwks_uri:H.optional(),jwks:Qn().optional(),software_id:m().optional(),software_version:m().optional(),software_statement:m().optional()}).strip(),ar=_e({client_id:m(),client_secret:m().optional(),client_id_issued_at:xr().optional(),client_secret_expires_at:xr().optional()}).strip(),_t=Cd.merge(ar),hg=_e({error:m(),error_description:m().optional()}).strip(),gg=_e({token:m(),token_type_hint:m().optional()}).strip();function ai(e){let t=typeof e=="string"?new URL(e):new URL(e.href);return t.hash="",t}o(ai,"resourceUrlFromServerUrl");function si({requestedResource:e,configuredResource:t}){let r=typeof e=="string"?new URL(e):new URL(e.href),n=typeof t=="string"?new URL(t):new URL(t.href);if(r.origin!==n.origin||r.pathname.length<n.pathname.length)return!1;let i=r.pathname.endsWith("/")?r.pathname:r.pathname+"/",a=n.pathname.endsWith("/")?n.pathname:n.pathname+"/";return i.startsWith(a)}o(si,"checkResourceAllowed");var x=class extends Error{static{o(this,"OAuthError")}constructor(t,r){super(t),this.errorUri=r,this.name=this.constructor.name}toResponseObject(){let t={error:this.errorCode,error_description:this.message};return this.errorUri&&(t.error_uri=this.errorUri),t}get errorCode(){return this.constructor.errorCode}},wt=class extends x{static{o(this,"InvalidRequestError")}};wt.errorCode="invalid_request";var Oe=class extends x{static{o(this,"InvalidClientError")}};Oe.errorCode="invalid_client";var Me=class extends x{static{o(this,"InvalidGrantError")}};Me.errorCode="invalid_grant";var qe=class extends x{static{o(this,"UnauthorizedClientError")}};qe.errorCode="unauthorized_client";var bt=class extends x{static{o(this,"UnsupportedGrantTypeError")}};bt.errorCode="unsupported_grant_type";var Rt=class extends x{static{o(this,"InvalidScopeError")}};Rt.errorCode="invalid_scope";var Ct=class extends x{static{o(this,"AccessDeniedError")}};Ct.errorCode="access_denied";var pe=class extends x{static{o(this,"ServerError")}};pe.errorCode="server_error";var St=class extends x{static{o(this,"TemporarilyUnavailableError")}};St.errorCode="temporarily_unavailable";var It=class extends x{static{o(this,"UnsupportedResponseTypeError")}};It.errorCode="unsupported_response_type";var vt=class extends x{static{o(this,"UnsupportedTokenTypeError")}};vt.errorCode="unsupported_token_type";var At=class extends x{static{o(this,"InvalidTokenError")}};At.errorCode="invalid_token";var kt=class extends x{static{o(this,"MethodNotAllowedError")}};kt.errorCode="method_not_allowed";var xt=class extends x{static{o(this,"TooManyRequestsError")}};xt.errorCode="too_many_requests";var De=class extends x{static{o(this,"InvalidClientMetadataError")}};De.errorCode="invalid_client_metadata";var Ut=class extends x{static{o(this,"InsufficientScopeError")}};Ut.errorCode="insufficient_scope";var Tt=class extends x{static{o(this,"InvalidTargetError")}};Tt.errorCode="invalid_target";var ci={[wt.errorCode]:wt,[Oe.errorCode]:Oe,[Me.errorCode]:Me,[qe.errorCode]:qe,[bt.errorCode]:bt,[Rt.errorCode]:Rt,[Ct.errorCode]:Ct,[pe.errorCode]:pe,[St.errorCode]:St,[It.errorCode]:It,[vt.errorCode]:vt,[At.errorCode]:At,[kt.errorCode]:kt,[xt.errorCode]:xt,[De.errorCode]:De,[Ut.errorCode]:Ut,[Tt.errorCode]:Tt};function Sd(e){return["client_secret_basic","client_secret_post","none"].includes(e)}o(Sd,"isClientAuthMethod");var Jr="code",Fr="S256";function Id(e,t){let r=e.client_secret!==void 0;return"token_endpoint_auth_method"in e&&e.token_endpoint_auth_method&&Sd(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?r?"client_secret_basic":"none":r&&t.includes("client_secret_basic")?"client_secret_basic":r&&t.includes("client_secret_post")?"client_secret_post":t.includes("none")?"none":r?"client_secret_post":"none"}o(Id,"selectClientAuthMethod");function vd(e,t,r,n){let{client_id:i,client_secret:a}=t;switch(e){case"client_secret_basic":Ad(i,a,r);return;case"client_secret_post":kd(i,a,n);return;case"none":xd(i,n);return;default:throw new Error(`Unsupported client authentication method: ${e}`)}}o(vd,"applyClientAuthentication");function Ad(e,t,r){if(!t)throw new Error("client_secret_basic authentication requires a client_secret");let n=btoa(`${e}:${t}`);r.set("Authorization",`Basic ${n}`)}o(Ad,"applyBasicAuth");function kd(e,t,r){r.set("client_id",e),t&&r.set("client_secret",t)}o(kd,"applyPostAuth");function xd(e,t){t.set("client_id",e)}o(xd,"applyPublicAuth");async function ui(e){let t=e instanceof Response?e.status:void 0,r=e instanceof Response?await e.text():e;try{let n=ii.parse(JSON.parse(r)),{error:i,error_description:a,error_uri:s}=n,c=ci[i]||pe;return new c(a||"",s)}catch(n){let i=`${t?`HTTP ${t}: `:""}Invalid OAuth error response: ${n}. Raw body: ${r}`;return new pe(i)}}o(ui,"parseErrorResponse");async function Kr(e,t){try{return await $r(e,t)}catch(r){if(r instanceof Oe||r instanceof qe)return await e.invalidateCredentials?.("all"),await $r(e,t);if(r instanceof Me)return await e.invalidateCredentials?.("tokens"),await $r(e,t);throw r}}o(Kr,"auth");async function $r(e,{serverUrl:t,authorizationCode:r,scope:n,resourceMetadataUrl:i,fetchFn:a}){let s=await e.discoveryState?.(),c,u,l,p=i;if(!p&&s?.resourceMetadataUrl&&(p=new URL(s.resourceMetadataUrl)),s?.authorizationServerUrl){if(u=s.authorizationServerUrl,c=s.resourceMetadata,l=s.authorizationServerMetadata??await mi(u,{fetchFn:a}),!c)try{c=await pi(t,{resourceMetadataUrl:p},a)}catch{}(l!==s.authorizationServerMetadata||c!==s.resourceMetadata)&&await e.saveDiscoveryState?.({authorizationServerUrl:String(u),resourceMetadataUrl:p?.toString(),resourceMetadata:c,authorizationServerMetadata:l})}else{let M=await Md(t,{resourceMetadataUrl:p,fetchFn:a});u=M.authorizationServerUrl,l=M.authorizationServerMetadata,c=M.resourceMetadata,await e.saveDiscoveryState?.({authorizationServerUrl:String(u),resourceMetadataUrl:p?.toString(),resourceMetadata:c,authorizationServerMetadata:l})}let g=await Ud(t,e,c),R=n||c?.scopes_supported?.join(" ")||e.clientMetadata.scope,_=await Promise.resolve(e.clientInformation());if(!_){if(r!==void 0)throw new Error("Existing OAuth client information is required when exchanging an authorization code");let M=l?.client_id_metadata_document_supported===!0,j=e.clientMetadataUrl;if(j&&!Wr(j))throw new De(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${j}`);if(M&&j)_={client_id:j},await e.saveClientInformation?.(_);else{if(!e.saveClientInformation)throw new Error("OAuth client information must be saveable for dynamic registration");let $n=await Hd(u,{metadata:l,clientMetadata:e.clientMetadata,scope:R,fetchFn:a});await e.saveClientInformation($n),_=$n}}let O=!e.redirectUrl;if(r!==void 0||O){let M=await jd(e,u,{metadata:l,resource:g,authorizationCode:r,fetchFn:a});return await e.saveTokens(M),"AUTHORIZED"}let T=await e.tokens();if(T?.refresh_token)try{let M=await zd(u,{metadata:l,clientInformation:_,refreshToken:T.refresh_token,resource:g,addClientAuthentication:e.addClientAuthentication,fetchFn:a});return await e.saveTokens(M),"AUTHORIZED"}catch(M){if(!(!(M instanceof x)||M instanceof pe))throw M}let B=e.state?await e.state():void 0,{authorizationUrl:Le,codeVerifier:X}=await qd(u,{metadata:l,clientInformation:_,state:B,redirectUrl:e.redirectUrl,scope:R,resource:g});return await e.saveCodeVerifier(X),await e.redirectToAuthorization(Le),"REDIRECT"}o($r,"authInternal");function Wr(e){if(!e)return!1;try{let t=new URL(e);return t.protocol==="https:"&&t.pathname!=="/"}catch{return!1}}o(Wr,"isHttpsUrl");async function Ud(e,t,r){let n=ai(e);if(t.validateResourceURL)return await t.validateResourceURL(n,r?.resource);if(r){if(!si({requestedResource:n,configuredResource:r.resource}))throw new Error(`Protected resource ${r.resource} does not match expected ${n} (or origin)`);return new URL(r.resource)}}o(Ud,"selectResourceURL");function li(e){let t=e.headers.get("WWW-Authenticate");if(!t)return{};let[r,n]=t.split(" ");if(r.toLowerCase()!=="bearer"||!n)return{};let i=Zr(e,"resource_metadata")||void 0,a;if(i)try{a=new URL(i)}catch{}let s=Zr(e,"scope")||void 0,c=Zr(e,"error")||void 0;return{resourceMetadataUrl:a,scope:s,error:c}}o(li,"extractWWWAuthenticateParams");function Zr(e,t){let r=e.headers.get("WWW-Authenticate");if(!r)return null;let n=new RegExp(`${t}=(?:"([^"]+)"|([^\\s,]+))`),i=r.match(n);return i?i[1]||i[2]:null}o(Zr,"extractFieldFromWwwAuth");async function pi(e,t,r=fetch){let n=await Ed(e,"oauth-protected-resource",r,{protocolVersion:t?.protocolVersion,metadataUrl:t?.resourceMetadataUrl});if(!n||n.status===404)throw await n?.body?.cancel(),new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");if(!n.ok)throw await n.body?.cancel(),new Error(`HTTP ${n.status} trying to load well-known OAuth protected resource metadata.`);return or.parse(await n.json())}o(pi,"discoverOAuthProtectedResourceMetadata");async function Vr(e,t,r=fetch){try{return await r(e,{headers:t})}catch(n){if(n instanceof TypeError)return t?Vr(e,void 0,r):void 0;throw n}}o(Vr,"fetchWithCorsRetry");function Td(e,t="",r={}){return t.endsWith("/")&&(t=t.slice(0,-1)),r.prependPathname?`${t}/.well-known/${e}`:`/.well-known/${e}${t}`}o(Td,"buildWellKnownPath");async function di(e,t,r=fetch){return await Vr(e,{"MCP-Protocol-Version":t},r)}o(di,"tryMetadataDiscovery");function Pd(e,t){return!e||e.status>=400&&e.status<500&&t!=="/"}o(Pd,"shouldAttemptFallback");async function Ed(e,t,r,n){let i=new URL(e),a=n?.protocolVersion??Ur,s;if(n?.metadataUrl)s=new URL(n.metadataUrl);else{let u=Td(t,i.pathname);s=new URL(u,n?.metadataServerUrl??i),s.search=i.search}let c=await di(s,a,r);if(!n?.metadataUrl&&Pd(c,i.pathname)){let u=new URL(`/.well-known/${t}`,i);c=await di(u,a,r)}return c}o(Ed,"discoverMetadataWithFallback");function Od(e){let t=typeof e=="string"?new URL(e):e,r=t.pathname!=="/",n=[];if(!r)return n.push({url:new URL("/.well-known/oauth-authorization-server",t.origin),type:"oauth"}),n.push({url:new URL("/.well-known/openid-configuration",t.origin),type:"oidc"}),n;let i=t.pathname;return i.endsWith("/")&&(i=i.slice(0,-1)),n.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:"oauth"}),n.push({url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:"oidc"}),n.push({url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:"oidc"}),n}o(Od,"buildDiscoveryUrls");async function mi(e,{fetchFn:t=fetch,protocolVersion:r=Ur}={}){let n={"MCP-Protocol-Version":r,Accept:"application/json"},i=Od(e);for(let{url:a,type:s}of i){let c=await Vr(a,n,t);if(c){if(!c.ok){if(await c.body?.cancel(),c.status>=400&&c.status<500)continue;throw new Error(`HTTP ${c.status} trying to load ${s==="oauth"?"OAuth":"OpenID provider"} metadata from ${a}`)}return s==="oauth"?yt.parse(await c.json()):ir.parse(await c.json())}}}o(mi,"discoverAuthorizationServerMetadata");async function Md(e,t){let r,n;try{r=await pi(e,{resourceMetadataUrl:t?.resourceMetadataUrl},t?.fetchFn),r.authorization_servers&&r.authorization_servers.length>0&&(n=r.authorization_servers[0])}catch{}n||(n=String(new URL("/",e)));let i=await mi(n,{fetchFn:t?.fetchFn});return{authorizationServerUrl:n,authorizationServerMetadata:i,resourceMetadata:r}}o(Md,"discoverOAuthServerInfo");async function qd(e,{metadata:t,clientInformation:r,redirectUrl:n,scope:i,state:a,resource:s}){let c;if(t){if(c=new URL(t.authorization_endpoint),!t.response_types_supported.includes(Jr))throw new Error(`Incompatible auth server: does not support response type ${Jr}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(Fr))throw new Error(`Incompatible auth server: does not support code challenge method ${Fr}`)}else c=new URL("/authorize",e);let u=await Gr(),l=u.code_verifier,p=u.code_challenge;return c.searchParams.set("response_type",Jr),c.searchParams.set("client_id",r.client_id),c.searchParams.set("code_challenge",p),c.searchParams.set("code_challenge_method",Fr),c.searchParams.set("redirect_uri",String(n)),a&&c.searchParams.set("state",a),i&&c.searchParams.set("scope",i),i?.includes("offline_access")&&c.searchParams.append("prompt","consent"),s&&c.searchParams.set("resource",s.href),{authorizationUrl:c,codeVerifier:l}}o(qd,"startAuthorization");function Dd(e,t,r){return new URLSearchParams({grant_type:"authorization_code",code:e,code_verifier:t,redirect_uri:String(r)})}o(Dd,"prepareAuthorizationCodeRequest");async function fi(e,{metadata:t,tokenRequestParams:r,clientInformation:n,addClientAuthentication:i,resource:a,fetchFn:s}){let c=t?.token_endpoint?new URL(t.token_endpoint):new URL("/token",e),u=new Headers({"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"});if(a&&r.set("resource",a.href),i)await i(u,r,c,t);else if(n){let p=t?.token_endpoint_auth_methods_supported??[],g=Id(n,p);vd(g,n,u,r)}let l=await(s??fetch)(c,{method:"POST",headers:u,body:r});if(!l.ok)throw await ui(l);return We.parse(await l.json())}o(fi,"executeTokenRequest");async function zd(e,{metadata:t,clientInformation:r,refreshToken:n,resource:i,addClientAuthentication:a,fetchFn:s}){let c=new URLSearchParams({grant_type:"refresh_token",refresh_token:n}),u=await fi(e,{metadata:t,tokenRequestParams:c,clientInformation:r,addClientAuthentication:a,resource:i,fetchFn:s});return{refresh_token:n,...u}}o(zd,"refreshAuthorization");async function jd(e,t,{metadata:r,resource:n,authorizationCode:i,fetchFn:a}={}){let s=e.clientMetadata.scope,c;if(e.prepareTokenRequest&&(c=await e.prepareTokenRequest(s)),!c){if(!i)throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");if(!e.redirectUrl)throw new Error("redirectUrl is required for authorization_code flow");let l=await e.codeVerifier();c=Dd(i,l,e.redirectUrl)}let u=await e.clientInformation();return fi(t,{metadata:r,tokenRequestParams:c,clientInformation:u??void 0,addClientAuthentication:e.addClientAuthentication,resource:n,fetchFn:a})}o(jd,"fetchToken");async function Hd(e,{metadata:t,clientMetadata:r,scope:n,fetchFn:i}){let a;if(t){if(!t.registration_endpoint)throw new Error("Incompatible auth server: does not support dynamic client registration");a=new URL(t.registration_endpoint)}else a=new URL("/register",e);let s=await(i??fetch)(a,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({...r,...n!