brains-mcp 1.61.2

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,MAAM,CAAC;IAC/E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,aAAa;IACrB,SAAS,EAAE,QAAQ,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,kBAAkB;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAsID,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;gBAEpD,KAAK,EAAE,UAAU,EAAE,WAAW,GAAE,WAAW,GAAG,IAAW;IAcrE,SAAS,IAAI,OAAO;IAIpB,cAAc,IAAI,OAAO;IAIzB,OAAO,CAAC,sBAAsB;IAI9B,WAAW,IAAI,iBAAiB,EAAE;IAIlC,2BAA2B,IAAI,KAAK,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IAQlF,gBAAgB,IAAI,iBAAiB,EAAE;YAOzB,UAAU;IAgBlB,wBAAwB,CAAC,KAAK,EAAE;QACpC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,iBAAiB,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCrE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4CvE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B3H,sBAAsB,CAAC,KAAK,EAAE;QAClC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBb,yBAAyB,CAAC,KAAK,EAAE;QACrC,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+CpB,kBAAkB,CAAC,KAAK,EAAE;QAC9B,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyBpB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoBhF,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIxC;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,KAAK,EAAE;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;YAqCH,WAAW;IAgCnB,qBAAqB,CAAC,KAAK,EAAE;QACjC,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAwDzJ"}

package/dist/auth/oauth.js

@@ -0,0 +1,491 @@
+import crypto from "crypto";
+const AUTH_CODE_TTL_MS = 5 * 60 * 1000;
+const ACCESS_TOKEN_TTL_MS = 8 * 60 * 60 * 1000;
+const REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const AUTH_CACHE_TTL_MS = 60 * 1000;
+function randomToken(prefix) {
+    return `${prefix}_${crypto.randomBytes(24).toString("base64url")}`;
+}
+function sha256Base64Url(input) {
+    return crypto.createHash("sha256").update(input, "utf8").digest("base64url");
+}
+function parseScopes(scope, fallback) {
+    if (!scope || !scope.trim())
+        return [...fallback];
+    return scope
+        .split(/\s+/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+function parseClientConfig() {
+    const legacyClientId = process.env.BRAINS_OAUTH_CLIENT_ID;
+    const legacyClientSecret = process.env.BRAINS_OAUTH_CLIENT_SECRET;
+    const legacyRedirectUri = process.env.BRAINS_OAUTH_REDIRECT_URI;
+    if (legacyClientId && legacyClientSecret && legacyRedirectUri) {
+        return [
+            {
+                clientId: legacyClientId,
+                clientSecret: legacyClientSecret,
+                tokenEndpointAuthMethod: "client_secret_post",
+                redirectUris: legacyRedirectUri.split(",").map((s) => s.trim()).filter(Boolean),
+                scopes: ["wiki.read", "wiki.write"],
+            },
+        ];
+    }
+    const raw = process.env.BRAINS_OAUTH_CLIENTS;
+    if (!raw || !raw.trim())
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed
+            .map((entry) => {
+            const item = entry;
+            const clientId = typeof item.clientId === "string" ? item.clientId : "";
+            const clientSecret = typeof item.clientSecret === "string" ? item.clientSecret : "";
+            const isPublicClient = item.publicClient === true;
+            const redirectUris = Array.isArray(item.redirectUris)
+                ? item.redirectUris.filter((v) => typeof v === "string")
+                : [];
+            const scopes = Array.isArray(item.scopes)
+                ? item.scopes.filter((v) => typeof v === "string")
+                : ["wiki.read", "wiki.write"];
+            const tokenEndpointAuthMethod = isPublicClient
+                ? "none"
+                : "client_secret_post";
+            return {
+                clientId,
+                clientSecret: clientSecret || undefined,
+                tokenEndpointAuthMethod,
+                redirectUris,
+                scopes,
+            };
+        })
+            .filter((c) => c.clientId && c.redirectUris.length > 0)
+            .filter((c) => c.tokenEndpointAuthMethod === "none" || Boolean(c.clientSecret));
+    }
+    catch {
+        return [];
+    }
+}
+// Per RFC 8252 §7.3: loopback redirect URIs must match ignoring port.
+// Registered URIs ending with /* allow path-prefix matching on the same HTTPS origin.
