mcp-use 2.0.0-beta.9 → 2.0.0

package/dist/chunk-DPL7OEXC.js

@@ -1,518 +0,0 @@
-// src/oauth/guards.ts
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isLocalhost(url) {
-  const hostname = url.hostname.toLowerCase();
-  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
-}
-function parseAbsoluteUrl(value, name) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`${name} must be an absolute URL`);
-  }
-  if (url.origin === "null" || url.username !== "" || url.password !== "") {
-    throw new Error(`${name} must be an absolute URL without credentials`);
-  }
-  return url;
-}
-function assertSecureHttpUrl(url, name) {
-  if (url.protocol === "https:") {
-    return;
-  }
-  if (url.protocol === "http:" && isLocalhost(url)) {
-    return;
-  }
-  throw new Error(`${name} must use HTTPS, or HTTP for localhost`);
-}
-
-// src/oauth/jwt.ts
-import {
-  OAuthError,
-  OAuthErrorCode
-} from "@modelcontextprotocol/server";
-import {
-  createRemoteJWKSet,
-  jwtVerify,
-  errors
-} from "jose";
-function createJwtVerifier(options) {
-  const key = options.key ?? createRemoteJWKSet(options.jwksUrl);
-  const configuredResource = canonicalUrl(options.resource);
-  return {
-    async verifyAccessToken(token) {
-      try {
-        const { payload } = await jwtVerify(token, key, {
-          issuer: options.issuer,
-          ...options.algorithms !== void 0 && {
-            algorithms: [...options.algorithms]
-          },
-          requiredClaims: ["exp", "sub"]
-        });
-        const claims = { ...payload };
-        const clientId = requiredString(claims, "client_id") ?? requiredString(claims, "azp");
-        const expiresAt = requiredFutureNumber(claims, "exp");
-        const resource = verifiedResource(claims, configuredResource);
-        return {
-          token,
-          clientId: clientId ?? "",
-          scopes: normalizedStrings(claims["scope"]),
-          expiresAt,
-          extra: { payload: claims },
-          resource
-        };
-      } catch (error) {
-        if (error instanceof OAuthError) {
-          throw error;
-        }
-        if (isCredentialFailure(error)) {
-          if (process.env["MCP_USE_OAUTH_DEBUG"]) {
-            logJwtFailure(token, error);
-          }
-          throw invalidToken("JWT verification failed", error);
-        }
-        throw error;
-      }
-    }
-  };
-}
-function normalizedProviderUrl(value, name) {
-  const raw = typeof value === "string" && !value.includes("://") ? `https://${value}` : value;
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    throw new TypeError(`${name} must be an absolute HTTP(S) URL`);
-  }
-  if (!isAllowedHttpUrl(url)) {
-    throw new TypeError(
-      `${name} must use HTTPS, or HTTP for localhost, without credentials, query, or fragment`
-    );
-  }
-  url.pathname = url.pathname.replace(/\/+$/, "") || "/";
-  return url;
-}
-function providerEndpoint(issuer, path) {
-  const base = new URL(issuer);
-  base.pathname = `${base.pathname.replace(/\/+$/, "")}/`;
-  return new URL(path.replace(/^\/+/, ""), base).href;
-}
-function payloadFromAuthInfo(authInfo) {
-  const payload = authInfo.extra?.["payload"];
-  if (!isRecord(payload)) {
-    throw invalidToken("Verified token payload is missing");
-  }
-  return payload;
-}
-function requiredString(claims, name) {
-  const value = claims[name];
-  return typeof value === "string" && value.trim().length > 0 ? value : void 0;
-}
-function stringValue(claims, name) {
-  const value = claims[name];
-  return typeof value === "string" ? value : void 0;
-}
-function booleanValue(claims, name) {
-  const value = claims[name];
-  return typeof value === "boolean" ? value : void 0;
-}
-function numberValue(claims, name) {
-  const value = claims[name];
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function recordValue(claims, name) {
-  const value = claims[name];
-  return isRecord(value) ? value : void 0;
-}
-function normalizedStrings(value) {
-  if (typeof value === "string") {
-    return value.split(/\s+/).filter(Boolean);
-  }
-  if (!Array.isArray(value)) {
-    return [];
-  }
-  return value.filter(
-    (item) => typeof item === "string" && item.length > 0
-  );
-}
-function requiredFutureNumber(claims, name) {
-  const value = numberValue(claims, name);
-  if (value === void 0 || value <= Date.now() / 1e3) {
-    throw invalidToken(`Missing or expired ${name} claim`);
-  }
-  return value;
-}
-function invalidToken(message, cause) {
-  const error = new OAuthError(OAuthErrorCode.InvalidToken, message);
-  if (cause !== void 0) {
-    error.cause = cause;
-  }
-  return error;
-}
-function verifiedResource(claims, configuredResource) {
-  const value = claims["resource"];
-  if (value !== void 0) {
-    if (typeof value !== "string") {
-      throw invalidToken("Token resource claim must be an absolute URL");
-    }
-    const resource = canonicalUrl(value);
-    if (resource.href !== configuredResource.href) {
-      throw invalidToken(
-        "Token resource claim does not match protected resource"
-      );
-    }
-    return configuredResource;
-  }
-  const audience = claims["aud"];
-  if (!validAudience(audience)) {
-    throw invalidToken("Token audience claim must be a string or string array");
-  }
-  const audiences = typeof audience === "string" ? [audience] : audience;
-  if (!audiences.includes(configuredResource.href)) {
-    throw invalidToken(
-      "Token audience does not include the protected resource"
-    );
-  }
-  return configuredResource;
-}
-function validAudience(value) {
-  return typeof value === "string" || Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string");
-}
-function canonicalUrl(value) {
-  try {
-    const url = new URL(value);
-    if (!isAllowedHttpUrl(url)) {
-      throw new TypeError();
-    }
-    url.pathname = url.pathname === "/" ? "/" : url.pathname.replace(/\/+$/, "");
-    return url;
-  } catch {
-    throw invalidToken(
-      "Token resource claim must be an absolute HTTPS URL, or HTTP URL for localhost"
-    );
-  }
-}
-function isAllowedHttpUrl(url) {
-  return /^https?:$/.test(url.protocol) && !url.username && !url.password && !url.search && !url.hash && (url.protocol !== "http:" || isLocalhost(url));
-}
-function isCredentialFailure(error) {
-  return error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTExpired || error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported || error instanceof errors.JWSInvalid || error instanceof errors.JWTInvalid || error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JWKSNoMatchingKey;
