fluxmail 0.16.0 → 0.17.0

package/dist/storage/oauth.js

@@ -0,0 +1,556 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { and, count, eq, gt, inArray, isNull, lte, notExists, or, sql } from 'drizzle-orm';
+import { authRateLimits, mcpOauthClients, mcpOauthCodes, mcpOauthGrants, mcpOauthRequests, mcpOauthTokens, members, } from './db.js';
+import { MCP_CAPABILITIES, isMcpCapability } from '../permissions.js';
+export const OAUTH_ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;
+export const OAUTH_REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const OAUTH_GRANT_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+export const OAUTH_CODE_TTL_MS = 60 * 1000;
+export const OAUTH_REQUEST_TTL_MS = 10 * 60 * 1000;
+export const OAUTH_MAX_CLIENTS = 1_000;
+export const OAUTH_MAX_CLIENTS_PER_HOST = 20;
+const UNUSED_CLIENT_TTL_MS = 24 * 60 * 60 * 1000;
+const PRUNE_BATCH = 100;
+const GRANT_TOUCH_INTERVAL_MS = 60 * 60 * 1000;
+export const OFFLINE_ACCESS_SCOPE = 'offline_access';
+export const OAUTH_SCOPES = [...MCP_CAPABILITIES, OFFLINE_ACCESS_SCOPE];
+function secretHash(secret) {
+    return createHash('sha256').update(secret).digest('hex');
+}
+function sameHash(a, b) {
+    const left = Buffer.from(a, 'hex');
+    const right = Buffer.from(b, 'hex');
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+export function isOAuthScope(value) {
+    return value === OFFLINE_ACCESS_SCOPE || isMcpCapability(value);
+}
+/** Keep known scopes in canonical order. */
+export function canonicalOAuthScopes(scopes) {
+    const set = new Set(scopes);
+    return OAUTH_SCOPES.filter((scope) => set.has(scope));
+}
+export function mailScopesOf(scopes) {
+    const set = new Set(scopes);
+    return MCP_CAPABILITIES.filter((scope) => set.has(scope));
+}
+function parseStringArray(value) {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === 'string')) {
+        throw new Error('Stored OAuth value must be a JSON array of strings.');
+    }
+    return parsed;
+}
+function parseAccountIds(value) {
+    return value === null ? null : [...new Set(parseStringArray(value))];
+}
+function clientFromRow(row) {
+    return {
+        id: row.id,
+        kind: row.kind,
+        name: row.name,
+        redirectUris: parseStringArray(row.redirectUris),
+        scopes: mailScopesOf(parseStringArray(row.scopes)),
+        metadataHost: row.metadataHost,
+        metadataExpiresAt: row.metadataExpiresAt,
+        createdAt: row.createdAt,
+        lastUsedAt: row.lastUsedAt,
+    };
+}
+function pruneUnusedClients(db, now) {
+    const unused = db
+        .select({ id: mcpOauthClients.id })
+        .from(mcpOauthClients)
+        .where(and(lte(mcpOauthClients.createdAt, now - UNUSED_CLIENT_TTL_MS), notExists(db.select().from(mcpOauthGrants).where(eq(mcpOauthGrants.clientId, mcpOauthClients.id))), notExists(db.select().from(mcpOauthRequests).where(eq(mcpOauthRequests.clientId, mcpOauthClients.id)))))
+        .limit(PRUNE_BATCH)
+        .all();
+    if (unused.length) {
+        db.delete(mcpOauthClients)
+            .where(inArray(mcpOauthClients.id, unused.map((row) => row.id)))
+            .run();
+    }
+}
+/** Remove expired protocol state, ended grants, and clients nobody uses. */
+export function pruneOAuthState(db, now = Date.now()) {
+    db.transaction((tx) => {
+        tx.delete(mcpOauthRequests).where(lte(mcpOauthRequests.expiresAt, now)).run();
+        tx.delete(mcpOauthCodes).where(lte(mcpOauthCodes.expiresAt, now)).run();
+        // Ended grants take their tokens and codes with them through cascades.
+        tx.delete(mcpOauthGrants)
+            .where(or(lte(mcpOauthGrants.expiresAt, now), sql `${mcpOauthGrants.revokedAt} IS NOT NULL`))
+            .run();
+        // Rotated refresh tokens stay until they expire so their reuse is still detected.
+        tx.delete(mcpOauthTokens).where(lte(mcpOauthTokens.expiresAt, now)).run();
+        pruneUnusedClients(tx, now);
+    });
+}
+/**
+ * Count an attempt in a fixed window shared across processes. Returns false
+ * once the limit is reached.