+// This covers platforms (e.g. ChatGPT) that generate a unique callback path per integration
+// while sharing a common host/path prefix.
+function isRedirectUriAllowed(registered, requested) {
+    if (registered.includes(requested))
+        return true;
+    // Wildcard prefix matching for HTTPS URIs only.
+    // A registered value like "https://chat.openai.com/aip/*" matches any URI
+    // that begins with "https://chat.openai.com/aip/" on the same origin.
+    for (const r of registered) {
+        if (r.endsWith("/*")) {
+            const prefix = r.slice(0, -1); // drop trailing *
+            if (requested.startsWith(prefix)) {
+                try {
+                    const regUrl = new URL(prefix);
+                    const reqUrl = new URL(requested);
+                    if (regUrl.protocol === "https:" && regUrl.origin === reqUrl.origin) {
+                        return true;
+                    }
+                }
+                catch {
+                    // not a valid URL pair — continue
+                }
+            }
+        }
+    }
+    try {
+        const req = new URL(requested);
+        const isLoopback = req.protocol === "http:" &&
+            (req.hostname === "127.0.0.1" || req.hostname === "localhost");
+        if (!isLoopback)
+            return false;
+        return registered.some((r) => {
+            try {
+                const reg = new URL(r);
+                return (reg.protocol === "http:" &&
+                    (reg.hostname === "127.0.0.1" || reg.hostname === "localhost") &&
+                    reg.pathname === req.pathname);
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return false;
+    }
+}
+export class OAuthManager {
+    clients = new Map();
+    loginUser;
+    loginPassword;
+    supabaseUrl;
+    supabaseAnonKey;
+    store;
+    clientStore;
+    authCache = new Map();
+    constructor(store, clientStore = null) {
+        this.store = store;
+        this.clientStore = clientStore;
+        for (const client of parseClientConfig()) {
+            this.clients.set(client.clientId, client);
+        }
+        this.loginUser = process.env.BRAINS_OAUTH_USER ?? "owner";
+        this.loginPassword = process.env.BRAINS_OAUTH_PASSWORD ?? "";
+        this.supabaseUrl = (process.env.SUPABASE_URL ?? "").trim().replace(/\/$/, "");
+        this.supabaseAnonKey = (process.env.SUPABASE_ANON_KEY ?? "").trim();
+    }
+    isEnabled() {
+        return this.clients.size > 0 && (this.loginPassword.length > 0 || this.hasSupabaseLoginConfig());
+    }
+    hasLoginConfig() {
+        return this.loginPassword.length > 0 || this.hasSupabaseLoginConfig();
+    }
+    hasSupabaseLoginConfig() {
+        return this.supabaseUrl.length > 0 && this.supabaseAnonKey.length > 0;
+    }
+    listClients() {
+        return Array.from(this.clients.values()).map((c) => ({ ...c }));
+    }
+    getTokenEndpointAuthMethods() {
+        const methods = new Set();
+        for (const client of this.clients.values()) {
+            methods.add(client.tokenEndpointAuthMethod);
+        }
+        return Array.from(methods);
+    }
+    getClientConfigs() {
+        return Array.from(this.clients.values());
+    }
+    // Lookup a client_id, falling back to the persisted DCR store when the
+    // in-memory Map doesn't have it (i.e. after a process restart). Hydrates
+    // back into the Map so subsequent lookups in the same process are O(1).