-}
-var JWT_DEBUG_CLAIMS = [
-  "iss",
-  "aud",
-  "azp",
-  "sub",
-  "exp",
-  "iat",
-  "nbf",
-  "client_id",
-  "scope",
-  "typ",
-  "jti"
-];
-function debugErrorText(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function logJwtFailure(token, error) {
-  try {
-    let decodeSegment2 = function(segment, label) {
-      try {
-        return Buffer.from(segment, "base64url").toString("utf8");
-      } catch (decodeError) {
-        console.error(
-          `[oauth-debug] ${label} decode failed: ${debugErrorText(decodeError)}`
-        );
-        return void 0;
-      }
-    };
-    var decodeSegment = decodeSegment2;
-    const name = error instanceof Error ? error.constructor.name : typeof error;
-    console.error(
-      `[oauth-debug] JWT verify failed: ${name}: ${debugErrorText(error)}`
-    );
-    if (error instanceof errors.JWTClaimValidationFailed) {
-      console.error(
-        `[oauth-debug] claim=${error.claim} reason=${error.reason}`
-      );
-    }
-    const segments = token.split(".");
-    console.error(`[oauth-debug] token segments: ${segments.length}`);
-    if (segments.length !== 3) {
-      const preview = token.length > 12 ? `${token.slice(0, 12)}\u2026` : token;
-      console.error(
-        `[oauth-debug] non-JWT token preview=${preview} length=${token.length}`
-      );
-      return;
-    }
-    const headerJson = decodeSegment2(segments[0], "header");
-    if (headerJson !== void 0) {
-      console.error(`[oauth-debug] header=${headerJson}`);
-    }
-    const payloadJson = decodeSegment2(segments[1], "payload");
-    if (payloadJson === void 0) {
-      return;
-    }
-    try {
-      const payload = JSON.parse(payloadJson);
-      const selected = {};
-      for (const claim of JWT_DEBUG_CLAIMS) {
-        if (claim in payload) {
-          selected[claim] = payload[claim];
-        }
-      }
-      selected["now"] = Math.floor(Date.now() / 1e3);
-      console.error(`[oauth-debug] payload=${JSON.stringify(selected)}`);
-    } catch (decodeError) {
-      console.error(
-        `[oauth-debug] payload decode failed: ${debugErrorText(decodeError)}`
-      );
-    }
-  } catch {
-  }
-}
-
-// src/oauth/internal.ts
-function resolveConfiguredOAuthResource(options) {
-  const provider = options.provider;
-  const basePath = normalizeBasePath(options.basePath);
-  if (provider.resource !== void 0) {
-    return validateOAuthResource(provider.resource, basePath);
-  }
-  if (options.mcpUrl !== void 0) {
-    return validateOAuthResource(
-      appendBasePath(
-        requireAbsoluteOrigin(options.mcpUrl, "MCP_URL"),
-        basePath
-      ),
-      basePath
-    );
-  }
-  return void 0;
-}
-function resolveLocalOAuthResource(listenOrigin, basePath) {
-  const listenOriginUrl = requireAbsoluteOrigin(listenOrigin, "listen origin");
-  if (!isLocalhost(listenOriginUrl)) {
-    throw new Error(
-      "OAuth listen origin must be localhost or a loopback address"
-    );
-  }
-  return validateOAuthResource(
-    appendBasePath(listenOriginUrl, normalizeBasePath(basePath)),
-    basePath
-  );
-}
-function validateOAuthResource(resource, basePath) {
-  const normalizedBasePath = normalizeBasePath(basePath);
-  const url = parseAbsoluteUrl(resource, "OAuth resource");
-  if (url.search !== "" || url.hash !== "") {
-    throw new Error(
-      "OAuth resource must not include a query string or fragment"
-    );
-  }
-  assertSecureHttpUrl(url, "OAuth resource");
-  if (normalizePathname(url.pathname) !== normalizedBasePath) {
-    throw new Error(
-      `OAuth resource path must exactly match basePath (${normalizedBasePath})`
-    );
-  }
-  url.pathname = normalizedBasePath;
-  return url;
-}
-function wrapOAuthTokenVerifier(provider, expectedResource) {
-  const canonicalResource = normalizeResourceUrl(expectedResource);
-  const tokenVerifier = provider.createTokenVerifier(
-    new URL(canonicalResource.href)
-  );
-  if (tokenVerifier === null || typeof tokenVerifier !== "object" || typeof tokenVerifier.verifyAccessToken !== "function") {
-    throw new TypeError(
-      "OAuth provider createTokenVerifier must return an OAuthTokenVerifier"
-    );
-  }
-  return {
-    async verifyAccessToken(token) {
-      const authInfo = await tokenVerifier.verifyAccessToken(token);
-      assertVerifiedAuthInfo(authInfo);
-      assertResourceBinding(authInfo, canonicalResource);
-      let mapped;
-      try {
-        mapped = provider.mapAuthInfo(authInfo);
-      } catch (error) {
-        throw invalidToken("Token identity mapping failed", error);
-      }
-      assertMappedExtra(mapped);
-      return {
-        ...authInfo,
-        scopes: [...authInfo.scopes],
-        extra: { ...authInfo.extra, ...mapped }
-      };
-    }
-  };
-}
-function assertResourceBinding(authInfo, expectedResource) {
-  if (authInfo.resource === void 0) {
-    throw invalidToken(
-      "Token verifier did not return a validated protected resource"
-    );
-  }
-  const resource = parseTokenResource(authInfo.resource);
-  if (resource.href !== normalizeResourceUrl(expectedResource).href) {
-    throw invalidToken("Token resource does not match the protected resource");
-  }
-}
-function parseTokenResource(value) {
-  if (!(value instanceof URL)) {
-    throw invalidToken(
-      "Token resource must be an absolute HTTPS URL, or HTTP URL for localhost"
-    );
-  }
-  const resource = value;
-  if (!/^https?:$/.test(resource.protocol) || resource.username !== "" || resource.password !== "" || resource.search !== "" || resource.hash !== "" || resource.protocol === "http:" && !isLocalhost(resource)) {
-    throw invalidToken(
-      "Token resource must be an absolute HTTPS URL, or HTTP URL for localhost"
-    );
-  }
-  return normalizeResourceUrl(resource);
-}
-function normalizeResourceUrl(resource) {
-  const normalized = new URL(resource);
-  normalized.pathname = normalized.pathname === "/" ? "/" : normalized.pathname.replace(/\/+$/, "");
-  return normalized;
-}
-function getOAuthProviderOptions(provider) {
-  return {
-    oauthMetadata: provider.oauthMetadata,
-    ...provider.requiredScopes !== void 0 && {
-      requiredScopes: [...provider.requiredScopes]
-    },
-    ...provider.scopesSupported !== void 0 && {
-      scopesSupported: [...provider.scopesSupported]
-    },
-    ...provider.resourceName !== void 0 && {
-      resourceName: provider.resourceName
-    },
-    ...provider.serviceDocumentationUrl !== void 0 && {
-      serviceDocumentationUrl: provider.serviceDocumentationUrl
-    }
-  };
-}