+ */
+export function reserveOAuthRateLimit(db, name, limit, windowMs, now = Date.now()) {
+    const key = `oauth:${secretHash(name)}`;
+    return db.transaction((tx) => {
+        const row = tx.select().from(authRateLimits).where(eq(authRateLimits.key, key)).get();
+        if (!row || row.windowStartedAt <= now - windowMs) {
+            tx.insert(authRateLimits)
+                .values({ key, attempts: 1, windowStartedAt: now })
+                .onConflictDoUpdate({ target: authRateLimits.key, set: { attempts: 1, windowStartedAt: now } })
+                .run();
+            return true;
+        }
+        if (row.attempts >= limit)
+            return false;
+        tx.update(authRateLimits)
+            .set({ attempts: row.attempts + 1 })
+            .where(eq(authRateLimits.key, key))
+            .run();
+        return true;
+    }, { behavior: 'immediate' });
+}
+/** Store a dynamically registered public client. Returns null when the client limit is reached. */
+export function registerOAuthClient(db, input, now = Date.now()) {
+    pruneOAuthState(db, now);
+    return db.transaction((tx) => {
+        const total = tx.select({ value: count() }).from(mcpOauthClients).get()?.value ?? 0;
+        if (total >= OAUTH_MAX_CLIENTS)
+            return null;
+        const row = {
+            id: `client_${randomBytes(16).toString('hex')}`,
+            kind: 'registered',
+            name: input.name,
+            redirectUris: JSON.stringify([...new Set(input.redirectUris)]),
+            scopes: JSON.stringify(mailScopesOf(input.scopes)),
+            metadataHost: null,
+            metadataExpiresAt: null,
+            createdAt: now,
+            lastUsedAt: null,
+        };
+        tx.insert(mcpOauthClients).values(row).run();
+        return clientFromRow(row);
+    }, { behavior: 'immediate' });
+}
+/**
+ * Create or refresh a client described by a metadata document. New clients
+ * count toward the global and per-host limits.
+ */
+export function storeMetadataOAuthClient(db, input, now = Date.now()) {
+    return db.transaction((tx) => {
+        const values = {
+            name: input.name,
+            redirectUris: JSON.stringify([...new Set(input.redirectUris)]),
+            // Metadata documents cannot narrow scopes; consent decides what the client receives.
+            scopes: JSON.stringify(MCP_CAPABILITIES),
+            metadataHost: input.host,
+            metadataExpiresAt: input.expiresAt,
+        };
+        const existing = tx.select().from(mcpOauthClients).where(eq(mcpOauthClients.id, input.id)).get();
+        if (existing) {
+            tx.update(mcpOauthClients).set(values).where(eq(mcpOauthClients.id, input.id)).run();
+            return { status: 'stored', client: clientFromRow({ ...existing, ...values }) };
+        }
+        const total = tx.select({ value: count() }).from(mcpOauthClients).get()?.value ?? 0;
+        const perHost = tx.select({ value: count() }).from(mcpOauthClients).where(eq(mcpOauthClients.metadataHost, input.host)).get()
+            ?.value ?? 0;
+        if (total >= OAUTH_MAX_CLIENTS || perHost >= OAUTH_MAX_CLIENTS_PER_HOST)
+            return { status: 'limit' };
+        const row = {
+            id: input.id,
+            kind: 'metadata_document',
+            ...values,
+            createdAt: now,
+            lastUsedAt: null,
+        };
+        tx.insert(mcpOauthClients).values(row).run();
+        return { status: 'stored', client: clientFromRow(row) };
+    }, { behavior: 'immediate' });
+}
+export function getOAuthClient(db, id) {
+    const row = db.select().from(mcpOauthClients).where(eq(mcpOauthClients.id, id)).get();
+    return row ? clientFromRow(row) : null;
+}
+export function countOAuthClients(db, host) {
+    return (db
+        .select({ value: count() })
+        .from(mcpOauthClients)
+        .where(host ? eq(mcpOauthClients.metadataHost, host) : undefined)
+        .get()?.value ?? 0);
+}
+function requestFromRow(row) {
+    return {
+        id: row.id,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        state: row.state,
+        codeChallenge: row.codeChallenge,
+        scopes: canonicalOAuthScopes(parseStringArray(row.scopes)),
+        memberId: row.memberId,
+        expiresAt: row.expiresAt,
+    };
+}
+/** Save a validated authorization request. The CSRF token is returned once. */
+export function createOAuthAuthorizationRequest(db, input, now = Date.now()) {
+    const csrf = randomBytes(32).toString('hex');
+    const row = {
+        id: randomBytes(16).toString('hex'),
+        clientId: input.clientId,
+        redirectUri: input.redirectUri,
+        state: input.state ?? null,
+        codeChallenge: input.codeChallenge,
+        scopes: JSON.stringify(canonicalOAuthScopes(input.scopes)),
+        csrfHash: secretHash(csrf),
+        memberId: null,
+        createdAt: now,
+        expiresAt: now + OAUTH_REQUEST_TTL_MS,
+    };
+    db.transaction((tx) => {
+        // Keep this client referenced while cleanup removes its ended grants.
