dodo-mcp 1.0.0

package/dist/auth/interactions.js

@@ -0,0 +1,184 @@
+import { Router } from 'express';
+import { phraseFor } from '../util/hash.js';
+import { ALL_SCOPES } from '../security/policy.js';
+import { INSTALLATION_AUTHORITY_EPOCH, INSTALLATION_AUTHORITY_ID, OWNER_ACCOUNT_ID } from './constants.js';
+import { isPersonalMode } from '../security/accessMode.js';
+/**
+ * Owner-consent interactions (spec §8.4).
+ *
+ * Flow: OAuth client starts → provider creates an interaction bound to the
+ * BROWSER session cookie → the page shows a request id + phrase → the owner
+ * verifies details on the terminal (`dodo auth pending`) and approves over
+ * the private IPC socket (`dodo auth approve -- <id>`) → the SAME browser
+ * session completes the interaction (custom-header + SameSite protected) →
+ * the provider issues the code to the registered exact redirect URI.
+ *
+ * The public listener has NO endpoint that approves an interaction from a
+ * request id alone: approval state changes only over local IPC, and the
+ * complete endpoint requires the provider's own session cookie.
+ */
+const MAX_PENDING_OAUTH = 20;
+export const OAUTH_INTERACTION_TTL_MS = 5 * 60 * 1000;
+export function interactionRouter(opts) {
+    const { provider, store } = opts;
+    const authority = { workspaceId: INSTALLATION_AUTHORITY_ID, epoch: INSTALLATION_AUTHORITY_EPOCH };
+    const router = Router();
+    router.get('/interaction/:uid', async (req, res) => {
+        try {
+            const details = await provider.interactionDetails(req, res);
+            const params = details.params;
+            const clientId = String(params['client_id'] ?? '');
+            if (!store.getOAuthClient(clientId))
+                throw new Error('unknown client');
+            const redirectUri = String(params['redirect_uri'] ?? '');
+            const requested = typeof params['scope'] === 'string' ? params['scope'].split(' ').filter(Boolean) : [];
+            const scopes = requested.filter((s) => ALL_SCOPES.includes(s));
+            const effectiveScopes = scopes.length > 0 ? scopes : [...ALL_SCOPES];
+            const { workspaceId, epoch } = authority;
+            const existing = store.getApproval(details.uid);
+            if (existing && (existing.workspaceId !== workspaceId || existing.epoch !== epoch)) {
+                res.status(400).send('Workspace changed; start a fresh authorization request.');
+                return;
+            }
+            if (!existing) {
+                if (store.listPendingApprovals('oauth').length >= MAX_PENDING_OAUTH) {
+                    res.status(429).type('text/plain').send('Too many pending authorization requests. Try again later.');
+                    return;
+                }
+                const summary = {
+                    clientId,
+                    redirectUri,
+                    scopes: effectiveScopes,
+                    phrase: phraseFor(details.uid),
+                };
+                store.createApproval({
+                    kind: 'oauth',
+                    workspaceId,
+                    epoch,
+                    id: details.uid,
+                    summary: JSON.stringify(summary),
+                    ttlMs: OAUTH_INTERACTION_TTL_MS,
+                });
+            }
+            res
+                .status(200)
+                .type('html')
+                .setHeader('Cache-Control', 'no-store')
+                .setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'")
+                .send(interactionPage(details.uid, phraseFor(details.uid), clientId, effectiveScopes, isPersonalMode(store)));
+        }
+        catch {
+            res.status(400).type('text/plain').send('Unknown or expired authorization request.');
+        }
+    });
+    router.get('/interaction/:uid/status', async (req, res) => {
+        try {
+            const details = await provider.interactionDetails(req, res); // session-cookie bound
+            const approval = store.getApproval(details.uid);
+            res.setHeader('Cache-Control', 'no-store').json({ status: approval?.status ?? 'pending' });
+        }
+        catch {
+            res.status(400).json({ status: 'unknown' });
+        }
+    });
+    router.post('/interaction/:uid/complete', async (req, res) => {
+        try {
+            const details = await provider.interactionDetails(req, res); // session-cookie bound
+            // Cross-site form posts cannot set custom headers; require one.