-function assertVerifiedAuthInfo(authInfo) {
-  if (authInfo === null || typeof authInfo !== "object" || typeof authInfo.token !== "string" || authInfo.token.length === 0 || typeof authInfo.clientId !== "string" || !Array.isArray(authInfo.scopes) || !authInfo.scopes.every((scope) => typeof scope === "string") || typeof authInfo.expiresAt !== "number" || !Number.isFinite(authInfo.expiresAt) || authInfo.expiresAt <= Date.now() / 1e3) {
-    throw invalidToken(
-      "Token verifier returned invalid authentication information"
-    );
-  }
-}
-function assertMappedExtra(mapped) {
-  if (mapped === null || typeof mapped !== "object" || !("user" in mapped) || mapped.user === void 0 || !isRecord(mapped.payload) || !Array.isArray(mapped.permissions) || !mapped.permissions.every((permission) => typeof permission === "string")) {
-    throw invalidToken(
-      "Token identity mapping must return user, payload, and string permissions"
-    );
-  }
-}
-function requireAbsoluteOrigin(value, name) {
-  const url = parseAbsoluteUrl(value, name);
-  if (url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") {
-    throw new Error(`${name} must be an absolute origin without a path`);
-  }
-  return url;
-}
-function appendBasePath(origin, basePath) {
-  const resource = new URL(origin.origin);
-  resource.pathname = basePath;
-  return resource;
-}
-function normalizeBasePath(basePath) {
-  if (!basePath.startsWith("/") || basePath.includes("?") || basePath.includes("#")) {
-    throw new Error("basePath must be an absolute URL pathname");
-  }
-  return normalizePathname(basePath);
-}
-function normalizePathname(pathname) {
-  return pathname === "/" ? "/" : pathname.replace(/\/+$/, "");
-}
-
-// src/oauth/provider.ts
-function oauthCustomProvider(options) {
-  if (options === null || typeof options !== "object" || typeof options.createTokenVerifier !== "function" || typeof options.mapAuthInfo !== "function") {
-    throw new TypeError(
-      "oauthCustomProvider requires createTokenVerifier, oauthMetadata, and mapAuthInfo"
-    );
-  }
-  assertOAuthMetadata(options.oauthMetadata);
-  if (options.resource !== void 0) {
-    assertResourceUrl(options.resource);
-  }
-  assertStringArray(options.requiredScopes, "requiredScopes");
-  assertStringArray(options.scopesSupported, "scopesSupported");
-  if (options.resourceName !== void 0 && (typeof options.resourceName !== "string" || options.resourceName.trim().length === 0)) {
-    throw new TypeError("resourceName must be a non-empty string");
-  }
-  if (options.serviceDocumentationUrl !== void 0) {
-    if (!(options.serviceDocumentationUrl instanceof URL)) {
-      throw new TypeError("serviceDocumentationUrl must be a URL");
-    }
-    assertSecureHttpUrl(
-      options.serviceDocumentationUrl,
-      "serviceDocumentationUrl"
-    );
-  }
-  const provider = {
-    createTokenVerifier: options.createTokenVerifier,
-    oauthMetadata: options.oauthMetadata,
-    mapAuthInfo: options.mapAuthInfo,
-    ...options.resource !== void 0 && { resource: options.resource },
-    ...options.requiredScopes !== void 0 && {
-      requiredScopes: [...options.requiredScopes]
-    },
-    ...options.scopesSupported !== void 0 && {
-      scopesSupported: [...options.scopesSupported]
-    },
-    ...options.resourceName !== void 0 && {
-      resourceName: options.resourceName
-    },
-    ...options.serviceDocumentationUrl !== void 0 && {
-      serviceDocumentationUrl: options.serviceDocumentationUrl
-    }
-  };
-  return provider;
-}
-function assertOAuthMetadata(metadata) {
-  if (metadata === null || typeof metadata !== "object" || !("issuer" in metadata) || typeof metadata.issuer !== "string") {
-    throw new TypeError("oauthMetadata must include a string issuer");
-  }
-  assertSecureHttpUrl(
-    parseAbsoluteUrl(metadata.issuer, "oauthMetadata.issuer"),
-    "oauthMetadata.issuer"
-  );
-}
-function assertResourceUrl(resource) {
-  assertSecureHttpUrl(parseAbsoluteUrl(resource, "resource"), "resource");
-}
-function assertStringArray(value, name) {
-  if (value !== void 0 && (!Array.isArray(value) || !value.every((item) => typeof item === "string"))) {
-    throw new TypeError(`${name} must be an array of strings`);
-  }
-}
-
-export {
-  isRecord,
-  createJwtVerifier,
-  normalizedProviderUrl,
-  providerEndpoint,
-  payloadFromAuthInfo,
-  requiredString,
-  stringValue,
-  booleanValue,
-  recordValue,
-  normalizedStrings,
-  invalidToken,
-  resolveConfiguredOAuthResource,
-  resolveLocalOAuthResource,
-  wrapOAuthTokenVerifier,
-  getOAuthProviderOptions,
-  oauthCustomProvider
-};
-//# sourceMappingURL=chunk-DPL7OEXC.js.map

package/dist/chunk-DPL7OEXC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/oauth/guards.ts","../src/oauth/jwt.ts","../src/oauth/internal.ts","../src/oauth/provider.ts"],"sourcesContent":["/** @internal Narrows unknown values to plain object records. */\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n/** @internal Checks if a URL points to localhost or a loopback address. */\nexport function isLocalhost(url: URL): boolean {\n  const hostname = url.hostname.toLowerCase();\n  return (\n    hostname === \"localhost\" ||\n    hostname.endsWith(\".localhost\") ||\n    hostname === \"[::1]\" ||\n    /^127(?:\\.\\d{1,3}){3}$/.test(hostname)\n  );\n}\n\n/** @internal Parses and validates an absolute URL without credentials. */\nexport function parseAbsoluteUrl(value: string | URL, name: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(`${name} must be an absolute URL`);\n  }\n  if (url.origin === \"null\" || url.username !== \"\" || url.password !== \"\") {\n    throw new Error(`${name} must be an absolute URL without credentials`);\n  }\n  return url;\n}\n\n/** @internal Validates that a URL uses HTTPS, or HTTP for localhost. */\nexport function assertSecureHttpUrl(url: URL, name: string): void {\n  if (url.protocol === \"https:\") {\n    return;\n  }\n  if (url.protocol === \"http:\" && isLocalhost(url)) {\n    return;\n  }\n  throw new Error(`${name} must use HTTPS, or HTTP for localhost`);\n}\n","import {\n  OAuthError,\n  OAuthErrorCode,\n  type AuthInfo,\n  type OAuthTokenVerifier,\n} from \"@modelcontextprotocol/server\";\nimport {\n  createRemoteJWKSet,\n  jwtVerify,\n  errors,\n  type JWTVerifyGetKey,\n} from \"jose\";\n\nimport { isLocalhost, isRecord } from \"./guards.js\";\n\n/** @internal Record of claims extracted from a verified JWT. */\nexport type VerifiedPayload = Record<string, unknown>;\n\n/** @internal Configures issuer, keys, and claims enforced by a JWT verifier. */\nexport interface JwtVerifierOptions {\n  issuer: string;\n  jwksUrl: URL;\n  resource: URL;\n  algorithms?: readonly string[];\n  key?: Uint8Array;\n}\n\n/** @internal Creates a verifier that rejects JWTs with invalid signatures or required claims. */\nexport function createJwtVerifier(\n  options: JwtVerifierOptions\n): OAuthTokenVerifier {\n  // jose overloads key material vs JWKS getters; runtime accepts either.