agent-nuvira 3.4.0 → 3.5.1

package/dist/mcp/mcp-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../../src/mcp/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAmD5C,6EAA6E;AAE7E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7D,MAAM,OAAO,eAAe;IAClB,MAAM,GAA4B,IAAI,GAAG,EAAE,CAAC;IAEpD;QACE,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,SAAS,CAAC,UAAkB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,8CAA8C;QAC9C,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,sBAAsB,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC,CAAC,wBAAwB;YACvC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,qBAAqB,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB,EAAE,MAAmB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;YAC3C,UAAU;YACV,MAAM,EAAE,EAAiB;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,UAAkB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,UAAkB,EAClB,MAAmB;QAEnB,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QAEtC,eAAe;QACf,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;iBACjC,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,0CAA0C,CAAC;QAErF,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,gBAAgB,GAAG,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEhF,cAAc;QACd,MAAM,KAAK,GAAe;YACxB,UAAU;YACV,MAAM;YACN,YAAY;YACZ,aAAa;YACb,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,UAAkB,EAClB,iBAAyB,EACzB,aAAqB;QAErB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,0CAA0C,CAAC;QAE3F,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;SACjC,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,iBAAiB;YAC5C,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;SAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAA2B;gBACnC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACxC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;aACjC,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YACjD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;aAC3C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,kCAAkC,UAAU,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;YAEF,MAAM,MAAM,GAAgB;gBAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY;gBAC7D,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;gBACtC,SAAS,EAAE,IAAI,CAAC,UAAU;oBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;oBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBACzB,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;aAC/B,CAAC;YAEF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,iCAAiC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,0BAA0B,CAC9B,UAAkB,EAClB,MAAmB;QAEnB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YACzB,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;SAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IAEhE,UAAU;QAChB,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+B,CAAC;gBAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,GAA+B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAED,6EAA6E;AAE7E,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}
+{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../../src/mcp/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAmD5C,6EAA6E;AAE7E;;;;;;;;;GASG;AACH,SAAS,QAAQ;IACf,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,eAAe;IAClB,MAAM,GAA4B,IAAI,GAAG,EAAE,CAAC;IAEpD;QACE,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,SAAS,CAAC,UAAkB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,8CAA8C;QAC9C,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,sBAAsB,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC,CAAC,wBAAwB;YACvC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,qBAAqB,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB,EAAE,MAAmB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;YAC3C,UAAU;YACV,MAAM,EAAE,EAAiB;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,iCAAiC,UAAU,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,UAAkB,EAAE,MAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAe,QAAQ;YAC/B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE;YAC5D,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,sEAAsE;IACtE,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAC7F,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC;YACpD,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,UAAkB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,UAAkB,EAClB,MAAmB;QAEnB,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QAEtC,eAAe;QACf,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;iBACjC,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,0CAA0C,CAAC;QAErF,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,gBAAgB,GAAG,