+            if (req.headers['x-dodo-interaction'] !== details.uid) {
+                res.status(403).json({ error: 'bad interaction header' });
+                return;
+            }
+            const { workspaceId, epoch } = authority;
+            const approval = store.getApproval(details.uid);
+            if (!approval || approval.kind !== 'oauth' || approval.workspaceId !== workspaceId || approval.epoch !== epoch || approval.status !== 'approved') {
+                res.status(403).json({ error: 'not approved' });
+                return;
+            }
+            if (!store.setApprovalStatus(details.uid, 'consumed')) {
+                res.status(403).json({ error: 'approval expired' });
+                return;
+            }
+            const summary = JSON.parse(approval.summary);
+            const params = details.params;
+            const clientId = String(params['client_id'] ?? '');
+            if (clientId !== summary.clientId || !store.getOAuthClient(clientId)) {
+                res.status(403).json({ error: 'client mismatch' });
+                return;
+            }
+            const grant = new provider.Grant({ accountId: OWNER_ACCOUNT_ID, clientId });
+            // Grant at both levels: OIDC scope satisfies the authorization request's
+            // `scope` param; resource scope binds the token audience to /mcp.
+            // OIDC clients request openid in addition to resource permissions. It
+            // must be consented at the OIDC level or the provider prompts forever.
+            // Never add it to the workspace's resource permissions.
+            const requestedScopes = typeof params['scope'] === 'string' ? params['scope'].split(/\s+/) : [];
+            const oidcScopes = [...summary.scopes, 'offline_access'];
+            if (requestedScopes.includes('openid'))
+                oidcScopes.push('openid');
+            grant.addOIDCScope(oidcScopes.join(' '));
+            grant.addResourceScope(opts.resourceUrl, summary.scopes.join(' '));
+            const grantId = await grant.save();
+            // Deletion may run while provider persistence yields. Never recreate ACLs.
+            if (!store.getOAuthClient(clientId)) {
+                await grant.destroy();
+                throw new Error('client was deleted');
+            }
+            store.putGrant({
+                id: grantId,
+                workspaceId,
+                clientId,
+                accountId: OWNER_ACCOUNT_ID,
+                scopes: summary.scopes,
+            });
+            store.setMeta(`identity-grant:${grantId}`, '2');
+            const returnTo = await provider.interactionResult(req, res, { login: { accountId: OWNER_ACCOUNT_ID }, consent: { grantId } }, { mergeWithLastSubmission: false });
+            res.setHeader('Cache-Control', 'no-store').json({ returnTo });
+        }
+        catch {
+            res.status(400).json({ error: 'interaction failed' });
+        }
+    });
+    return router;
+}
+function interactionPage(uid, phrase, clientId, scopes, personal) {
+    const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+    return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>DODO authorization</title>
+<body style="font-family:system-ui;max-width:38rem;margin:3rem auto;line-height:1.5;padding:0 1rem">
+<h1 style="font-size:1.4rem">Authorize this connection on your terminal</h1>
+<p>A client is asking to connect to this DODO installation.</p>
+<p><strong>${personal ? 'Personal mode is active.' : 'Managed mode is active.'}</strong> ${personal ? 'After local approval, this client can use owner-registered projects according to these OAuth scopes; no second project permission step is needed.' : 'This login grants no project access. The owner assigns each project and its read/write/exec scopes later in Local Config.'}</p>
+<table style="border-collapse:collapse">
+<tr><td style="padding:.2rem .8rem .2rem 0;color:#555">Request ID</td><td><code>${esc(uid)}</code></td></tr>
+<tr><td style="padding:.2rem .8rem .2rem 0;color:#555">Check phrase</td><td><strong>${esc(phrase)}</strong></td></tr>
+<tr><td style="padding:.2rem .8rem .2rem 0;color:#555">Client</td><td><code>${esc(clientId)}</code></td></tr>
+<tr><td style="padding:.2rem .8rem .2rem 0;color:#555">Scopes</td><td><code>${esc(scopes.join(' '))}</code></td></tr>
+</table>
+<p>On the machine running DODO, verify the same request ID, phrase, client and callback URL with:</p>
+<pre style="background:#f4f4f4;padding:.6rem">dodo auth pending
+dodo auth approve -- ${esc(uid)}</pre>
+<p id="st" aria-live="polite">Waiting for local approval…</p>
+<script>
+(function(){
+  var uid=${JSON.stringify(uid)};
+  var done=false;
+  function tick(){
+    if(done)return;