==void 0?{scope:n}:{}})});if(!s.ok)throw await ui(s);return _t.parse(await s.json())}o(Hd,"registerClient");var Yr="zuplo.com",Bd=new Set(["co.jp","co.kr","co.nz","co.uk","com.au","com.br","com.cn","com.mx","com.sg","co.in"]),Ld=[".example.test",".example.com",".example.org",".invalid",".localhost",".test"];function hi(e){return`https://www.google.com/s2/favicons?domain=${e}&sz=128`}o(hi,"s2FaviconHref");function Nd(e){return`https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&drop_404_icon=true&fallback_opts=TYPE,SIZE,URL&url=http://${e}&size=128`}o(Nd,"strictFaviconHref");var sr=hi(Yr);function Xr(e){let t=e.toLowerCase();return t===Yr||t==="zuplo.app"||t==="zuplo.dev"||t.endsWith(".zuplo.app")||t.endsWith(".zuplo.dev")?hi(Yr):Nd(e)}o(Xr,"resolveIconHref");function Gd(e){try{return new URL(`http://${e}`).hostname}catch{return e}}o(Gd,"hostnameFromHost");function Jd(e){return e==="localhost"||e.includes(":")||/^\d{1,3}(?:\.\d{1,3}){3}$/.test(e)}o(Jd,"isLocalOrAddressHost");function Fd(e){let t=Gd(e).toLowerCase().replace(/\.$/,"");if(Jd(t)||Ld.some(a=>t===a.slice(1)||t.endsWith(a)))return t;let r=t.split(".").filter(Boolean);if(r.length<=2)return t;let n=r.slice(-2).join("."),i=Bd.has(n)?3:2;return r.slice(-i).join(".")}o(Fd,"inferFaviconDomain");function Qr(e){return{src:Xr(Fd(e)),mimeType:"image/png",sizes:["128x128"]}}o(Qr,"resolveMcpFaviconIcon");function cr(e){try{return Qr(new URL(e).host)}catch{return}}o(cr,"resolveMcpFaviconIconFromUrl");function ve(e){let t=ee().connectionsById.get(e);if(!t)throw new k(`Unknown upstream server "${e}". Check the route's MCP upstream policy and ensure policies.json declares a matching upstream connection.`);return{displayName:t.displayName,description:t.description,serverInfo:t.serverInfo,transport:{baseUrl:t.mcpUrl,resourceMetadataUrl:t.protectedResourceMetadataUrl}}}o(ve,"getUpstreamServerConfig");function dr(e){let t=ee().connectionsById.get(e.upstreamServerId);if(!t||t.authProfileId!==e.authProfileId)throw new k(`Unknown auth profile "${String(e.authProfileId)}" for upstream server "${e.upstreamServerId}". Check the route's MCP upstream policy and ensure policies.json declares a matching auth mode for that upstream connection.`);return t.authConfig}o(dr,"getUpstreamAuthConfig");function Ve(e,t){let r=dr({upstreamServerId:e,authProfileId:t});if(r.mode!=="shared-oauth"&&r.mode!=="user-oauth")throw new k(`Upstream server "${e}" does not use upstream OAuth. Select authMode "shared-oauth" or "user-oauth" before starting an upstream OAuth connection flow.`);return r.oauth}o(Ve,"requireUpstreamOAuthConfig");function gi(e,t){let r=dr({upstreamServerId:e,authProfileId:t});if(r.mode!=="id-jag")throw new k(`Upstream server "${e}" does not use upstream ID-JAG. Select authMode "id-jag" before requesting an upstream XAA token exchange.`);return r.idJag}o(gi,"requireUpstreamIdJagConfig");function yi(e,t){if(!t)return;if(t.aborted){e.abort(t.reason);return}let r=o(()=>e.abort(t.reason),"abort");return t.addEventListener("abort",r,{once:!0}),()=>t.removeEventListener("abort",r)}o(yi,"mergeAbortSignals");async function $d(e){try{await e.cancel()}catch{}}o($d,"cancelReader");async function ur(e,t){if(!e)return new Uint8Array;let r=e.getReader(),n=[],i=0,a=await r.read();for(;!a.done;){let u=a.value;if(i+=u.byteLength,i>t.maxBytes)throw await $d(r),t.createLimitError();n.push(u),a=await r.read()}let s=new Uint8Array(i),c=0;for(let u of n)s.set(u,c),c+=u.byteLength;return s}o(ur,"readBoundedByteStream");var Zd=2,Kd=1024*1024,Wd=1e4,Vd=new Set([301,302,303,307,308]),Yd=["authorization","proxy-authorization","cookie","cookie2"];function en(e){return typeof e=="string"?e:e instanceof URL?e.toString():e.url}o(en,"readRequestUrl");function Ye(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}o(Ye,"readRequestMethod");function Xd(e,t,r){let n=e.headers.get("content-length");if(!n)return;let i=Number.parseInt(n,10);if(Number.isFinite(i)&&i>t)throw new h({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[y]:r}})}o(Xd,"assertContentLengthWithinLimit");async function Qd(e,t,r){return Xd(e,t,r),ur(e.body,{maxBytes:t,createLimitError:o(()=>new h({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[y]:r}}),"createLimitError")})}o(Qd,"readBoundedResponseBody");function eu(e,t){let r=new ArrayBuffer(t.byteLength);return new Uint8Array(r).set(t),new Response(r,{status:e.status,statusText:e.statusText,headers:e.headers})}o(eu,"responseFromBufferedBody");function tu(e,t){if(!Vd.has(e.status))return;let r=e.headers.get("location");if(r)return new URL(r,t).toString()}o(tu,"resolveRedirectUrl");function _i(e,t){try{return t.validateUrl(e)}catch(r){throw new h({message:"Outbound URL was not allowed.",extensionMembers:{[y]:t.problemCode}},{cause:r})}}o(_i,"validateOutboundUrl");function ru(e,t){throw e instanceof h&&Gt(e.extensionMembers?.[y])?e:new h({message:"Outbound fetch failed.",extensionMembers:{[y]:t}},{cause:e})}o(ru,"normalizeFetchError");function Pt(e,t){if(e===void 0)return;let r={event:t.event,code:t.problemCode,method:t.method};if(t.host!==void 0&&(r.host=t.host),t.extra!==void 0)for(let[n,i]of Object.entries(t.extra))i!==void 0&&(r[n]=i);t.error!==void 0&&G(r,"error",t.error),e.log.warn(r,"Outbound HTTP exchange rejected")}o(Pt,"logOutboundFailure");async function nu(e,t,r,n,i,a,s){let c=Ye(r,n);try{return await t(r,n)}catch(u){let l=u instanceof DOMException&&u.name==="AbortError";Pt(e,{event:l?"outbound_fetch_aborted":"outbound_fetch_failed",problemCode:i,method:c,host:q(a),error:u,extra:{abortReason:s()}}),ru(u,i)}}o(nu,"fetchWithNormalizedError");function ou(e){if(e.redirects>=e.maxRedirects)throw new h({message:"Outbound redirects exceeded the maximum allowed depth.",extensionMembers:{[y]:e.problemCode}});if(e.method!=="GET"&&e.method!=="HEAD")throw new h({message:"Outbound redirect after a non-idempotent request was blocked.",extensionMembers:{[y]:e.problemCode}})}o(ou,"assertRedirectAllowed");function iu(e,t){let r=new Headers(e);for(let n of Yd)r.delete(n);for(let n of t)r.delete(n);return r}o(iu,"stripCrossOriginHeaders");function au(e,t,r,n,i){let a={...e,method:t,redirect:"manual",signal:r};return n&&(a.headers=iu(e.headers,i)),a}o(au,"buildRedirectInit");function su(e,t,r){let n={...t,redirect:"manual",signal:r};return n.headers===void 0&&e instanceof Request&&(n.headers=e.headers),n}o(su,"buildInitialRequestInit");function cu(e){let t=Ye(e.currentInput,e.currentInit);ou({redirects:e.redirects,maxRedirects:e.maxRedirects,method:t,problemCode:e.problemCode});let r=_i(e.redirectUrl,{problemCode:e.problemCode,validateUrl:e.validateUrl}),n=new URL(e.currentUrl),i=r.origin!==n.origin,a=r.toString();return{currentInput:a,currentUrl:a,currentInit:au(e.currentInit,t,e.signal,i,e.additionalCrossOriginStrippedHeaders),redirects:e.redirects+1}}o(cu,"followRedirect");async function tn(e,t,r){let n=r.problemCode??"invalid_request",i=r.maxRedirects??Zd,a=r.maxResponseBytes??Kd,s=r.timeoutMs??Wd,c=r.fetchImpl??fetch,u=r.additionalCrossOriginStrippedHeaders??[],l=r.context,p=new AbortController,g=yi(p,t.signal),R=!1,_=setTimeout(()=>{R=!0,p.abort()},s),O=e,T=su(e,t,p.signal),B;try{B=_i(en(e),{problemCode:n,validateUrl:r.validateUrl}).toString()}catch(X){throw Pt(l,{event:"outbound_url_blocked",problemCode:n,method:Ye(e,t),host:q(en(e)),error:X}),clearTimeout(_),g?.(),X}let Le=0;try{for(;;){let X=await nu(l,c,O,T,n,B,()=>R?`timeout_after_${s}ms`:void 0),M=tu(X,B);if(M!==void 0)try{let j=cu({currentInput:O,currentInit:T,currentUrl:B,redirectUrl:M,redirects:Le,maxRedirects:i,problemCode:n,validateUrl:r.validateUrl,signal:p.signal,additionalCrossOriginStrippedHeaders:u});O=j.currentInput,T=j.currentInit,B=j.currentUrl,Le=j.redirects;continue}catch(j){throw Pt(l,{event:"outbound_redirect_blocked",problemCode:n,method:Ye(O,T),host:q(B),error:j,extra:{redirects:Le,maxRedirects:i,redirectTargetHost:q(M)}}),j}try{return eu(X,await Qd(X,a,n))}catch(j){throw Pt(l,{event:"outbound_response_size_exceeded",problemCode:n,method:Ye(O,T),host:q(B),error:j,extra:{maxResponseBytes:a,status:X.status}}),j}}}finally{clearTimeout(_),g?.()}}o(tn,"runSafeOutboundExchange");async function Et(e,t,r){let n=await tn(e,t,r);try{return{response:n,json:await n.clone().json()}}catch(i){throw Pt(r.context,{event:"outbound_json_parse_failed",problemCode:r.problemCode??"invalid_request",method:Ye(e,t),host:q(en(e)),error:i,extra:{status:n.status,contentType:n.headers.get("content-type")??void 0}}),new h({message:"Outbound JSON response could not be parsed.",extensionMembers:{[y]:r.problemCode??"invalid_request"}},{cause:i})}}o(Et,"runSafeOutboundJsonExchange");function wi(e,t={},r={}){return tn(e,t,{...r,validateUrl:ft})}o(wi,"fetchConfiguredOutbound");function bi(e,t={},r={}){return Et(e,t,{...r,validateUrl:ft})}o(bi,"fetchConfiguredOutboundJson");function lr(e,t={},r={}){return Et(e,t,{...r,validateUrl:jo})}o(lr,"fetchIdentityProviderJson");function Ri(e,t={},r={}){return Et(e,t,{...r,validateUrl:Xt})}o(Ri,"fetchCimdClientMetadataJson");function Ci(e,t={},r={}){return Et(e,t,{...r,validateUrl:ht})}o(Ci,"fetchCimdClientJwksJson");import{errors as xi,jwtVerify as Ui,SignJWT as Ti}from"jose";var Z="zuplo-mcp-gateway",W=Z,V="HS256";import{base64url as du}from"jose";var uu=new TextEncoder,lu="MCP gateway could not initialize secure key material.",pu=32,Si=new Map,Ii=new Map,mu;function fu(){return mu??Zn.instance.authPrivateKey}o(fu,"readAuthPrivateKey");function vi(e){return new Q(lu,e===void 0?void 0:{cause:e})}o(vi,"createGeneratedKeyMaterialError");function Ai(e,t){let r=du.decode(t);if(r.byteLength!==pu)throw new Error(`Generated deployment auth key ${e} is invalid.`);return r}o(Ai,"decodeJwkKeyField");function hu(e){let t=fu();if(!t)throw vi();try{let r=JSON.parse(t);if(r.kty!=="OKP"||r.crv!=="Ed25519"||typeof r.d!="string"||typeof r.x!="string")throw new Error("Generated deployment auth key is not an Ed25519 JWK.");let n=Ai("d",r.d);Ai("x",r.x);let i=uu.encode(`zuplo-mcp-gateway:${e}:Ed25519:`),a=new Uint8Array(i.byteLength+n.byteLength);return a.set(i),a.set(n,i.byteLength),a}catch(r){throw vi(r)}}o(hu,"decodeGeneratedKeyMaterial");function gu(e){let t=Si.get(e);return t||(t=hu(e),Si.set(e,t)),t}o(gu,"getMasterKeyMaterial");async function oe(e){let t=Ii.get(e.purpose);if(t!==void 0)return t;let r=await e.derive(gu(e.keyMaterialPurpose));return Ii.set(e.purpose,r),r}o(oe,"readCachedDerivedKey");var yu="SHA-256",_u=32,wu="zuplo-mcp-gateway:",bu=new TextEncoder,ki=new WeakMap;async function Ae(e,t){let r=ki.get(e);r||(r=new Map,ki.set(e,r));let n=r.get(t);if(n)return n;let i=await Ru(e,t);return r.set(t,i),i}o(Ae,"deriveGatewaySigningKey");async function Ru(e,t){let r=J(e),n=await crypto.subtle.importKey("raw",r,{name:"HKDF"},!1,["deriveBits"]),i=bu.encode(`${wu}${t}`),a=await crypto.subtle.deriveBits({name:"HKDF",hash:yu,salt:new Uint8Array,info:J(i)},n,_u*8);return new Uint8Array(a)}o(Ru,"hkdfExpand");var Pi=900,Cu=900,Su=bo.extend({id:Go}),Iu=Su.extend({exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Ei=Tr.extend({id:Jo,purpose:d.literal("browser_connect")}),vu=Tr.extend({purpose:d.literal("browser_connect")}),Au=Ei.extend({exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Oi=Pi*1e3;async function Mi(){return oe({purpose:"oauth-state",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"oauth-state"),"derive")})}o(Mi,"getOAuthStateKey");async function qi(){return oe({purpose:"browser-connect",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"browser-connect"),"derive")})}o(qi,"getBrowserConnectKey");async function Di(e){let t=Math.floor(Date.now()/1e3)+Pi;return new Ti(e).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(t).sign(await Mi())}o(Di,"signOAuthState");async function pr(e){try{let{payload:t}=await Ui(e,await Mi(),{algorithms:[V],issuer:Z,audience:W});return Iu.parse(t)}catch(t){throw t instanceof xi.JWTExpired?new h({message:"OAuth state has expired",extensionMembers:{[y]:"oauth_state_expired"}},{cause:t}):new h({message:"OAuth state could not be verified",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:t})}}o(pr,"verifyOAuthState");async function zi(e){let t=Math.floor(Date.now()/1e3)+Cu,r=vu.parse(e),n=Ei.parse({...r,id:Ko()});return new Ti(n).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(t).sign(await qi())}o(zi,"signBrowserConnectTicket");async function ji(e){try{let{payload:t}=await Ui(e,await qi(),{algorithms:[V],issuer:Z,audience:W});return Au.parse(t)}catch(t){throw t instanceof xi.JWTExpired?new h({message:"Browser connect ticket has expired",extensionMembers:{[y]:"oauth_state_expired"}},{cause:t}):new h({message:"Browser connect ticket could not be verified",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:t})}}o(ji,"verifyBrowserConnectTicket");async function Hi(e){if((await C().consumeBrowserConnectTicket({id:e.id,expiresAt:S(new Date(e.exp*1e3)),now:S(new Date)})).kind==="consumed")throw new h({message:"Browser connect ticket has already been used",extensionMembers:{[y]:"oauth_state_reused"}})}o(Hi,"consumeBrowserConnectTicket");function ku(e,t,r=!1){return r?`${e} authorization must be renewed before this ${t} can be used.`:`${e} authorization is required before this ${t} can be used.