+    async findClient(clientId) {
+        const cached = this.clients.get(clientId);
+        if (cached)
+            return cached;
+        if (!this.clientStore)
+            return undefined;
+        const stored = await this.clientStore.find(clientId);
+        if (!stored)
+            return undefined;
+        const config = {
+            clientId: stored.clientId,
+            tokenEndpointAuthMethod: "none",
+            redirectUris: [...stored.redirectUris],
+            scopes: [...stored.scopes],
+        };
+        this.clients.set(clientId, config);
+        return config;
+    }
+    async validateAuthorizeRequest(input) {
+        if (input.responseType !== "code") {
+            throw new Error("Unsupported response_type. Only 'code' is allowed.");
+        }
+        const client = await this.findClient(input.clientId);
+        if (!client) {
+            throw new Error("Unknown client_id");
+        }
+        if (!isRedirectUriAllowed(client.redirectUris, input.redirectUri)) {
+            throw new Error("redirect_uri is not registered for this client");
+        }
+        const requestedScopes = parseScopes(input.scope, client.scopes);
+        for (const scope of requestedScopes) {
+            if (!client.scopes.includes(scope)) {
+                throw new Error(`Invalid scope requested: ${scope}`);
+            }
+        }
+        if (input.codeChallengeMethod && input.codeChallengeMethod !== "S256" && input.codeChallengeMethod !== "plain") {
+            throw new Error("Unsupported code_challenge_method");
+        }
+        if (input.codeChallenge && !input.codeChallengeMethod) {
+            throw new Error("code_challenge_method is required when code_challenge is provided");
+        }
+        return { client, scope: requestedScopes, state: input.state };
+    }
+    async verifyLogin(username, password) {
+        if (!this.isEnabled())
+            return null;
+        if (this.loginPassword.length > 0 && username === this.loginUser && password === this.loginPassword) {
+            return process.env.BRAINS_OAUTH_SUBJECT?.trim() || username;
+        }
+        if (!this.hasSupabaseLoginConfig()) {
+            console.error("[oauth] verifyLogin: no Supabase config (SUPABASE_URL/SUPABASE_ANON_KEY not set)");
+            return null;
+        }
+        const response = await fetch(`${this.supabaseUrl}/auth/v1/token?grant_type=password`, {
+            method: "POST",
+            headers: {
+                apikey: this.supabaseAnonKey,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                email: username,
+                password,
+            }),
+        }).catch((err) => {
+            console.error("[oauth] Supabase auth fetch failed:", err instanceof Error ? err.message : String(err));
+            return null;
+        });
+        if (!response) {
+            return null;
+        }
+        if (!response.ok) {
+            const errBody = await response.json().catch(() => null);
+            const detail = errBody?.error_description ?? errBody?.msg ?? `HTTP ${response.status}`;
+            console.error(`[oauth] Supabase auth rejected: ${detail}`);
+            return null;
+        }
+        const payload = (await response.json().catch(() => null));
+        return payload?.user?.id ?? payload?.user?.email ?? username;
+    }
+    async signUpWithEmail(email, password, redirectTo) {
+        if (!this.hasSupabaseLoginConfig()) {
+            return { ok: false, error: "Email sign-up is not available (Supabase not configured)" };
+        }
+        const signupUrl = new URL(`${this.supabaseUrl}/auth/v1/signup`);
+        if (redirectTo)
+            signupUrl.searchParams.set("redirect_to", redirectTo);
+        const response = await fetch(signupUrl.toString(), {
+            method: "POST",
+            headers: {
+                apikey: this.supabaseAnonKey,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ email, password }),
+        }).catch(() => null);
+        if (!response) {
+            return { ok: false, error: "Could not reach the auth service. Try again." };
+        }
+        if (!response.ok) {
+            const body = (await response.json().catch(() => null));
+            const msg = body?.msg ?? body?.message ?? "Sign-up failed. Check your email and password.";
+            return { ok: false, error: msg };
+        }
+        return { ok: true };
+    }
+    async issueAuthorizationCode(input) {
+        void this.store.pruneExpired().catch(() => { });
+        const code = randomToken("code");
+        await this.store.save({
+            type: "auth_code",
+            token: code,
+            clientId: input.clientId,
+            redirectUri: input.redirectUri,
+            scope: [...input.scope],
+            subject: input.subject,
+            codeChallenge: input.codeChallenge,
+            codeChallengeMethod: input.codeChallengeMethod,
+            expiresAt: Date.now() + AUTH_CODE_TTL_MS,
+        });
+        return code;
+    }
+    async exchangeAuthorizationCode(input) {
+        void this.store.pruneExpired().catch(() => { });
+        const record = await this.store.find("auth_code", input.code);
+        if (!record) {
+            throw new Error("Invalid or expired authorization code");