+        tx.insert(mcpOauthRequests).values(row).run();
+        pruneOAuthState(tx, now);
+    }, { behavior: 'immediate' });
+    return { request: requestFromRow(row), csrf };
+}
+/** Find an unexpired request whose CSRF token matches. */
+export function getOAuthAuthorizationRequest(db, id, csrf, now = Date.now()) {
+    const row = db
+        .select()
+        .from(mcpOauthRequests)
+        .where(and(eq(mcpOauthRequests.id, id), gt(mcpOauthRequests.expiresAt, now)))
+        .get();
+    if (!row || !/^[0-9a-f]{64}$/.test(csrf) || !sameHash(row.csrfHash, secretHash(csrf)))
+        return null;
+    return requestFromRow(row);
+}
+/** Record the signed-in member on a request and rotate its CSRF token. */
+export function signInOAuthAuthorizationRequest(db, id, memberId, now = Date.now()) {
+    const csrf = randomBytes(32).toString('hex');
+    const updated = db
+        .update(mcpOauthRequests)
+        .set({ memberId, csrfHash: secretHash(csrf) })
+        .where(and(eq(mcpOauthRequests.id, id), gt(mcpOauthRequests.expiresAt, now)))
+        .run();
+    return updated.changes === 1 ? csrf : null;
+}
+export function deleteOAuthAuthorizationRequest(db, id) {
+    db.delete(mcpOauthRequests).where(eq(mcpOauthRequests.id, id)).run();
+}
+/**
+ * Turn a signed-in request into a grant and a single-use authorization code.
+ * The request is deleted in the same transaction, so it cannot be approved twice.
+ */
+export function approveOAuthAuthorizationRequest(db, input, now = Date.now()) {
+    const code = `fmc_${randomBytes(32).toString('hex')}`;
+    return db.transaction((tx) => {
+        const row = tx
+            .select()
+            .from(mcpOauthRequests)
+            .where(and(eq(mcpOauthRequests.id, input.requestId), eq(mcpOauthRequests.memberId, input.memberId), gt(mcpOauthRequests.expiresAt, now)))
+            .get();
+        if (!row)
+            return null;
+        const requested = new Set(requestFromRow(row).scopes);
+        const scopes = mailScopesOf(input.scopes).filter((scope) => requested.has(scope));
+        if (!scopes.length)
+            return null;
+        tx.delete(mcpOauthRequests).where(eq(mcpOauthRequests.id, row.id)).run();
+        const grantId = `grant_${randomBytes(8).toString('hex')}`;
+        tx.insert(mcpOauthGrants)
+            .values({
+            id: grantId,
+            clientId: row.clientId,
+            memberId: input.memberId,
+            scopes: JSON.stringify(scopes),
+            accountIds: input.accountIds === null ? null : JSON.stringify([...new Set(input.accountIds)]),
+            createdAt: now,
+            expiresAt: now + OAUTH_GRANT_TTL_MS,
+            lastUsedAt: null,
+            revokedAt: null,
+        })
+            .run();
+        // Every grant gets a refresh token, so clients that omit offline_access
+        // are not asked to sign in again every 15 minutes.