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEhF,cAAc;QACd,MAAM,KAAK,GAAe;YACxB,UAAU;YACV,MAAM;YACN,YAAY;YACZ,aAAa;YACb,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,UAAkB,EAClB,iBAAyB,EACzB,aAAqB;QAErB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,0CAA0C,CAAC;QAE3F,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;SACjC,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,iBAAiB;YAC5C,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;SAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAA2B;gBACnC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACxC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;aACjC,CAAC;YAEF,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;YACjD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;aAC3C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,kCAAkC,UAAU,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;YAEF,MAAM,MAAM,GAAgB;gBAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY;gBAC7D,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;gBACtC,SAAS,EAAE,IAAI,CAAC,UAAU;oBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;oBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBACzB,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;aAC/B,CAAC;YAEF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,iCAAiC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,0BAA0B,CAC9B,UAAkB,EAClB,MAAmB;QAEnB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YACzB,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;SAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IAEhE,UAAU;QAChB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;YACnC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+B,CAAC;gBAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,GAA+B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,aAAa,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAED,6EAA6E;AAE7E,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/mcp/oauth-authorize.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `nuvira mcp authorize <server>` — the interactive half of OAuth for MCP.
+ *
+ * WHY IT EXISTS. `mcp-oauth.ts` can build an authorization URL and exchange a
+ * code, but nothing ever LISTENED for the redirect: the flow was reachable only
+ * through a tool that asked a human to paste a code back by hand, and the CLI had
+ * no way to authorize a remote server at all. So an OAuth server could be
+ * configured and never used. This module closes the loop — start a loopback
+ * server on the registered redirect URI, open the consent page, take the `code`
+ * the provider redirects with, exchange it, and store the tokens.
+ *
+ * THE REDIRECT URI IS THE CONTRACT. A provider only redirects to a URI registered
+ * on the OAuth client, so the DEFAULT (`http://localhost:3456/mcp/oauth/callback`)
+ * is stated in the printed instructions and overridable with `--redirect-uri`.
+ * Guessing a port would look like it worked and fail at the provider, which is
+ * why the URI is printed before the browser opens rather than after.
+ *
+ * The tokens land in the OAuth manager's store (never in a server config file),
+ * and the access token is refreshed silently afterwards by `oauth-connect.ts`.
+ */
+import { type OAuthConfig, type OAuthTokens } from './mcp-oauth.js';
+/** The default loopback redirect — must match the OAuth client's registered URI. */
+export declare const DEFAULT_REDIRECT_URI = "http://localhost:3456/mcp/oauth/callback";
+export interface AuthorizeOptions {
+    /** Override the redirect URI (defaults to {@link DEFAULT_REDIRECT_URI}). */
+    redirectUri?: string;
+    /** How long to wait for the user to finish consent (default 5 minutes). */
+    timeoutMs?: number;
+    /** Try to open the consent page in a browser (default true). */
+    openBrowser?: boolean;
+    /** Progress/log sink. Defaults to writing to the terminal. */
+    log?: (line: string) => void;
+    /** Test seam: how the consent URL is visited. Defaults to a browser spawn. */
+    visit?: (url: string) => void;
+}
+export type AuthorizeResult = {
+    ok: true;
+    tokens: OAuthTokens;
+    redirectUri: string;
+} | {
+    ok: false;
+    reason: string;
+    redirectUri: string;
+};
+/**
+ * Run the authorization-code flow for one server and store the resulting tokens.
+ * Resolves when the provider redirects back; rejects nothing — failures are
+ * returned as `{ ok: false, reason }` so the CLI can print them and exit non-zero.
+ */
+export declare function runAuthorizeFlow(serverName: string, oauth: OAuthConfig, options?: AuthorizeOptions): Promise<AuthorizeResult>;
+//# sourceMappingURL=oauth-authorize.d.ts.map