+    fetch('/interaction/'+uid+'/status',{headers:{'accept':'application/json'}}).then(function(r){return r.json()}).then(function(d){
+      if(d.status==='approved'){
+        done=true;
+        document.getElementById('st').textContent='Approved — finishing sign-in…';
+        fetch('/interaction/'+uid+'/complete',{method:'POST',headers:{'x-dodo-interaction':uid}}).then(function(r){return r.json()}).then(function(d){
+          if(d.returnTo){window.location.assign(d.returnTo);}else{document.getElementById('st').textContent='Error: '+(d.error||'unknown');}
+        });
+      } else if(d.status==='denied'||d.status==='expired'){
+        done=true;document.getElementById('st').textContent='Request '+d.status+'.';
+      } else { setTimeout(tick,2000); }
+    }).catch(function(){setTimeout(tick,3000)});
+  }
+  tick();
+})();
+</script>
+</body>`;
+}
+//# sourceMappingURL=interactions.js.map

package/dist/auth/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../../src/auth/interactions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AAEH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAoBtD,MAAM,UAAU,iBAAiB,CAAC,IAA8B;IAC9D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,SAAS,GAAG,EAAE,WAAW,EAAE,yBAAyB,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAiC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,OAAO,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,UAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;YACrE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;gBAAC,OAAO;YAC1F,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;oBACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;oBACrG,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAyB;oBACpC,QAAQ;oBACR,WAAW;oBACX,MAAM,EAAE,eAAe;oBACvB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;iBAC/B,CAAC;gBACF,KAAK,CAAC,cAAc,CAAC;oBACnB,IAAI,EAAE,OAAO;oBACb,WAAW;oBACX,KAAK;oBACL,EAAE,EAAE,OAAO,CAAC,GAAG;oBACf,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAChC,KAAK,EAAE,wBAAwB;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC;iBACtC,SAAS,CAAC,yBAAyB,EAAE,+FAA+F,CAAC;iBACrI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,uBAAuB;YACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,uBAAuB;YACpF,gEAAgE;YAChE,IAAI,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjJ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAyB,CAAC;YACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAiC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5E,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,uEAAuE;YACvE,wDAAwD;YACxD,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACzD,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnC,2EAA2E;YAC3E,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;YACtG,KAAK,CAAC,QAAQ,CAAC;gBACb,EAAE,EAAE,OAAO;gBACX,WAAW;gBACX,QAAQ;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,kBAAkB,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAC/C,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAChE,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAc,EAAE,QAAgB,EAAE,MAAgB,EAAE,QAAiB;IACzG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAChJ,OAAO;;;;aAII,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,yBAAyB,aAAa,QAAQ,CAAC,CAAC,CAAC,mJAAmJ,CAAC,CAAC,CAAC,2HAA2H;;kFAErS,GAAG,CAAC,GAAG,CAAC;sFACJ,GAAG,CAAC,MAAM,CAAC;8EACnB,GAAG,CAAC,QAAQ,CAAC;8EACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;uBAI5E,GAAG,CAAC,GAAG,CAAC;;;;YAInB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;QAmBvB,CAAC;AACT,CAAC"}

package/dist/auth/keys.js

@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import { generateKeyPairSync, randomBytes, createPrivateKey, createPublicKey } from 'node:crypto';
+import { DodoError } from '../errors.js';
+export function loadOrCreateJwks(jwksFile) {
+    try {
+        const raw = fs.readFileSync(jwksFile, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed.keys) || parsed.keys.length === 0)
+            throw new Error('empty');
+        return parsed;
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            throw new DodoError('INTERNAL_ERROR', 'signing key store is corrupt; refusing to regenerate silently', {
+                recovery: `inspect ${jwksFile}; deleting it invalidates all issued tokens`,
+            });
+        }
+    }
+    const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    const jwk = privateKey.export({ format: 'jwk' });
+    jwk['kid'] = `dodo-${randomBytes(6).toString('hex')}`;
+    jwk['alg'] = 'ES256';
+    jwk['use'] = 'sig';
+    const out = { keys: [jwk] };
+    fs.writeFileSync(jwksFile, JSON.stringify(out, null, 2), { mode: 0o600 });
+    return out;
+}
+/** Public JWKS derived from the private file (for local verification). */
+export function publicJwks(jwks) {
+    return {