`}o(ku,"buildConnectRequiredMessage");async function xu(e){let t=D(e.requestUrl,e.requestHeaders),r=new URL(e.path,t);return e.redirect&&r.searchParams.set("redirect","true"),r.searchParams.set("operationId",e.operationId),r.searchParams.set("browserTicket",await zi({...pt(e),purpose:"browser_connect"})),r.toString()}o(xu,"buildGatewayBrowserTicketUrl");function Uu(e){return L().actionPath(`/auth/connections/${encodeURIComponent(e)}/connect`)}o(Uu,"buildGatewayConnectPath");async function rn(e){return xu({...e,path:Uu(e.upstreamServerId),redirect:!0})}o(rn,"buildGatewayConnectUrl");async function mr(e){let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return{state:e.requiresReconsent?"reconsent_required":"authenticating",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},authUrl:await rn(t),message:ku(e.upstreamDisplayName,e.subject,e.requiresReconsent),nextAction:"redirect"}}o(mr,"buildRedirectConnectRequiredResponse");function Bi(e){return Tu({...e,message:e.requiresReconsent?`An administrator must reconnect ${e.upstreamDisplayName} before this tool can be used.`:`An administrator must connect ${e.upstreamDisplayName} before this tool can be used.`})}o(Bi,"buildAdminConnectRequiredResponse");function Tu(e){return{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},message:e.message,nextAction:"admin_setup_required"}}o(Tu,"buildAdminSetupRequiredResponse");var Li=12;async function Ni(e){let t=await crypto.subtle.digest("SHA-256",J(new TextEncoder().encode(e)));return Array.from(new Uint8Array(t)).map(r=>r.toString(16).padStart(2,"0")).join("")}o(Ni,"sha256Hex");async function ze(e){if(e)return(await Ni(e)).slice(0,Li)}o(ze,"fingerprintSecret");async function Xe(e){let t=JSON.stringify([e.owner.mode,e.owner.mode==="user"?e.owner.subjectId:"",e.upstreamServerId,e.authProfileId]);return(await Ni(t)).slice(0,Li)}o(Xe,"fingerprintConnectionIdentity");var Pu=6e4;function Qe(e,t){return e===void 0?!0:e.status!==t.status||e.encryptedAccessToken!==t.encryptedAccessToken||e.encryptedRefreshToken!==t.encryptedRefreshToken||e.expiresAt!==t.expiresAt||e.scopes.length!==t.scopes.length||e.scopes.some((r,n)=>t.scopes[n]!==r)}o(Qe,"credentialGenerationChanged");function F(e){if(!e)return"no_connection";if(e.status!=="active")return"inactive";if(!e.encryptedAccessToken)return"no_access_token";if(e.expiresAt){let t=new Date(e.expiresAt).getTime();if(t<=Date.now())return"expired";if(t<=Date.now()+Pu)return"near_expiry"}return"usable"}o(F,"describeAccessTokenState");var Gi=new Set(["client_id","code_challenge","code_challenge_method","display","login_hint","nonce","prompt","redirect_uri","response_mode","response_type","state"]);function Eu(e,t){return e&&e.length>0?e.join(t):void 0}o(Eu,"joinOAuthScopes");function Ou(e){if(e?.authorization_endpoint===void 0)return e;let t=new URL(e.authorization_endpoint);for(let r of Gi)t.searchParams.delete(r);return{...e,authorization_endpoint:t.toString()}}o(Ou,"sanitizeAuthorizationServerMetadata");function Ji(e){let t=Ou(e.authorizationServerMetadata);return t===e.authorizationServerMetadata?e:{...e,authorizationServerMetadata:t}}o(Ji,"sanitizeOAuthDiscoveryState");function Fi(e){let t=new URL(e);for(let r of Gi){let n=t.searchParams.getAll(r);n.length<=1||(t.searchParams.delete(r),t.searchParams.set(r,n.at(-1)??""))}return t}o(Fi,"dedupeSingletonAuthorizationRequestParams");function fr(e){let t=new URL(e);return K(t)&&oo(t.hostname)!=="localhost"&&(t.hostname="localhost"),t}o(fr,"normalizeLoopbackOAuthRedirectUri");function $i(e){return Eu(e.state?.resourceMetadata?.scopes_supported,e.delimiter)}o($i,"readProtectedResourceMetadataScope");function Mu(e){return`Zuplo MCP Gateway - ${e}`}o(Mu,"buildGatewayOAuthClientName");function qu(e,t){return e&&e.length>0?e.join(t):void 0}o(qu,"joinOAuthScopeList");function Du(e){if(e.clientRegistration.mode!=="auto")return qu(e.scopes,e.scopeDelimiter)}o(Du,"readPublicClientMetadataScope");function nn(e){return new URL(L().actionPath(`/.well-known/oauth-client/${encodeURIComponent(e.upstreamServerId)}`),e.origin).toString()}o(nn,"buildOAuthClientMetadataDocumentUrl");function on(e){let t=ve(e.upstreamServerId);return{client_name:Mu(t.displayName),client_uri:new URL("/",e.origin).toString(),redirect_uris:[e.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],application_type:"web",...e.scope===void 0?{}:{scope:e.scope},token_endpoint_auth_method:"none"}}o(on,"buildGatewayOAuthClientMetadata");function Zi(e,t,r){let n=Ve(t,r),i=Du(n);return{client_id:nn({origin:e,upstreamServerId:t}),...on({origin:e,upstreamServerId:t,redirectUri:fr(new URL(n.redirectPath,e)).toString(),scope:i})}}o(Zi,"buildOAuthClientMetadataDocument");import{base64url as ke}from"jose";var zu="SHA-256",et="AES-GCM",ju=12,sn="zuplo-secret",cn=1,Ki="generated:auth_private_key:token-encryption",Hu=d.object({version:d.literal(cn),keyId:d.literal(Ki),algorithm:d.literal(et),iv:d.string().min(1),ciphertext:d.string().min(1)}).strict();async function an(){return oe({purpose:"token-encryption",keyMaterialPurpose:"token-encryption",derive:o(async e=>{let t=await crypto.subtle.digest(zu,J(e));return crypto.subtle.importKey("raw",t,{name:et},!1,["encrypt","decrypt"])},"derive")})}o(an,"getEncryptionKey");function Wi(e){return J(new TextEncoder().encode(`${sn}:v${e.version}:${e.keyId}`))}o(Wi,"getAssociatedData");function Bu(e){return`${sn}:v${e.version}:${ke.encode(new TextEncoder().encode(JSON.stringify(e)))}`}o(Bu,"encodeEnvelope");function Lu(e){let t=`${sn}:v${cn}:`;if(!e.startsWith(t))return;let r=e.slice(t.length),n=new TextDecoder().decode(ke.decode(r));return Hu.parse(JSON.parse(n))}o(Lu,"decodeEnvelope");async function me(e){let t=await an(),r=crypto.getRandomValues(new Uint8Array(ju)),n={version:cn,keyId:Ki},i=await crypto.subtle.encrypt({name:et,iv:r,additionalData:Wi(n)},t,new TextEncoder().encode(e));return Bu({...n,algorithm:et,iv:ke.encode(r),ciphertext:ke.encode(new Uint8Array(i))})}o(me,"encryptSecret");async function fe(e){let t=Lu(e);if(t){let s=await an(),c=await crypto.subtle.decrypt({name:et,iv:J(ke.decode(t.iv)),additionalData:Wi(t)},s,J(ke.decode(t.ciphertext)));return new TextDecoder().decode(c)}let[r,n]=e.split(".");if(!r||!n)throw new Q("Encrypted payload is malformed");let i=await an(),a=await crypto.subtle.decrypt({name:et,iv:J(ke.decode(r))},i,J(ke.decode(n)));return new TextDecoder().decode(a)}o(fe,"decryptSecret");var Nu=d.union([_t,ar]),Gu=d.object({authorizationServerUrl:d.url(),resourceMetadataUrl:d.url().optional(),resourceMetadata:or.optional(),authorizationServerMetadata:d.union([yt,ir]).optional()}).passthrough(),Ju="Bearer",Fu="__zuplo_refresh_only_upstream_access_token__";function dn(e){return e?e.split(/[,\s]+/).filter(Boolean):[]}o(dn,"splitScopes");function un(e,t){let r=new Set(e);return t.every(n=>r.has(n))}o(un,"scopesCover");function $u(e){return Ge.parse(e)}o($u,"parsePkceCodeVerifier");function Zu(e){if(typeof e.expires_in=="number")return S(new Date(Date.now()+e.expires_in*1e3))}o(Zu,"readTokenExpiry");async function Ku(e){if(e!==void 0)return me(JSON.stringify(e))}o(Ku,"encryptJson");async function Wu(e,t){if(!e)return;let r=await fe(e);try{return t.parse(JSON.parse(r))}catch(n){throw new h({message:"Stored upstream OAuth JSON state is invalid.",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:n})}}o(Wu,"decryptJson");function Vu(e,t){return"redirect_uris"in e?e.redirect_uris.includes(t):!0}o(Vu,"clientInformationAllowsRedirectUri");function Yu(e){return e.clientMetadataUrl===void 0?"redirect_uris"in e.clientInformation:"redirect_uris"in e.clientInformation||e.clientInformation.client_id===e.clientMetadataUrl}o(Yu,"clientInformationMatchesCurrentClientMetadataUrl");function Xu(e){return e.clientMetadataUrl!==void 0&&!("redirect_uris"in e.clientInformation)&&e.clientInformation.client_id===e.clientMetadataUrl}o(Xu,"isUrlBasedClientInformation");function Qu(e,t){return t===void 0?e:{...e,scope:t}}o(Qu,"applyOAuthClientMetadataScope");function el(e,t){return $i({state:e,delimiter:t})}o(el,"readResourceMetadataScope");function tl(e,t){return e&&e.length>0?e.join(t):void 0}o(tl,"joinOAuthScopeList");function rl(e){let t;if(e.registration.tokenEndpointAuthMethod!=="none"&&(t=e.registration.clientSecret,!t))throw new k(`Manual OAuth registration for upstream "${e.upstreamServerId}" requires clientSecret. Set the env var that backs the client secret or use tokenEndpointAuthMethod "none".`);return _t.parse({...e.clientMetadata,client_id:e.registration.clientId,token_endpoint_auth_method:e.registration.tokenEndpointAuthMethod,...t===void 0?{}:{client_secret:t}})}o(rl,"buildManualOAuthClientInformation");function nl(e,t){let r=nn({origin:new URL(t).origin,upstreamServerId:e});return Wr(r)?r:void 0}o(nl,"buildClientMetadataUrl");function ol(e){for(let t of e)if(t!==void 0)return t}o(ol,"firstDefined");function il(e){let t=Ve(e.target.upstreamServerId,e.target.authProfileId),r=tl(t.scopes,t.scopeDelimiter),n=on({origin:new URL(e.redirectUri).origin,upstreamServerId:e.target.upstreamServerId,redirectUri:e.redirectUri,scope:r});if(t.clientRegistration.mode==="manual")return{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,configuredClientInformation:rl({clientMetadata:n,registration:t.clientRegistration,upstreamServerId:e.target.upstreamServerId})};let i=nl(e.target.upstreamServerId,e.redirectUri);return i===void 0?{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt}:{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,clientMetadataUrl:i}}o(il,"buildInitialOAuthClientSetup");function al(e,t){if(t===void 0)return ol([e.pendingState?.encryptedClientInformation,e.connectionMetadata?.encryptedClientInformation,e.connection?.metadata?.encryptedClientInformation])}o(al,"readEncryptedClientInformation");var xe=class{static{o(this,"UpstreamOAuthProvider")}clientMetadataUrl;target;redirectUriValue;returnOrigin;clientMetadataValue;configuredScope;scopeDelimiter;promptOverride;configuredClientInformation;challengeScope;inferredScope;authorizationUrlValue;credentialState;pendingState;encryptedClientInformation;cachedClientInformation;clientInformationLoaded=!1;cachedDiscoveryState;discoveryStateLoaded=!1;tokensLoaded=!1;tokenPersistenceOutcome;connectionFingerprintValue;usedRefreshTokenFingerprintValue;constructor(t){let r=il({target:t.target,redirectUri:t.redirectUri});this.target=t.target,this.redirectUriValue=t.redirectUri,this.returnOrigin=t.returnOrigin,this.clientMetadataValue=r.clientMetadata,this.configuredScope=r.configuredScope,this.scopeDelimiter=r.scopeDelimiter,this.promptOverride=r.promptOverride,this.configuredClientInformation=r.configuredClientInformation,r.clientMetadataUrl!==void 0&&(this.clientMetadataUrl=r.clientMetadataUrl),this.credentialState={sourceConnection:t.connection,currentConnection:t.connection},this.pendingState=t.pendingState?{...t.pendingState}:void 0,this.encryptedClientInformation=al(t,this.configuredClientInformation)}get authorizationUrl(){return this.authorizationUrlValue}get configuredAuthorizationScope(){return this.configuredScope}get usedRefreshTokenFingerprint(){return this.usedRefreshTokenFingerprintValue}get currentConnection(){return this.credentialState.currentConnection}get tokenWriteWasPersisted(){return this.tokenPersistenceOutcome==="persisted"}connectionSatisfiesRequestedScope(t,r){let n=dn(this.configuredScope??r??this.readEffectiveScope());return un(t.scopes,n)}readUsablePeerAdoption(t){let r=this.credentialState.peerAdoption?.connection;return r!==void 0&&F(r)==="usable"&&this.connectionSatisfiesRequestedScope(r,t)?r:void 0}async adoptConnectionForDirectResolution(t,r){this.adoptPeerConnection(t,r),this.tokensLoaded=!1,this.credentialState.sdkTokenMemo=void 0;let n=U();n&&n.info({event:"upstream_oauth_peer_credential_adopted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,adoptionReason:r,sourceUpdatedAt:this.credentialState.sourceConnection?.updatedAt,resultingUpdatedAt:t.updatedAt,sourceScopeCount:this.credentialState.sourceConnection?.scopes.length,resultingScopeCount:t.scopes.length,accessTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedAccessToken),refreshTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedRefreshToken)},"Adopted a concurrent upstream OAuth credential")}adoptPeerConnection(t,r){this.credentialState.currentConnection=t,this.credentialState.peerAdoption={connection:t,reason:r}}async connectionFingerprint(){return this.connectionFingerprintValue===void 0&&(this.connectionFingerprintValue=await Xe({owner:this.target.owner,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId})),this.connectionFingerprintValue}async storedSecretFingerprint(t){if(t!==void 0)try{return await ze(await fe(t))}catch{return}}async conditionalUpsertCredential(t,r){try{return await C().conditionalUpsertUpstreamConnection(t,r)}catch(n){let i=U();if(i){let a=Object.assign(new Error("Upstream OAuth conditional storage write failed",{cause:n}),{event:"upstream_oauth_conditional_write_failed",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),sourceUpdatedAt:"expectedUpdatedAt"in r?r.expectedUpdatedAt:void 0,expectAbsent:"expectAbsent"in r,scopeCount:t.scopes.length});i.error(a,"Upstream OAuth conditional storage write failed")}throw n}}get redirectUrl(){return this.redirectUriValue}get clientMetadata(){return Qu(this.clientMetadataValue,this.readEffectiveScope())}async state(){let t=await this.createPendingState();return Di({id:t.id,...pt({owner:this.target.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId})})}async clientInformation(){return this.configuredClientInformation?this.configuredClientInformation:this.loadPersistedClientInformation()}async saveClientInformation(t){this.configuredClientInformation||(this.cachedClientInformation=t,this.clientInformationLoaded=!0,U()?.info({event:"upstream_oauth_client_registered",upstreamServerId:this.target.upstreamServerId,clientId:"client_id"in t?t.client_id:void 0,redirectUriCount:"redirect_uris"in t?t.redirect_uris.length:void 0},"Upstream OAuth client registered for the gateway"),!Xu({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl})&&(this.encryptedClientInformation=await Ku(t),await this.syncPendingState(!1)))}async discoveryState(){return this.readCachedDiscoveryState()}applyChallengeScope(t){this.challengeScope=t}async saveDiscoveryState(t){let r=Ji(Gu.parse(t));this.cachedDiscoveryState=r,this.discoveryStateLoaded=!0,U()?.info({event:"upstream_oauth_discovery_resolved",upstreamServerId:this.target.upstreamServerId,authorizationServerHost:q(r.authorizationServerUrl),resourceMetadataHost:q(r.resourceMetadataUrl),resource:r.resourceMetadata?.resource,scopesSupportedCount:r.resourceMetadata?.scopes_supported?.length,hasResourceMetadata:r.resourceMetadata!