\n  const key = options.key ?? createRemoteJWKSet(options.jwksUrl);\n  const configuredResource = canonicalUrl(options.resource);\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      try {\n        const { payload } = await jwtVerify(token, key as JWTVerifyGetKey, {\n          issuer: options.issuer,\n          ...(options.algorithms !== undefined && {\n            algorithms: [...options.algorithms],\n          }),\n          requiredClaims: [\"exp\", \"sub\"],\n        });\n        const claims: VerifiedPayload = { ...payload };\n        // clientId is only the OAuth client (client_id / azp), never sub.\n        // SDK AuthInfo requires a string, but many IdPs (WorkOS AuthKit,\n        // Supabase) issue tokens without client claims; empty string is mapped\n        // to undefined at the mcp-use context layer.\n        const clientId =\n          requiredString(claims, \"client_id\") ?? requiredString(claims, \"azp\");\n        const expiresAt = requiredFutureNumber(claims, \"exp\");\n        const resource = verifiedResource(claims, configuredResource);\n\n        return {\n          token,\n          clientId: clientId ?? \"\",\n          scopes: normalizedStrings(claims[\"scope\"]),\n          expiresAt,\n          extra: { payload: claims },\n          resource,\n        };\n      } catch (error) {\n        if (error instanceof OAuthError) {\n          throw error;\n        }\n        if (isCredentialFailure(error)) {\n          if (process.env[\"MCP_USE_OAUTH_DEBUG\"]) {\n            logJwtFailure(token, error);\n          }\n          throw invalidToken(\"JWT verification failed\", error);\n        }\n        throw error;\n      }\n    },\n  };\n}\n\n/** Validates and canonicalizes an authorization-server URL before JWKS setup. */\nexport function normalizedProviderUrl(value: URL | string, name: string): URL {\n  const raw =\n    typeof value === \"string\" && !value.includes(\"://\")\n      ? `https://${value}`\n      : value;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    throw new TypeError(`${name} must be an absolute HTTP(S) URL`);\n  }\n  if (!isAllowedHttpUrl(url)) {\n    throw new TypeError(\n      `${name} must use HTTPS, or HTTP for localhost, without credentials, query, or fragment`\n    );\n  }\n  url.pathname = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n  return url;\n}\n\n/** @internal Resolves a provider endpoint without losing an issuer path prefix. */\nexport function providerEndpoint(issuer: string | URL, path: string): string {\n  const base = new URL(issuer);\n  base.pathname = `${base.pathname.replace(/\\/+$/, \"\")}/`;\n  return new URL(path.replace(/^\\/+/, \"\"), base).href;\n}\n\n/** @internal Reads the verified JWT payload from SDK auth information. */\nexport function payloadFromAuthInfo(authInfo: AuthInfo): VerifiedPayload {\n  const payload = authInfo.extra?.[\"payload\"];\n  if (!isRecord(payload)) {\n    throw invalidToken(\"Verified token payload is missing\");\n  }\n  return payload;\n}\n\n/** @internal Returns a non-blank string claim when present. */\nexport function requiredString(\n  claims: VerifiedPayload,\n  name: string\n): string | undefined {\n  const value = claims[name];\n  return typeof value === \"string\" && value.trim().length > 0\n    ? value\n    : undefined;\n}\n\n/** @internal Returns a string claim without coercion. */\nexport function stringValue(\n  claims: VerifiedPayload,\n  name: string\n): string | undefined {\n  const value = claims[name];\n  return typeof value === \"string\" ? value : undefined;\n}\n\n/** @internal Returns a boolean claim without coercion. */\nexport function booleanValue(\n  claims: VerifiedPayload,\n  name: string\n): boolean | undefined {\n  const value = claims[name];\n  return typeof value === \"boolean\" ? value : undefined;\n}\n\n/** @internal Returns a finite numeric claim without coercion. */\nexport function numberValue(\n  claims: VerifiedPayload,\n  name: string\n): number | undefined {\n  const value = claims[name];\n  return typeof value === \"number\" && Number.isFinite(value)\n    ? value\n    : undefined;\n}\n\n/** @internal Returns an object claim and excludes arrays. */\nexport function recordValue(\n  claims: VerifiedPayload,\n  name: string\n): Record<string, unknown> | undefined {\n  const value = claims[name];\n  return isRecord(value) ? value : undefined;\n}\n\n/** @internal Normalizes scope-like strings or arrays into non-empty strings. */\nexport function normalizedStrings(value: unknown): string[] {\n  if (typeof value === \"string\") {\n    return value.split(/\\s+/).filter(Boolean);\n  }\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return value.filter(\n    (item): item is string => typeof item === \"string\" && item.length > 0\n  );\n}\n\n/** @internal Returns a future numeric claim or raises an invalid-token error. */\nexport function requiredFutureNumber(\n  claims: VerifiedPayload,\n  name: string\n): number {\n  const value = numberValue(claims, name);\n  if (value === undefined || value <= Date.now() / 1000) {\n    throw invalidToken(`Missing or expired ${name} claim`);\n  }\n  return value;\n}\n\n/** @internal Creates an OAuth invalid-token error with an optional cause. */\nexport function invalidToken(message: string, cause?: unknown): OAuthError {\n  const error = new OAuthError(OAuthErrorCode.InvalidToken, message);\n  if (cause !== undefined) {\n    error.cause = cause;\n  }\n  return error;\n}\n\nfunction verifiedResource(\n  claims: VerifiedPayload,\n  configuredResource: URL\n): URL {\n  const value = claims[\"resource\"];\n  if (value !== undefined) {\n    if (typeof value !== \"string\") {\n      throw invalidToken(\"Token resource claim must be an absolute URL\");\n    }\n    const resource = canonicalUrl(value);\n    if (resource.href !