+        keys: jwks.keys.map((priv) => {
+            const key = createPrivateKey({ key: priv, format: 'jwk' });
+            const pub = createPublicKey(key).export({ format: 'jwk' });
+            pub['kid'] = priv['kid'];
+            pub['alg'] = priv['alg'];
+            pub['use'] = 'sig';
+            return pub;
+        }),
+    };
+}
+export function loadOrCreateCookieKeys(cookieKeysFile) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cookieKeysFile, 'utf8'));
+        if (Array.isArray(parsed.keys) && parsed.keys.length > 0)
+            return parsed.keys;
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            throw new DodoError('INTERNAL_ERROR', 'cookie key store is corrupt', { recovery: `inspect ${cookieKeysFile}` });
+        }
+    }
+    const keys = [randomBytes(32).toString('hex'), randomBytes(32).toString('hex')];
+    fs.writeFileSync(cookieKeysFile, JSON.stringify({ keys }, null, 2), { mode: 0o600 });
+    return keys;
+}
+//# sourceMappingURL=keys.js.map

package/dist/auth/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/auth/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,+DAA+D,EAAE;gBACrG,QAAQ,EAAE,WAAW,QAAQ,6CAA6C;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;IAC5E,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACrB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAmD,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1G,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;YACtF,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAuB,CAAC;QACzF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,EAAE,QAAQ,EAAE,WAAW,cAAc,EAAE,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/provider.js

@@ -0,0 +1,131 @@
+import Provider from 'oidc-provider';
+import { createAdapterFactory } from './adapter.js';
+import { ALL_SCOPES } from '../security/policy.js';
+import { OWNER_ACCOUNT_ID } from './constants.js';
+export { OWNER_ACCOUNT_ID } from './constants.js';
+export function buildProvider(opts) {
+    const { store, resourceUrl } = opts;
+    const activeWorkspaceId = () => (typeof opts.workspaceId === 'function' ? opts.workspaceId() : opts.workspaceId);
+    const scopeString = ALL_SCOPES.join(' ');
+    const configuration = {
+        adapter: createAdapterFactory(store),
+        clients: [],
+        jwks: { keys: opts.jwks.keys },
+        cookies: {
+            keys: opts.cookieKeys,
+            short: { signed: true, httpOnly: true, sameSite: 'lax' },
+            long: { signed: true, httpOnly: true, sameSite: 'lax' },
+        },
+        // dodo:* are advertised both as global scopes (so the authorization
+        // request's `scope` param is accepted) and as resource scopes via
+        // resourceIndicators below (so the access token's audience is the /mcp
+        // resource). The grant binds both levels; the verifier still checks the
+        // exact resource audience.
+        scopes: ['offline_access', ...ALL_SCOPES],
+        claims: {},
+        clientDefaults: {
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'client_secret_basic',
+            // The signing key set is ES256-only; align client alg defaults with it.
+            id_token_signed_response_alg: 'ES256',
+        },
+        pkce: {
+            required: () => true,
+        },
+        responseTypes: ['code'],
+        interactions: {
+            // The default login+consent policy still applies; we simply render the
+            // prompt ourselves (owner terminal approval) at this URL. On resume the
+            // interaction result carries both login and consent, satisfying it.
+            url: (_ctx, interaction) => `/interaction/${interaction.uid}`,
+        },
+        findAccount: async (_ctx, id) => id === OWNER_ACCOUNT_ID
+            ? {
+                accountId: OWNER_ACCOUNT_ID,
+                claims: async () => ({ sub: OWNER_ACCOUNT_ID }),
+            }
+            : undefined,
+        /**
+         * Reuse the DODO grant the owner just approved (or approved earlier) for
+         * THIS client and THIS workspace. Consent for the single owner is granted
+         * once over local IPC; the flow must not then re-prompt in the browser.
+         * A grant bound to a different workspace never authorizes this one (spec
+         * §6, AUTH-07) — it is filtered out, forcing a fresh owner approval.
+         */
+        loadExistingGrant: async (ctx) => {
+            const clientId = ctx.oidc.client?.clientId;
+            const result = ctx.oidc.result;
+            const accountId = ctx.oidc.session?.accountId ?? result?.login?.accountId;
+            if (!clientId || accountId !== OWNER_ACCOUNT_ID)
+                return undefined;
+            // Prefer a grantId explicitly carried by the just-submitted interaction.