==void 0},"Upstream OAuth discovery resolved authorization server and resource"),this.inferredScope=el(r,this.scopeDelimiter);let n=r.resourceMetadata?.scopes_supported;if(this.configuredScope!==void 0&&n!==void 0){let i=dn(this.configuredScope).filter(a=>!n.includes(a));i.length>0&&U()?.debug({event:"upstream_oauth_configured_scopes_not_advertised",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,unadvertisedScopes:i,scopesSupported:n},"Configured upstream OAuth scopes include values the resource metadata does not advertise")}}async tokens(){return this.loadStoredTokens()}async saveTokens(t){let r=We.parse(t),n=this.target.owner.mode==="user"?this.target.owner.subjectId:void 0,i=this.credentialState.sourceConnection,a=!r.refresh_token&&!!i?.encryptedRefreshToken,s=r.refresh_token?await me(r.refresh_token):i?.encryptedRefreshToken;this.credentialState.sdkTokenMemo=r.refresh_token||!i?.encryptedRefreshToken?r:We.parse({...r,refresh_token:await fe(i.encryptedRefreshToken)}),this.tokensLoaded=!0;let c={id:i?.id??Qt(),ownerMode:this.target.owner.mode,subjectId:n,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,status:"active",encryptedAccessToken:await me(r.access_token),encryptedRefreshToken:s,scopes:dn(r.scope??this.readEffectiveScope()),expiresAt:Zu(r),metadata:this.readStoredOAuthPersistence(this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0)},u=i?{expectedUpdatedAt:i.updatedAt}:{expectAbsent:!0},l=await this.conditionalUpsertCredential(c,u),p=!1;if(l.kind==="precondition_failed"&&l.connection!==void 0&&(F(l.connection)!=="usable"||!un(l.connection.scopes,c.scopes)||!Qe(i,l.connection))){p=!0;let R=l.connection,_={id:R.id,ownerMode:R.ownerMode,subjectId:R.subjectId,upstreamServerId:R.upstreamServerId,authProfileId:R.authProfileId,status:"active",encryptedAccessToken:c.encryptedAccessToken,encryptedRefreshToken:r.refresh_token===void 0?R.encryptedRefreshToken:c.encryptedRefreshToken,scopes:c.scopes,expiresAt:c.expiresAt,metadata:R.metadata};U()?.info({event:"upstream_oauth_bounded_rebase_attempted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:R.id,sourceUpdatedAt:i?.updatedAt,winnerUpdatedAt:R.updatedAt,sourceScopeCount:i?.scopes.length,winnerScopeCount:R.scopes.length,resultingScopeCount:_.scopes.length},"Retrying an upstream OAuth token write against the CAS winner"),l=await this.conditionalUpsertCredential(_,{expectedUpdatedAt:R.updatedAt})}if(l.kind!=="persisted"&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),this.tokenPersistenceOutcome=l.kind,l.kind==="persisted"?(this.credentialState.currentConnection=l.connection,this.credentialState.peerAdoption=void 0):l.kind==="precondition_failed"&&l.connection!==void 0?(this.credentialState.currentConnection=l.connection,Qe(i,l.connection)&&F(l.connection)==="usable"&&un(l.connection.scopes,c.scopes)?this.adoptPeerConnection(l.connection,"cas_loss"):this.credentialState.peerAdoption=void 0):(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0),p){let R=l.kind==="persisted"?"succeeded":l.kind==="precondition_failed"?"lost":"exhausted";U()?.info({event:`upstream_oauth_bounded_rebase_${R}`,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:this.credentialState.currentConnection?.id,sourceUpdatedAt:i?.updatedAt,resultingUpdatedAt:this.credentialState.currentConnection?.updatedAt,sourceScopeCount:i?.scopes.length,resultingScopeCount:this.credentialState.currentConnection?.scopes.length},`Upstream OAuth bounded rebase ${R}`)}let g=l.kind==="persisted"?l.connection:void 0;U()?.info({event:"upstream_oauth_tokens_persisted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:g?.id??this.credentialState.currentConnection?.id,hasRefreshToken:!!s,sourceScopeCount:i?.scopes.length,priorStatus:i?.status,priorUpdatedAt:i?.updatedAt,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,newRefreshTokenFingerprint:await ze(r.refresh_token),reusedSnapshotRefreshToken:a,scopeCount:c.scopes.length,expiresAt:c.expiresAt,outcome:l.kind,rebaseAttempted:p,resultingUpdatedAt:g?.updatedAt??this.credentialState.currentConnection?.updatedAt,resultingScopeCount:g?.scopes.length??this.credentialState.currentConnection?.scopes.length},g?"Upstream OAuth tokens persisted; upstream connection is active":"Upstream OAuth token persistence yielded to concurrent storage state")}async redirectToAuthorization(t){let r=Fi(t);this.promptOverride===!1?r.searchParams.delete("prompt"):this.promptOverride!==void 0&&r.searchParams.set("prompt",this.promptOverride),this.authorizationUrlValue=r.toString()}async saveCodeVerifier(t){let r=await this.createPendingState();await this.persistPendingState({...r,codeVerifier:$u(t)})}async codeVerifier(){if(!this.pendingState?.codeVerifier)throw new h({message:"OAuth code verifier is missing",extensionMembers:{[y]:"oauth_state_invalid"}});return this.pendingState.codeVerifier}async invalidateCredentials(t){let r=t==="all"||t==="client"||t==="tokens",n=t==="all"||t==="client",i=t==="all"||t==="discovery",a=t==="all"||t==="verifier";n&&(this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,this.encryptedClientInformation=void 0),i&&(this.cachedDiscoveryState=void 0,this.discoveryStateLoaded=!0,this.challengeScope=void 0,this.inferredScope=void 0),r&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),await this.syncPendingState(a),await this.persistCredentialInvalidation(r)}async createPendingState(){if(this.pendingState)return this.pendingState;let t={id:Zo(),...pt({owner:this.target.owner,initiatedBySubjectId:this.target.initiatedBySubjectId,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,operationId:this.target.operationId,...this.target.returnTo===void 0?{}:{returnTo:this.target.returnTo}}),callbackPath:new URL(this.redirectUriValue).pathname,expiresAt:S(new Date(Date.now()+Oi)),redirectUri:this.redirectUriValue,...this.returnOrigin===void 0?{}:{returnOrigin:this.returnOrigin},encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0};return await this.persistPendingState(t),t}async persistPendingState(t){await C().saveUpstreamOAuthState({record:t}),this.pendingState=t}async syncPendingState(t){this.pendingState&&await this.persistPendingState({...this.pendingState,codeVerifier:t?void 0:this.pendingState.codeVerifier,encryptedClientInformation:this.encryptedClientInformation})}async loadPersistedClientInformation(){if(this.clientInformationLoaded)return this.cachedClientInformation;let t;try{t=await Wu(this.encryptedClientInformation,Nu)}catch{this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}if(t&&(!Vu(t,this.redirectUriValue)||!Yu({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl}))){this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}return t===void 0&&this.pendingState?.codeVerifier!==void 0&&this.clientMetadataUrl!==void 0&&(t=ar.parse({client_id:this.clientMetadataUrl})),this.cachedClientInformation=t,this.clientInformationLoaded=!0,this.cachedClientInformation}async readCachedDiscoveryState(){if(this.discoveryStateLoaded)return this.cachedDiscoveryState;this.discoveryStateLoaded=!0}readEffectiveScope(){return this.configuredScope??this.challengeScope??this.inferredScope}async loadStoredTokens(){if(this.tokensLoaded)return this.credentialState.sdkTokenMemo;this.tokensLoaded=!0;let t=this.credentialState.currentConnection;if(!t||t.status!=="active"){U()?.debug({event:"upstream_oauth_tokens_not_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t?.id,status:t?.status??"not_connected"},"Upstream OAuth tokens not loaded; connection is not active");return}let r=t.encryptedAccessToken?await fe(t.encryptedAccessToken):void 0,n=t.encryptedRefreshToken?await fe(t.encryptedRefreshToken):void 0;if(!r&&!n)return;let i=U();this.usedRefreshTokenFingerprintValue=i?await ze(n):void 0,i?.debug({event:"upstream_oauth_tokens_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,hasAccessToken:!!r,hasRefreshToken:!!n,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,expiresAt:t.expiresAt},"Upstream OAuth tokens loaded from stored connection");let a=We.parse({access_token:r??Fu,token_type:Ju,refresh_token:n,scope:t.scopes.length>0?t.scopes.join(" "):void 0});return this.credentialState.sdkTokenMemo=a,a}async persistCredentialInvalidation(t){let r=this.credentialState.sourceConnection;if(!r)return;let n=r.status,i=r.updatedAt,a={id:r.id,ownerMode:r.ownerMode,subjectId:r.subjectId,upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,status:r.status,encryptedAccessToken:r.encryptedAccessToken,encryptedRefreshToken:r.encryptedRefreshToken,scopes:[...r.scopes],expiresAt:r.expiresAt,metadata:r.metadata?{...r.metadata}:void 0};t&&(a.status="reconsent_required",a.encryptedAccessToken=void 0,a.encryptedRefreshToken=void 0,a.scopes=[],a.expiresAt=void 0),a.metadata=this.readStoredOAuthPersistence(r.metadata?.connectedBySubjectId);let s=await this.conditionalUpsertCredential(a,{expectedUpdatedAt:r.updatedAt});s.kind==="persisted"?(this.credentialState.currentConnection=s.connection,this.credentialState.peerAdoption=void 0):s.kind==="missing"?(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0):s.connection!==void 0&&(this.credentialState.currentConnection=s.connection,Qe(r,s.connection)&&F(s.connection)==="usable"&&this.connectionSatisfiesRequestedScope(s.connection)?this.adoptPeerConnection(s.connection,"cas_loss"):this.credentialState.peerAdoption=void 0);let c=U();if(c){let u=s.kind==="missing"?void 0:s.connection,l={event:"upstream_oauth_credentials_invalidated",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:u?.id,clearedTokens:t,priorStatus:n,newStatus:u?.status,priorUpdatedAt:i,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,outcome:s.kind};s.kind==="precondition_failed"?c.warn({...l,event:"upstream_oauth_invalidation_precondition_lost"},"Upstream OAuth credential invalidation yielded to concurrent storage state"):t?c.warn(l,"Upstream OAuth credentials invalidated; connection now requires reconsent"):c.debug(l,"Upstream OAuth credential metadata rewritten")}}readStoredOAuthPersistence(t){if(!(!this.encryptedClientInformation&&!t))return{encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:t}}};var sl=3e4,cl=256*1024,dl=2,ul="does not support dynamic client registration",ll=["Resource server does not implement OAuth 2.0 Protected Resource Metadata","trying to load well-known OAuth protected resource metadata"],pl=["HTTP 403 Forbidden","Access Denied","permission to access"],ml=new Set(["access_denied","invalid_client","invalid_grant","invalid_request","invalid_scope","invalid_target","unauthorized_client","unsupported_grant_type"]);function fl(e){return e instanceof Error&&e.message.includes(ul)}o(fl,"isDynamicClientRegistrationUnsupported");function hl(e){return e instanceof Error&&ll.some(t=>e.message.includes(t))}o(hl,"isProtectedResourceMetadataUnavailable");function gl(e){return e instanceof Error&&pl.some(t=>e.message.includes(t))}o(gl,"isUpstreamProviderAccessDenied");function yl(e){return e instanceof x&&ml.has(e.errorCode)}o(yl,"isStoredConnectionReconsentError");function _l(e){if(e.error instanceof h&&e.error.extensionMembers?.[y]!==void 0)return e.error;if(fl(e.error))return new h({message:`The authorization server for ${e.upstreamServerId} does not advertise Client ID Metadata Document support and does not support Dynamic Client Registration. Register an OAuth client for the gateway manually before retrying.`,extensionMembers:{[y]:"upstream_client_registration_required"}},{cause:e.error});if(hl(e.error))return new h({message:`The upstream MCP server "${e.upstreamServerId}" does not publish OAuth protected resource metadata at "${e.resourceMetadataUrl}". Configure protectedResourceMetadataUrl to a working metadata document, use a provider-supported legacy client, or contact the provider to approve/allowlist this gateway OAuth client before retrying.`,extensionMembers:{[y]:"upstream_oauth_discovery_unavailable"}},{cause:e.error});if(gl(e.error))return new h({message:`The upstream provider denied access while connecting ${e.upstreamServerId}. Confirm the provider allows this gateway and its OAuth client, then retry.`,extensionMembers:{[y]:"upstream_provider_access_denied"}},{cause:e.error})}o(_l,"mapUpstreamOAuthSetupError");function wl(e){return typeof e=="string"||e instanceof URL?{url:new URL(e.toString())}:{method:e.method,url:new URL(e.url)}}o(wl,"readOAuthFetchRequest");function bl(e,t){return(e.headers.get("content-type")??"").includes("json")||t.trimStart().startsWith("{")||t.trimStart().startsWith("[")}o(bl,"responseLooksJson");function Rl(e,t){let r=e.headers.get("content-type")??"",n=t.trimStart().toLowerCase();return r.includes("html")||n.startsWith("<!doctype html")||n.startsWith("<html")}o(Rl,"responseLooksHtml");function Cl(e){let t=e.response.statusText?` ${e.response.statusText}`:"",r=e.response.headers.get("content-type")??"text/html";throw new h({message:`The upstream provider returned ${e.response.status}${t} (${r}) from ${e.request.url.toString()} while connecting ${e.upstreamServerId}.`,extensionMembers:{[y]:e.response.status===403?"upstream_provider_access_denied":"upstream_token_exchange_failed",[we]:e.response.status,[Je]:r,[be]:e.request.url.toString(),[Fe]:e.body}})}o(Cl,"throwUpstreamHtmlError");function Sl(e){try{let t=JSON.parse(e);if(typeof t!