+        }
+        const client = await this.findClient(input.clientId);
+        if (!client) {
+            throw new Error("Unknown client_id");
+        }
+        if (client.tokenEndpointAuthMethod === "none") {
+            if (!record.codeChallenge) {
+                throw new Error("Public clients require PKCE-enabled authorization requests");
+            }
+        }
+        else if (client.clientSecret !== input.clientSecret) {
+            throw new Error("Invalid client credentials");
+        }
+        if (record.clientId !== input.clientId) {
+            throw new Error("authorization code was not issued to this client");
+        }
+        if (record.redirectUri !== input.redirectUri) {
+            throw new Error("redirect_uri mismatch");
+        }
+        if (record.codeChallenge) {
+            if (!input.codeVerifier) {
+                throw new Error("code_verifier required");
+            }
+            const expected = record.codeChallengeMethod === "plain"
+                ? input.codeVerifier
+                : sha256Base64Url(input.codeVerifier);
+            if (expected !== record.codeChallenge) {
+                throw new Error("Invalid code_verifier");
+            }
+        }
+        await this.store.delete("auth_code", input.code);
+        return await this.issueTokens(record.clientId, record.subject, record.scope);
+    }
+    async refreshAccessToken(input) {
+        void this.store.pruneExpired().catch(() => { });
+        const refresh = await this.store.find("refresh_token", input.refreshToken);
+        if (!refresh) {
+            throw new Error("Invalid or expired refresh_token");
+        }
+        if (refresh.clientId !== input.clientId) {
+            throw new Error("refresh_token client mismatch");
+        }
+        const client = await this.findClient(input.clientId);
+        if (!client) {
+            throw new Error("Unknown client_id");
+        }
+        if (client.tokenEndpointAuthMethod !== "none" && client.clientSecret !== input.clientSecret) {
+            throw new Error("Invalid client credentials");
+        }
+        await this.store.delete("refresh_token", input.refreshToken);
+        return await this.issueTokens(refresh.clientId, refresh.subject, refresh.scope);
+    }
+    async authenticateAccessToken(token) {
+        const now = Date.now();
+        const cached = this.authCache.get(token);
+        if (cached && cached.expiresAt > now)
+            return cached.result;
+        const record = await this.store.find("access_token", token);
+        if (!record) {
+            this.authCache.delete(token);
+            return null;
+        }
+        const result = {
+            subject: record.subject,
+            clientId: record.clientId,
+            scopes: [...record.scope],
+        };
+        this.authCache.set(token, { expiresAt: now + AUTH_CACHE_TTL_MS, result });
+        return result;
+    }
+    invalidateAuthCache(token) {
+        this.authCache.delete(token);
+    }
+    /**
+     * Revoke a token per RFC 7009.
+     *
+     * Accepts either an access_token or refresh_token.  Uses `tokenTypeHint`
+     * to try the likely type first, then falls back to the other.  Always
+     * returns `ok: true` — callers must not reveal whether a token existed.
+     *
+     * For confidential clients, `clientId` + `clientSecret` must match the
+     * registered client.  For public clients (PKCE), only `clientId` is needed.
+     *
+     * Returns `{ ok: true }` on success.
+     * Throws if `clientId` is unknown or credentials are invalid.
+     */
+    async revokeToken(input) {
+        const client = await this.findClient(input.clientId);
+        if (!client) {
+            throw new Error("Unknown client_id");
+        }
+        if (client.tokenEndpointAuthMethod !== "none" && client.clientSecret !== input.clientSecret) {
+            throw new Error("Invalid client credentials");
+        }
+        // Determine lookup order based on hint (RFC 7009 §2.1)
+        const hint = input.tokenTypeHint;
+        const order = hint === "refresh_token"
+            ? ["refresh_token", "access_token"]
+            : ["access_token", "refresh_token"];
+        this.authCache.delete(input.token);
+        for (const tokenType of order) {
+            const record = await this.store.find(tokenType, input.token);
+            if (record) {
+                await this.store.delete(tokenType, input.token);
+                // RFC 7009 §2: revoking a refresh token also invalidates all derived access tokens
+                if (tokenType === "refresh_token") {
+                    for (const [cachedToken, entry] of this.authCache) {
+                        if (entry.result.subject === record.subject && entry.result.clientId === record.clientId) {
+                            this.authCache.delete(cachedToken);
+                        }
+                    }
+                    await this.store.deleteAllForSubject(record.subject, record.clientId, "access_token");
+                }
+                return;
+            }
+        }
+        // Token not found — silently succeed per RFC 7009 §2.2
+    }
+    async issueTokens(clientId, subject, scope) {
+        const accessToken = randomToken("atk");
