ftown 0.19.52 → 0.19.53

package/dist/mcp/mcp-key-store.js

@@ -0,0 +1,206 @@
+import { randomBytes } from 'node:crypto';
+import { z } from 'zod';
+import { generateEndpoint, importEndpoint, importPublicKey, SecurityError } from '../security/crypto.js';
+const MAX_RECORD_BYTES = 65_536;
+const MAX_ACTIVE_MS = 30 * 24 * 60 * 60 * 1000;
+const endpointSchema = z.object({ version: z.literal(1), id: z.string().regex(/^[A-Za-z0-9_-]{43}$/), ownerId: z.string().uuid(), kind: z.enum(['bridge', 'browser', 'mcp', 'local-cli']), publicKey: z.string().regex(/^[A-Za-z0-9_-]{87}$/) }).strict();
+const pinSchema = z.object({ bridgeId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/), endpoint: endpointSchema, permissions: z.array(z.enum(['read', 'control'])).min(1).max(2) }).strict();
+const keySchema = z.object({ kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string().regex(/^[A-Za-z0-9_-]{43}$/), y: z.string().regex(/^[A-Za-z0-9_-]{43}$/), d: z.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict();
+const storedSchema = z.object({
+    version: z.literal(1), ownerId: z.string().uuid(), requestId: z.string().regex(/^[A-Za-z0-9_-]{43}$/), grantId: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    endpoint: endpointSchema, privateKey: keySchema, bridges: z.array(pinSchema).max(64),
+    permissions: z.array(z.enum(['read', 'control'])).min(1).max(2),
+    pendingExpiresAt: z.string().datetime(), activeExpiresAt: z.string().datetime(), state: z.enum(['pending', 'approved', 'active', 'revoked']),
+}).strict();
+const safeUnavailable = () => new SecurityError('key_unavailable', 'MCP encryption identity is unavailable');
+const b64 = (value) => Buffer.from(value).toString('base64url');
+function from64(value, min, max = min) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/.test(value) || value.length > Math.ceil(max * 4 / 3))
+        throw safeUnavailable();
+    const decoded = Uint8Array.from(Buffer.from(value, 'base64url'));
+    if (decoded.length < min || decoded.length > max || b64(decoded) !== value)
+        throw safeUnavailable();
+    return decoded;
+}
+function context(row) {
+    return new TextEncoder().encode(JSON.stringify(['ftown/mcp-private-key/v1', row.version, row.ownerId, row.requestId, row.grantId, row.endpointId, row.expiresAt, row.keyId]));
+}
+function configKey(config) {
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(config.keyId) || config.key.byteLength !== 32)
+        throw new SecurityError('security_setup_required', 'MCP encryption wrapping key and key ID must be provisioned');
+    return crypto.subtle.importKey('raw', Uint8Array.from(config.key), 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+async function validatePins(pins, ownerId) {
+    if (pins.length > 64 || new Set(pins.map(pin => pin.bridgeId)).size !== pins.length || new Set(pins.map(pin => pin.endpoint.id)).size !== pins.length)
+        throw safeUnavailable();
+    for (const pin of pins) {
+        if (pin.endpoint.ownerId !== ownerId || pin.endpoint.kind !== 'bridge' || !pin.permissions.includes('read') || pin.permissions.some(permission => permission === 'admin'))
+            throw safeUnavailable();
+        await importPublicKey(pin.endpoint.publicKey);
+        if (b64(new Uint8Array(await crypto.subtle.digest('SHA-256', from64(pin.endpoint.publicKey, 65)))) !== pin.endpoint.id)
+            throw safeUnavailable();
+    }
+}
+function stored(identity, privateKey) {
+    const parsed = storedSchema.safeParse({
+        version: 1, ownerId: identity.ownerId, requestId: identity.requestId, grantId: identity.grantId,
+        endpoint: identity.identity.endpoint, privateKey: { kty: privateKey.kty, crv: privateKey.crv, x: privateKey.x, y: privateKey.y, d: privateKey.d },
+        bridges: identity.bridges, permissions: identity.permissions, pendingExpiresAt: identity.pendingExpiresAt,
+        activeExpiresAt: identity.activeExpiresAt, state: identity.state,
+    });
+    if (!parsed.success)
+        throw safeUnavailable();
+    return parsed.data;
+}
+export async function encryptMcpIdentity(identity, privateKey, config) {
+    const value = stored(identity, privateKey);
+    await importEndpoint(value.endpoint, value.privateKey);
+    await validatePins(value.bridges, value.ownerId);
+    if (value.endpoint.kind !== 'mcp' || value.endpoint.ownerId !== value.ownerId)
+        throw safeUnavailable();
+    const plaintext = new TextEncoder().encode(JSON.stringify(value));
+    if (plaintext.byteLength > MAX_RECORD_BYTES)
+        throw safeUnavailable();
+    const row = { version: 1, ownerId: value.ownerId, requestId: value.requestId, grantId: value.grantId, endpointId: value.endpoint.id, expiresAt: value.activeExpiresAt, keyId: config.keyId, nonce: b64(randomBytes(12)), ciphertext: '' };