== configuredResource.href) {\n      throw invalidToken(\n        \"Token resource claim does not match protected resource\"\n      );\n    }\n    return configuredResource;\n  }\n\n  const audience = claims[\"aud\"];\n  if (!validAudience(audience)) {\n    throw invalidToken(\"Token audience claim must be a string or string array\");\n  }\n  const audiences = typeof audience === \"string\" ? [audience] : audience;\n  if (!audiences.includes(configuredResource.href)) {\n    throw invalidToken(\n      \"Token audience does not include the protected resource\"\n    );\n  }\n  return configuredResource;\n}\n\nfunction validAudience(value: unknown): value is string | string[] {\n  return (\n    typeof value === \"string\" ||\n    (Array.isArray(value) &&\n      value.length > 0 &&\n      value.every((item) => typeof item === \"string\"))\n  );\n}\n\nfunction canonicalUrl(value: URL | string): URL {\n  try {\n    const url = new URL(value);\n    if (!isAllowedHttpUrl(url)) {\n      throw new TypeError();\n    }\n    url.pathname =\n      url.pathname === \"/\" ? \"/\" : url.pathname.replace(/\\/+$/, \"\");\n    return url;\n  } catch {\n    throw invalidToken(\n      \"Token resource claim must be an absolute HTTPS URL, or HTTP URL for localhost\"\n    );\n  }\n}\n\n/** Shared URL-shape rules for provider and resource URLs (HTTP only on localhost). */\nfunction isAllowedHttpUrl(url: URL): boolean {\n  return (\n    /^https?:$/.test(url.protocol) &&\n    !url.username &&\n    !url.password &&\n    !url.search &&\n    !url.hash &&\n    (url.protocol !== \"http:\" || isLocalhost(url))\n  );\n}\n\nfunction isCredentialFailure(error: unknown): boolean {\n  return (\n    error instanceof errors.JWTClaimValidationFailed ||\n    error instanceof errors.JWTExpired ||\n    error instanceof errors.JOSEAlgNotAllowed ||\n    error instanceof errors.JOSENotSupported ||\n    error instanceof errors.JWSInvalid ||\n    error instanceof errors.JWTInvalid ||\n    error instanceof errors.JWSSignatureVerificationFailed ||\n    error instanceof errors.JWKSNoMatchingKey\n  );\n}\n\nconst JWT_DEBUG_CLAIMS = [\n  \"iss\",\n  \"aud\",\n  \"azp\",\n  \"sub\",\n  \"exp\",\n  \"iat\",\n  \"nbf\",\n  \"client_id\",\n  \"scope\",\n  \"typ\",\n  \"jti\",\n] as const;\n\nfunction debugErrorText(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction logJwtFailure(token: string, error: unknown): void {\n  try {\n    const name = error instanceof Error ? error.constructor.name : typeof error;\n    console.error(\n      `[oauth-debug] JWT verify failed: ${name}: ${debugErrorText(error)}`\n    );\n    if (error instanceof errors.JWTClaimValidationFailed) {\n      console.error(\n        `[oauth-debug] claim=${error.claim} reason=${error.reason}`\n      );\n    }\n\n    const segments = token.split(\".\");\n    console.error(`[oauth-debug] token segments: ${segments.length}`);\n    if (segments.length !== 3) {\n      const preview = token.length > 12 ? `${token.slice(0, 12)}…` : token;\n      console.error(\n        `[oauth-debug] non-JWT token preview=${preview} length=${token.length}`\n      );\n      return;\n    }\n\n    function decodeSegment(segment: string, label: string): string | undefined {\n      try {\n        return Buffer.from(segment, \"base64url\").toString(\"utf8\");\n      } catch (decodeError) {\n        console.error(\n          `[oauth-debug] ${label} decode failed: ${debugErrorText(decodeError)}`\n        );\n        return undefined;\n      }\n    }\n\n    const headerJson = decodeSegment(segments[0]!, \"header\");\n    if (headerJson !== undefined) {\n      console.error(`[oauth-debug] header=${headerJson}`);\n    }\n\n    const payloadJson = decodeSegment(segments[1]!, \"payload\");\n    if (payloadJson === undefined) {\n      return;\n    }\n    try {\n      const payload = JSON.parse(payloadJson) as Record<string, unknown>;\n      const selected: Record<string, unknown> = {};\n      for (const claim of JWT_DEBUG_CLAIMS) {\n        if (claim in payload) {\n          selected[claim] = payload[claim];\n        }\n      }\n      selected[\"now\"] = Math.floor(Date.now() / 1000);\n      console.error(`[oauth-debug] payload=${JSON.stringify(selected)}`);\n    } catch (decodeError) {\n      console.error(\n        `[oauth-debug] payload decode failed: ${debugErrorText(decodeError)}`\n      );\n    }\n  } catch {\n    // never throw from debug logging\n  }\n}\n","import type {\n  AuthInfo,\n  OAuthTokenVerifier,\n} from \"@modelcontextprotocol/server\";\n\nimport {\n  assertSecureHttpUrl,\n  isLocalhost,\n  isRecord,\n  parseAbsoluteUrl,\n} from \"./guards.js\";\nimport { invalidToken } from \"./jwt.js\";\nimport type { OAuthExtra, OAuthProvider } from \"./provider.js\";\n\nexport {\n  assertSecureHttpUrl,\n  isLocalhost,\n  parseAbsoluteUrl,\n} from \"./guards.js\";\n\n/** @internal Resolves configured resource identity, or undefined when none is configured. */\nexport function resolveConfiguredOAuthResource<TUser>(options: {\n  provider: OAuthProvider<TUser>;\n  basePath: string;\n  mcpUrl?: string | URL;\n}): URL | undefined {\n  const provider = options.provider;\n  const basePath = normalizeBasePath(options.basePath);\n  if (provider.resource !== undefined) {\n    return validateOAuthResource(provider.resource, basePath);\n  }\n  if (options.mcpUrl !== undefined) {\n    return validateOAuthResource(\n      appendBasePath(\n        requireAbsoluteOrigin(options.mcpUrl, \"MCP_URL\"),\n        basePath\n      ),\n      basePath\n    );\n  }\n  return undefined;\n}\n\n/** @internal Resolves a canonical resource from a trusted local listener. */\nexport function resolveLocalOAuthResource(\n  listenOrigin: string | URL,\n  basePath: string\n): URL {\n  const listenOriginUrl = requireAbsoluteOrigin(listenOrigin, \"listen origin\");\n  if (!isLocalhost(listenOriginUrl)) {\n    throw new Error(\n      \"OAuth listen origin must be localhost or a loopback address\"\n    );\n  }\n  return validateOAuthResource(\n    appendBasePath(listenOriginUrl, normalizeBasePath(basePath)),\n    basePath\n  );\n}\n\n/** @internal Validates and canonicalizes one resource-server URL. */\nexport function validateOAuthResource(\n  resource: URL | string,\n  basePath: string\n): URL {\n  const normalizedBasePath = normalizeBasePath(basePath);\n  const url = parseAbsoluteUrl(resource, \"OAuth resource\");\n  if (url.search !== \"\" || url.hash !== \"\") {\n    throw new Error(\n      \"OAuth resource must not include a query string or fragment\"\n    );\n  }\n  assertSecureHttpUrl(url, \"OAuth resource\");\n  if (normalizePathname(url.pathname) !== normalizedBasePath) {\n    throw new Error(\n      `OAuth resource path must exactly match basePath (${normalizedBasePath})`\n    );\n  }\n  url.pathname = normalizedBasePath;\n  return url;\n}\n\n/** @internal Wraps a provider verifier with mcp-use's verified auth mapping. */\nexport function wrapOAuthTokenVerifier<TUser>(\n  provider: OAuthProvider<TUser>,\n  expectedResource: URL\n): OAuthTokenVerifier {\n  const canonicalResource = normalizeResourceUrl(expectedResource);\n  const tokenVerifier = provider.createTokenVerifier(\n    new URL(canonicalResource.href)\n  );\n  if (\n    tokenVerifier === null ||\n    typeof tokenVerifier !