+            const explicit = result?.consent?.grantId;
+            const wsId = activeWorkspaceId();
+            const candidate = (explicit && store.getGrant(explicit)) ||
+                store
+                    .listGrants()
+                    .filter((g) => g.clientId === clientId && g.revokedAt === null && (g.workspaceId === wsId || store.getMeta(`identity-grant:${g.id}`) === '2'))
+                    .pop();
+            if (!candidate || candidate.revokedAt !== null || (candidate.workspaceId !== wsId && store.getMeta(`identity-grant:${candidate.id}`) !== '2'))
+                return undefined;
+            return ctx.oidc.provider.Grant.find(candidate.id);
+        },
+        issueRefreshToken: async (_ctx, client) => client.grantTypeAllowed('refresh_token'),
+        rotateRefreshToken: true,
+        extraTokenClaims: async (_ctx, token) => {
+            // Preserve the original grant and version across refresh. dodo_ws is
+            // retained for legacy tokens; v2 authorization checks the active ACL.
+            const grantId = token.grantId;
+            const appGrant = grantId ? store.getGrant(grantId) : undefined;
+            return {
+                dodo_grant: grantId ?? null,
+                dodo_ws: appGrant?.workspaceId ?? null,
+                dodo_auth: grantId && store.getMeta(`identity-grant:${grantId}`) === '2' ? 2 : 1,
+            };
+        },
+        ttl: {
+            AccessToken: opts.accessTokenTtlSec ?? 600,
+            IdToken: 600,
+            AuthorizationCode: 60,
+            Grant: 30 * 24 * 3600,
+            Interaction: 300,
+            Session: 14 * 24 * 3600,
+            RefreshToken: 30 * 24 * 3600,
+        },
+        features: {
+            devInteractions: { enabled: false },
+            revocation: { enabled: true },
+            introspection: { enabled: false },
+            registration: { enabled: false }, // DCR off by default (spec §8.3)
+            rpInitiatedLogout: { enabled: false },
+            resourceIndicators: {
+                enabled: true,
+                defaultResource: () => resourceUrl,
+                useGrantedResource: () => true,
+                getResourceServerInfo: () => ({
+                    scope: scopeString,
+                    audience: resourceUrl,
+                    accessTokenTTL: opts.accessTokenTtlSec ?? 600,
+                    accessTokenFormat: 'jwt',
+                    jwt: { sign: { alg: 'ES256' } },
+                }),
+            },
+        },
+        renderError: async (ctx, out, _error) => {
+            ctx.type = 'html';
+            ctx.body = `<!doctype html><meta charset="utf-8"><title>DODO auth error</title><body style="font-family:system-ui;max-width:36rem;margin:4rem auto"><h1>Authorization error</h1><p>${escapeHtml(out.error ?? 'error')}</p><p>${escapeHtml(out.error_description ?? '')}</p></body>`;
+        },
+    };
+    const provider = new Provider(opts.issuer, configuration);
+    // The only hop in front of DODO is the owner's local tunnel daemon on
+    // loopback; X-Forwarded-Proto from it is trusted so secure-cookie and
+    // https checks reflect the public HTTPS origin (ADR-013; Host is
+    // allowlisted before the provider ever sees a request).