+    const key = await configKey(config);
+    row.ciphertext = b64(new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: from64(row.nonce, 12), additionalData: context(row), tagLength: 128 }, key, plaintext)));
+    return row;
+}
+export async function decryptMcpIdentity(row, config) {
+    const key = await configKey(config);
+    try {
+        if (row.version !== 1 || row.keyId !== config.keyId || Object.keys(row).length !== 9)
+            throw safeUnavailable();
+        const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: from64(row.nonce, 12), additionalData: context(row), tagLength: 128 }, key, from64(row.ciphertext, 16, MAX_RECORD_BYTES + 16));
+        const parsed = storedSchema.safeParse(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(plaintext)));
+        if (!parsed.success)
+            throw safeUnavailable();
+        const value = parsed.data;
+        if (value.ownerId !== row.ownerId || value.requestId !== row.requestId || value.grantId !== row.grantId || value.endpoint.id !== row.endpointId || value.activeExpiresAt !== row.expiresAt || value.endpoint.ownerId !== value.ownerId || value.endpoint.kind !== 'mcp')
+            throw safeUnavailable();
+        await validatePins(value.bridges, value.ownerId);
+        return { ownerId: value.ownerId, requestId: value.requestId, grantId: value.grantId, identity: await importEndpoint(value.endpoint, value.privateKey), bridges: value.bridges, permissions: value.permissions, pendingExpiresAt: value.pendingExpiresAt, activeExpiresAt: value.activeExpiresAt, state: value.state };
+    }
+    catch {
+        throw safeUnavailable();
+    }
+}
+function dbEnvelope(row) {
+    if (row.envelope.ownerId !== row.owner_id || row.envelope.requestId !== row.request_id || row.envelope.grantId !== row.grant_id
+        || row.envelope.endpointId !== row.endpoint_id || row.envelope.expiresAt !== row.expires_at.toISOString())
+        throw safeUnavailable();
+    return row.envelope;
+}
+function securityDetails(identity) {
+    return { requestId: identity.requestId, grantId: identity.grantId, endpoint: identity.identity.endpoint, expiresAt: identity.pendingExpiresAt, activeExpiresAt: identity.activeExpiresAt, permissions: identity.permissions };
+}
+/** Uses the gateway's existing pool; no second connection-string/secret source. */
+export class McpKeyStore {
+    pool;
+    now;
+    config;
+    constructor(pool, config, now = Date.now) {
+        this.pool = pool;
+        this.now = now;
+        if (!/^[A-Za-z0-9_-]{1,64}$/.test(config.keyId) || config.key.byteLength !== 32)
+            throw new SecurityError('security_setup_required', 'MCP encryption wrapping key and key ID must be provisioned');
+        this.config = { keyId: config.keyId, key: Uint8Array.from(config.key) };
+    }
+    async checkSchema() {
+        try {
+            await this.pool.query('SELECT owner_id,request_id,grant_id,endpoint_id,envelope,expires_at FROM mcp_endpoint_identities LIMIT 0');
+        }
+        catch {
+            throw new SecurityError('security_setup_required', 'MCP encryption database migration is required');
+        }
+    }
+    async ensurePendingIdentity(requestId, ownerId, permissions) {
+        const existing = await this.pool.query('SELECT * FROM mcp_endpoint_identities WHERE request_id=$1', [requestId]);
+        if (existing.rows[0]) {
+            const current = await decryptMcpIdentity(dbEnvelope(existing.rows[0]), this.config);
+            if (current.ownerId !== ownerId || current.state !== 'pending' || Date.parse(current.pendingExpiresAt) <= this.now() || current.permissions.join(' ') !== permissions.join(' '))
+                throw safeUnavailable();
+            return securityDetails(current);
+        }
+        const identity = await generateEndpoint(ownerId, 'mcp', true);
+        const privateKey = await crypto.subtle.exportKey('jwk', identity.keyPair.privateKey);
+        const record = {
+            ownerId, requestId, grantId: b64(randomBytes(32)), identity, bridges: [], permissions,
+            pendingExpiresAt: new Date(this.now() + 300_000).toISOString(), activeExpiresAt: new Date(this.now() + MAX_ACTIVE_MS).toISOString(), state: 'pending',
+        };
+        const envelope = await encryptMcpIdentity(record, privateKey, this.config);
+        await this.pool.query('INSERT INTO mcp_endpoint_identities(owner_id,request_id,grant_id,endpoint_id,envelope,expires_at) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(request_id) DO NOTHING', [ownerId, requestId, record.grantId, identity.endpoint.id, JSON.stringify(envelope), record.activeExpiresAt]);
+        // Reload the winner, including under concurrent consent inspections.