package/dist/mcp/oauth-authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorize.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAExF,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,6CAA6C,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBvD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA6F1B"}

package/dist/mcp/oauth-authorize.js

@@ -0,0 +1,133 @@
+/**
+ * `nuvira mcp authorize <server>` — the interactive half of OAuth for MCP.
+ *
+ * WHY IT EXISTS. `mcp-oauth.ts` can build an authorization URL and exchange a
+ * code, but nothing ever LISTENED for the redirect: the flow was reachable only
+ * through a tool that asked a human to paste a code back by hand, and the CLI had
+ * no way to authorize a remote server at all. So an OAuth server could be
+ * configured and never used. This module closes the loop — start a loopback
+ * server on the registered redirect URI, open the consent page, take the `code`
+ * the provider redirects with, exchange it, and store the tokens.
+ *
+ * THE REDIRECT URI IS THE CONTRACT. A provider only redirects to a URI registered
+ * on the OAuth client, so the DEFAULT (`http://localhost:3456/mcp/oauth/callback`)
+ * is stated in the printed instructions and overridable with `--redirect-uri`.
+ * Guessing a port would look like it worked and fail at the provider, which is
+ * why the URI is printed before the browser opens rather than after.
+ *
+ * The tokens land in the OAuth manager's store (never in a server config file),
+ * and the access token is refreshed silently afterwards by `oauth-connect.ts`.
+ */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { getMCPOAuthManager } from './mcp-oauth.js';
+/** The default loopback redirect — must match the OAuth client's registered URI. */
+export const DEFAULT_REDIRECT_URI = 'http://localhost:3456/mcp/oauth/callback';
+/** Open a URL with the OS handler, best-effort (never throws, never blocks). */
+function openInBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => undefined);
+        child.unref();
+    }
+    catch {
+        // A headless machine has no browser — the URL is already printed.
+    }
+}
+/** The tiny HTML the browser lands on, so a success does not look like a hang. */
+function respondPage(message) {
+    return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Agent-Nuvira</title></head>
+<body style="font-family: system-ui, sans-serif; margin: 3rem">
+<h1>${message}</h1><p>You can close this tab and return to the terminal.</p></body></html>`;
+}
+/**
+ * Run the authorization-code flow for one server and store the resulting tokens.
+ * Resolves when the provider redirects back; rejects nothing — failures are
+ * returned as `{ ok: false, reason }` so the CLI can print them and exit non-zero.
+ */
+export async function runAuthorizeFlow(serverName, oauth, options = {}) {
+    const redirectUri = options.redirectUri ?? oauth.redirectUri ?? DEFAULT_REDIRECT_URI;
+    const log = options.log ?? ((line) => process.stdout.write(line + '\n'));
+    const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
+    let url;
+    try {
+        url = new URL(redirectUri);
+    }
+    catch {
+        return { ok: false, redirectUri, reason: `'${redirectUri}' is not a valid redirect URI.` };
+    }
+    if (!oauth.authorizationEndpoint || !oauth.tokenEndpoint) {
+        return {
+            ok: false,
+            redirectUri,
+            reason: `'${serverName}' is missing an authorizationEndpoint or tokenEndpoint — check its oauth block.`,
+        };
+    }
+    if (!oauth.clientId) {
+        return { ok: false, redirectUri, reason: `'${serverName}' has no oauth.clientId.` };
+    }
+    const listener = createServer();
+    const manager = getMCPOAuthManager();
+    // Persist the config FIRST: the state (PKCE verifier, state param, scopes) is
+    // written by startAuthorizationCodeFlow, and a refresh later needs the config.
+    manager.setConfig(serverName, { ...oauth, redirectUri });
+    const { authorizationUrl, state } = await manager.startAuthorizationCodeFlow(serverName, {
+        ...oauth,
+        redirectUri,
+    });
+    const callbackPath = url.pathname;
+    const codePromise = new Promise((resolve) => {
+        listener.on('error', (err) => {
+            resolve({ code: '', state: '', error: `could not listen on ${redirectUri}: ${err.message}` });
+        });
+        listener.on('request', (req, res) => {
+            const requestUrl = new URL(req.url ?? '/', redirectUri);
+            if (requestUrl.pathname !== callbackPath) {
+                res.writeHead(404).end('Not the OAuth callback path.');
+                return;
+            }
+            const error = requestUrl.searchParams.get('error');
+            const code = requestUrl.searchParams.get('code') ?? '';
+            const returnedState = requestUrl.searchParams.get('state') ?? '';
+            res.writeHead(200, { 'content-type': 'text/html' }).end(respondPage(error ? `Authorization failed: ${error}` : 'Authorized — Agent-Nuvira can continue.'));
+            resolve({ code, state: returnedState, ...(error ? { error } : {}) });
+        });
+    });
+    await new Promise((resolve) => {
+        listener.listen(Number(url.port || 80), url.hostname === 'localhost' ? '127.0.0.1' : url.hostname, () => resolve());
+    });
+    log('');
+    log(`🔐 Authorizing '${serverName}' (${redirectUri} must be a registered redirect URI for this client).`);
+    log(`   If the browser does not open, visit:\n   ${authorizationUrl}`);
+    const open = options.visit ?? (options.openBrowser === false ? () => undefined : openInBrowser);
+    open(authorizationUrl);
+    const callback = await Promise.race([
+        codePromise,
+        new Promise((resolve) => {
+            const t = setTimeout(() => resolve({ code: '', state: '', error: `timed out after ${Math.round(timeoutMs / 1000)}s` }), timeoutMs);
+            t.unref?.();
+        }),
+    ]);
+    listener.close();
+    if (callback.error)
+        return { ok: false, redirectUri, reason: `Authorization failed: ${callback.error}` };
+    if (!callback.code)
+        return { ok: false, redirectUri, reason: 'The provider did not return an authorization code.' };
+    if (callback.state !== state) {
+        return { ok: false, redirectUri, reason: 'OAuth state mismatch — the response did not come from this request.' };
+    }
+    try {
+        const tokens = await manager.exchangeCode(serverName, callback.code, callback.state);
+        return { ok: true, tokens, redirectUri };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            redirectUri,
+            reason: `Token exchange failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+//# sourceMappingURL=oauth-authorize.js.map