="object"||t===null)return{};let r=t;return{error:typeof r.error=="string"?r.error:void 0,errorDescription:typeof r.error_description=="string"?r.error_description:void 0}}catch{return{}}}o(Sl,"readUpstreamOAuthErrorBody");function Il(e){let{error:t,errorDescription:r}=Sl(e.body);e.log?.warn({event:"upstream_oauth_http_error",upstreamServerId:e.upstreamServerId,method:e.request.method??"GET",host:q(e.request.url),path:e.request.url.pathname,status:e.response.status,oauthError:t,oauthErrorDescription:r?.slice(0,256)},"Upstream OAuth HTTP request returned an error response")}o(Il,"logUpstreamOAuthHttpError");function Yi(e){return async(t,r)=>{let n=wl(t),i=U(),a=Date.now(),s=await wi(t,r,{maxRedirects:dl,maxResponseBytes:cl,problemCode:"upstream_token_exchange_failed",timeoutMs:sl}),c=await s.clone().text();if(i?.debug({event:"upstream_oauth_http_request",upstreamServerId:e,method:n.method??"GET",host:q(n.url),path:n.url.pathname,status:s.status,durationMs:Date.now()-a,responseChars:c.length},"Upstream OAuth HTTP request completed"),s.ok||Il({log:i,upstreamServerId:e,request:n,response:s,body:c}),!s.ok&&Rl(s,c)&&Cl({upstreamServerId:e,request:n,response:s,body:c}),!bl(s,c))return s;try{JSON.parse(c)}catch(u){throw new h({message:`Upstream OAuth fetch ${n.url.origin}${n.url.pathname} for ${e} returned invalid JSON.`,extensionMembers:{[y]:"upstream_token_exchange_failed"}},{cause:u})}return s}}o(Yi,"createUpstreamOAuthFetch");function Xi(e){U()?.debug({event:e.phase==="authorize"?"upstream_oauth_authorize_started":"upstream_oauth_token_exchange_started",upstreamServerId:e.upstreamServerId,serverHost:q(e.serverUrl),resourceMetadataHost:q(e.resourceMetadataUrl),hasRequestedScope:e.requestedScope!==void 0},e.phase==="authorize"?"Upstream OAuth authorization flow started":"Upstream OAuth authorization-code exchange started")}o(Xi,"logUpstreamOAuthFlowStarted");function Qi(e){let t={event:"upstream_oauth_flow_failed",phase:e.phase,upstreamServerId:e.upstreamServerId},r=q(e.serverUrl);r!==void 0&&(t.serverHost=r);let n=e.error instanceof h?e.error.extensionMembers?.[y]:void 0;typeof n=="string"&&(t.code=n),G(t,"error",e.error),U()?.warn(t,"Upstream OAuth flow failed before a connection was established")}o(Qi,"logUpstreamOAuthFlowFailed");function ea(e,t){return e.configuredAuthorizationScope??t.requestedScope}o(ea,"readAuthorizationRequestScope");async function ta(e,t){e.applyChallengeScope(t.requestedScope),Xi({phase:"authorize",...t});try{let r={serverUrl:t.serverUrl,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Yi(t.upstreamServerId)},n=ea(e,t);return n!==void 0&&(r.scope=n),await Kr(e,r)}catch(r){Qi({phase:"authorize",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:r});let n=_l({upstreamServerId:t.upstreamServerId,resourceMetadataUrl:t.resourceMetadataUrl,error:r});throw n!==void 0?n:r}}o(ta,"runUpstreamOAuth");async function vl(e,t){e.applyChallengeScope(t.requestedScope),Xi({phase:"token_exchange",...t});let r={serverUrl:t.serverUrl,authorizationCode:t.authorizationCode,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Yi(t.upstreamServerId)},n=ea(e,t);n!==void 0&&(r.scope=n);try{return await Kr(e,r)}catch(i){throw Qi({phase:"token_exchange",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:i}),i}}o(vl,"exchangeUpstreamAuthorizationCode");async function Vi(e){let t=e.provider.readUsablePeerAdoption(e.requestedScope);if(t!==void 0)return await e.provider.adoptConnectionForDirectResolution(t,"cas_loss"),!0;let[r]=await C().batchGetUpstreamConnections([{owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}]);return r===void 0||F(r)!=="usable"||!Qe(e.connection,r)||!e.provider.connectionSatisfiesRequestedScope(r,e.requestedScope)?!1:(await e.provider.adoptConnectionForDirectResolution(r,"boundary_reread"),!0)}o(Vi,"adoptPeerCredentialAtResolutionBoundary");async function ra(e,t){let r=await ta(e,t);if(r==="REDIRECT"&&e.authorizationUrl)return e.authorizationUrl;throw r==="AUTHORIZED"?new h({message:`OAuth connect flow reused existing credentials instead of producing a redirect for ${t.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}}):new h({message:`Unexpected OAuth result for ${t.upstreamServerId}: ${r}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}})}o(ra,"requireUpstreamAuthorizationRedirect");async function na(e){let t=F(e.connection),r=!!e.forceRefresh,n=!r&&t==="usable"&&e.connection!==void 0&&e.provider.connectionSatisfiesRequestedScope(e.connection,e.requestedScope),i=U(),a=i?await Xe({owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}):void 0;if(i?.debug({event:"upstream_oauth_refresh_decision",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,ownerMode:e.target.owner.mode,connectionFingerprint:a,connectionId:e.connection?.id,accessTokenState:t,forceRefresh:r,willRefresh:!n,expiresAt:e.connection?.expiresAt,connectionUpdatedAt:e.connection?.updatedAt},n?"Reusing stored upstream access token":"Refreshing upstream credential"),n)return{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}};let s;try{s=await ta(e.provider,{upstreamServerId:e.target.upstreamServerId,serverUrl:e.serverUrl,resourceMetadataUrl:e.resourceMetadataUrl,...e.requestedScope===void 0?{}:{requestedScope:e.requestedScope}})}catch(c){if(e.connection===void 0||!yl(c))throw c;return i?.warn({event:"upstream_oauth_connection_reconsent_required",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,oauthError:c.errorCode,connectionFingerprint:a,connectionId:e.connection.id,rejectedRefreshTokenFingerprint:e.provider.usedRefreshTokenFingerprint,connectionUpdatedAt:e.connection.updatedAt,connectionExpiresAt:e.connection.expiresAt},"Stored upstream OAuth connection was rejected by the upstream provider"),await e.provider.invalidateCredentials("all"),await Vi({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}if(s==="AUTHORIZED"){let c=e.provider.readUsablePeerAdoption(e.requestedScope);return c!==void 0&&await e.provider.adoptConnectionForDirectResolution(c,"cas_loss"),!e.provider.tokenWriteWasPersisted&&c===void 0?{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:void 0,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}:{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}}if(s!=="REDIRECT")throw new h({message:`Unexpected OAuth result for ${e.target.upstreamServerId}: ${s}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});if(!e.provider.authorizationUrl)throw new h({message:`OAuth connect-required flow did not produce a redirect for ${e.target.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});return await Vi({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}o(na,"authorizeUpstreamOAuthSession");async function Al(e){let t=await pr(e.stateToken),r=await C().consumeUpstreamOAuthState({id:t.id,now:S(new Date)}),n=kl(r);return xl({storedState:n,signedState:t,upstreamServerId:e.upstreamServerId,callbackPath:new URL(e.request.url).pathname}),Ul(n),n}o(Al,"consumeStoredCallbackState");function kl(e){switch(e.kind){case"consumed":throw new h({message:"OAuth state has already been used",extensionMembers:{[y]:"oauth_state_reused"}});case"missing":throw new h({message:"OAuth state is missing or expired",extensionMembers:{[y]:"oauth_state_expired"}});case"available":return e.record}}o(kl,"readConsumedCallbackState");function xl(e){if(![e.storedState.ownerMode===e.signedState.ownerMode,e.storedState.initiatedBySubjectId===e.signedState.initiatedBySubjectId,e.storedState.ownerSubjectId===e.signedState.ownerSubjectId,e.storedState.upstreamServerId===e.signedState.upstreamServerId,e.storedState.authProfileId===e.signedState.authProfileId,e.storedState.operationId===e.signedState.operationId,e.storedState.upstreamServerId===e.upstreamServerId,e.storedState.callbackPath===e.callbackPath].every(Boolean))throw new h({message:"OAuth callback did not match the initiating request",extensionMembers:{[y]:"oauth_callback_mismatch"}})}o(xl,"assertStoredCallbackStateMatches");function Ul(e){if(new Date(e.expiresAt).getTime()<=Date.now())throw new h({message:"OAuth state has expired",extensionMembers:{[y]:"oauth_state_expired"}})}o(Ul,"assertStoredCallbackStateFresh");async function ln(e){if(e.owner.mode==="shared"){let r={upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,requiresReconsent:!!e.connection};return e.connection!==void 0&&(r.connectionId=e.connection.id),Bi(r)}let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,subject:"tool",requiresReconsent:!!e.connection,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return e.connection!==void 0&&(t.connectionId=e.connection.id),mr(t)}o(ln,"buildOAuthConnectRequiredResponse");async function oa(e){let t=await Al({request:e.request,upstreamServerId:e.upstreamServerId,stateToken:e.stateToken}),r=Kt(t),[n]=await C().batchGetUpstreamConnections([{owner:r,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId}]),i={target:{owner:r,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,...t.returnTo===void 0?{}:{returnTo:t.returnTo}},redirectUri:t.redirectUri,pendingState:t};n!==void 0&&(i.connection=n);let a=new xe(i),s=await vl(a,{upstreamServerId:e.upstreamServerId,serverUrl:e.upstreamServerConfig.transport.baseUrl,authorizationCode:e.authorizationCode,resourceMetadataUrl:e.upstreamServerConfig.transport.resourceMetadataUrl});if(s==="AUTHORIZED"){let c=a.readUsablePeerAdoption();if(c!==void 0&&await a.adoptConnectionForDirectResolution(c,"cas_loss"),!a.tokenWriteWasPersisted&&c===void 0)throw new h({message:`OAuth callback storage changed while connecting ${e.upstreamServerId}. Restart the connection flow and try again.`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});return t}throw s!=="REDIRECT"?new h({message:`Unexpected OAuth result for ${e.upstreamServerId}: ${s}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}}):new h({message:`OAuth callback flow did not finish authorization for ${e.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}})}o(oa,"finishUpstreamOAuthCallback");import{importPKCS8 as Tl,SignJWT as Pl}from"jose";var aa=1e4,sa=64*1024,ca=2,El=300,ne=d.string().min(1),Ol=d.object({access_token:ne,issued_token_type:d.literal(Er),token_type:d.string().optional(),expires_in:d.number().int().positive().optional(),scope:ne.optional()}).passthrough(),Ml=d.object({id_token:ne,token_type:ne.optional(),expires_in:d.number().int().positive().optional(),refresh_token:ne.optional(),scope:ne.optional()}).passthrough(),ql=d.object({access_token:ne,token_type:ne,expires_in:d.number().int().positive().optional(),scope:ne.optional(),resource:ne.optional(),refresh_token:ne.optional()}).passthrough();function ia(e){return encodeURIComponent(e).replace(/%20/g,"+")}o(ia,"formEncodeClientCredential");function Dl(e){return e.replaceAll("\\n",`
 `)}o(Dl,"normalizePem");async function zl(e){let t=e.clientAuth.algorithm??"RS256",r=e.clientAuth.expiresInSeconds??El,n=await Tl(Dl(e.clientAuth.privateKeyPem),t),i={alg:t,typ:"JWT",...e.clientAuth.keyId===void 0?{}:{kid:e.clientAuth.keyId}};return new Pl({jti:crypto.randomUUID()}).setProtectedHeader(i).setIssuer(e.clientAuth.clientId).setSubject(e.clientAuth.clientId).setAudience(e.clientAuth.audience??e.tokenUrl).setIssuedAt().setExpirationTime(`${r}s`).sign(n)}o(zl,"createPrivateKeyJwtClientAssertion");async function jl(e){switch(e.clientAuth.method){case"client_secret_post":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_secret",e.clientAuth.clientSecret);return;case"client_secret_basic":{let t=ia(e.clientAuth.clientId),r=ia(e.clientAuth.clientSecret);e.headers.authorization=`Basic ${btoa(`${t}:${r}`)}`;return}case"private_key_jwt":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_assertion_type",Vt),e.form.set("client_assertion",await zl({clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}));return}}o(jl,"appendClientAuthentication");async function pn(e){let t={"Content-Type":"application/x-www-form-urlencoded"};return await jl({form:e.form,headers:t,clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}),{method:"POST",headers:t,body:e.form.toString()}}o(pn,"buildFormRequest");function da(e){return(t,r)=>lr(t,r,{context:e,maxRedirects:ca,maxResponseBytes:sa,problemCode:"upstream_token_exchange_failed",timeoutMs:aa})}o(da,"defaultIdpFetchJson");function Hl(e){return(t,r)=>bi(t,r,{context:e,maxRedirects:ca,maxResponseBytes:sa,problemCode:"upstream_token_exchange_failed",timeoutMs:aa})}o(Hl,"defaultResourceAsFetchJson");function hr(e){let t={[y]:e.code,[be]:e.tokenUrl};return e.response!==void 0&&(t[we]=e.response.status),new h({message:e.message,extensionMembers:t},e.cause===void 0?void 0:{cause:e.cause})}o(hr,"runtimeError");function mn(e){if(!e.response.ok)throw hr({code:"upstream_token_exchange_failed",message:(()=>{switch(e.stage){case"idp_refresh_token":return"IdP refresh-token grant failed while renewing the upstream ID-JAG subject token.";case"idp_token_exchange":return"IdP token exchange failed while requesting an upstream ID-JAG.";case"resource_as_jwt_bearer":return"Upstream Resource AS rejected the ID-JAG JWT-bearer exchange."}})(),tokenUrl:e.tokenUrl,response:e.response})}o(mn,"assertTokenEndpointSucceeded");function Bl(e){let t=Ml.safeParse(e.json);if(!t.success)throw hr({code:"upstream_token_response_invalid",message:"IdP refresh-token grant returned an invalid subject-token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={idToken:t.data.id_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),t.data.scope!==void 0&&(r.scope=t.data.scope),r}o(Bl,"parseIdpRefreshTokenResponse");function Ll(e){let t=Ol.safeParse(e.json);if(!t.success)throw hr({code:"upstream_token_response_invalid",message:"IdP token exchange returned an invalid ID-JAG response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={assertion:t.data.access_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),r}o(Ll,"parseIdJagTokenExchangeResponse");function Nl(e){let t=ql.safeParse(e.json);if(!t.success)throw hr({code:"upstream_token_response_invalid",message:"Upstream Resource AS returned an invalid JWT-bearer token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={accessToken:t.data.access_token,tokenType:t.data.token_type};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),t.data.resource!