+    provider.proxy = true;
+    return provider;
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAqBlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzH,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzC,MAAM,aAAa,GAAkB;QACnC,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACpC,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAa,EAAE;QACvC,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;YACxD,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;SACxD;QACD,oEAAoE;QACpE,kEAAkE;QAClE,uEAAuE;QACvE,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,EAAE,CAAC,gBAAgB,EAAE,GAAG,UAAU,CAAC;QACzC,MAAM,EAAE,EAAE;QACV,cAAc,EAAE;YACd,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,qBAAqB;YACjD,wEAAwE;YACxE,4BAA4B,EAAE,OAAO;SACtC;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;SACrB;QACD,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE;SAC9D;QACD,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAC9B,EAAE,KAAK,gBAAgB;YACrB,CAAC,CAAC;gBACE,SAAS,EAAE,gBAAgB;gBAC3B,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;aAChD;YACH,CAAC,CAAC,SAAS;QACf;;;;;;WAMG;QACH,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAwF,CAAC;YACjH,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;YAC1E,IAAI,CAAC,QAAQ,IAAI,SAAS,KAAK,gBAAgB;gBAAE,OAAO,SAAS,CAAC;YAClE,yEAAyE;YACzE,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAC1C,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACjC,MAAM,SAAS,GACb,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACtC,KAAK;qBACF,UAAU,EAAE;qBACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;qBAC7I,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,SAAS,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChK,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC;QACnF,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,OAAO,GAAI,KAA8B,CAAC,OAAO,CAAC;YACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,OAAO;gBACL,UAAU,EAAE,OAAO,IAAI,IAAI;gBAC3B,OAAO,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI;gBACtC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,OAAO,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACjF,CAAC;QACJ,CAAC;QACD,GAAG,EAAE;YACH,WAAW,EAAE,IAAI,CAAC,iBAAiB,IAAI,GAAG;YAC1C,OAAO,EAAE,GAAG;YACZ,iBAAiB,EAAE,EAAE;YACrB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACrB,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACvB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;SAC7B;QACD,QAAQ,EAAE;YACR,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACjC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,iCAAiC;YACnE,iBAAiB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACrC,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW;gBAClC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;gBAC9B,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC5B,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,WAAW;oBACrB,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,GAAG;oBAC7C,iBAAiB,EAAE,KAAK;oBACxB,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;iBAChC,CAAC;aACH;SACF;QACD,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;YAClB,GAAG,CAAC,IAAI,GAAG,0KAA0K,UAAU,CAC7L,GAAG,CAAC,KAAK,IAAI,OAAO,CACrB,UAAU,UAAU,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,aAAa,CAAC;QAClE,CAAC;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1D,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,wDAAwD;IACxD,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;IACtB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;AAC9H,CAAC"}

package/dist/auth/verifier.js

@@ -0,0 +1,74 @@
+import { createLocalJWKSet, jwtVerify } from 'jose';
+import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
+import { publicJwks } from './keys.js';
+export function buildTokenVerifier(opts) {
+    const jwkSet = createLocalJWKSet(publicJwks(opts.jwks));
+    const active = () => {
+        if (opts.active)
+            return opts.active();
+        if (opts.workspaceId === undefined || opts.store === undefined)
+            throw new Error('verifier needs workspaceId+store or active()');
+        return { workspaceId: opts.workspaceId, store: opts.store };
+    };
+    return {
+        async verifyAccessToken(token) {
+            const { workspaceId, store } = active();
+            let payload;
+            try {
+                const result = await jwtVerify(token, jwkSet, {
+                    issuer: opts.issuer,
+                    audience: opts.resourceUrl,
+                    algorithms: ['ES256'],
+                    typ: 'at+jwt',
+                });
+                payload = result.payload;
+            }
+            catch {
+                throw new OAuthError(OAuthErrorCode.InvalidToken, 'invalid access token');
+            }
+            const grantId = payload['dodo_grant'];
+            const tokenWs = payload['dodo_ws'];
+            const clientId = payload['client_id'];
+            const exp = payload['exp'];
+            if (typeof grantId !== 'string' || typeof tokenWs !== 'string' || typeof clientId !== 'string' || typeof exp !== 'number') {
+                throw new OAuthError(OAuthErrorCode.InvalidToken, 'invalid access token');
+            }
+            const grant = store.getGrant(grantId);
+            if (!store.getOAuthClient(clientId) || !grant || grant.revokedAt !== null) {
+                throw new OAuthError(OAuthErrorCode.InvalidToken, 'grant revoked or unknown');
+            }
+            if (grant.clientId !== clientId) {
+                throw new OAuthError(OAuthErrorCode.InvalidToken, 'client mismatch');
+            }
+            const identityGrant = payload['dodo_auth'] === 2 && store.getMeta(`identity-grant:${grantId}`) === '2';
+            if (!identityGrant && (tokenWs !== grant.workspaceId || (!opts.targetRouting && tokenWs !== workspaceId))) {
+                // Token from another workspace on the same hostname: consent is
+                // per-workspace; never disclose the current root in the refusal.
+                throw new OAuthError(OAuthErrorCode.InvalidToken, 'token is not valid for this workspace');
+            }
+            let scopes = typeof payload['scope'] === 'string' ? payload['scope'].split(' ').filter(Boolean) : [];
+            const tokenScopes = [...scopes];
+            {
+                const access = store.clientAccess(workspaceId, clientId);
+                scopes = scopes.filter((scope) => access.includes(scope) && grant.scopes.includes(scope));
+                // Authentication remains valid with no workspace permissions. Tool gate
+                // returns WORKSPACE_ACCESS_REQUIRED without an OAuth relinking challenge.