package/dist/mcp/oauth-authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorize.js","sourceRoot":"","sources":["../../src/mcp/oauth-authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAsC,MAAM,gBAAgB,CAAC;AAExF,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAmB/E,gFAAgF;AAChF,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACvG,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;;MAEH,OAAO,8EAA8E,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAkB,EAClB,UAA4B,EAAE;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAErD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,WAAW,gCAAgC,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,IAAI,UAAU,iFAAiF;SACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,UAAU,0BAA0B,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzD,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,UAAU,EAAE;QACvF,GAAG,KAAK;QACR,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAkD,CAAC,OAAO,EAAE,EAAE;QAC3F,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,uBAAuB,WAAW,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACzC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CACrD,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAClG,CAAC;YACF,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACtH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,mBAAmB,UAAU,MAAM,WAAW,sDAAsD,CAAC,CAAC;IAC1G,GAAG,CAAC,+CAA+C,gBAAgB,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAChG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QAClC,WAAW;QACX,IAAI,OAAO,CAAiD,CAAC,OAAO,EAAE,EAAE;YACtE,MAAM,CAAC,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EACjG,SAAS,CACV,CAAC;YACF,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC;KACH,CAAC,CAAC;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEjB,IAAI,QAAQ,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,yBAAyB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACpH,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;IACnH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW;YACX,MAAM,EAAE,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACrF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/mcp/oauth-connect.d.ts

@@ -0,0 +1,53 @@
+/**
+ * OAuth for MCP servers at CONNECT time — turning a server config's `oauth`
+ * block into the `Authorization: Bearer …` header the remote server expects.
+ *
+ * WHY THIS EXISTS SEPARATELY. `mcp-oauth.ts` owns the FLOW (authorization code,
+ * PKCE, client credentials, token storage). It was reachable only through the
+ * `mcp_oauth` tool, so a remote server that authenticates with OAuth could be
+ * *configured* and never *connected*: nothing in the connect path looked for a
+ * token. This module is that missing link, and it is the difference between
+ * "we support OAuth" as a claim and as a behaviour.
+ *
+ * THE CONTRACT
+ *   1. A stored, unexpired token is used as-is (`getTokens()` already returns
+ *      null for an expired one, with its own safety buffer).
+ *   2. An expired one is REFRESHED silently — a refresh token is the whole
+ *      reason a remote MCP server keeps working across sessions.
+ *   3. `grant: 'client_credentials'` mints a token with no user involved.
+ *   4. Otherwise the failure is actionable: it names the exact command that
+ *      obtains a token, instead of surfacing as an opaque 401 from the server.
+ *
+ * Nothing here logs a token value, and no token is ever written into a server
+ * config — the credential lives in the OAuth manager's own store.
+ */
+import { type OAuthConfig } from './mcp-oauth.js';
+import type { MCPServerConfig, MCPOAuthServerConfig } from './types.js';
+export interface OAuthTokenSuccess {
+    ok: true;
+    accessToken: string;
+    tokenType: string;
+    /** Where the token came from — recorded so a trace can explain a reconnect. */
+    how: 'stored' | 'refreshed' | 'client_credentials';
+}
+export interface OAuthTokenFailure {
+    ok: false;
+    /** Why no token could be produced, phrased for the user. */
+    reason: string;
+    how: 'not_configured' | 'needs_authorization' | 'refresh_failed' | 'client_credentials_failed';
+}
+export type OAuthTokenOutcome = OAuthTokenSuccess | OAuthTokenFailure;
+/** The server config's `oauth` block in the shape `mcp-oauth` expects. */
+export declare function toOAuthConfig(oauth: MCPOAuthServerConfig): OAuthConfig;
+/**
+ * Resolve a usable access token for a server, or explain why there is none.
+ * Never throws: a connect path must be able to report a credential problem as a
+ * message rather than as a crash inside a transport.
+ */
+export declare function resolveOAuthAccessToken(config: Pick<MCPServerConfig, 'name' | 'oauth'>): Promise<OAuthTokenOutcome>;
+/** Merge an OAuth access token into a remote server's headers (explicit header wins). */
+export declare function withOAuthHeader(headers: Record<string, string> | undefined, token: {
+    accessToken: string;
+    tokenType: string;
+}): Record<string, string>;
+//# sourceMappingURL=oauth-connect.d.ts.map