+        return this.ensurePendingIdentity(requestId, ownerId, permissions);
+    }
+    async loadByRequest(ownerId, requestId) {
+        const result = await this.pool.query('SELECT * FROM mcp_endpoint_identities WHERE owner_id=$1 AND request_id=$2', [ownerId, requestId]);
+        if (!result.rows[0])
+            throw safeUnavailable();
+        return decryptMcpIdentity(dbEnvelope(result.rows[0]), this.config);
+    }
+    async loadGrantIdentity(ownerId, grantId) {
+        const result = await this.pool.query('SELECT * FROM mcp_endpoint_identities WHERE owner_id=$1 AND grant_id=$2 AND expires_at>NOW()', [ownerId, grantId]);
+        if (!result.rows[0])
+            throw safeUnavailable();
+        const identity = await decryptMcpIdentity(dbEnvelope(result.rows[0]), this.config);
+        if ((identity.state !== 'approved' && identity.state !== 'active') || Date.parse(identity.activeExpiresAt) <= this.now())
+            throw safeUnavailable();
+        if (identity.state === 'approved' && Date.parse(identity.pendingExpiresAt) <= this.now())
+            throw safeUnavailable();
+        return identity;
+    }
+    /** Caller must verify exact bridge Auth receipts before supplying these pins. */
+    async approve(ownerId, requestId, bridges) {
+        if (!bridges.length)
+            throw safeUnavailable();
+        return this.update(ownerId, requestId, current => {
+            if (current.state !== 'pending' || Date.parse(current.pendingExpiresAt) <= this.now()
+                || bridges.some(bridge => bridge.permissions.some(permission => !current.permissions.includes(permission === 'admin' ? 'control' : permission)) || bridge.permissions.includes('admin')))
+                throw safeUnavailable();
+            return { ...current, state: 'approved', bridges };
+        });
+    }
+    async markActive(ownerId, requestId) {
+        await this.update(ownerId, requestId, current => {
+            if (current.state === 'active' && Date.parse(current.activeExpiresAt) > this.now())
+                return current;
+            if (current.state !== 'approved' || Date.parse(current.pendingExpiresAt) <= this.now())
+                throw safeUnavailable();
+            return { ...current, state: 'active' };
+        });
+    }
+    async revoke(ownerId, requestId) {
+        await this.update(ownerId, requestId, current => ({ ...current, state: 'revoked' }));
+    }
+    async update(ownerId, requestId, change) {
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            const result = await client.query('SELECT * FROM mcp_endpoint_identities WHERE owner_id=$1 AND request_id=$2 FOR UPDATE', [ownerId, requestId]);
+            if (!result.rows[0])
+                throw safeUnavailable();
+            const envelope = dbEnvelope(result.rows[0]);
+            const current = await decryptMcpIdentity(envelope, this.config);
+            const updated = change(current);
+            // Private keys are non-extractable after loading. Recover original plaintext only inside the wrapping boundary.
+            const key = await configKey(this.config);
+            const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: from64(envelope.nonce, 12), additionalData: context(envelope), tagLength: 128 }, key, from64(envelope.ciphertext, 16, MAX_RECORD_BYTES + 16));
+            const original = storedSchema.parse(JSON.parse(new TextDecoder().decode(plain)));
+            const encrypted = await encryptMcpIdentity(updated, original.privateKey, this.config);
+            await client.query('UPDATE mcp_endpoint_identities SET envelope=$1 WHERE owner_id=$2 AND request_id=$3', [JSON.stringify(encrypted), ownerId, requestId]);
+            await client.query('COMMIT');
+            return updated;
+        }
+        catch (error) {
+            await client.query('ROLLBACK');
+            if (error instanceof SecurityError)
+                throw error;
+            throw safeUnavailable();
+        }
+        finally {
+            client.release();
+        }
+    }
+}
+//# sourceMappingURL=mcp-key-store.js.map

package/dist/mcp/mcp-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-key-store.js","sourceRoot":"","sources":["../../src/mcp/mcp-key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGzG,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1P,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzL,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3N,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACvJ,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;CAC7I,CAAC,CAAC,MAAM,EAAE,CAAC;AAkCZ,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;AAC7G,MAAM,GAAG,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5E,SAAS,MAAM,CAAC,KAAa,EAAE,GAAW,EAAE,GAAG,GAAG,GAAG;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,eAAe,EAAE,CAAC;IACnI,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK;QAAE,MAAM,eAAe,EAAE,CAAC;IACpG,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,SAAS,OAAO,CAAC,GAAyB;IACxC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,0BAA0B,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChL,CAAC;AACD,SAAS,SAAS,CAAC,MAA8B;IAC/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,4DAA4D,CAAC,CAAC;IAClM,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/G,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,IAA+B,EAAE,OAAe;IAC1E,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,eAAe,EAAE,CAAC;IAC/K,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC;YAAE,MAAM,eAAe,EAAE,CAAC;QACnM,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,eAAe,EAAE,CAAC;IAClJ,CAAC;AACH,CAAC;AACD,SAAS,MAAM,CAAC,QAA0B,EAAE,UAAsB;IAChE,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;QAC/F,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE;QACjJ,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QACzG,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK;KACjE,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,eAAe,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAA0B,EAAE,UAAsB,EAAE,MAA8B;IACzH,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,MAAM,eAAe,EAAE,CAAC;IACvG,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