==void 0&&(r.resource=t.data.resource),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),r}o(Nl,"parseAccessTokenResponse");async function ua(e){let t=new URLSearchParams({grant_type:Wt,requested_token_type:Er,subject_token:e.subjectToken,subject_token_type:e.subjectTokenType,audience:e.audience});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope),e.authorizationDetails!==void 0&&t.set("authorization_details",JSON.stringify(e.authorizationDetails));let r=e.fetchJson??da(e.context),{response:n,json:i}=await r(e.idp.tokenUrl,await pn({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return mn({response:n,tokenUrl:e.idp.tokenUrl,stage:"idp_token_exchange"}),Ll({json:i,response:n,tokenUrl:e.idp.tokenUrl})}o(ua,"requestIdJag");async function la(e){let t=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken}),r=e.fetchJson??da(e.context),{response:n,json:i}=await r(e.idp.tokenUrl,await pn({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return mn({response:n,tokenUrl:e.idp.tokenUrl,stage:"idp_refresh_token"}),Bl({json:i,response:n,tokenUrl:e.idp.tokenUrl})}o(la,"refreshIdpSubjectToken");async function pa(e){let t=new URLSearchParams({grant_type:Ce,assertion:e.assertion});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope);let r=e.fetchJson??Hl(e.context),{response:n,json:i}=await r(e.resourceAs.tokenUrl,await pn({form:t,clientAuth:e.clientAuth,tokenUrl:e.resourceAs.tokenUrl}));return mn({response:n,tokenUrl:e.resourceAs.tokenUrl,stage:"resource_as_jwt_bearer"}),Nl({json:i,response:n,tokenUrl:e.resourceAs.tokenUrl})}o(pa,"exchangeIdJagForAccessToken");function Gl(e){return F(e)==="usable"}o(Gl,"hasUsableAccessToken");function Jl(e){if(e.tokenType.toLowerCase()!=="bearer")throw new h({message:"Upstream Resource AS returned a token type the MCP gateway cannot send as a bearer token.",extensionMembers:{[y]:"upstream_token_response_invalid"}})}o(Jl,"assertBearerToken");function ma(e,t){if(t===Ke)return!1;let r=e?.metadata?.idpSubjectTokenExpiresAt;return r!==void 0&&new Date(r).getTime()<=Date.now()}o(ma,"hasExpiredSubjectToken");async function Fl(e){let t=await fe(e.encryptedSubjectToken);if(e.subjectTokenType!==Ke)return{connection:e.connection,subjectToken:t,subjectTokenType:e.subjectTokenType};let r=await la({idp:e.idp,refreshToken:t,clientAuth:e.clientAuth,context:e.context});if(r.refreshToken===void 0)return{connection:e.connection,subjectToken:r.idToken,subjectTokenType:mt};let n=await C().upsertUpstreamConnection({id:e.connection.id,ownerMode:e.connection.ownerMode,subjectId:e.connection.subjectId,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,status:"active",encryptedAccessToken:e.connection.encryptedAccessToken,encryptedRefreshToken:e.connection.encryptedRefreshToken,scopes:e.connection.scopes,expiresAt:e.connection.expiresAt,metadata:{...e.connection.metadata??{},encryptedIdpSubjectToken:await me(r.refreshToken),idpSubjectTokenType:Ke,idpSubjectTokenExpiresAt:void 0}});return U()?.info({event:"upstream_id_jag_subject_token_rotated",upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,connectionFingerprint:e.connectionFingerprint,connectionId:n.id,priorStatus:e.connection.status,priorUpdatedAt:e.connection.updatedAt,usedSubjectRefreshTokenFingerprint:await ze(t),newSubjectRefreshTokenFingerprint:await ze(r.refreshToken)},"Upstream ID-JAG IdP subject refresh token rotated and persisted"),{connection:n,subjectToken:r.idToken,subjectTokenType:mt}}o(Fl,"resolveIdJagSubjectToken");async function fa(e){let t="preloadedConnection"in e?e.preloadedConnection:(await C().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0],r=F(t),n=!!e.forceRefresh,i=!n&&r==="usable",a=U(),s=a?await Xe({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}):void 0;if(a?.debug({event:"upstream_id_jag_auth_decision",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode,connectionFingerprint:s,connectionId:t?.id,accessTokenState:r,forceRefresh:n,willMint:!i,expiresAt:t?.expiresAt,connectionUpdatedAt:t?.updatedAt},i?"Reusing stored upstream ID-JAG access token":"Minting upstream ID-JAG access token"),!e.forceRefresh&&Gl(t))return{kind:"authorized",credential:{type:"bearer_token",token:await fe(t.encryptedAccessToken)}};let c=t?.metadata?.encryptedIdpSubjectToken,u=t?.metadata?.idpSubjectTokenType;if(t?.status!=="active"||c===void 0||u===void 0||ma(t,u))return a?.debug({event:"upstream_id_jag_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:s,connectionId:t?.id,status:t?.status??"not_connected",hasSubjectToken:c!==void 0,subjectTokenType:u,subjectTokenExpired:u!==void 0&&ma(t,u)},"Upstream ID-JAG requires an admin subject-token binding"),{kind:"connect_required",payload:{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,message:`An IdP subject-token binding is required for ${e.upstreamDisplayName} before this tool can use XAA / ID-JAG.`,nextAction:"admin_setup_required"}};let l=ve(e.upstreamServerId),p=gi(e.upstreamServerId,e.authProfileId),g=p.resourceAs.resource??l.transport.baseUrl,R=e.requestedScope??(p.scopes.length===0?void 0:p.scopes.join(p.scopeDelimiter)),_=await Fl({connection:t,connectionFingerprint:s,encryptedSubjectToken:c,subjectTokenType:u,idp:{tokenUrl:p.idp.tokenUrl},clientAuth:p.idp.clientAuth,context:e.context}),O=await ua({idp:{tokenUrl:p.idp.tokenUrl},subjectToken:_.subjectToken,subjectTokenType:_.subjectTokenType,audience:p.resourceAs.audience,resource:g,scope:R,clientAuth:p.idp.clientAuth,context:e.context}),T=O.scope??R,B=await pa({resourceAs:{tokenUrl:p.resourceAs.tokenUrl},assertion:O.assertion,resource:g,scope:T,clientAuth:p.resourceAs.clientAuth,context:e.context});if(Jl(B),t!==void 0){let X=(B.scope??T)?.split(/[,\s]+/).filter(Boolean)??[],M=B.expiresIn===void 0?void 0:S(new Date(Date.now()+B.expiresIn*1e3)),j=await C().upsertUpstreamConnection({id:_.connection.id,ownerMode:_.connection.ownerMode,subjectId:_.connection.subjectId,upstreamServerId:_.connection.upstreamServerId,authProfileId:_.connection.authProfileId,status:"active",encryptedAccessToken:await me(B.accessToken),encryptedRefreshToken:_.connection.encryptedRefreshToken,scopes:X,expiresAt:M,metadata:_.connection.metadata});a?.info({event:"upstream_id_jag_access_token_persisted",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:s,connectionId:j.id,priorStatus:_.connection.status,priorUpdatedAt:_.connection.updatedAt,scopeCount:X.length,expiresAt:M},"Upstream ID-JAG access token persisted; connection is active")}return{kind:"authorized",credential:{type:"bearer_token",token:B.accessToken}}}o(fa,"authorizeUpstreamIdJagRequest");var gr=new Map;function $l(e){return[...new Set(e?.split(/[,\s]+/).filter(Boolean)??[])].sort().join(" ")}o($l,"normalizeRefreshFlightScope");function Zl(e){return fr(new URL(e.callbackPath,D(e.requestUrl,e.requestHeaders))).toString()}o(Zl,"buildGatewayOAuthRedirectUri");async function fn(e){let t=ve(e.upstreamServerId),r=Ve(e.upstreamServerId,e.authProfileId),n=Zl({callbackPath:r.redirectPath,requestUrl:e.request.url,requestHeaders:e.request.headers}),i="preloadedConnection"in e?e.preloadedConnection:(await C().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0];return{upstreamServerConfig:t,connection:i,providerInput:{target:{owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,returnTo:e.returnTo},redirectUri:n,returnOrigin:D(e.request.url,e.request.headers)}}}o(fn,"prepareUpstreamOAuthRequest");async function ha(e){let t=await fn(e),r=new xe({...t.providerInput,...t.connection?.metadata===void 0?{}:{connectionMetadata:t.connection.metadata}});return ra(r,{upstreamServerId:e.upstreamServerId,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl})}o(ha,"startUpstreamConnect");async function ga(e){let t=await fn(e),r=new xe({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),n=o(()=>na({target:e,provider:r,connection:t.connection,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,upstreamDisplayName:t.upstreamServerConfig.displayName,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl}),"runSession");if(!e.forceRefresh&&t.connection!==void 0&&F(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return n();let i=Fo({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}),a=JSON.stringify([i,$l(r.configuredAuthorizationScope??e.requestedScope)]),s=gr.get(a);if(s!==void 0){U()?.debug({event:"upstream_oauth_refresh_single_flight_coalesced",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode},"Upstream OAuth refresh joined an isolate-local single-flight");let l=await s;if(l.kind==="usable"&&r.connectionSatisfiesRequestedScope(l.connection,e.requestedScope))return await r.adoptConnectionForDirectResolution(l.connection,"single_flight"),{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:r}};let{preloadedConnection:p,...g}=e;if(t=await fn(g),r=new xe({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),!e.forceRefresh&&t.connection!==void 0&&F(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return n()}let c=n(),u;return u=c.then(()=>{let l=r.currentConnection;return l!==void 0&&F(l)==="usable"?{kind:"usable",connection:l}:{kind:"unresolved"}}).catch(()=>({kind:"unresolved"})).finally(()=>{gr.get(a)===u&&gr.delete(a)}),gr.set(a,u),c}o(ga,"authorizeUpstreamRequest");async function tt(e){let{routeAuth:t}=e;switch(t.authMode){case"shared-oauth":case"user-oauth":return ga({request:e.request,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo});case"id-jag":return fa({request:e.request,context:e.context,authMode:t.authMode,ownerMode:t.ownerMode,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,upstreamDisplayName:t.upstreamDisplayName,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo})}let r=t;throw new Q(`Unsupported upstream auth route context ${JSON.stringify(r)}.`)}o(tt,"resolveUpstreamCredentialForRoute");async function ya(e){if(e.connectRequest.authMode==="id-jag")throw new Q(`Upstream server ${e.connectRequest.upstreamServerId} uses XAA / ID-JAG and does not support browser OAuth connection flows.`);let t=await ha({request:e.request,owner:e.connectRequest.owner,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,upstreamServerId:e.connectRequest.upstreamServerId,authProfileId:e.connectRequest.authProfileId,operationId:e.connectRequest.operationId,returnTo:e.connectRequest.returnTo});return{authProfileId:e.connectRequest.authProfileId,authUrl:t,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,owner:e.connectRequest.owner,upstreamDisplayName:e.connectRequest.upstreamDisplayName,operationId:e.connectRequest.operationId}}o(ya,"startUpstreamConnectForRequest");async function _a(e){let r=(await pr(e.callbackRequest.state)).authProfileId;if(dr({upstreamServerId:e.callbackRequest.upstreamServerId,authProfileId:r}).mode==="id-jag")throw new Q(`Upstream server ${e.callbackRequest.upstreamServerId} uses XAA / ID-JAG and does not support OAuth callbacks.`);return oa({request:e.request,upstreamServerId:e.callbackRequest.upstreamServerId,authorizationCode:e.callbackRequest.code,stateToken:e.callbackRequest.state,upstreamServerConfig:ve(e.callbackRequest.upstreamServerId)})}o(_a,"finishUpstreamCallbackForRequest");function Kl(e){return{upstreamServerId:e.connection.upstreamServerId,operationId:e.operationId,authProfileId:e.connection.authProfileId,upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}o(Kl,"buildRouteAuthBaseFromConnection");function wa(e){return{upstreamServerId:e.connection.id,operationId:e.operationId,authProfileId:Ro(e.connection.id,e.connection.authMode),upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}o(wa,"buildRouteAuthBaseFromPolicyOptions");function yr(e,t){let n=ee().byOperationId.get(t);if(!n)throw new k(`Unknown MCP route "${t}". Ensure routes.oas.json declares this operationId before starting an upstream connection flow.`);if(n.connection===void 0)throw new k(`MCP route "${t}" does not declare an MCP token exchange policy. Add one before starting an upstream connection flow.`);if(n.connection.upstreamServerId!==e)throw new k(`MCP route "${t}" does not bind upstream "${e}". Check the route's MCP upstream policies and bind the upstream before starting an upstream connection flow.`);return Kl({connection:n.connection,operationId:t})}o(yr,"resolveRouteAuthBase");function hn(e,t){switch(e){case"user":return $e(t);case"shared":return wo()}}o(hn,"buildOwnerForSubject");function rt(e,t){switch(e.authMode){case"shared-oauth":return{...e,authMode:"shared-oauth",ownerMode:"shared",owner:hn("shared",t),initiatedBySubjectId:t};case"user-oauth":return{...e,authMode:"user-oauth",ownerMode:"user",owner:hn("user",t),initiatedBySubjectId:t};case"id-jag":return{...e,authMode:"id-jag",ownerMode:"user",owner:hn("user",t),initiatedBySubjectId:t}}}o(rt,"resolveRouteAuthForSubject");var Wl=ut.InvalidRequest,Vl=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function Yl(e,t){return{credentialType:e.type,forceRefresh:t}}o(Yl,"buildCredentialResolvedAttributes");function Xl(e){switch(e){case"admin_connect_required":return"admin_connect_required";case"authenticating":return"connect_required"}}o(Xl,"connectRequiredReasonCode");function ba(e){A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED,outcome:"success",routeBinding:e.routeBinding,attributes:Yl(e.credential,e.forceRefresh===!0)})}o(ba,"emitCredentialResolvedAnalyticsEvent");function Ra(e){let t={forceRefresh:e.forceRefresh===!0,nextAction:e.payload.nextAction,state:e.payload.state};if(A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"connect_required",reasonClass:"auth",attributes:t}),e.payload.state==="reconsent_required"){A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"reconsent_required",reasonClass:"auth",attributes:t});return}A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_CONNECT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:Xl(e.payload.state),reasonClass:"auth",attributes:t})}o(Ra,"emitCredentialMissingAnalyticsEvents");function Ql(e){let t=e.route.raw();return Ft.parse(t?.operationId)}o(Ql,"readOperationId");async function ep(e,t,r,n){let i=await tt({request:e,context:n,routeAuth:t});if(i.kind==="connect_required")return Ra({context:n,payload:i.payload,routeBinding:t}),n.log.info({event:"mcp_upstream_connect_required",upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId},"MCP upstream proxy: upstream connection required"),{kind:"connect_required",payload:i.payload};let a=i.credential;if(ba({context:n,credential:a,routeBinding:t}),a.type==="bearer_token")return{kind:"headers",headers:[["authorization",`Bearer ${a.token}`]]};let s=await a.provider.tokens();return s?