package/dist/mcp/oauth-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connect.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,GAAG,EAAE,QAAQ,GAAG,WAAW,GAAG,oBAAoB,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAC;IACV,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,gBAAgB,GAAG,2BAA2B,CAAC;CAChG;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAEtE,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,WAAW,CAStE;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,iBAAiB,CAAC,CA4D5B;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC3C,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}

package/dist/mcp/oauth-connect.js

@@ -0,0 +1,103 @@
+/**
+ * OAuth for MCP servers at CONNECT time — turning a server config's `oauth`
+ * block into the `Authorization: Bearer …` header the remote server expects.
+ *
+ * WHY THIS EXISTS SEPARATELY. `mcp-oauth.ts` owns the FLOW (authorization code,
+ * PKCE, client credentials, token storage). It was reachable only through the
+ * `mcp_oauth` tool, so a remote server that authenticates with OAuth could be
+ * *configured* and never *connected*: nothing in the connect path looked for a
+ * token. This module is that missing link, and it is the difference between
+ * "we support OAuth" as a claim and as a behaviour.
+ *
+ * THE CONTRACT
+ *   1. A stored, unexpired token is used as-is (`getTokens()` already returns
+ *      null for an expired one, with its own safety buffer).
+ *   2. An expired one is REFRESHED silently — a refresh token is the whole
+ *      reason a remote MCP server keeps working across sessions.
+ *   3. `grant: 'client_credentials'` mints a token with no user involved.
+ *   4. Otherwise the failure is actionable: it names the exact command that
+ *      obtains a token, instead of surfacing as an opaque 401 from the server.
+ *
+ * Nothing here logs a token value, and no token is ever written into a server
+ * config — the credential lives in the OAuth manager's own store.
+ */
+import { getMCPOAuthManager } from './mcp-oauth.js';
+/** The server config's `oauth` block in the shape `mcp-oauth` expects. */
+export function toOAuthConfig(oauth) {
+    return {
+        clientId: oauth.clientId ?? '',
+        ...(oauth.clientSecret ? { clientSecret: oauth.clientSecret } : {}),
+        authorizationEndpoint: oauth.authorizationEndpoint ?? '',
+        tokenEndpoint: oauth.tokenEndpoint,
+        ...(oauth.scopes ? { scopes: oauth.scopes } : {}),
+        ...(oauth.usePKCE !== undefined ? { usePKCE: oauth.usePKCE } : {}),
+    };
+}
+/**
+ * Resolve a usable access token for a server, or explain why there is none.
+ * Never throws: a connect path must be able to report a credential problem as a
+ * message rather than as a crash inside a transport.
+ */
+export async function resolveOAuthAccessToken(config) {
+    const oauth = config.oauth;
+    if (!oauth?.tokenEndpoint) {
+        return {
+            ok: false,
+            how: 'not_configured',
+            reason: `'${config.name}' has no OAuth configuration (a tokenEndpoint is required).`,
+        };
+    }
+    const manager = getMCPOAuthManager();
+    // Seed the manager's per-server config so a REFRESH works in a process that
+    // never ran the interactive flow (a scheduled turn, the gateway, the
+    // dashboard) — see MCPOAuthManager.setConfig. Deliberately does NOT touch
+    // tokens: this is the how, not the credential.
+    manager.setConfig(config.name, toOAuthConfig(oauth));
+    // 1) A live token, straight from the store. `getTokens()` returns null once
+    //    the token is expired (its own 30s buffer), which is exactly the signal
+    //    that a refresh is worth attempting.