,UAAU,GAAG,gBAAgB;QAAE,MAAM,eAAe,EAAE,CAAC;IACrE,MAAM,GAAG,GAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAChQ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAChL,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAyB,EAAE,MAA8B;IAChG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,eAAe,EAAE,CAAC;QAC9G,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;QACpM,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,eAAe,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,eAAe,KAAK,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;YAAE,MAAM,eAAe,EAAE,CAAC;QACjS,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxT,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,eAAe,EAAE,CAAC;IAAC,CAAC;AACtC,CAAC;AACD,SAAS,UAAU,CAAC,GAAU;IAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,QAAQ;WAC1H,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QAAE,MAAM,eAAe,EAAE,CAAC;IACrI,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AACD,SAAS,eAAe,CAAC,QAA0B;IACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,gBAAgB,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;AAChO,CAAC;AAED,mFAAmF;AACnF,MAAM,OAAO,WAAW;IAED;IAA6D;IADjE,MAAM,CAAyB;IAChD,YAAqB,IAAU,EAAE,MAA8B,EAAmB,MAAM,IAAI,CAAC,GAAG;QAA3E,SAAI,GAAJ,IAAI,CAAM;QAAmD,QAAG,GAAH,GAAG,CAAW;QAC9F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,4DAA4D,CAAC,CAAC;QAClM,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAAC,CAAC;QAC1I,MAAM,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAAC,CAAC;IAChH,CAAC;IACD,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,OAAe,EAAE,WAAmC;QACjG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAQ,2DAA2D,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACpF,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,eAAe,EAAE,CAAC;YACzM,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrF,MAAM,MAAM,GAAqB;YAC/B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW;YACrF,gBAAgB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS;SACtJ,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gKAAgK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACtS,qEAAqE;QACrE,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,SAAiB;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAQ,2EAA2E,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/I,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,eAAe,EAAE,CAAC;QAC7C,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,OAAe;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAQ,8FAA8F,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,eAAe,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,eAAe,EAAE,CAAC;QAClJ,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,eAAe,EAAE,CAAC;QAClH,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,iFAAiF;IACjF,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAyB;QACzE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,eAAe,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;YAC/C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;mBAChF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,eAAe,EAAE,CAAC;YACpN,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,SAAiB;QACjD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;YAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,OAAO,CAAC;YACnG,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,eAAe,EAAE,CAAC;YAChH,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,SAAiB;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACO,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAuD;QAC9G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAQ,sFAAsF,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YACvJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,MAAM,eAAe,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,gHAAgH;YAChH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/M,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtF,MAAM,MAAM,CAAC,KAAK,CAAC,oFAAoF,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1J,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/mcp/oauth.d.ts

@@ -3,6 +3,7 @@ import type { OAuthServerProvider, AuthorizationParams } from "@modelcontextprot
 import type { OAuthClientInformationFull, OAuthTokenRevocationRequest } from "@modelcontextprotocol/sdk/shared/auth.js";
 import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
 import type { OAuthStore } from "./oauth-store.js";
+import type { McpIdentityStore } from './mcp-key-store.js';
 export declare const MCP_SCOPES: string[];
 export interface OAuthOptions {
     publicUrl: string;
@@ -16,8 +17,9 @@ export interface OAuthOptions {
 export declare class FtownOAuthProvider implements OAuthServerProvider {
     readonly store: OAuthStore;
     readonly options: OAuthOptions;
+    readonly keys?: McpIdentityStore | undefined;
     readonly resource: string;
-    constructor(store: OAuthStore, options: OAuthOptions);
+    constructor(store: OAuthStore, options: OAuthOptions, keys?: McpIdentityStore | undefined);
     private currentMachines;
     readonly clientsStore: {
         getClient: (id: string) => Promise<{
@@ -52,8 +54,10 @@ export declare class FtownOAuthProvider implements OAuthServerProvider {
         redirectUri: string;
         scopes: string[];
         machines: string[];
+        security: import("../security/protocol.js").McpConsentSecurity;
     }>;
     approve(assertion: string, deny?: boolean): Promise<string>;
+    private approvalPins;
     challengeForAuthorizationCode(client: OAuthClientInformationFull, code: string): Promise<string>;
     private tokens;
     exchangeAuthorizationCode(client: OAuthClientInformationFull, code: string, _verifier?: string, redirectUri?: string, resource?: URL): Promise<{

package/dist/mcp/oauth.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
 import jwt from "jsonwebtoken";
 import { InvalidGrantError, InvalidTokenError, InvalidRequestError, InvalidScopeError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { z } from 'zod';
+import { open, parseSecureEnvelope } from '../security/crypto.js';
 const secretToken = () => randomBytes(32).toString("base64url");
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 const now = () => Math.floor(Date.now() / 1000);