+            }
+            return {
+                token,
+                clientId,
+                scopes,
+                expiresAt: exp,
+                resource: new URL(opts.resourceUrl),
+                extra: {
+                    tokenScopes,
+                    identityGrant,
+                    grantId,
+                    workspaceId,
+                    sub: typeof payload['sub'] === 'string' ? payload['sub'] : 'owner',
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/auth/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/auth/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,cAAc,EAA0C,MAAM,8BAA8B,CAAC;AAElH,OAAO,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AA0BtD,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAA4C,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,GAA0C,EAAE;QACzD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAChI,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9D,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC;YACxC,IAAI,OAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;oBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,WAAW;oBAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;oBACrB,GAAG,EAAE,QAAQ;iBACd,CAAC,CAAC;gBACH,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1H,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1E,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,OAAO,EAAE,CAAC,KAAK,GAAG,CAAC;YACvG,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,OAAO,KAAK,WAAW,CAAC,CAAC,EAAE,CAAC;gBAC1G,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjH,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;YAChC,CAAC;gBACC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1F,wEAAwE;gBACxE,0EAA0E;YAC5E,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBACnC,KAAK,EAAE;oBACL,WAAW;oBACX,aAAa;oBACb,OAAO;oBACP,WAAW;oBACX,GAAG,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO;iBACnE;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/kill.js

@@ -0,0 +1,124 @@
+import fs from 'node:fs';
+import { ipcIdentity } from '../ipc/authentication.js';
+import { z } from 'zod';
+import { ipcSocketPath, statePaths } from '../config/paths.js';
+import { openDatabaseReadonly } from '../store/db.js';
+import { Store } from '../store/store.js';
+import { mintWorkspaceId } from '../workspace/identity.js';
+import { ipcCall, IpcError } from '../ipc/client.js';
+const LiveStatus = z.looseObject({
+    pid: z.number().int().positive(), root: z.string().min(1).max(4096),
+    workspaceId: z.string(), workspaceEpoch: z.string().min(1),
+    version: z.string(), transport: z.enum(['http', 'stdio']),
+});
+/** Owner-only shutdown discovery. Never sends signals to PIDs or scans ports. */
+export async function killServers(configDir, timeoutMs = 30_000) {
+    const report = { configDir, stopped: [], failed: [], authPreserved: true };
+    const dbFile = statePaths(configDir).dbFile;
+    if (!fs.existsSync(dbFile))
+        return report;
+    const db = openDatabaseReadonly(dbFile);
+    if (!db)
+        throw new Error('cannot read DODO state; no processes were stopped');
+    const candidates = [];
+    try {
+        const secret = new Store(db).readInstallSecret();
+        if (!secret)
+            throw new Error('DODO installation identity is missing; no processes were stopped');
+        let roots = db.prepare('SELECT id, root FROM workspaces ORDER BY root LIMIT 10001').all();
+        if (roots.length > 10000)
+            throw new Error('too many workspace records to inspect safely; use dodo stop for a specific workspace');
+        roots = roots.filter(w => typeof w.root === 'string' && typeof w.id === 'string' && w.id === mintWorkspaceId(secret, w.root));
+        for (const w of roots)
+            candidates.push({ ...w, socket: ipcSocketPath(configDir, w.id, { createDirectory: false }) });
+        const instances = db.prepare("SELECT value FROM meta WHERE key LIKE 'ipc-instance:%' LIMIT 10001").all();
+        if (instances.length > 10000)
+            throw new Error('too many instance records to inspect safely');
+        const Instance = z.object({ socketKey: z.string().regex(/^[a-f0-9]{32}$/), workspaceId: z.string(), root: z.string() }).strict();
+        for (const row of instances) {
+            try {
+                const i = Instance.parse(JSON.parse(row.value));
+                if (!roots.some(w => w.id === i.workspaceId && w.root === i.root))
+                    continue;
+                candidates.unshift({ id: i.workspaceId, root: i.root, socket: ipcSocketPath(configDir, i.socketKey, { createDirectory: false }), instance: true });
+            }
+            catch { /* malformed historical metadata cannot authorize a target */ }
+        }
+    }
+    finally {
+        db.close();
+    }
+    // Probe all candidates before stopping anything, so root aliases cannot race
+    // their per-instance endpoints. Never trust stored PIDs as signal targets.