+        const refreshToken = randomToken("rtk");
+        await Promise.all([
+            this.store.save({
+                type: "access_token",
+                token: accessToken,
+                clientId,
+                subject,
+                scope: [...scope],
+                expiresAt: Date.now() + ACCESS_TOKEN_TTL_MS,
+            }),
+            this.store.save({
+                type: "refresh_token",
+                token: refreshToken,
+                clientId,
+                subject,
+                scope: [...scope],
+                expiresAt: Date.now() + REFRESH_TOKEN_TTL_MS,
+            }),
+        ]);
+        return {
+            tokenType: "Bearer",
+            accessToken,
+            expiresIn: Math.floor(ACCESS_TOKEN_TTL_MS / 1000),
+            refreshToken,
+            scope: scope.join(" "),
+        };
+    }
+    async registerDynamicClient(input) {
+        if (!Array.isArray(input.redirectUris) || input.redirectUris.length === 0) {
+            throw new Error("redirect_uris is required and must be a non-empty array");
+        }
+        const ALLOWED_HTTPS_REDIRECT_HOSTS = new Set([
+            "vscode.dev",
+            "chatgpt.com",
+            "chat.openai.com",
+            "claude.ai",
+        ]);
+        for (const uri of input.redirectUris) {
+            try {
+                const u = new URL(uri);
+                const isLoopback = (u.protocol === "http:" || u.protocol === "https:") &&
+                    (u.hostname === "127.0.0.1" || u.hostname === "localhost");
+                const isCustomScheme = u.protocol !== "http:" && u.protocol !== "https:";
+                const isAllowedHttpsHost = u.protocol === "https:" && ALLOWED_HTTPS_REDIRECT_HOSTS.has(u.hostname);
+                if (!isLoopback && !isCustomScheme && !isAllowedHttpsHost) {
+                    throw new Error(`redirect_uri must be a loopback, custom-scheme, or approved redirect URI: ${uri}`);
+                }
+            }
+            catch (e) {
+                if (e instanceof Error && e.message.startsWith("redirect_uri"))
+                    throw e;
+                throw new Error(`Invalid redirect_uri: ${uri}`);
+            }
+        }
+        const clientId = randomToken("mcpsrv");
+        const config = {
+            clientId,
+            tokenEndpointAuthMethod: "none",
+            redirectUris: [...input.redirectUris],
+            scopes: ["wiki.read", "wiki.write"],
+        };
+        this.clients.set(clientId, config);
+        if (this.clientStore) {
+            await this.clientStore.save({
+                clientId,
+                redirectUris: config.redirectUris,
+                scopes: config.scopes,
+                createdAt: Date.now(),
+            });
+        }
+        return {
+            clientId,
+            redirectUris: config.redirectUris,
+            tokenEndpointAuthMethod: "none",
+            grantTypes: ["authorization_code", "refresh_token"],
+            responseTypes: ["code"],
+            scope: config.scopes.join(" "),
+        };
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AA0B5B,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAOpC,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB,EAAE,QAAkB;IAChE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAClD,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC1D,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAClE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAEhE,IAAI,cAAc,IAAI,kBAAkB,IAAI,iBAAiB,EAAE,CAAC;QAC9D,OAAO;YACL;gBACE,QAAQ,EAAE,cAAc;gBACxB,YAAY,EAAE,kBAAkB;gBAChC,uBAAuB,EAAE,oBAAoB;gBAC7C,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC/E,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAEtC,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,KAAgC,CAAC;YAC9C,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;YAClD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACrE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAC/D,CAAC,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEhC,MAAM,uBAAuB,GAAiD,cAAc;gBAC1F,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,oBAAoB,CAAC;YAEzB,OAAO;gBACL,QAAQ;gBACR,YAAY,EAAE,YAAY,IAAI,SAAS;gBACvC,uBAAuB;gBACvB,YAAY;gBACZ,MAAM;aACP,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,sFAAsF;AACtF,4FAA4F;AAC5F,2CAA2C;AAC3C,SAAS,oBAAoB,CAAC,UAAoB,EAAE,SAAiB;IACnE,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,gDAAgD;IAChD,0EAA0E;IAC1E,sEAAsE;IACtE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACjD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;oBAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kCAAkC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,UAAU,GACd,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvB,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;oBACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;oBAC9D,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAC9B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACN,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC/C,SAAS,CAAS;IAClB,aAAa,CAAS;IACtB,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,KAAK,CAAa;IAClB,WAAW,CAAqB;IAChC,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEhE,YAAY,KAAiB,EAAE,cAAkC,IAAI;QACnE