== \"object\" ||\n    typeof tokenVerifier.verifyAccessToken !== \"function\"\n  ) {\n    throw new TypeError(\n      \"OAuth provider createTokenVerifier must return an OAuthTokenVerifier\"\n    );\n  }\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      const authInfo = await tokenVerifier.verifyAccessToken(token);\n      assertVerifiedAuthInfo(authInfo);\n      assertResourceBinding(authInfo, canonicalResource);\n\n      let mapped: OAuthExtra<TUser>;\n      try {\n        mapped = provider.mapAuthInfo(authInfo);\n      } catch (error) {\n        throw invalidToken(\"Token identity mapping failed\", error);\n      }\n      assertMappedExtra(mapped);\n\n      return {\n        ...authInfo,\n        scopes: [...authInfo.scopes],\n        extra: { ...authInfo.extra, ...mapped },\n      };\n    },\n  };\n}\n\nfunction assertResourceBinding(\n  authInfo: AuthInfo,\n  expectedResource: URL\n): void {\n  if (authInfo.resource === undefined) {\n    throw invalidToken(\n      \"Token verifier did not return a validated protected resource\"\n    );\n  }\n  const resource = parseTokenResource(authInfo.resource);\n  if (resource.href !== normalizeResourceUrl(expectedResource).href) {\n    throw invalidToken(\"Token resource does not match the protected resource\");\n  }\n}\n\nfunction parseTokenResource(value: unknown): URL {\n  if (!(value instanceof URL)) {\n    throw invalidToken(\n      \"Token resource must be an absolute HTTPS URL, or HTTP URL for localhost\"\n    );\n  }\n  const resource = value;\n  if (\n    !/^https?:$/.test(resource.protocol) ||\n    resource.username !== \"\" ||\n    resource.password !== \"\" ||\n    resource.search !== \"\" ||\n    resource.hash !== \"\" ||\n    (resource.protocol === \"http:\" && !isLocalhost(resource))\n  ) {\n    throw invalidToken(\n      \"Token resource must be an absolute HTTPS URL, or HTTP URL for localhost\"\n    );\n  }\n  return normalizeResourceUrl(resource);\n}\n\nfunction normalizeResourceUrl(resource: URL): URL {\n  const normalized = new URL(resource);\n  normalized.pathname =\n    normalized.pathname === \"/\" ? \"/\" : normalized.pathname.replace(/\\/+$/, \"\");\n  return normalized;\n}\n\n/** @internal Gets immutable provider metadata for Hono adapter wiring. */\nexport function getOAuthProviderOptions<TUser>(\n  provider: OAuthProvider<TUser>\n): {\n  oauthMetadata: OAuthProvider<TUser>[\"oauthMetadata\"];\n  requiredScopes?: string[];\n  scopesSupported?: string[];\n  resourceName?: string;\n  serviceDocumentationUrl?: URL;\n} {\n  return {\n    oauthMetadata: provider.oauthMetadata,\n    ...(provider.requiredScopes !== undefined && {\n      requiredScopes: [...provider.requiredScopes],\n    }),\n    ...(provider.scopesSupported !== undefined && {\n      scopesSupported: [...provider.scopesSupported],\n    }),\n    ...(provider.resourceName !== undefined && {\n      resourceName: provider.resourceName,\n    }),\n    ...(provider.serviceDocumentationUrl !== undefined && {\n      serviceDocumentationUrl: provider.serviceDocumentationUrl,\n    }),\n  };\n}\n\nfunction assertVerifiedAuthInfo(\n  authInfo: AuthInfo\n): asserts authInfo is AuthInfo {\n  if (\n    authInfo === null ||\n    typeof authInfo !== \"object\" ||\n    typeof authInfo.token !== \"string\" ||\n    authInfo.token.length === 0 ||\n    typeof authInfo.clientId !== \"string\" ||\n    !Array.isArray(authInfo.scopes) ||\n    !authInfo.scopes.every((scope) => typeof scope === \"string\") ||\n    typeof authInfo.expiresAt !== \"number\" ||\n    !Number.isFinite(authInfo.expiresAt) ||\n    authInfo.expiresAt <= Date.now() / 1000\n  ) {\n    throw invalidToken(\n      \"Token verifier returned invalid authentication information\"\n    );\n  }\n}\n\nfunction assertMappedExtra<TUser>(\n  mapped: OAuthExtra<TUser>\n): asserts mapped is OAuthExtra<TUser> {\n  if (\n    mapped === null ||\n    typeof mapped !== \"object\" ||\n    !(\"user\" in mapped) ||\n    mapped.user === undefined ||\n    !isRecord(mapped.payload) ||\n    !Array.isArray(mapped.permissions) ||\n    !mapped.permissions.every((permission) => typeof permission === \"string\")\n  ) {\n    throw invalidToken(\n      \"Token identity mapping must return user, payload, and string permissions\"\n    );\n  }\n}\n\nfunction requireAbsoluteOrigin(value: string | URL, name: string): URL {\n  const url = parseAbsoluteUrl(value, name);\n  if (\n    url.pathname !== \"/\" ||\n    url.search !== \"\" ||\n    url.hash !== \"\" ||\n    url.username !== \"\" ||\n    url.password !== \"\"\n  ) {\n    throw new Error(`${name} must be an absolute origin without a path`);\n  }\n  return url;\n}\n\nfunction appendBasePath(origin: URL, basePath: string): URL {\n  const resource = new URL(origin.origin);\n  resource.pathname = basePath;\n  return resource;\n}\n\nfunction normalizeBasePath(basePath: string): string {\n  if (\n    !basePath.startsWith(\"/\") ||\n    basePath.includes(\"?\") ||\n    basePath.includes(\"#\")\n  ) {\n    throw new Error(\"basePath must be an absolute URL pathname\");\n  }\n  return normalizePathname(basePath);\n}\n\nfunction normalizePathname(pathname: string): string {\n  return pathname === \"/\" ? \"/\" : pathname.replace(/\\/+$/, \"\");\n}\n","import type {\n  AuthInfo as OAuthAuthInfo,\n  OAuthMetadata,\n  OAuthTokenVerifier,\n} from \"@modelcontextprotocol/server\";\n\nimport { assertSecureHttpUrl, parseAbsoluteUrl } from \"./internal.js\";\n\n/** Additional verified identity information exposed by mcp-use callbacks. */\nexport type OAuthExtra<TUser> = Record<string, unknown> & {\n  /** The authenticated application user. */\n  user: TUser;\n  /** Verified token claims or introspection data. */\n  payload: Record<string, unknown>;\n  /** Verified permissions granted to the user. */\n  permissions: string[];\n};\n\n/** Resource-server metadata and bearer-gate configuration. */\nexport interface OAuthResourceOptions {\n  /** Full canonical public MCP endpoint URL. */\n  resource?: URL | string;\n  /** Endpoint-wide scopes enforced by the SDK bearer gate. */\n  requiredScopes?: readonly string[];\n  /** Scopes advertised by protected-resource metadata. */\n  scopesSupported?: readonly string[];\n  /** Human-readable name advertised by protected-resource metadata. */\n  resourceName?: string;\n  /** Documentation URL advertised by protected-resource metadata. */\n  serviceDocumentationUrl?: URL;\n}\n\n/** Options for {@link oauthCustomProvider}. */\nexport interface CustomOAuthProviderOptions<\n  TUser,\n> extends OAuthResourceOptions {\n  /** Creates a verifier bound to the resolved canonical MCP resource. */\n  createTokenVerifier: (resource: URL) => OAuthTokenVerifier;\n  /** RFC 8414 metadata for the external authorization server. */\n  oauthMetadata: OAuthMetadata;\n  /** Maps verified SDK auth information into mcp-use callback identity data. */\n  mapAuthInfo: (authInfo: OAuthAuthInfo) => OAuthExtra<TUser>;\n}\n\n/** OAuth resource-server provider accepted by {@link MCPServer}. */\nexport type OAuthProvider<TUser> = CustomOAuthProviderOptions<TUser>;\n\n/**\n * Creates an OAuth provider backed by an external authorization server.