@@ -8,10 +10,12 @@ export const MCP_SCOPES = ["mcp:read", "mcp:control"];
 export class FtownOAuthProvider {
     store;
     options;
+    keys;
     resource;
-    constructor(store, options) {
+    constructor(store, options, keys) {
         this.store = store;
         this.options = options;
+        this.keys = keys;
         this.resource = new URL("/mcp", options.publicUrl).href;
     }
     currentMachines(subject) {
@@ -66,6 +70,7 @@ export class FtownOAuthProvider {
             state: params.state,
             scopes,
             resource: this.resource,
+            expiresAt: now() + 600,
         };
         await this.store.transaction((tx) => tx.put("pending", id, pending, now() + 600));
         const consent = new URL("/mcp/consent", this.options.loginUrl);
@@ -92,45 +97,100 @@ export class FtownOAuthProvider {
             pending: await tx.get("pending", claims.request),
             owned: await tx.ownedMachines(claims.sub),
         }));
-        if (!pending || pending.resource !== this.resource)
+        if (!pending || pending.resource !== this.resource || !pending.expiresAt || (pending.subject && pending.subject !== claims.sub))
             throw new InvalidRequestError("Authorization request expired");
+        if (!this.keys)
+            throw new InvalidRequestError('Encrypted MCP identities must be configured');
+        const security = await this.keys.ensurePendingIdentity(claims.request, claims.sub, pending.scopes.includes('mcp:control') ? ['read', 'control'] : ['read']);
+        await this.store.transaction(async (tx) => {
+            const current = await tx.get('pending', claims.request);
+            if (!current || (current.subject && current.subject !== claims.sub))
+                throw new InvalidRequestError('Authorization request expired');
+            await tx.put('pending', claims.request, { ...current, subject: claims.sub, grantId: security.grantId }, current.expiresAt);
+        });
         return {
             clientName: pending.clientName,
             redirectUri: pending.redirectUri,
             scopes: pending.scopes,
             machines: this.currentMachines(claims.sub).filter((m) => owned.includes(m)),
+            security,
         };
     }
     async approve(assertion, deny = false) {
         const claims = this.assertion(assertion, deny ? "deny" : "approve");
-        return this.store.transaction(async (tx) => {
-            const pending = await tx.take("pending", claims.request);
-            if (!pending || pending.resource !== this.resource)
-                throw new InvalidRequestError("Authorization request expired or already handled");
-            const redirect = new URL(pending.redirectUri);
-            if (pending.state !== undefined)
-                redirect.searchParams.set("state", pending.state);
-            redirect.searchParams.set("iss", this.options.publicUrl);
-            if (deny) {
-                redirect.searchParams.set("error", "access_denied");
-                return redirect.href;
-            }
-            const machines = claims.machines;
-            const owned = await tx.ownedMachines(claims.sub);
-            const allowed = this.currentMachines(claims.sub).filter((m) => owned.includes(m));
-            if (!Array.isArray(machines) ||
-                !machines.length ||
-                machines.some((m) => typeof m !== "string" || !allowed.includes(m)))
-                throw new InvalidRequestError("No authorized machines selected");
-            const code = secretToken();
-            await tx.put("code", hash(code), {
-                ...pending,
-                subject: claims.sub,
-                machines: [...new Set(machines)],
-            }, now() + 120);
-            redirect.searchParams.set("code", code);
+        // Never hold an OAuth pool connection while the key store acquires another.
+        const { pending, owned } = await this.store.transaction(async (tx) => ({
+            pending: await tx.get('pending', claims.request),
+            owned: deny ? [] : await tx.ownedMachines(claims.sub),
+        }));
+        if (!pending || pending.resource !== this.resource)
+            throw new InvalidRequestError('Authorization request expired or already handled');
+        const redirect = new URL(pending.redirectUri);
+        if (pending.state !== undefined)
+            redirect.searchParams.set('state', pending.state);
+        redirect.searchParams.set('iss', this.options.publicUrl);
+        if (deny) {
+            await this.store.transaction(async (tx) => {
+                if (!await tx.take('pending', claims.request))
+                    throw new InvalidRequestError('Authorization request expired or already handled');
+            });
+            redirect.searchParams.set('error', 'access_denied');
             return redirect.href;
+        }
+        if (!this.keys || pending.subject !== claims.sub || !pending.grantId)
+            throw new InvalidRequestError('Inspect and approve the encrypted endpoint before continuing');
+        const machines = claims.machines;
+        const allowed = this.currentMachines(claims.sub).filter(machine => owned.includes(machine));
+        if (!Array.isArray(machines) || !machines.length || machines.some(machine => typeof machine !== 'string' || !allowed.includes(machine)))
+            throw new InvalidRequestError('No authorized machines selected');
+        const selected = [...new Set(machines)];
+        if (selected.length > 64)
+            throw new InvalidRequestError('Select at most 64 computers');
+        const identity = await this.keys.loadByRequest(claims.sub, claims.request);
+        if (identity.grantId !== pending.grantId || identity.state !== 'pending' || Date.parse(identity.pendingExpiresAt) <= Date.now())
+            throw new InvalidRequestError('Encrypted endpoint approval expired');
+        const pins = await this.approvalPins(claims.approvals, selected, identity);
+        // The row-locked transition permits one winner. If code persistence fails,
+        // the orphan approval has no usable OAuth token and fresh consent is required.