+    // Windows identity/credential validation runs synchronous ACL probes. A
+    // second worker would block the event loop while the first awaits its IPC
+    // handshake, spending that request's deadline on unrelated PowerShell work.
+    // Serialize there; retain every live identity and credential recheck.
+    const concurrency = process.platform === 'win32' ? 1 : 8;
+    const live = new Map();
+    let index = 0;
+    await Promise.all(Array.from({ length: Math.min(concurrency, candidates.length) }, async () => {
+        while (index < candidates.length) {
+            const w = candidates[index++], { socket } = w;
+            try {
+                const original = socketIdentity(socket);
+                if (!original)
+                    continue;
+                let status;
+                try {
+                    status = LiveStatus.parse(await ipcCall(socket, 'status', {}, 1500));
+                }
+                catch (e) {
+                    if (isNotRunning(e))
+                        continue;
+                    throw e;
+                }
+                if (status.workspaceId !== w.id || status.root !== w.root)
+                    throw new Error('IPC identity does not match the registered workspace');
+                if (socketIdentity(socket) !== original)
+                    throw new Error('server changed while checking; retry dodo kill');
+                if (!live.has(status.pid) || (w.instance && !live.get(status.pid).candidate.instance))
+                    live.set(status.pid, { candidate: w, status, identity: original });
+            }
+            catch (e) {
+                if (!isNotRunning(e))
+                    report.failed.push({ root: w.root, reason: e instanceof Error ? e.message : 'shutdown failed' });
+            }
+        }
+    }));
+    const targets = [...live.values()];
+    index = 0;
+    await Promise.all(Array.from({ length: Math.min(concurrency, targets.length) }, async () => {
+        while (index < targets.length) {
+            const { candidate: w, status, identity } = targets[index++];
+            try {
+                if (socketIdentity(w.socket) !== identity)
+                    throw new Error('server changed before shutdown; retry dodo kill');
+                const result = await ipcCall(w.socket, 'stop', { expectedPid: status.pid, expectedEpoch: status.workspaceEpoch }, 1500);
+                if (!z.object({ stopping: z.literal(true) }).safeParse(result).success)
+                    throw new Error('server did not acknowledge shutdown');
+                const deadline = Date.now() + timeoutMs;
+                while (socketIdentity(w.socket) === identity) {
+                    if (Date.now() >= deadline)
+                        throw new Error('shutdown is still draining work; retry status later (no force kill sent)');
+                    await new Promise(resolve => setTimeout(resolve, 100));
+                }
+                report.stopped.push({ pid: status.pid, root: status.root, transport: status.transport });
+            }
+            catch (e) {
+                if (!isNotRunning(e))
+                    report.failed.push({ root: w.root, reason: e instanceof Error ? e.message : 'shutdown failed' });
+            }
+        }
+    }));
+    report.stopped.sort((a, b) => a.root.localeCompare(b.root));
+    report.failed.sort((a, b) => a.root.localeCompare(b.root));
+    return report;
+}
+function isNotRunning(e) {
+    return e instanceof IpcError && e.message.startsWith('no running DODO server');
+}
+function socketIdentity(socket) {
+    return ipcIdentity(socket);
+}
+//# sourceMappingURL=kill.js.map

package/dist/cli/kill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kill.js","sourceRoot":"","sources":["../../src/cli/kill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1D,CAAC,CAAC;AAUH,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,SAAS,GAAG,MAAM;IACrE,MAAM,MAAM,GAAe,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1C,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACjG,IAAI,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,EAAyC,CAAC;QACjI,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAClI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9H,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACrH,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAA8B,CAAC;QACrI,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACjI,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC5E,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACrJ,CAAC;YAAC,MAAM,CAAC,CAAC,6DAA6D,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAEzB,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsE,CAAC;IAC3F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC5F,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC7E,OAAO,CAAC,EAAE,CAAC;oBAAC,IAAI,YAAY,CAAC,CAAC,CAAC;wBAAE,SAAS;oBAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACrD,IAAI,MAAM,CAAC,WAAW,KAAK,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACnI,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC3G,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7J,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACzH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,KAAK,GAAG,CAAC,CAAC;IACV,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACzF,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBAC9G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;gBACxH,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC/H,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC7C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;oBACxH,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACzH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}