+        const tokenScopes = canonicalOAuthScopes([...scopes, OFFLINE_ACCESS_SCOPE]);
+        tx.insert(mcpOauthCodes)
+            .values({
+            codeHash: secretHash(code),
+            grantId,
+            redirectUri: row.redirectUri,
+            codeChallenge: row.codeChallenge,
+            scopes: JSON.stringify(tokenScopes),
+            createdAt: now,
+            expiresAt: now + OAUTH_CODE_TTL_MS,
+            consumedAt: null,
+        })
+            .run();
+        tx.update(mcpOauthClients).set({ lastUsedAt: now }).where(eq(mcpOauthClients.id, row.clientId)).run();
+        return { code, grantId, redirectUri: row.redirectUri, state: row.state };
+    }, { behavior: 'immediate' });
+}
+function pkceMatches(verifier, challenge) {
+    if (!/^[A-Za-z0-9\-._~]{43,128}$/.test(verifier))
+        return false;
+    const expected = Buffer.from(createHash('sha256').update(verifier).digest('base64url'));
+    const actual = Buffer.from(challenge);
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+function activeGrant(tx, grantId, now) {
+    const grant = tx.select().from(mcpOauthGrants).where(eq(mcpOauthGrants.id, grantId)).get();
+    if (!grant || grant.revokedAt !== null || grant.expiresAt <= now)
+        return null;
+    const member = tx.select().from(members).where(eq(members.id, grant.memberId)).get();
+    return member?.status === 'active' ? grant : null;
+}
+function revokeGrantInTx(tx, grantId, now) {
+    const revoked = tx
+        .update(mcpOauthGrants)
+        .set({ revokedAt: now })
+        .where(and(eq(mcpOauthGrants.id, grantId), isNull(mcpOauthGrants.revokedAt)))
+        .run();
+    tx.delete(mcpOauthTokens).where(eq(mcpOauthTokens.grantId, grantId)).run();
+    tx.delete(mcpOauthCodes).where(eq(mcpOauthCodes.grantId, grantId)).run();
+    return revoked.changes > 0;
+}
+function issueTokens(tx, grant, scopes, now) {
+    const accessToken = `fmo_${randomBytes(32).toString('hex')}`;
+    const accessExpiresAt = Math.min(now + OAUTH_ACCESS_TOKEN_TTL_MS, grant.expiresAt);
+    const serialized = JSON.stringify(scopes);
+    tx.insert(mcpOauthTokens)
+        .values({
+        tokenHash: secretHash(accessToken),
+        grantId: grant.id,
+        kind: 'access',
+        scopes: serialized,
+        createdAt: now,
+        expiresAt: accessExpiresAt,
+        rotatedAt: null,
+    })
+        .run();
+    let refreshToken;
+    if (scopes.includes(OFFLINE_ACCESS_SCOPE)) {
+        refreshToken = `fmr_${randomBytes(32).toString('hex')}`;
+        tx.insert(mcpOauthTokens)
+            .values({
+            tokenHash: secretHash(refreshToken),
+            grantId: grant.id,
+            kind: 'refresh',
+            scopes: serialized,
+            createdAt: now,
+            expiresAt: Math.min(now + OAUTH_REFRESH_TOKEN_TTL_MS, grant.expiresAt),
+            rotatedAt: null,
+        })
+            .run();
+    }
+    return {
+        accessToken,
+        ...(refreshToken ? { refreshToken } : {}),
+        expiresIn: Math.max(1, Math.floor((accessExpiresAt - now) / 1000)),
+        scopes: [...scopes],
+    };
+}
+const INVALID_GRANT = (description) => ({ ok: false, error: 'invalid_grant', description });
+/** Exchange an authorization code. Replaying a used code revokes its grant. */
+export function exchangeOAuthAuthorizationCode(db, input, now = Date.now()) {
+    return db.transaction((tx) => {
+        const row = tx
+            .select()
+            .from(mcpOauthCodes)
+            .where(eq(mcpOauthCodes.codeHash, secretHash(input.code)))
+            .get();
+        if (!row)
+            return INVALID_GRANT('The authorization code is invalid.');
+        const grant = tx.select().from(mcpOauthGrants).where(eq(mcpOauthGrants.id, row.grantId)).get();
+        if (!grant || grant.clientId !== input.clientId)
+            return INVALID_GRANT('The authorization code is invalid.');
+        if (row.consumedAt !== null) {
+            revokeGrantInTx(tx, grant.id, now);
+            return INVALID_GRANT('The authorization code was already used.');
+        }
+        if (row.expiresAt <= now)
+            return INVALID_GRANT('The authorization code has expired.');
+        if (row.redirectUri !== input.redirectUri)
+            return INVALID_GRANT('redirect_uri does not match the authorization.');
+        if (!pkceMatches(input.codeVerifier, row.codeChallenge))
+            return INVALID_GRANT('PKCE verification failed.');
+        const active = activeGrant(tx, grant.id, now);
+        if (!active)
+            return INVALID_GRANT('The authorization is no longer active.');
+        tx.update(mcpOauthCodes).set({ consumedAt: now }).where(eq(mcpOauthCodes.codeHash, row.codeHash)).run();
+        return {
+            ok: true,
+            tokens: issueTokens(tx, active, canonicalOAuthScopes(parseStringArray(row.scopes)), now),
+        };
+    }, { behavior: 'immediate' });
+}
+/**
+ * Rotate a refresh token. Reusing a rotated token revokes the grant. A refresh
+ * can keep or narrow its scopes but never add one.