+        await this.keys.approve(claims.sub, claims.request, pins);
+        const code = secretToken();
+        await this.store.transaction(async (tx) => {
+            const current = await tx.take('pending', claims.request);
+            if (!current || current.subject !== claims.sub || current.grantId !== identity.grantId || JSON.stringify(current) !== JSON.stringify(pending))
+                throw new InvalidRequestError('Authorization request expired or already handled');
+            const currentOwned = await tx.ownedMachines(claims.sub);
+            if (selected.some(machine => !currentOwned.includes(machine) || !this.currentMachines(claims.sub).includes(machine)))
+                throw new InvalidRequestError('Machine access revoked');
+            await tx.put('code', hash(code), { ...current, subject: claims.sub, machines: selected, grantId: identity.grantId, activeExpiresAt: identity.activeExpiresAt }, now() + 120);
         });
+        redirect.searchParams.set('code', code);
+        return redirect.href;
+    }
+    async approvalPins(value, machines, identity) {
+        const endpoint = z.object({ version: z.literal(1), id: z.string().regex(/^[A-Za-z0-9_-]{43}$/), ownerId: z.string().uuid(), kind: z.literal('bridge'), publicKey: z.string().regex(/^[A-Za-z0-9_-]{87}$/) }).strict();
+        const approvals = z.array(z.object({ bridgeId: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/), bridge: endpoint, receipt: z.unknown() }).strict()).min(1).max(64).safeParse(value);
+        if (!approvals.success || approvals.data.length !== machines.length || new Set(approvals.data.map(approval => approval.bridgeId)).size !== machines.length)
+            throw new InvalidRequestError('Every selected bridge must return encrypted approval');
+        const pins = [];
+        for (const approval of approvals.data) {
+            if (!machines.includes(approval.bridgeId) || approval.bridge.ownerId !== identity.ownerId)
+                throw new InvalidRequestError('Bridge approval does not match this account');
+            let receipt;
+            try {
+                const envelope = parseSecureEnvelope(approval.receipt);
+                receipt = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(await open(identity.identity, approval.bridge, envelope, { ownerId: identity.ownerId, bridgeId: approval.bridgeId, channel: `mcp-approval:${approval.bridgeId}:${identity.requestId}`, recipientId: identity.identity.endpoint.id, purpose: 'mcp-approval' })));
+            }
+            catch {
+                throw new InvalidRequestError('Bridge encrypted approval could not be verified');
+            }
+            const parsed = z.object({ type: z.literal('mcp-approval'), approvalId: z.string().min(1).max(200), requestId: z.literal(identity.requestId), ownerId: z.literal(identity.ownerId), grantId: z.literal(identity.grantId), candidateEndpointId: z.literal(identity.identity.endpoint.id), bridgeId: z.literal(approval.bridgeId), bridge: endpoint, permissions: z.array(z.enum(['read', 'control'])).min(1).max(2), expiresAt: z.string().datetime(), activeExpiresAt: z.literal(identity.activeExpiresAt) }).strict().safeParse(receipt);
+            if (!parsed.success || parsed.data.bridge.id !== approval.bridge.id || parsed.data.bridge.publicKey !== approval.bridge.publicKey
+                || [...parsed.data.permissions].sort().join(' ') !== [...identity.permissions].sort().join(' ')
+                || Date.parse(parsed.data.expiresAt) <= Date.now() || Date.parse(parsed.data.expiresAt) > Date.parse(identity.pendingExpiresAt))
+                throw new InvalidRequestError('Bridge approval does not match this consent');
+            pins.push({ bridgeId: approval.bridgeId, endpoint: approval.bridge, permissions: parsed.data.permissions });
+        }
+        return pins;
     }
     async challengeForAuthorizationCode(client, code) {
         const record = await this.store.transaction((tx) => tx.get("code", hash(code)));
@@ -151,22 +211,26 @@ export class FtownOAuthProvider {
         };
     }
     async exchangeAuthorizationCode(client, code, _verifier, redirectUri, resource) {
+        const prepared = await this.store.transaction(tx => tx.get('code', hash(code)));
+        if (!prepared || prepared.clientId !== client.client_id || prepared.redirectUri !== redirectUri || prepared.resource !== this.resource || resource?.href !== this.resource)
+            throw new InvalidGrantError('Invalid code, redirect URI or resource');
+        if (!this.keys || !prepared.grantId || !prepared.activeExpiresAt)
+            throw new InvalidGrantError('Renew consent to authorize an encrypted endpoint');
+        const identity = await this.keys.loadGrantIdentity(prepared.subject, prepared.grantId);
+        if (identity.state !== 'approved' || identity.activeExpiresAt !== prepared.activeExpiresAt)
+            throw new InvalidGrantError('Encrypted endpoint consent is unavailable');
         return this.store.transaction(async (tx) => {
-            const record = await tx.take("code", hash(code));
-            if (!record ||
-                record.clientId !== client.client_id ||
-                record.redirectUri !== redirectUri ||
-                record.resource !== this.resource ||
-                resource?.href !== this.resource)
-                throw new InvalidGrantError("Invalid code, redirect URI or resource");
-            const grantId = secretToken();
+            const record = await tx.take('code', hash(code));
+            if (!record || JSON.stringify(record) !== JSON.stringify(prepared))
+                throw new InvalidGrantError('Invalid or already used authorization code');
+            const grantId = record.grantId;
             const grant = {
                 resource: this.resource,
                 subject: record.subject,
                 machines: record.machines,
                 scopes: record.scopes,
                 clientId: client.client_id,
-                expiresAt: now() + 30 * 86400,
+                expiresAt: Math.floor(Date.parse(record.activeExpiresAt) / 1000),
                 revoked: false,
             };
             await tx.put("grant", grantId, grant, grant.expiresAt);
@@ -201,7 +265,7 @@ export class FtownOAuthProvider {
         return result;
     }
     async verifyAccessToken(token) {
-        return this.store.transaction(async (tx) => {
+        const result = await this.store.transaction(async (tx) => {
             const record = await tx.get("access", hash(token));
             const grant = record && (await tx.get("grant", record.grantId));
             if (!record || !grant || grant.revoked || grant.resource !== this.resource)
@@ -216,9 +280,19 @@ export class FtownOAuthProvider {
                 scopes: record.scopes,
                 expiresAt: record.expiresAt,
                 resource: new URL(this.resource),
-                extra: { subject: grant.subject, machines },
+                extra: { subject: grant.subject, machines, grantId: record.grantId },
             };
         });
+        if (!this.keys)
+            throw new InvalidTokenError('Renew consent to authorize an encrypted endpoint');
+        let identity;
+        try {
+            identity = await this.keys.loadGrantIdentity(result.extra.subject, result.extra.grantId);