+    const stored = manager.getTokens(config.name);
+    if (stored?.accessToken) {
+        return { ok: true, accessToken: stored.accessToken, tokenType: stored.tokenType || 'Bearer', how: 'stored' };
+    }
+    // 2) Silent refresh. Returns null when there is no refresh token to use.
+    const refreshed = await manager.refreshToken(config.name);
+    if (refreshed?.accessToken) {
+        return { ok: true, accessToken: refreshed.accessToken, tokenType: refreshed.tokenType || 'Bearer', how: 'refreshed' };
+    }
+    // 3) Server-to-server, no user involved.
+    if (oauth.grant === 'client_credentials') {
+        try {
+            const minted = await manager.startClientCredentialsFlow(config.name, toOAuthConfig(oauth));
+            return {
+                ok: true,
+                accessToken: minted.accessToken,
+                tokenType: minted.tokenType || 'Bearer',
+                how: 'client_credentials',
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                how: 'client_credentials_failed',
+                reason: `'${config.name}': the client-credentials token request failed — ` +
+                    `${err instanceof Error ? err.message : String(err)}. Verify clientId/clientSecret and the token endpoint.`,
+            };
+        }
+    }
+    // 4) The honest dead end, with the one command that fixes it.
+    return {
+        ok: false,
+        how: 'needs_authorization',
+        reason: `${config.name}: no valid OAuth token. Authorize it once with \`nuvira mcp authorize ${config.name}\` ` +
+            '(afterwards it refreshes automatically), or set an explicit Authorization header in its config.',
+    };
+}
+/** Merge an OAuth access token into a remote server's headers (explicit header wins). */
+export function withOAuthHeader(headers, token) {
+    const hasAuthorization = Object.keys(headers ?? {}).some((h) => h.toLowerCase() === 'authorization');
+    if (hasAuthorization)
+        return headers ?? {};
+    return { ...(headers ?? {}), Authorization: `${token.tokenType || 'Bearer'} ${token.accessToken}` };
+}
+//# sourceMappingURL=oauth-connect.js.map

package/dist/mcp/oauth-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connect.js","sourceRoot":"","sources":["../../src/mcp/oauth-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,kBAAkB,EAAoB,MAAM,gBAAgB,CAAC;AAoBtE,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,KAA2B;IACvD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;QACxD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA+C;IAE/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,gBAAgB;YACrB,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,6DAA6D;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,+CAA+C;IAC/C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,4EAA4E;IAC5E,4EAA4E;IAC5E,yCAAyC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC/G,CAAC;IAED,yEAAyE;IACzE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,WAAW,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACxH,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;gBACvC,GAAG,EAAE,oBAAoB;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,2BAA2B;gBAChC,MAAM,EACJ,IAAI,MAAM,CAAC,IAAI,mDAAmD;oBAClE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,wDAAwD;aAC9G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,qBAAqB;QAC1B,MAAM,EACJ,GAAG,MAAM,CAAC,IAAI,yEAAyE,MAAM,CAAC,IAAI,KAAK;YACvG,iGAAiG;KACpG,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAC7B,OAA2C,EAC3C,KAAiD;IAEjD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;IACrG,IAAI,gBAAgB;QAAE,OAAO,OAAO,IAAI,EAAE,CAAC;IAC3C,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;AACtG,CAAC"}