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACxE,CAAC;IAEO,sBAAsB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,2BAA2B;QACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgD,CAAC;QACxE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,gBAAgB;QACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IAChE,KAAK,CAAC,UAAU,CAAC,QAAgB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,MAAM,GAAsB;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,uBAAuB,EAAE,MAAM;YAC/B,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;SAC3B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,OAAO,EAAE,CAAC;YAC/G,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,QAAgB;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpG,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,oCAAoC,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,eAAe;gBAC5B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,QAAQ;gBACf,QAAQ;aACT,CAAC;SACH,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvG,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAwD,CAAC;YAC/G,MAAM,MAAM,GAAG,OAAO,EAAE,iBAAiB,IAAI,OAAO,EAAE,GAAG,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvF,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAEhD,CAAC;QAET,OAAO,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAmB;QACxE,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,iBAAiB,CAAC,CAAC;QAChE,IAAI,UAAU;YAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,eAAe;gBAC5B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8C,CAAC;YACpG,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,OAAO,IAAI,gDAAgD,CAAC;YAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACnC,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAO5B;QACC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACpB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB;SACzC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,KAM/B;QACC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,KAAK,OAAO;gBACrD,CAAC,CAAC,KAAK,CAAC,YAAY;gBACpB,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAExC,IAAI,QAAQ,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAIxB;QACC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAuB;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;SAC1B,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mBAAmB,CAAC,KAAa;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,WAAW,CAAC,KAKjB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;QACjC,MAAM,KAAK,GACT,IAAI,KAAK,eAAe;YACtB,CAAC,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC;YACnC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAExC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChD,mFAAmF;gBACnF,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;oBAClC,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBAClD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;4BACzF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBACrC,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;QACD,uDAAuD;IACzD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAe;QAC1E,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,WAAW;gBAClB,QAAQ;gBACR,OAAO;gBACP,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;aAC5C,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,OAAO;gBACP,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;aAC7C,CAAC;SACH,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACjD,YAAY;YACZ,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAO3B;QACC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;YAC3C,YAAY;YACZ,aAAa;YACb,iBAAiB;YACjB,WAAW;SACZ,CAAC,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,UAAU,GACd,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;oBACnD,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;gBAC7D,MAAM,cAAc,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBACzE,MAAM,kBAAkB,GACtB,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,6EAA6E,GAAG,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAsB;YAChC,QAAQ;YACR,uBAAuB,EAAE,MAAM;YAC/B,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACrC,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;SACpC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;gBAC1B,QAAQ;gBACR,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,uBAAuB,EAAE,MAAM;YAC/B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACnD,aAAa,EAAE,CAAC,MAAM,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/patStore.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Personal Access Token (PAT) store.
+ *
+ * PATs are long-lived, user-scoped bearer tokens meant for CLI / local-first
+ * workflows where re-authenticating every hour is impractical.  They are
+ * distinct from the short-lived Supabase JWTs and the workspace-wide
+ * BRAINS_API_KEY — each PAT is tied to the Supabase/OAuth user who minted it
+ * and is stored alongside their wiki content under `users/<subject>/`.
+ *
+ * Two backends, auto-selected (mirrors createTokenStore):
+ *   - LocalSQLitePATStore  — adds a `pats` table to the existing oauth-tokens
+ *     SQLite database. Good for single-instance / local runs.
+ *   - PostgresPATStore     — PostgREST-backed, stored in a `pats` table.
+ *     Requires scripts/pats.sql to be applied once.
+ *
+ * expires_at is nullable — NULL means the token never expires.