{kind:"headers",headers:[["authorization",`${s.token_type??"Bearer"} ${s.access_token}`]]}:(n.log.warn({event:"mcp_upstream_no_tokens",upstreamServerId:t.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens"),Response.json({error:"no_upstream_tokens"},{status:401}))}o(ep,"buildCredentialHeaders");var tp=new Set(["authorization","cookie","cookie2"]);function rp(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return t&&typeof t=="object"&&!Array.isArray(t)&&"method"in t&&typeof t.method=="string"?t.method:void 0}catch{return}}o(rp,"readJsonRequestMethod");function np(e){let t=e.headers.get("content-type")??"";return/\bapplication\/(?:[\w.+-]+\+)?json\b/i.test(t)}o(np,"isJsonResponse");function gn(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}o(gn,"isRecord");function op(e){return Array.isArray(e)&&e.length>0}o(op,"hasIconList");function ip(e){if(e.connection.serverInfo?.icons!==void 0&&e.connection.serverInfo.icons.length>0)return e.connection.serverInfo.icons;try{let t=cr(po(e.context.route.handler));return t===void 0?void 0:[t]}catch{return}}o(ip,"readFallbackServerIcons");function ap(e){if(!gn(e.body))return e.body;let t=e.body.result;if(!gn(t))return e.body;let r=t.serverInfo;return!gn(r)||op(r.icons)?e.body:{...e.body,result:{...t,serverInfo:{...r,icons:e.icons}}}}o(ap,"addMissingServerIcons");function sp(e,t){let r=Ca(e);for(let n of tp)r.delete(n);for(let[n,i]of t)r.set(n,i);return new Wn(e,{headers:r})}o(sp,"applyUpstreamHeaders");var cp=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function dp(e){let t=e.get("connection");return t===null?[]:t.split(",").map(r=>r.trim()).filter(r=>cp.test(r))}o(dp,"connectionNominatedHeaderNames");function Ca(e){let t=new Headers(e.headers);for(let r of dp(t))t.delete(r);for(let r of Vl)t.delete(r);return t}o(Ca,"buildProxyHeaders");async function up(e){if(!(e.method==="GET"||e.method==="HEAD"))return e.clone().arrayBuffer()}o(up,"readRetryBody");function Sa(e,t){let r=t.authUrl===void 0?void 0:Yo({message:t.message,elicitationId:["connect",t.operationId,t.upstreamServerId,t.authProfileId].join(":"),url:t.authUrl});return Response.json(tr({id:Vo(e),error:{code:r?.code??Wl,message:t.message,data:{...r?.data??{},connectRequired:t}}}))}o(Sa,"connectRequiredJsonRpcResponse");async function lp(e){let{scope:t}=li(e.upstreamResponse),r=await tt({request:e.request,context:e.context,routeAuth:e.routeAuth,forceRefresh:!0,requestedScope:t});if(r.kind==="connect_required")return Ra({context:e.context,payload:r.payload,routeBinding:e.routeAuth,forceRefresh:!0}),{kind:"connect_required",payload:r.payload};let n=new Headers(e.headers),i=r.credential;if(ba({context:e.context,credential:i,routeBinding:e.routeAuth,forceRefresh:!0}),i.type==="bearer_token")return n.set("authorization",`Bearer ${i.token}`),{kind:"headers",headers:n};let a=await i.provider.tokens();return a?(n.set("authorization",`${a.token_type??"Bearer"} ${a.access_token}`),{kind:"headers",headers:n}):(e.context.log.warn({event:"mcp_upstream_no_tokens_after_refresh",upstreamServerId:e.routeAuth.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens after refresh"),{kind:"response",response:Response.json({error:"no_upstream_tokens"},{status:401})})}o(lp,"applyRefreshedCredentialHeaders");function pp(e){e.context.addResponseSendingHook(async(t,r)=>{if(t.status!==401)return t;let n=await lp({request:e.request,context:e.context,headers:Ca(r),routeAuth:e.routeAuth,upstreamResponse:t});if(n.kind==="connect_required")return Sa(e.requestBody,n.payload);if(n.kind==="response")return n.response;let i=mo({handler:e.context.route.handler,request:r,body:e.requestBody,headers:n.headers});return Bt.fetch(i.url,i.init)})}o(pp,"installUpstreamAuthRetryHook");function mp(e){if(rp(e.requestBody)!=="initialize")return;let t=ip({connection:e.connection,context:e.context});t===void 0||t.length===0||e.context.addResponseSendingHook(async r=>{if(!np(r))return r;let n;try{n=await r.clone().json()}catch{return r}let i=ap({body:n,icons:t});if(i===n)return r;let a=new Headers(r.headers);return a.delete("content-length"),new Response(JSON.stringify(i),{status:r.status,statusText:r.statusText,headers:a})})}o(mp,"installInitializeIconHook");async function yn(e,t,r){let n=Ql(t),i=await up(e),a=wa({connection:r,operationId:n}),s=Ee(e.user,e.url,e.headers);t.log.setLogProperties?.({requestId:t.requestId}),ko(t,s);let c=rt(a,s.subjectId),u=await ep(e,c,r,t);if(!(u instanceof Response)&&u.kind==="connect_required")return Sa(i,u.payload);if(u instanceof Response)return u;let l=sp(e,u.headers);return pp({request:l,context:t,requestBody:i,routeAuth:c}),mp({context:t,requestBody:i,connection:r}),l}o(yn,"mcpTokenExchangePolicy");var _n=class extends Lt{static{o(this,"McpTokenExchangeInboundPolicy")}static policyType="mcp-token-exchange";#e;constructor(t,r){let n=Co(t,r);super(n,r),this.#e=n}async handler(t,r){return yn(t,r,this.#e)}};var Ia=Symbol("Html");function fp(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}o(fp,"escapeHtml");function hp(e){return e===null||typeof e!="object"?!1:e[Ia]===!0}o(hp,"isHtml");function va(e){return e==null||e===!1?"":Array.isArray(e)?e.map(va).join(""):hp(e)?e.value:fp(String(e))}o(va,"renderValue");function he(e){return{[Ia]:!0,value:e}}o(he,"trustedHtml");var te=he("");function v(e,...t){let r=e[0]??"";for(let n=0;n<t.length;n+=1)r+=va(t[n]),r+=e[n+1]??"";return he(r)}o(v,"html");function nt(e){return e.value}o(nt,"renderHtml");function Aa(e){return v`<p class="card__description">${e.detail}</p>${e.guidance} ${e.technicalDetails} ${e.action}`}o(Aa,"renderBrowserErrorPage");var ot=he('*,:before,:after{box-sizing:border-box}:root{--bg:#f5f6f8;--surface:#fff;--surface-2:#f8fafc;--border:#e5e7eb;--border-strong:#d1d5db;--text:#0f172a;--text-2:#475569;--text-3:#64748b;--text-muted:#94a3b8;--accent:#0f172a;--accent-hover:#1e293b;--accent-text:#fff;--focus-ring:#0f172a29;--danger:#b91c1c;--danger-bg:#b91c1c0f;--danger-border:#b91c1c38;--warning:#92400e;--warning-bg:#fffbeb;--warning-border:#fde68a;--success:#15803d;--success-bg:#f0fdf4;--success-border:#bbf7d0;--radius-sm:4px;--radius:8px;--radius-lg:12px;--radius-pill:9999px;--shadow-sm:0 1px 2px #0f172a0d;--shadow:0 1px 2px #0f172a0a,0 6px 16px #0f172a0f;--font-sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;--font-mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Monaco,Consolas,monospace}@media (prefers-color-scheme:dark){:root{--bg:#0a0c10;--surface:#15171c;--surface-2:#1e2128;--border:#262932;--border-strong:#3a3e48;--text:#fafafa;--text-2:#cbd5e1;--text-3:#94a3b8;--text-muted:#71717a;--accent:#fafafa;--accent-hover:#e4e4e7;--accent-text:#0a0c10;--focus-ring:#fafafa2e;--danger:#f87171;--danger-bg:#f8717114;--danger-border:#f871714d;--warning:#fbbf24;--warning-bg:#fbbf2414;--warning-border:#fbbf2447;--success:#34d399;--success-bg:#34d39914;--success-border:#34d3994d;--shadow-sm:0 1px 2px #0006;--shadow:0 1px 2px #0006,0 8px 24px #0006}}html,body{margin:0;padding:0}body{font-family:var(--font-sans);background:var(--bg);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;flex-direction:column;justify-content:center;align-items:center;min-height:100dvh;padding:48px 20px;font-size:14px;line-height:1.5;display:flex}.card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius-lg);width:100%;max-width:480px;box-shadow:var(--shadow);overflow:hidden}.card__head{text-align:center;padding:32px 32px 24px}.card__icon{border-radius:var(--radius);background:var(--surface-2);object-fit:contain;border:1px solid var(--border);width:48px;height:48px;margin:0 auto 16px;display:block}.card__title{letter-spacing:-.01em;color:var(--text);margin:0;font-size:20px;font-weight:600;line-height:1.3}.card__subtitle{color:var(--text-2);margin:8px 0 0;font-size:14px;line-height:1.55}.card__subtitle strong{color:var(--text);font-weight:600}.card__description{color:var(--text-3);margin:12px 0 0;font-size:13px;line-height:1.55}.card__principal{color:var(--text-3);background:var(--surface-2);border-radius:var(--radius-pill);text-overflow:ellipsis;white-space:nowrap;align-items:center;gap:6px;max-width:100%;margin:16px 0 0;padding:4px 12px;font-size:12.5px;display:inline-flex;overflow:hidden}.card__body{flex-direction:column;gap:20px;padding:8px 32px 24px;display:flex}.card__head+.card__body{border-top:1px solid var(--border);padding-top:24px}.card__footer{border-top:1px solid var(--border);background:var(--surface-2);flex-wrap:wrap;justify-content:flex-end;align-items:center;gap:8px;padding:16px 24px;display:flex}.card__fineprint{color:var(--text-3);text-align:center;margin:0;font-size:12.5px;line-height:1.5}.card__fineprint strong{color:var(--text-2);font-weight:600}.section-label{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);align-items:baseline;gap:6px;margin:0;font-size:11px;font-weight:600;display:flex}.section-label__count{color:var(--text-3);letter-spacing:0;font-weight:500}.banner{border-radius:var(--radius);border:1px solid;align-items:flex-start;gap:10px;padding:12px 14px;font-size:13px;display:flex}.banner__icon{flex-shrink:0;justify-content:center;align-items:center;width:16px;height:16px;margin-top:1px;display:inline-flex}.banner__body{flex-direction:column;flex:1;gap:2px;min-width:0;display:flex}.banner__title{color:var(--text);margin:0;font-size:13px;font-weight:600}.banner__message{color:var(--text-2);margin:0;font-size:13px;line-height:1.5}.banner--warning{background:var(--warning-bg);border-color:var(--warning-border)}.banner--warning .banner__icon{color:var(--warning)}.banner--alert{background:var(--danger-bg);border-color:var(--danger-border)}.banner--alert .banner__icon,.banner--alert .banner__title{color:var(--danger)}.upstream-list{flex-direction:column;gap:8px;margin:0;padding:0;list-style:none;display:flex}.upstream-card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);flex-direction:column;gap:10px;padding:14px;display:flex}.upstream-card--needs-action{border-color:var(--warning-border);background:var(--warning-bg)}.upstream-card__head{align-items:flex-start;gap:10px;display:flex}.icon-frame{border-radius:var(--radius-sm);border:1px solid var(--border);background:var(--surface-2);width:32px;height:32px;color:var(--text-3);flex-shrink:0;justify-content:center;align-items:center;display:inline-flex;overflow:hidden}.icon-frame img{object-fit:contain;max-width:100%;max-height:100%}.icon-frame--fallback svg{width:18px;height:18px}.inline-icon{object-fit:contain;vertical-align:-2px;border-radius:2px;width:14px;height:14px;margin-right:4px}.upstream-card__main{flex-direction:column;flex:1;gap:3px;min-width:0;display:flex}.upstream-card__title-row{justify-content:space-between;align-items:center;gap:10px;min-width:0;display:flex}.upstream-card__title{color:var(--text);letter-spacing:-.005em;text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;margin:0;font-size:14px;font-weight:600;line-height:1.3;overflow:hidden}.upstream-card__meta{color:var(--text-3);flex-wrap:wrap;align-items:center;gap:6px;font-size:12px;display:flex}.upstream-card__host{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);padding:1px 6px;font-size:11.5px}.upstream-card__sep{color:var(--border-strong)}.upstream-card__description{color:var(--text-2);margin:4px 0 0;font-size:12.5px;line-height:1.5}.status-badge{border-radius:var(--radius-pill);white-space:nowrap;border:1px solid #0000;flex-shrink:0;align-items:center;gap:6px;padding:2px 8px;font-size:11.5px;font-weight:600;display:inline-flex}.status-badge:before{content:"";background:currentColor;border-radius:50%;flex-shrink:0;width:5px;height:5px}.status-badge--success{background:var(--success-bg);color:var(--success);border-color:var(--success-border)}.status-badge--warning{background:var(--warning-bg);color:var(--warning);border-color:var(--warning-border)}.status-badge--neutral{background:var(--surface-2);color:var(--text-2);border-color:var(--border)}.upstream-card__capabilities,.upstream-card__scopes{border-top:1px solid var(--border);margin-top:2px;padding-top:10px}.upstream-card__capabilities--empty{color:var(--text-3);font-size:12px;font-style:italic}.capabilities-summary,.scopes-summary{cursor:pointer;user-select:none;color:var(--text-2);justify-content:space-between;align-items:center;gap:12px;padding:2px 0;font-size:12.5px;list-style:none;display:flex}.capabilities-summary::-webkit-details-marker,.scopes-summary::-webkit-details-marker{display:none}.capabilities-summary:hover,.scopes-summary:hover{color:var(--text)}.capabilities-summary:focus-visible,.scopes-summary:focus-visible{outline:2px solid var(--accent);outline-offset:2px;border-radius:var(--radius-sm)}.capabilities-summary__counts{flex-wrap:wrap;align-items:center;gap:12px;display:flex}.count-pill{color:var(--text-2);align-items:baseline;gap:4px;font-size:12.5px;display:inline-flex}.count-pill__num{font-variant-numeric:tabular-nums;color:var(--text);font-size:13px;font-weight:600}.count-pill--destructive .count-pill__num,.count-pill--destructive .count-pill__label{color:var(--danger)}.capabilities-summary__chevron{color:var(--text-3);flex-shrink:0;transition:transform .15s;display:inline-flex}details[open]>.capabilities-summary .capabilities-summary__chevron,details[open]>.scopes-summary .capabilities-summary__chevron{transform:rotate(180deg)}.capabilities-detail{margin-top:10px}.capability-section{margin-top:14px}.capability-section:first-child{margin-top:6px}.capability-section__title{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);margin:0 0 6px;font-size:11px;font-weight:600}.capability-list{flex-direction:column;gap:5px;margin:0;padding:0;font-size:12.5px;list-style:none;display:flex}.capability-row{flex-wrap:wrap;align-items:baseline;gap:6px;padding:2px 0;display:flex}.capability-row__name{font-weight:500;font-family:var(--font-mono);color:var(--text);font-size:12.5px}.capability-row__description{color:var(--text-3);flex-basis:100%;font-size:12px;line-height:1.45}.capability-row__description code{font-family:var(--font-mono);background:var(--surface-2);border-radius:var(--radius-sm);color:var(--text-2);padding:1px 4px}.capability-row--more{color:var(--text-3);font-size:12px;font-style:italic}.scopes-list{flex-wrap:wrap;gap:4px;margin-top:8px;display:flex}.scope-chip{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);border:1px solid var(--border);padding:2px 7px;font-size:11.5px}.badge{border-radius:var(--radius-sm);letter-spacing:.04em;text-transform:uppercase;align-items:center;padding:1px 5px;font-size:10px;font-weight:600;display:inline-flex}.badge--destructive{background:var(--danger-bg);color:var(--danger)}.badge--muted{background:var(--surface-2);color:var(--text-3)}.badge-row{flex-wrap:wrap;gap:4px;display:inline-flex}.muted{color:var(--text-3)}.button{font:inherit;border-radius:var(--radius);cursor:pointer;white-space:nowrap;border:1px solid #0000;justify-content:center;align-items:center;gap:6px;min-height:40px;padding:8px 16px;font-size:14px;font-weight:500;text-decoration:none;transition:background .12s,border-color .12s,color .12s,box-shadow .12s,transform 40ms;display:inline-flex}.button:active{transform:translateY(1px)}.button:focus-visible{box-shadow:0 0 0 3px var(--focus-ring);outline:0}.button--small{padding:5px 10px;font-size:12.5px}.button--primary{background:var(--accent);color:var(--accent-text);border-color:var(--accent)}.button--primary:hover:not(:disabled):not([aria-disabled=true]){background:var(--accent-hover);border-color:var(--accent-hover)}.button:disabled,.button[aria-disabled=true]{cursor:not-allowed;opacity:.55}.button:disabled:hover,.button[aria-disabled=true]:hover{background:var(--accent);border-color:var(--accent)}.button--secondary{background:var(--surface);color:var(--text);border-color:var(--border-strong)}.button--secondary:hover{background:var(--surface-2);border-color:var(--border-strong)}.button--block{width:100%}.reconnect-action{align-items:center;margin-right:auto;display:inline-flex;position:relative}.reconnect-button{gap:7px}.tooltip{width:16px;height:16px;color:var(--accent);background:color-mix(in srgb,var(--accent)8%,transparent);cursor:help;border:1.5px solid;border-radius:50%;justify-content:center;align-items:center;font-size:10.5px;font-weight:700;line-height:1;display:inline-flex;position:relative}.tooltip:after{content:attr(aria-label);z-index:10;border-radius:var(--radius-sm);background:var(--accent);width:280px;max-width:min(280px,100vw - 48px);color:var(--accent-text);box-shadow:var(--shadow);text-align:left;white-space:normal;opacity:0;pointer-events:none;padding:12px 14px;font-size:13px;font-weight:600;line-height:1.45;transition:opacity .12s;position:absolute;bottom:calc(100% + 12px);left:50%;transform:translate(-50%)}.tooltip:before{content:"";z-index:11;border-left:7px solid #0000;border-right:7px solid #0000;border-top:8px solid var(--accent);opacity:0;pointer-events:none;transition:opacity .12s;position:absolute;bottom:calc(100% + 5px);left:50%;transform:translate(-50%)}.tooltip:hover:after,.tooltip:hover:before,.tooltip:focus-visible:after,.tooltip:focus-visible:before{opacity:1}.form{flex-direction:column;gap:6px;display:flex}.form__label{color:var(--text);margin:8px 0 0;font-size:13px;font-weight:600;display:block}.form__label:first-child{margin-top:0}.form__input{box-sizing:border-box;border:1px solid var(--border-strong);border-radius:var(--radius);width:100%;font:inherit;background:var(--surface);color:var(--text);padding:9px 12px;font-size:14px;transition:border-color .12s,box-shadow .12s}.form__input:focus{border-color:var(--accent);box-shadow:0 0 0 3px var(--focus-ring);outline:0}.form__note{color:var(--text-3);margin:4px 0 0;font-size:12.5px;line-height:1.5}.form__submit{margin-top:8px}.empty{text-align:center;color:var(--text-3);border:1px dashed var(--border);border-radius:var(--radius);background:var(--surface);padding:24px 16px;font-size:13px}.actions{gap:8px;margin:0;display:flex}@media (width<=480px){body{padding:0}.card{box-shadow:none;border-left:0;border-right:0;border-radius:0;min-height:100dvh}.card__head{padding:24px 20px 16px}.card__body{padding:16px 20px}.card__footer{flex-direction:column-reverse;align-items:stretch;padding:14px 20px}.card__footer .button{width:100%}.reconnect-action{justify-content:center;width:100%;margin-right:0}.reconnect-action .button{flex:1}.tooltip:after{left:auto;right:0;transform:none}}@media (prefers-reduced-motion:reduce){*{transition:none!important}}');function it(e){return v`<!doctype html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name="referrer" content="no-referrer" /><meta name="robots" content="noindex" /><title>${e.title}</title><link rel="icon" href="${e.iconHref}" /><style>
       ${e.styles}
     </style></head><body><main class="card"><header class="card__head">${e.headerIcon}<h1 class="card__title">${e.heading}</h1>${e.subhead}</header><div class="card__body">${e.body}</div>${e.footer}</main></body></html>`}o(it,"renderShell");var gp="text/html; charset=utf-8";function at(e){try{return new URL(e).host}catch{return""}}o(at,"safeHostFromUrl");function ie(e){let t=_p(e.kind??"authorization_failed"),r=yp(e);return new Response(nt(it({title:e.title??t.title,iconHref:"",styles:ot,headerIcon:te,heading:e.title??t.title,subhead:"",body:Aa({detail:e.detail,guidance:v`<p class="card__description">${t.guidance}</p>`,technicalDetails:Sp({diagnostic:r,upstreamHtml:e.upstreamHtml}),action:Rp(e.action)}),footer:""})),{status:e.status??400,headers:{"content-type":gp,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}o(ie,"browserErrorPageResponse");function yp(e){let t=e.diagnostic?.code??e.code??"unknown";return{code:t,stage:e.diagnostic?.stage??wp(t),timestamp:e.diagnostic?.timestamp??new Date().toISOString(),...e.requestId===void 0&&e.diagnostic?.requestId===void 0?{}:{requestId:e.diagnostic?.requestId??e.requestId},...e.diagnostic?.operationId===void 0?{}:{operationId:e.diagnostic.operationId},...e.diagnostic?.routePath===void 0?{}:{routePath:e.diagnostic.routePath},...e.diagnostic?.upstreamServerId===void 0?{}:{upstreamServerId:e.diagnostic.upstreamServerId},...e.diagnostic?.authProfileId===void 0?{}:{authProfileId:e.diagnostic.authProfileId},...e.diagnostic?.upstreamUrl===void 0?{}:{upstreamUrl:e.diagnostic.upstreamUrl},...e.diagnostic?.metadataUrl===void 0?{}:{metadataUrl:e.diagnostic.metadataUrl},...e.diagnostic?.httpStatus===void 0?{}:{httpStatus:e.diagnostic.httpStatus},...e.diagnostic?.contentType===void 0?{}:{contentType:e.diagnostic.contentType},...e.diagnostic?.providerError===void 0?{}:{providerError:e.diagnostic.providerError},...e.diagnostic?.providerErrorDescription===void 0?{}:{providerErrorDescription:e.diagnostic.providerErrorDescription},suggestedFix:e.diagnostic?.suggestedFix??bp(t),underlyingError:e.diagnostic?.underlyingError??e.developerDetail}}o(yp,"buildBrowserErrorDiagnostic");function _p(e){switch(e){case"session_expired":return{title:"Authorization expired",guidance:"Return to your MCP client and reconnect. Expired authorization requests cannot be resumed."};case"access_denied":return{title:"Authorization canceled",guidance:"Return to your MCP client to retry if you want to grant access."};case"configuration_error":return{title:"Configuration needs attention",guidance:"Contact your workspace admin with this error code. The gateway or upstream configuration must be fixed before retrying."};case"connection_failed":return{title:"Connection failed",guidance:"Return to your MCP client and reconnect this upstream. If this keeps happening, contact your gateway administrator with this error code."};case"invalid_request":return{title:"Authorization request invalid",guidance:"Return to your MCP client and try connecting again. If this keeps happening, the client request may need to be fixed."};case"admin_required":return{title:"Admin setup required",guidance:"Contact your workspace admin with this error code. This connection cannot be completed until setup is finished."};case"internal_error":return{title:"Gateway error",guidance:"Try again later from your MCP client. If this keeps happening, contact your gateway administrator with this error code."};case"authorization_failed":return{title:"Authorization failed",guidance:"Return to your MCP client and start authorization again. If this keeps happening, contact your gateway administrator with this error code."}}}o(_p,"readBrowserErrorPagePresentation");function wp(e){switch(e){case"upstream_oauth_discovery_unavailable":return"upstream_oauth_discovery";case"upstream_client_registration_required":return"upstream_oauth_client_registration";case"upstream_provider_access_denied":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"upstream_token_exchange";case"provider_access_denied":return"upstream_oauth_callback";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"upstream_oauth_state";case"browser_login_verification_failed":return"downstream_browser_login";case"authentication_required":case"identity_context_missing":return"downstream_auth";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"gateway_configuration";case"server_error":case"internal_server_error":return"gateway_internal";default:return"gateway_request"}}o(wp,"readBrowserErrorStage");function bp(e){switch(e){case"upstream_oauth_discovery_unavailable":return"Confirm the upstream MCP URL and OAuth protected resource metadata. If the provider requires approval, configure the provider app or contact the provider.";case"upstream_client_registration_required":return"Register an OAuth client with the upstream provider, then configure the gateway to use that client before retrying.";case"upstream_provider_access_denied":return"Confirm the provider allows this gateway, OAuth client, and upstream MCP URL, then retry the connection.";case"upstream_token_exchange_failed":return"Retry the connection. If it repeats, verify the upstream OAuth client, redirect URI, token endpoint, and provider allowlist.";case"upstream_token_response_invalid":return"Verify the upstream token endpoint returns a valid OAuth token response for this gateway client.";case"provider_access_denied":return"Start the connection again if access was denied by mistake. Otherwise, grant the requested upstream provider access.";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"Start a new connection from the MCP client. The previous browser authorization request cannot be resumed.";case"browser_login_verification_failed":return"Retry the browser login flow. If it repeats, verify the downstream login callback configuration.";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"Check the MCP route, upstream server, and auth profile entries in the gateway configuration.";case"authentication_required":case"identity_context_missing":return"Verify the normal Zuplo auth policy runs before the MCP gateway policy and sets request.user.";case"server_error":case"internal_server_error":return"Retry later and check gateway logs with the request ID.";default:return"Check the gateway configuration and request details associated with this error code."}}o(bp,"readBrowserErrorSuggestedFix");function Rp(e){return e===void 0?te:v`<a class="button button--primary button--block" href="${e.href}">${e.label}</a>`}o(Rp,"renderAction");function Cp(e){let t=[["Error code",e.code],["Stage",e.stage],["Request ID",e.requestId],["Time",e.timestamp],["Gateway route",e.routePath],["Operation ID",e.operationId],["Upstream",e.upstreamServerId],["Auth profile",e.authProfileId],["Upstream URL",e.upstreamUrl],["Metadata URL",e.metadataUrl],["HTTP status",e.httpStatus],["Content type",e.contentType],["Provider error",e.providerError],["Provider error description",e.providerErrorDescription],["Suggested fix",e.suggestedFix],["Underlying error",e.underlyingError]].filter(r=>r[1]!==void 0).map(([r,n])=>`${r}: ${n}`).join(`

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -488,7 +488,10 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
 }
 
 /**
- * Meters AI Gateway v2 usage and enforces options-driven usage limits.
+ * Meters AI Gateway v2 usage and enforces app and ancestor usage limits.
+ *
+ * Limits configured on parent teams or the bucket root are enforced through a
+ * server-side hierarchical check.
  *
  * The authentication policy must run before this policy so the app
  * configuration id is available for meter storage and analytics.
@@ -557,6 +560,7 @@ export declare class AIGatewayMeteringV2InboundPolicy extends InboundPolicy<AIGa
   ): Promise<ZuploRequest | Response>;
   private resolveConfiguration;
   private fetchCurrentMeters;
+  private checkHierarchicalViolation;
   private checkWarnings;
   private hasWarning;
   private findViolation;