\n *\n * @typeParam TUser - Application user type exposed to authenticated callbacks.\n * @param options - Token verification, discovery metadata, and identity mapping.\n * @returns A provider for an OAuth-enabled MCP server.\n */\nexport function oauthCustomProvider<TUser>(\n  options: CustomOAuthProviderOptions<TUser>\n): OAuthProvider<TUser> {\n  if (\n    options === null ||\n    typeof options !== \"object\" ||\n    typeof options.createTokenVerifier !== \"function\" ||\n    typeof options.mapAuthInfo !== \"function\"\n  ) {\n    throw new TypeError(\n      \"oauthCustomProvider requires createTokenVerifier, oauthMetadata, and mapAuthInfo\"\n    );\n  }\n\n  assertOAuthMetadata(options.oauthMetadata);\n  if (options.resource !== undefined) {\n    assertResourceUrl(options.resource);\n  }\n  assertStringArray(options.requiredScopes, \"requiredScopes\");\n  assertStringArray(options.scopesSupported, \"scopesSupported\");\n  if (\n    options.resourceName !== undefined &&\n    (typeof options.resourceName !== \"string\" ||\n      options.resourceName.trim().length === 0)\n  ) {\n    throw new TypeError(\"resourceName must be a non-empty string\");\n  }\n  if (options.serviceDocumentationUrl !== undefined) {\n    if (!(options.serviceDocumentationUrl instanceof URL)) {\n      throw new TypeError(\"serviceDocumentationUrl must be a URL\");\n    }\n    assertSecureHttpUrl(\n      options.serviceDocumentationUrl,\n      \"serviceDocumentationUrl\"\n    );\n  }\n\n  const provider: OAuthProvider<TUser> = {\n    createTokenVerifier: options.createTokenVerifier,\n    oauthMetadata: options.oauthMetadata,\n    mapAuthInfo: options.mapAuthInfo,\n    ...(options.resource !== undefined && { resource: options.resource }),\n    ...(options.requiredScopes !== undefined && {\n      requiredScopes: [...options.requiredScopes],\n    }),\n    ...(options.scopesSupported !== undefined && {\n      scopesSupported: [...options.scopesSupported],\n    }),\n    ...(options.resourceName !== undefined && {\n      resourceName: options.resourceName,\n    }),\n    ...(options.serviceDocumentationUrl !== undefined && {\n      serviceDocumentationUrl: options.serviceDocumentationUrl,\n    }),\n  };\n  return provider;\n}\n\nfunction assertOAuthMetadata(\n  metadata: unknown\n): asserts metadata is OAuthMetadata {\n  if (\n    metadata === null ||\n    typeof metadata !== \"object\" ||\n    !(\"issuer\" in metadata) ||\n    typeof metadata.issuer !== \"string\"\n  ) {\n    throw new TypeError(\"oauthMetadata must include a string issuer\");\n  }\n  assertSecureHttpUrl(\n    parseAbsoluteUrl(metadata.issuer, \"oauthMetadata.issuer\"),\n    \"oauthMetadata.issuer\"\n  );\n}\n\nfunction assertResourceUrl(resource: URL | string): void {\n  assertSecureHttpUrl(parseAbsoluteUrl(resource, \"resource\"), \"resource\");\n}\n\nfunction assertStringArray(\n  value: readonly string[] | undefined,\n  name: string\n): void {\n  if (\n    value !== undefined &&\n    (!Array.isArray(value) || !value.every((item) => typeof item === \"string\"))\n  ) {\n    throw new TypeError(`${name} must be an array of strings`);\n  }\n}\n"],"mappings":";AACO,SAAS,SAAS,OAAkD;AACzE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAGO,SAAS,YAAY,KAAmB;AAC7C,QAAM,WAAW,IAAI,SAAS,YAAY;AAC1C,SACE,aAAa,eACb,SAAS,SAAS,YAAY,KAC9B,aAAa,WACb,wBAAwB,KAAK,QAAQ;AAEzC;AAGO,SAAS,iBAAiB,OAAqB,MAAmB;AACvE,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AAAA,EACnD;AACA,MAAI,IAAI,WAAW,UAAU,IAAI,aAAa,MAAM,IAAI,aAAa,IAAI;AACvE,UAAM,IAAI,MAAM,GAAG,IAAI,8CAA8C;AAAA,EACvE;AACA,SAAO;AACT;AAGO,SAAS,oBAAoB,KAAU,MAAoB;AAChE,MAAI,IAAI,aAAa,UAAU;AAC7B;AAAA,EACF;AACA,MAAI,IAAI,aAAa,WAAW,YAAY,GAAG,GAAG;AAChD;AAAA,EACF;AACA,QAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC;AACjE;;;ACvCA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAiBA,SAAS,kBACd,SACoB;AAEpB,QAAM,MAAM,QAAQ,OAAO,mBAAmB,QAAQ,OAAO;AAC7D,QAAM,qBAAqB,aAAa,QAAQ,QAAQ;AAExD,SAAO;AAAA,IACL,MAAM,kBAAkB,OAAkC;AACxD,UAAI;AACF,cAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,KAAwB;AAAA,UACjE,QAAQ,QAAQ;AAAA,UAChB,GAAI,QAAQ,eAAe,UAAa;AAAA,YACtC,YAAY,CAAC,GAAG,QAAQ,UAAU;AAAA,UACpC;AAAA,UACA,gBAAgB,CAAC,OAAO,KAAK;AAAA,QAC/B,CAAC;AACD,cAAM,SAA0B,EAAE,GAAG,QAAQ;AAK7C,cAAM,WACJ,eAAe,QAAQ,WAAW,KAAK,eAAe,QAAQ,KAAK;AACrE,cAAM,YAAY,qBAAqB,QAAQ,KAAK;AACpD,cAAM,WAAW,iBAAiB,QAAQ,kBAAkB;AAE5D,eAAO;AAAA,UACL;AAAA,UACA,UAAU,YAAY;AAAA,UACtB,QAAQ,kBAAkB,OAAO,OAAO,CAAC;AAAA,UACzC;AAAA,UACA,OAAO,EAAE,SAAS,OAAO;AAAA,UACzB;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,YAAY;AAC/B,gBAAM;AAAA,QACR;AACA,YAAI,oBAAoB,KAAK,GAAG;AAC9B,cAAI,QAAQ,IAAI,qBAAqB,GAAG;AACtC,0BAAc,OAAO,KAAK;AAAA,UAC5B;AACA,gBAAM,aAAa,2BAA2B,KAAK;AAAA,QACrD;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,sBAAsB,OAAqB,MAAmB;AAC5E,QAAM,MACJ,OAAO,UAAU,YAAY,CAAC,MAAM,SAAS,KAAK,IAC9C,WAAW,KAAK,KAChB;AACN,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,IAAI,kCAAkC;AAAA,EAC/D;AACA,MAAI,CAAC,iBAAiB,GAAG,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI,WAAW,IAAI,SAAS,QAAQ,QAAQ,EAAE,KAAK;AACnD,SAAO;AACT;AAGO,SAAS,iBAAiB,QAAsB,MAAsB;AAC3E,QAAM,OAAO,IAAI,IAAI,MAAM;AAC3B,OAAK,WAAW,GAAG,KAAK,SAAS,QAAQ,QAAQ,EAAE,CAAC;AACpD,SAAO,IAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE,GAAG,IAAI,EAAE;AACjD;AAGO,SAAS,oBAAoB,UAAqC;AACvE,QAAM,UAAU,SAAS,QAAQ,SAAS;AAC1C,MAAI,CAAC,SAAS,OAAO,GAAG;AACtB,UAAM,aAAa,mCAAmC;AAAA,EACxD;AACA,SAAO;AACT;AAGO,SAAS,eACd,QACA,MACoB;AACpB,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IACtD,QACA;AACN;AAGO,SAAS,YACd,QACA,MACoB;AACpB,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAGO,SAAS,aACd,QACA,MACqB;AACrB,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,OAAO,UAAU,YAAY,QAAQ;AAC9C;AAGO,SAAS,YACd,QACA,MACoB;AACpB,