+ */
+export function refreshOAuthTokens(db, input, now = Date.now()) {
+    return db.transaction((tx) => {
+        const row = tx
+            .select()
+            .from(mcpOauthTokens)
+            .where(and(eq(mcpOauthTokens.tokenHash, secretHash(input.refreshToken)), eq(mcpOauthTokens.kind, 'refresh')))
+            .get();
+        if (!row)
+            return INVALID_GRANT('The refresh token is invalid.');
+        const grant = tx.select().from(mcpOauthGrants).where(eq(mcpOauthGrants.id, row.grantId)).get();
+        if (!grant || grant.clientId !== input.clientId)
+            return INVALID_GRANT('The refresh token is invalid.');
+        if (row.rotatedAt !== null) {
+            revokeGrantInTx(tx, grant.id, now);
+            return INVALID_GRANT('The refresh token was already used.');
+        }
+        if (row.expiresAt <= now)
+            return INVALID_GRANT('The refresh token has expired.');
+        const active = activeGrant(tx, grant.id, now);
+        if (!active)
+            return INVALID_GRANT('The authorization is no longer active.');
+        const current = canonicalOAuthScopes(parseStringArray(row.scopes));
+        let scopes = current;
+        if (input.scopes) {
+            if (!input.scopes.every((scope) => current.includes(scope))) {
+                return { ok: false, error: 'invalid_scope', description: 'A refresh cannot add scopes.' };
+            }
+            scopes = canonicalOAuthScopes([...input.scopes, OFFLINE_ACCESS_SCOPE]);
+        }
+        if (!mailScopesOf(scopes).length) {
+            return { ok: false, error: 'invalid_scope', description: 'Request at least one mail scope.' };
+        }
+        tx.update(mcpOauthTokens).set({ rotatedAt: now }).where(eq(mcpOauthTokens.tokenHash, row.tokenHash)).run();
+        return { ok: true, tokens: issueTokens(tx, active, scopes, now) };
+    }, { behavior: 'immediate' });
+}
+/**
+ * Revoke the grant behind a token when the token belongs to the client.
+ * Unknown tokens are ignored, as RFC 7009 requires.
+ */
+export function revokeOAuthToken(db, input, now = Date.now()) {
+    db.transaction((tx) => {
+        const row = tx
+            .select({ grantId: mcpOauthTokens.grantId, clientId: mcpOauthGrants.clientId })
+            .from(mcpOauthTokens)
+            .innerJoin(mcpOauthGrants, eq(mcpOauthGrants.id, mcpOauthTokens.grantId))
+            .where(eq(mcpOauthTokens.tokenHash, secretHash(input.token)))
+            .get();
+        if (row && row.clientId === input.clientId)
+            revokeGrantInTx(tx, row.grantId, now);
+    }, { behavior: 'immediate' });
+}
+/** Verify an access token against its live grant and member. */
+export function authenticateOAuthAccessToken(db, token, now = Date.now()) {
+    const row = db
+        .select({
+        tokenScopes: mcpOauthTokens.scopes,
+        tokenExpiresAt: mcpOauthTokens.expiresAt,
+        grantId: mcpOauthGrants.id,
+        clientId: mcpOauthGrants.clientId,
+        memberId: mcpOauthGrants.memberId,
+        grantScopes: mcpOauthGrants.scopes,
+        accountIds: mcpOauthGrants.accountIds,
+        grantExpiresAt: mcpOauthGrants.expiresAt,
+        revokedAt: mcpOauthGrants.revokedAt,
+        lastUsedAt: mcpOauthGrants.lastUsedAt,
+        role: members.role,
+        status: members.status,
+    })
+        .from(mcpOauthTokens)
+        .innerJoin(mcpOauthGrants, eq(mcpOauthGrants.id, mcpOauthTokens.grantId))
+        .innerJoin(members, eq(members.id, mcpOauthGrants.memberId))
+        .where(and(eq(mcpOauthTokens.tokenHash, secretHash(token)), eq(mcpOauthTokens.kind, 'access')))
+        .get();
+    if (!row || row.tokenExpiresAt <= now || row.grantExpiresAt <= now || row.revokedAt !== null)
+        return null;
+    if (row.status !== 'active')
+        return null;
+    try {
+        const granted = new Set(parseStringArray(row.grantScopes));
+        const scopes = mailScopesOf(parseStringArray(row.tokenScopes)).filter((scope) => granted.has(scope));
+        if (!scopes.length)
+            return null;
+        const accountIds = parseAccountIds(row.accountIds);
+        if (row.lastUsedAt === null || now - row.lastUsedAt >= GRANT_TOUCH_INTERVAL_MS) {
+            db.update(mcpOauthGrants).set({ lastUsedAt: now }).where(eq(mcpOauthGrants.id, row.grantId)).run();
+        }
+        return {
+            grantId: row.grantId,
+            clientId: row.clientId,
+            memberId: row.memberId,
+            role: row.role,
+            scopes,
+            accountIds,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Active grants, optionally for one member, newest first. */
+export function listOAuthGrants(db, memberId, now = Date.now()) {
+    return db
+        .select({ grant: mcpOauthGrants, clientName: mcpOauthClients.name, clientKind: mcpOauthClients.kind })
+        .from(mcpOauthGrants)
+        .innerJoin(mcpOauthClients, eq(mcpOauthClients.id, mcpOauthGrants.clientId))
+        .where(and(isNull(mcpOauthGrants.revokedAt), gt(mcpOauthGrants.expiresAt, now), memberId ? eq(mcpOauthGrants.memberId, memberId) : undefined))
+        .all()
+        .map(({ grant, clientName, clientKind }) => ({
+        id: grant.id,
+        clientId: grant.clientId,
+        clientName,
+        clientKind: clientKind,