+        }
+        catch {
+            throw new InvalidTokenError('Encrypted endpoint approval expired or requires renewed consent');
+        }
+        return { ...result, extra: { ...result.extra, endpointId: identity.identity.endpoint.id } };
     }
     async revokeToken(client, request) {
         await this.store.transaction(async (tx) => {

package/dist/mcp/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,GAAG,MAAM,cAAc,CAAC;AAW/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AAIzD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAoCtD,MAAM,OAAO,kBAAkB;IAGlB;IACA;IAHF,QAAQ,CAAS;IAC1B,YACW,KAAiB,EACjB,OAAqB;QADrB,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAc;QAE9B,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC;IACQ,YAAY,GAAG;QACtB,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CACxB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,EAAE,CAAC,GAAG,CAA6B,QAAQ,EAAE,EAAE,CAAC,CACjD;QACH,cAAc,EAAE,KAAK,EACnB,KAGC,EACoC,EAAE;YACvC,mFAAmF;YACnF,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,KAAK,MAAM;gBAE3C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E,IACE,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;gBAC/B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,OAAO,CACL,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;wBACtC,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;4BACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;gCACrB,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,CACF,CAAC;gBACJ,CAAC,CAAC;gBAEF,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;YACJ,MAAM,MAAM,GAA+B;gBACzC,SAAS,EAAE,WAAW,EAAE;gBACxB,mBAAmB,EAAE,GAAG,EAAE;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7C,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,CAChE,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YACzC,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM;YAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3C,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAY;YACvB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS;YAClD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,OAAuC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAC3D,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC7B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,KAAK,OAAO;YAEzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAChD,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB;SACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAI,GAAG,KAAK;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAChD,MAAM,IAAI,mBAAmB,CAC3B,kDAAkD,CACnD,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC7B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBACpD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB,CAAC;YACF,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACxB,CAAC,QAAQ,CAAC,MAAM;gBAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEnE,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,GAAG,CACV,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,EACV;gBACE,GAAG,OAAO;gBACV,OAAO,EAAE,MAAM,CAAC,GAAI;gBACpB,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;aAClB,EAChB,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;YACF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YACjD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACO,KAAK,CAAC,MAAM,CAClB,EAAoB,EACpB,OAAe,EACf,KAAY,EACZ,MAAgB;QAEhB,MAAM,MAAM,GAAG,WAAW,EAAE,EAC1B,OAAO,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,EACZ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EACrE,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;QACF,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,EACb,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EACzE,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,IAAY,EACZ,SAAkB,EAClB,WAAoB,EACpB,QAAc;QAEd,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IACE,CAAC,MAAM;gBACP,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACpC,MAAM,CAAC,WAAW,KAAK,WAAW;gBAClC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACjC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;gBAEhC,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAU;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,KAAK;aACf,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,KAAa,EACb,MAAiB,EACjB,QAAc;QAEd,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAClC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACjD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC7D,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,uDAAuD;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;YAC1C,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEjD,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,EACX,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EACzB,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACxE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAClB,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE;aAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACxC,MAAM,MAAM,GACV,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC5D,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3C,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,GAAG,MAAM,cAAc,CAAC;AAW/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIlE,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAyCtD,MAAM,OAAO,kBAAkB;IAGlB;IACA;IACA;IAJF,QAAQ,CAAS;IAC1B,YACW,KAAiB,EACjB,OAAqB,EACrB,IAAuB;QAFvB,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAc;QACrB,SAAI,GAAJ,IAAI,CAAmB;QAEhC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IACO,eAAe,CAAC,OAAe;QACrC,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC;IACQ,YAAY,GAAG;QACtB,SAAS,EAAE,CAAC,EAAU,EAAE,EAAE,CACxB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,EAAE,CAAC,GAAG,CAA6B,QAAQ,EAAE,EAAE,CAAC,CACjD;QACH,cAAc,EAAE,KAAK,EACnB,KAGC,EACoC,EAAE;YACvC,mFAAmF;YACnF,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,KAAK,MAAM;gBAE3C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E,IACE,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;gBAC/B,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,OAAO,CACL,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;wBACtC,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;4BACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;gCACrB,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,CACF,CAAC;gBACJ,CAAC,CAAC;gBAEF,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,CAC/C,CAAC;YACJ,MAAM,MAAM,GAA+B;gBACzC,SAAS,EAAE,WAAW,EAAE;gBACxB,mBAAmB,EAAE,GAAG,EAAE;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7C,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,CAChE,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YACzC,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM;YAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3C,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAY;YACvB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS;YAClD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG;SACvB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,OAAuC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAC3D,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC7B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,KAAK,CAAC,OAAO,KAAK,OAAO;YAEzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC;YAC7H,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAI,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7J,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;YACpI,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClB;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAI,GAAG,KAAK;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,4EAA4E;QAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC;SACvD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;QACtI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;YAC5I,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACpD,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,8DAA8D,CAAC,CAAC;QACpK,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;QAC1M,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAa,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;QACtM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3E,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAU,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kDAAkD,CAAC,CAAC;YACjO,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YAC/K,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAiB,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;QAC/L,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACO,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,QAAkB,EAAE,QAAgE;QAC7H,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACtN,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/K,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,sDAAsD,CAAC,CAAC;QAClP,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;YACxK,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACvD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;YACxU,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;YAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzgB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,CAAC,SAAS;mBAC5H,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;mBAC5F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;YAChN,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CACjD,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YACjD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACO,KAAK,CAAC,MAAM,CAClB,EAAoB,EACpB,OAAe,EACf,KAAY,EACZ,MAAgB;QAEhB,MAAM,MAAM,GAAG,WAAW,EAAE,EAC1B,OAAO,GAAG,WAAW,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,CAAC,MAAM,CAAC,EACZ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EACrE,GAAG,EAAE,GAAG,GAAG,CACZ,CAAC;QACF,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,EACb,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EACzE,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,IAAY,EACZ,SAAkB,EAClB,WAAoB,EACpB,QAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;QAClP,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,CAAC,CAAC;QACrK,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAO,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;YAC9I,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,MAAM,KAAK,GAAU;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;gBAChE,OAAO,EAAE,KAAK;aACf,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,KAAa,EACb,MAAiB,EACjB,QAAc;QAEd,IAAI,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC,QAAQ;YAClC,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBACjD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC7D,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,uDAAuD;YACtE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;YAC1C,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEjD,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,CACV,SAAS,EACT,IAAI,CAAC,KAAK,CAAC,EACX,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EACzB,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,CAC9C,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACxE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAClB,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;aACrE,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAChG,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,CAAC;YAAC,MAAM,IAAI,iBAAiB,CAAC,iEAAiE,CAAC,CAAC;QAAC,CAAC;QACzG,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAC9F,CAAC;IACD,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACxC,MAAM,MAAM,GACV,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,CAAC,MAAM,EAAE,CAAC,GAAG,CAAc,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC5D,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAQ,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAC3C,MAAM,EAAE,CAAC,GAAG,CACV,OAAO,EACP,MAAM,CAAC,OAAO,EACd,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC3B,KAAK,CAAC,SAAS,CAChB,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/mcp/relay-handler.d.ts

@@ -1 +1,2 @@
-export declare function createRelayHandler(port: number, token: string): (id: string, payload: Record<string, unknown>) => Promise<unknown>;
+/** Legacy plaintext relay has no execution capability. Native ciphertext uses the verified dispatcher. */
+export declare function createRelayHandler(_port: number, _token: string): (_id: string, _payload: Record<string, unknown>) => Promise<never>;

package/dist/mcp/relay-handler.js

@@ -1,43 +1,8 @@
-import { createHash } from "node:crypto";
-import { requestSchema, httpRequest, errorResult, FleetError, } from "./fleet.js";
-export function createRelayHandler(port, token) {
-    const recent = new Map();
-    return async (id, payload) => {
-        const request = requestSchema.parse(payload.request);
-        if (typeof payload.expiresAt !== "number" ||
-            payload.expiresAt <= Date.now() ||
-            payload.expiresAt > Date.now() + 65000)
-            throw new Error("Expired relay request");
-        const fingerprint = createHash("sha256")
-            .update(JSON.stringify(request))
-            .digest("hex");
-        const existing = recent.get(id);
-        if (existing) {
-            if (existing.fingerprint !== fingerprint)
-                throw new Error("Request ID already used");
-            return existing.promise;
-        }
-        for (const [key, value] of recent)
-            if (value.expires < Date.now())
-                recent.delete(key);
-        if (recent.size >= 10000)
-            throw new Error("Relay request capacity reached");
-        const promise = (async () => {
-            try {
-                const data = await httpRequest(`http://127.0.0.1:${port}`, token, {
-                    ...request,
-                    timeoutMs: Math.max(1000, Math.min(request.timeoutMs, payload.expiresAt - Date.now())),
-                });
-                if (Buffer.byteLength(JSON.stringify(data)) > 400000)
-                    throw new FleetError("response_too_large", "Relay result is too large; request a smaller page", request.method !== "GET");
-                return { data };
-            }
-            catch (e) {
-                return { error: errorResult(e) };
-            }
-        })();
-        recent.set(id, { fingerprint, expires: Date.now() + 120000, promise });
-        return promise;
+import { FleetError } from './fleet.js';
+/** Legacy plaintext relay has no execution capability. Native ciphertext uses the verified dispatcher. */
+export function createRelayHandler(_port, _token) {
+    return async (_id, _payload) => {
+        throw new FleetError('upgrade_required', 'Encrypted endpoint approval is required');
     };
 }
 //# sourceMappingURL=relay-handler.js.map