+ */
+export declare const PAT_EXPIRY_DAYS_DEFAULT = 30;
+export declare const PAT_EXPIRY_DAYS_MAX = 365;
+export interface PAT {
+    id: string;
+    subject: string;
+    label: string;
+    scopes: string[];
+    expiresAt: number | null;
+    createdAt: number;
+}
+export interface PATWithToken extends PAT {
+    token: string;
+}
+export interface PATStore {
+    /** Mint a new PAT; returns the record including the raw token (only time it's visible). */
+    create(subject: string, label: string, scopes: string[], expiresAt: number | null): Promise<PATWithToken>;
+    /** Validate a bearer token; returns the PAT metadata or null if invalid/expired. */
+    find(token: string): Promise<PAT | null>;
+    /** List all non-expired PATs for a subject (token value is never returned). */
+    list(subject: string): Promise<PAT[]>;
+    /** Revoke a PAT by id. Returns true if deleted, false if not found or subject mismatch. */
+    revoke(id: string, subject: string): Promise<boolean>;
+    /** Prune expired PATs (called periodically). Never-expiring tokens are not pruned. */
+    pruneExpired(): Promise<void>;
+}
+export declare class LocalSQLitePATStore implements PATStore {
+    private readonly db;
+    constructor(storageLocation: string);
+    private initSchema;
+    /** Migrate existing tables that have NOT NULL on expires_at to allow NULL. */
+    private migrateNullableExpiry;
+    create(subject: string, label: string, scopes: string[], expiresAt: number | null): Promise<PATWithToken>;
+    find(token: string): Promise<PAT | null>;
+    list(subject: string): Promise<PAT[]>;
+    revoke(id: string, subject: string): Promise<boolean>;
+    pruneExpired(): Promise<void>;
+}
+export declare class PostgresPATStore implements PATStore {
+    private readonly supabaseUrl;
+    private readonly serviceRoleKey;
+    /**
+     * Validation cache, keyed by raw token.
+     *
+     * find() runs on every bearer-authenticated request and was an uncached
+     * Supabase round trip — ~175ms, measured (GH #427). Worse, PATs are
+     * indistinguishable from OAuth tokens (both opaque hex), so PAT lookup runs
+     * first and every OAuth/MCP request paid that round trip for a query
+     * guaranteed to miss. Negative results are therefore cached too; that is
+     * where most of the saving is.
+     *
+     * Revocation stays immediate: revoke() and pruneExpired() clear the cache,
+     * and create() seeds it. Only out-of-band changes (direct SQL) wait out the
+     * TTL — the same tradeoff auth/supabase.ts already accepts.
+     */
+    private readonly cache;
+    constructor(supabaseUrl: string, serviceRoleKey: string);
+    private cacheTtlMs;
+    private cacheSet;
+    /** Drop all cached validations. Called whenever a PAT is revoked or pruned. */
+    invalidateCache(): void;
+    private get baseUrl();
+    private headers;
+    create(subject: string, label: string, scopes: string[], expiresAt: number | null): Promise<PATWithToken>;
+    find(token: string): Promise<PAT | null>;
+    list(subject: string): Promise<PAT[]>;
+    revoke(id: string, subject: string): Promise<boolean>;
+    pruneExpired(): Promise<void>;
+}
+export declare function createPATStore(storageLocation: string): PATStore;
+//# sourceMappingURL=patStore.d.ts.map

package/dist/auth/patStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patStore.d.ts","sourceRoot":"","sources":["../../src/auth/patStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAa,SAAQ,GAAG;IACvC,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,QAAQ;IACvB,2FAA2F;IAC3F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1G,oFAAoF;IACpF,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACzC,+EAA+E;IAC/E,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,sFAAsF;IACtF,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAcD,qBAAa,mBAAoB,YAAW,QAAQ;IAClD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;gBAE3B,eAAe,EAAE,MAAM;IAUnC,OAAO,CAAC,UAAU;IAkBlB,8EAA8E;IAC9E,OAAO,CAAC,qBAAqB;IAgCvB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAqBzG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAQxC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IASrC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOrD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGpC;AA0BD,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsD;gBAEhE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;IAKvD,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,QAAQ;IAQhB,+EAA+E;IAC/E,eAAe,IAAI,IAAI;IAIvB,OAAO,KAAK,OAAO,GAElB;IAED,OAAO,CAAC,OAAO;IAUT,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBzG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IA4BxC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IASrC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAarD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAMpC;AAID,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,QAAQ,CAOhE"}