+        memberId: grant.memberId,
+        scopes: mailScopesOf(parseStringArray(grant.scopes)),
+        accountIds: parseAccountIds(grant.accountIds),
+        createdAt: grant.createdAt,
+        expiresAt: grant.expiresAt,
+        lastUsedAt: grant.lastUsedAt,
+    }))
+        .sort((a, b) => b.createdAt - a.createdAt || a.id.localeCompare(b.id));
+}
+export function getOAuthGrant(db, grantId, now = Date.now()) {
+    return listOAuthGrants(db, undefined, now).find((grant) => grant.id === grantId) ?? null;
+}
+/** Revoke one active grant. Pass memberId to limit the change to that member's grants. */
+export function revokeOAuthGrant(db, grantId, memberId, now = Date.now()) {
+    return db.transaction((tx) => {
+        const grant = tx.select().from(mcpOauthGrants).where(eq(mcpOauthGrants.id, grantId)).get();
+        if (!grant || grant.revokedAt !== null || grant.expiresAt <= now)
+            return false;
+        if (memberId && grant.memberId !== memberId)
+            return false;
+        return revokeGrantInTx(tx, grant.id, now);
+    }, { behavior: 'immediate' });
+}
+/** Revoke every grant a member approved, for suspension and password changes. */
+export function revokeMemberOAuthGrants(db, memberId, now = Date.now()) {
+    db.delete(mcpOauthRequests).where(eq(mcpOauthRequests.memberId, memberId)).run();
+    const grants = db
+        .select({ id: mcpOauthGrants.id })
+        .from(mcpOauthGrants)
+        .where(and(eq(mcpOauthGrants.memberId, memberId), isNull(mcpOauthGrants.revokedAt)))
+        .all();
+    if (!grants.length)
+        return 0;
+    const ids = grants.map((grant) => grant.id);
+    db.update(mcpOauthGrants).set({ revokedAt: now }).where(inArray(mcpOauthGrants.id, ids)).run();
+    db.delete(mcpOauthTokens).where(inArray(mcpOauthTokens.grantId, ids)).run();
+    db.delete(mcpOauthCodes).where(inArray(mcpOauthCodes.grantId, ids)).run();
+    return ids.length;
+}
+/** Replace the mailbox narrowing of an active grant. Existing tokens use it on their next request. */
+export function updateOAuthGrantAccounts(db, grantId, accountIds, now = Date.now()) {
+    return (db
+        .update(mcpOauthGrants)
+        .set({ accountIds: accountIds === null ? null : JSON.stringify([...new Set(accountIds)]) })
+        .where(and(eq(mcpOauthGrants.id, grantId), isNull(mcpOauthGrants.revokedAt), gt(mcpOauthGrants.expiresAt, now)))
+        .run().changes > 0);
+}
+/** Count active grants per member for listings. */
+export function countActiveOAuthGrants(db, memberId, now = Date.now()) {
+    return (db
+        .select({ value: count() })
+        .from(mcpOauthGrants)
+        .where(and(eq(mcpOauthGrants.memberId, memberId), isNull(mcpOauthGrants.revokedAt), gt(mcpOauthGrants.expiresAt, now)))
+        .get()?.value ?? 0);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/storage/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/storage/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,OAAO,GAER,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAsB,MAAM,mBAAmB,CAAC;AAE1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,gBAAgB,EAAE,oBAAoB,CAAU,CAAC;AA8DjF,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,KAAK,oBAAoB,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IAC3C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,GAAwC;IAC7D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAuB;QACjC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC;QAChD,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAc,EAAE,GAAW;IACrD,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;SAClC,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CACJ,GAAG,CACD,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,GAAG,oBAAoB,CAAC,EAC1D,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAClG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CACvG,CACF;SACA,KAAK,CAAC,WAAW,CAAC;SAClB,GAAG,EAAE,CAAC;IACT,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,OAAO,CACL,eAAe,CAAC,EAAE,EAClB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAC5B,CACF;aACA,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,EAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9D,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxE,uEAAuE;QACvE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,CAAA,GAAG,cAAc,CAAC,SAAS,cAAc,CAAC,CAAC;aAC3F,GAAG,EAAE,CAAC;QACT,kFAAkF;QAClF,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1E,kBAAkB,CAAC,EAA2B,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAc,EACd,IAAY,EACZ,KAAa,EACb,QAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,GAAG,GAAG,SAAS,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACxC,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;YAClD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;iBACtB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;iBAClD,kBAAkB,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC9F,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;aACnC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aAClC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CACjC,EAAc,EACd,KAA0F,EAC1F,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC;QACpF,IAAI,KAAK,IAAI,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,UAAU,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAC/C,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,YAAY,EAAE,IAAI;YAClB,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;SAC6B,CAAC;QAChD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7C,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAc,EACd,KAAqG,EACrG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9D,qFAAqF;YACrF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;YACxC,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,iBAAiB,EAAE,KAAK,CAAC,SAAS;SACnC,CAAC;QACF,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACjG,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,EAAW,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GACX,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;YAC3G,EAAE,KAAK,IAAI,CAAC,CAAC;QACjB,IAAI,KAAK,IAAI,iBAAiB,IAAI,OAAO,IAAI,0BAA0B;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAW,CAAC;QAC7G,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,mBAAmB;YACzB,GAAG,MAAM;YACT,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;SAC6B,CAAC;QAChD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAW,CAAC;IACnE,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAc,EAAE,EAAU;IACvD,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtF,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAc,EAAE,IAAa;IAC7D,OAAO,CACL,EAAE;SACC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;SAC1B,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAChE,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAyC;IAC/D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,MAAM,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1D,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B,CAC7C,EAAc,EACd,KAMC,EACD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1D,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,oBAAoB;KACS,CAAC;IACjD,EAAE,CAAC,WAAW,CACZ,CAAC,EAAE,EAAE,EAAE;QACL,sEAAsE;QACtE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9C,eAAe,CAAC,EAA2B,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,4BAA4B,CAC1C,EAAc,EACd,EAAU,EACV,IAAY,EACZ,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;SAC5E,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,+BAA+B,CAC7C,EAAc,EACd,EAAU,EACV,QAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,EAAE;SACf,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;SAC7C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;SAC5E,GAAG,EAAE,CAAC;IACT,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,EAAc,EAAE,EAAU;IACxE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,EAAc,EACd,KAKC,EACD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,IAAI,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CACpC,CACF;aACA,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,OAAO;YACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7F,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,kBAAkB;YACnC,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,WAAW,GAAG,oBAAoB,CAAC,CAAC,GAAG,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC5E,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC;YACN,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;YAC1B,OAAO;YACP,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;YACnC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,iBAAiB;YAClC,UAAU,EAAE,IAAI;SACjB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC3E,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,SAAiB;IACtD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAID,SAAS,WAAW,CAAC,EAAM,EAAE,OAAe,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACrF,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,EAAM,EAAE,OAAe,EAAE,GAAW;IAC3D,MAAM,OAAO,GAAG,EAAE;SACf,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;SAC5E,GAAG,EAAE,CAAC;IACT,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3E,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACzE,OAAO,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAClB,EAAM,EACN,KAAyC,EACzC,MAA6B,EAC7B,GAAW;IAEX,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE,IAAI;KAChB,CAAC;SACD,GAAG,EAAE,CAAC;IACT,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1C,YAAY,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;YACnC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,0BAA0B,EAAE,KAAK,CAAC,SAAS,CAAC;YACtE,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO;QACL,WAAW;QACX,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;AAEtH,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAC5C,EAAc,EACd,KAAoF,EACpF,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACzD,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAC5G,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC5B,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,aAAa,CAAC,0CAA0C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,qCAAqC,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,aAAa,CAAC,gDAAgD,CAAC,CAAC;QAClH,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC,2BAA2B,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,wCAAwC,CAAC,CAAC;QAC5E,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxG,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC;SAChF,CAAC;IACb,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAc,EACd,KAA6E,EAC7E,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;aAC5G,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAAE,OAAO,aAAa,CAAC,+BAA+B,CAAC,CAAC;QACvG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3B,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,aAAa,CAAC,qCAAqC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,wCAAwC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,GAAG,OAAO,CAAC;QACrB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAE,OAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,8BAA8B,EAAW,CAAC;YACrG,CAAC;YACD,MAAM,GAAG,oBAAoB,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,kCAAkC,EAAW,CAAC;QACzG,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAW,CAAC;IAC7E,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAc,EAAE,KAA0C,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3G,EAAE,CAAC,WAAW,CACZ,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC;aAC9E,IAAI,CAAC,cAAc,CAAC;aACpB,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;aACxE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;aAC5D,GAAG,EAAE,CAAC;QACT,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAAE,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,4BAA4B,CAC1C,EAAc,EACd,KAAa,EACb,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,CAAC;QACN,WAAW,EAAE,cAAc,CAAC,MAAM;QAClC,cAAc,EAAE,cAAc,CAAC,SAAS;QACxC,OAAO,EAAE,cAAc,CAAC,EAAE;QAC1B,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,WAAW,EAAE,cAAc,CAAC,MAAM;QAClC,UAAU,EAAE,cAAc,CAAC,UAAU;QACrC,cAAc,EAAE,cAAc,CAAC,SAAS;QACxC,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,UAAU,EAAE,cAAc,CAAC,UAAU;QACrC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;SACD,IAAI,CAAC,cAAc,CAAC;SACpB,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;SACxE,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;SAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;SAC9F,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1G,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,uBAAuB,EAAE,CAAC;YAC/E,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrG,CAAC;QACD,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAkB;YAC5B,MAAM;YACN,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,EAAc,EAAE,QAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjF,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;SACrG,IAAI,CAAC,cAAc,CAAC;SACpB,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;SAC3E,KAAK,CACJ,GAAG,CACD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAChC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,EACjC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAC7D,CACF;SACA,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU;QACV,UAAU,EAAE,UAA6B;QACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAc,EAAE,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7E,OAAO,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,EAAc,EAAE,OAAe,EAAE,QAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACnG,OAAO,EAAE,CAAC,WAAW,CACnB,CAAC,EAAE,EAAE,EAAE;QACL,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3F,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/E,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,EAAmB,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7F,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;SACjC,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;SACnF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5C,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/F,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5E,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1E,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,wBAAwB,CACtC,EAAc,EACd,OAAe,EACf,UAAoC,EACpC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO,CACL,EAAE;SACC,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;SAC/G,GAAG,EAAE,CAAC,OAAO,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,sBAAsB,CAAC,EAAc,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACvF,OAAO,CACL,EAAE;SACC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;SAC1B,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAChH;SACA,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fluxmail",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "mcpName": "io.github.fluxmailai/fluxmail",
   "description": "Self-hosted email API with MCP and REST support for Gmail, Outlook, and IMAP/SMTP",
   "keywords": [
@@ -66,7 +66,8 @@
   "dependencies": {
     "@hono/node-server": "^1.14.3",
     "@hono/zod-openapi": "0.19.10",
-    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@modelcontextprotocol/core": "2.4.0",
+    "@modelcontextprotocol/server": "2.4.0",
     "@node-rs/argon2": "2.0.2",
     "better-sqlite3": "^13.0.3",
     "commander": "^13.1.0",
@@ -80,12 +81,14 @@
     "update-notifier": "7.3.1",
     "zod": "^3.25.67",
     "zod-to-json-schema": "3.25.2",
-    "@fluxmail/core": "0.16.0",
-    "@fluxmail/provider-gmail": "0.16.0",
-    "@fluxmail/provider-imap": "0.16.0",
-    "@fluxmail/provider-outlook": "0.16.0"
+    "@fluxmail/core": "0.17.0",
+    "@fluxmail/provider-gmail": "0.17.0",
+    "@fluxmail/provider-imap": "0.17.0",
+    "@fluxmail/provider-outlook": "0.17.0"
   },
   "devDependencies": {
+    "@modelcontextprotocol/client": "2.4.0",
+    "@modelcontextprotocol/node": "2.1.2",
     "@types/better-sqlite3": "^7.6.13",
     "@types/mime-types": "^3.0.1",
     "@types/node": "^22.15.0",