package/dist/mcp/pin-verifier.d.ts

@@ -0,0 +1,44 @@
+/**
+ * MCP pin verifier — does a catalog's exact npm spec actually exist?
+ *
+ * Assessment §2 is the reason this exists: four of six shipped pins resolved to
+ * nothing (`@modelcontextprotocol/server-fetch` is not on npm at all;
+ * `context7@1.5.2`, `server-memory@0.3.6` and
+ * `server-sequential-thinking@0.4.2` never existed). Exact-version pinning is
+ * the right policy — it makes a stale pin visible — but nothing CHECKED it, so
+ * the failure surfaced as a stdio child that never spawns, deep in a chat turn.
+ *
+ * The check lives at the install boundary (Phase 1), not in a hot path, and it
+ * is deliberately tolerant: no network ⇒ `checked: false`, the install proceeds
+ * and REPORTS that the pin is unverified. An offline user can still configure
+ * MCP; they are simply told that verification did not happen instead of being
+ * handed a silent claim that it did.
+ *
+ * Also surfaced: npm's own `deprecated` flag for the exact version. A deprecated
+ * package that still resolves (like `@modelcontextprotocol/server-github@0.6.2`,
+ * "no longer supported") is reported, because "it installs" and "it is
+ * maintained" are different facts.
+ */
+import type { PinVerdict } from './catalog.js';
+/** Default registry lookup budget — short, because install is interactive. */
+export declare const DEFAULT_PIN_TIMEOUT_MS = 5000;
+export interface PinVerifyOptions {
+    /** Injectable fetch (tests never touch the network). */
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    /** Registry base URL (defaults to the public npm registry). */
+    registry?: string;
+}
+/** Split `@scope/name@1.2.3` → `{ name: '@scope/name', version: '1.2.3' }`. */
+export declare function parseNpmSpec(spec: string): {
+    name: string;
+    version: string;
+} | null;
+/** Verify one exact npm spec. Never throws. */
+export declare function verifyNpmSpec(spec: string, options?: PinVerifyOptions): Promise<PinVerdict>;
+/**
+ * Verify several specs in parallel (best-effort). Returns a map keyed by spec so
+ * a caller can attribute a refusal to the exact pin it came from.
+ */
+export declare function verifyNpmSpecs(specs: string[], options?: PinVerifyOptions): Promise<Map<string, PinVerdict>>;
+//# sourceMappingURL=pin-verifier.d.ts.map

package/dist/mcp/pin-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-verifier.d.ts","sourceRoot":"","sources":["../../src/mcp/pin-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUnF;AAED,+CAA+C;AAC/C,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgDrG;AASD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAGlC"}

package/dist/mcp/pin-verifier.js

@@ -0,0 +1,102 @@
+/**
+ * MCP pin verifier — does a catalog's exact npm spec actually exist?
+ *
+ * Assessment §2 is the reason this exists: four of six shipped pins resolved to
+ * nothing (`@modelcontextprotocol/server-fetch` is not on npm at all;
+ * `context7@1.5.2`, `server-memory@0.3.6` and
+ * `server-sequential-thinking@0.4.2` never existed). Exact-version pinning is
+ * the right policy — it makes a stale pin visible — but nothing CHECKED it, so
+ * the failure surfaced as a stdio child that never spawns, deep in a chat turn.
+ *
+ * The check lives at the install boundary (Phase 1), not in a hot path, and it
+ * is deliberately tolerant: no network ⇒ `checked: false`, the install proceeds
+ * and REPORTS that the pin is unverified. An offline user can still configure
+ * MCP; they are simply told that verification did not happen instead of being
+ * handed a silent claim that it did.
+ *
+ * Also surfaced: npm's own `deprecated` flag for the exact version. A deprecated
+ * package that still resolves (like `@modelcontextprotocol/server-github@0.6.2`,
+ * "no longer supported") is reported, because "it installs" and "it is
+ * maintained" are different facts.
+ */
+/** Default registry lookup budget — short, because install is interactive. */
+export const DEFAULT_PIN_TIMEOUT_MS = 5000;
+/** Split `@scope/name@1.2.3` → `{ name: '@scope/name', version: '1.2.3' }`. */
+export function parseNpmSpec(spec) {
+    const trimmed = String(spec ?? '').trim();
+    if (!trimmed)
+        return null;
+    // The version separator is the LAST '@' — the first may open a scope.
+    const at = trimmed.lastIndexOf('@');
+    if (at <= 0)
+        return null;
+    const name = trimmed.slice(0, at);
+    const version = trimmed.slice(at + 1);
+    if (!name || !version)
+        return null;
+    return { name, version };
+}
+/** Verify one exact npm spec. Never throws. */
+export async function verifyNpmSpec(spec, options = {}) {
+    const parsed = parseNpmSpec(spec);
+    if (!parsed) {
+        return { checked: false, ok: false, reason: `'${spec}' is not an exact npm spec (expected pkg@1.2.3)` };
+    }
+    const doFetch = options.fetchImpl ?? globalThis.fetch;
+    if (typeof doFetch !== 'function') {
+        return { checked: false, ok: false, reason: 'no fetch implementation available' };
+    }
+    const registry = (options.registry ?? 'https://registry.npmjs.org').replace(/\/$/, '');
+    const timeoutMs = options.timeoutMs ?? DEFAULT_PIN_TIMEOUT_MS;
+    try {
+        const response = await doFetch(`${registry}/${encodeURIComponent(parsed.name).replace('%40', '@')}`, {
+            signal: AbortSignal.timeout(timeoutMs),
+            headers: { accept: 'application/json' },
+        });
+        if (response.status === 404) {
+            return { checked: true, ok: false, reason: `npm has no package '${parsed.name}'` };
+        }
+        if (!response.ok) {
+            return { checked: false, ok: false, reason: `registry returned HTTP ${response.status}` };
+        }
+        const body = (await response.json());
+        const versions = body.versions ?? {};
+        const entry = versions[parsed.version];
+        if (!entry) {
+            return {
+                checked: true,
+                ok: false,
+                reason: `npm has no '${parsed.name}@${parsed.version}' (published: ${summarizeVersions(versions)})`,
+            };
+        }
+        const deprecated = entry.deprecated;
+        return {
+            checked: true,
+            ok: true,
+            ...(deprecated ? { deprecated: typeof deprecated === 'string' ? deprecated : 'deprecated' } : {}),
+        };
+    }
+    catch (err) {
+        return {
+            checked: false,
+            ok: false,
+            reason: `registry unreachable (${err instanceof Error ? err.message : String(err)})`,
+        };
+    }
+}
+/** A short "…1.0.34, 2.0.0" tail so a refusal says what DOES exist. */
+function summarizeVersions(versions, keep = 4) {
+    const keys = Object.keys(versions);
+    if (keys.length === 0)
+        return 'no versions published';
+    return keys.slice(-keep).join(', ');
+}
+/**
+ * Verify several specs in parallel (best-effort). Returns a map keyed by spec so
+ * a caller can attribute a refusal to the exact pin it came from.
+ */
+export async function verifyNpmSpecs(specs, options = {}) {
+    const results = await Promise.all(specs.map(async (spec) => [spec, await verifyNpmSpec(spec, options)]));
+    return new Map(results);
+}
+//# sourceMappingURL=pin-verifier.js.map

package/dist/mcp/pin-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-verifier.js","sourceRoot":"","sources":["../../src/mcp/pin-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAU3C,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,sEAAsE;IACtE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,UAA4B,EAAE;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,iDAAiD,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACtD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,4BAA4B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE;YACnG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACtC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,iBAAiB,iBAAiB,CAAC,QAAQ,CAAC,GAAG;aACpG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,IAAI;YACR,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;SACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,iBAAiB,CAAC,QAAiC,EAAE,IAAI,GAAG,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACtD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAe,EACf,UAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAU,CAAC,CAAC,CAAC;IAClH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC"}