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IACrD,QACA;AACN;AAGO,SAAS,YACd,QACA,MACqC;AACrC,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,SAAS,KAAK,IAAI,QAAQ;AACnC;AAGO,SAAS,kBAAkB,OAA0B;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO;AAAA,EAC1C;AACA,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,MAAM;AAAA,IACX,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,EACtE;AACF;AAGO,SAAS,qBACd,QACA,MACQ;AACR,QAAM,QAAQ,YAAY,QAAQ,IAAI;AACtC,MAAI,UAAU,UAAa,SAAS,KAAK,IAAI,IAAI,KAAM;AACrD,UAAM,aAAa,sBAAsB,IAAI,QAAQ;AAAA,EACvD;AACA,SAAO;AACT;AAGO,SAAS,aAAa,SAAiB,OAA6B;AACzE,QAAM,QAAQ,IAAI,WAAW,eAAe,cAAc,OAAO;AACjE,MAAI,UAAU,QAAW;AACvB,UAAM,QAAQ;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,iBACP,QACA,oBACK;AACL,QAAM,QAAQ,OAAO,UAAU;AAC/B,MAAI,UAAU,QAAW;AACvB,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,aAAa,8CAA8C;AAAA,IACnE;AACA,UAAM,WAAW,aAAa,KAAK;AACnC,QAAI,SAAS,SAAS,mBAAmB,MAAM;AAC7C,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,cAAc,QAAQ,GAAG;AAC5B,UAAM,aAAa,uDAAuD;AAAA,EAC5E;AACA,QAAM,YAAY,OAAO,aAAa,WAAW,CAAC,QAAQ,IAAI;AAC9D,MAAI,CAAC,UAAU,SAAS,mBAAmB,IAAI,GAAG;AAChD,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,SACE,OAAO,UAAU,YAChB,MAAM,QAAQ,KAAK,KAClB,MAAM,SAAS,KACf,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ;AAEpD;AAEA,SAAS,aAAa,OAA0B;AAC9C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,iBAAiB,GAAG,GAAG;AAC1B,YAAM,IAAI,UAAU;AAAA,IACtB;AACA,QAAI,WACF,IAAI,aAAa,MAAM,MAAM,IAAI,SAAS,QAAQ,QAAQ,EAAE;AAC9D,WAAO;AAAA,EACT,QAAQ;AACN,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,KAAmB;AAC3C,SACE,YAAY,KAAK,IAAI,QAAQ,KAC7B,CAAC,IAAI,YACL,CAAC,IAAI,YACL,CAAC,IAAI,UACL,CAAC,IAAI,SACJ,IAAI,aAAa,WAAW,YAAY,GAAG;AAEhD;AAEA,SAAS,oBAAoB,OAAyB;AACpD,SACE,iBAAiB,OAAO,4BACxB,iBAAiB,OAAO,cACxB,iBAAiB,OAAO,qBACxB,iBAAiB,OAAO,oBACxB,iBAAiB,OAAO,cACxB,iBAAiB,OAAO,cACxB,iBAAiB,OAAO,kCACxB,iBAAiB,OAAO;AAE5B;AAEA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,cAAc,OAAe,OAAsB;AAC1D,MAAI;AAqBF,QAASA,iBAAT,SAAuB,SAAiB,OAAmC;AACzE,UAAI;AACF,eAAO,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM;AAAA,MAC1D,SAAS,aAAa;AACpB,gBAAQ;AAAA,UACN,iBAAiB,KAAK,mBAAmB,eAAe,WAAW,CAAC;AAAA,QACtE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AATS,wBAAAA;AApBT,UAAM,OAAO,iBAAiB,QAAQ,MAAM,YAAY,OAAO,OAAO;AACtE,YAAQ;AAAA,MACN,oCAAoC,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACpE;AACA,QAAI,iBAAiB,OAAO,0BAA0B;AACpD,cAAQ;AAAA,QACN,uBAAuB,MAAM,KAAK,WAAW,MAAM,MAAM;AAAA,MAC3D;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG;AAChC,YAAQ,MAAM,iCAAiC,SAAS,MAAM,EAAE;AAChE,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,UAAU,MAAM,SAAS,KAAK,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,WAAM;AAC/D,cAAQ;AAAA,QACN,uCAAuC,OAAO,WAAW,MAAM,MAAM;AAAA,MACvE;AACA;AAAA,IACF;AAaA,UAAM,aAAaA,eAAc,SAAS,CAAC,GAAI,QAAQ;AACvD,QAAI,eAAe,QAAW;AAC5B,cAAQ,MAAM,wBAAwB,UAAU,EAAE;AAAA,IACpD;AAEA,UAAM,cAAcA,eAAc,SAAS,CAAC,GAAI,SAAS;AACzD,QAAI,gBAAgB,QAAW;AAC7B;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,WAAW;AACtC,YAAM,WAAoC,CAAC;AAC3C,iBAAW,SAAS,kBAAkB;AACpC,YAAI,SAAS,SAAS;AACpB,mBAAS,KAAK,IAAI,QAAQ,KAAK;AAAA,QACjC;AAAA,MACF;AACA,eAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC9C,cAAQ,MAAM,yBAAyB,KAAK,UAAU,QAAQ,CAAC,EAAE;AAAA,IACnE,SAAS,aAAa;AACpB,cAAQ;AAAA,QACN,wCAAwC,eAAe,WAAW,CAAC;AAAA,MACrE;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACF;;;ACjVO,SAAS,+BAAsC,SAIlC;AAClB,QAAM,WAAW,QAAQ;AACzB,QAAM,WAAW,kBAAkB,QAAQ,QAAQ;AACnD,MAAI,SAAS,aAAa,QAAW;AACnC,WAAO,sBAAsB,SAAS,UAAU,QAAQ;AAAA,EAC1D;AACA,MAAI,QAAQ,WAAW,QAAW;AAChC,WAAO;AAAA,MACL;AAAA,QACE,sBAAsB,QAAQ,QAAQ,SAAS;AAAA,QAC/C;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,0BACd,cACA,UACK;AACL,QAAM,kBAAkB,sBAAsB,cAAc,eAAe;AAC3E,MAAI,CAAC,YAAY,eAAe,GAAG;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,eAAe,iBAAiB,kBAAkB,QAAQ,CAAC;AAAA,IAC3D;AAAA,EACF;AACF;AAGO,SAAS,sBACd,UACA,UACK;AACL,QAAM,qBAAqB,kBAAkB,QAAQ;AACrD,QAAM,MAAM,iBAAiB,UAAU,gBAAgB;AACvD,MAAI,IAAI,WAAW,MAAM,IAAI,SAAS,IAAI;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,sBAAoB,KAAK,gBAAgB;AACzC,MAAI,kBAAkB,IAAI,QAAQ,MAAM,oBAAoB;AAC1D,UAAM,IAAI;AAAA,MACR,oDAAoD,kBAAkB;AAAA,IACxE;AAAA,EACF;AACA,MAAI,WAAW;AACf,SAAO;AACT;AAGO,SAAS,uBACd,UACA,kBACoB;AACpB,QAAM,oBAAoB,qBAAqB,gBAAgB;AAC/D,QAAM,gBAAgB,SAAS;AAAA,IAC7B,IAAI,IAAI,kBAAkB,IAAI;AAAA,EAChC;AACA,MACE,kBAAkB,QAClB,OAAO,kBAAkB,YACzB,OAAO,cAAc,sBAAsB,YAC3C;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB,OAAkC;AACxD,YAAM,WAAW,MAAM,cAAc,kBAAkB,KAAK;AAC5D,6BAAuB,QAAQ;AAC/B,4BAAsB,UAAU,iBAAiB;AAEjD,UAAI;AACJ,UAAI;AACF,iBAAS,SAAS,YAAY,QAAQ;AAAA,MACxC,SAAS,OAAO;AACd,cAAM,aAAa,iCAAiC,KAAK;AAAA,MAC3D;AACA,wBAAkB,MAAM;AAExB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,CAAC,GAAG,SAAS,MAAM;AAAA,QAC3B,OAAO,EAAE,GAAG,SAAS,OAAO,GAAG,OAAO;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBACP,UACA,kBACM;AACN,MAAI,SAAS,aAAa,QAAW;AACnC,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,mBAAmB,SAAS,QAAQ;AACrD,MAAI,SAAS,SAAS,qBAAqB,gBAAgB,EAAE,MAAM;AACjE,UAAM,aAAa,sDAAsD;AAAA,EAC3E;AACF;AAEA,SAAS,mBAAmB,OAAqB;AAC/C,MAAI,EAAE,iBAAiB,MAAM;AAC3B,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW;AACjB,MACE,CAAC,YAAY,KAAK,SAAS,QAAQ,KACnC,SAAS,aAAa,MACtB,SAAS,aAAa,MACtB,SAAS,WAAW,MACpB,SAAS,SAAS,MACjB,SAAS,aAAa,WAAW,CAAC,YAAY,QAAQ,GACvD;AACA,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACA,SAAO,qBAAqB,QAAQ;AACtC;AAEA,SAAS,qBAAqB,UAAoB;AAChD,QAAM,aAAa,IAAI,IAAI,QAAQ;AACnC,aAAW,WACT,WAAW,aAAa,MAAM,MAAM,WAAW,SAAS,QAAQ,QAAQ,EAAE;AAC5E,SAAO;AACT;AAGO,SAAS,wBACd,UAOA;AACA,SAAO;AAAA,IACL,eAAe,SAAS;AAAA,IACxB,GAAI,SAAS,mBAAmB,UAAa;AAAA,MAC3C,gBAAgB,CAAC,GAAG,SAAS,cAAc;AAAA,IAC7C;AAAA,IACA,GAAI,SAAS,oBAAoB,UAAa;AAAA,MAC5C,iBAAiB,CAAC,GAAG,SAAS,eAAe;AAAA,IAC/C;AAAA,IACA,GAAI,SAAS,iBAAiB,UAAa;AAAA,MACzC,cAAc,SAAS;AAAA,IACzB;AAAA,IACA,GAAI,SAAS,4BAA4B,UAAa;AAAA,MACpD,yBAAyB,SAAS;AAAA,IACpC;AAAA,EACF;AACF;AAEA,SAAS,uBACP,UAC8B;AAC9B,MACE,aAAa,QACb,OAAO,aAAa,YACpB,OAAO,SAAS,UAAU,YAC1B,SAAS,MAAM,WAAW,KAC1B,OAAO,SAAS,aAAa,YAC7B,CAAC,MAAM,QAAQ,SAAS,MAAM,KAC9B,CAAC,SAAS,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,KAC3D,OAAO,SAAS,cAAc,YAC9B,CAAC,OAAO,SAAS,SAAS,SAAS,KACnC,SAAS,aAAa,KAAK,IAAI,IAAI,KACnC;AACA,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBACP,QACqC;AACrC,MACE,WAAW,QACX,OAAO,WAAW,YAClB,EAAE,UAAU,WACZ,OAAO,SAAS,UAChB,CAAC,SAAS,OAAO,OAAO,KACxB,CAAC,MAAM,QAAQ,OAAO,WAAW,KACjC,CAAC,OAAO,YAAY,MAAM,CAAC,eAAe,OAAO,eAAe,QAAQ,GACxE;AACA,UAAM;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAqB,MAAmB;AACrE,QAAM,MAAM,iBAAiB,OAAO,IAAI;AACxC,MACE,IAAI,aAAa,OACjB,IAAI,WAAW,MACf,IAAI,SAAS,MACb,IAAI,aAAa,MACjB,IAAI,aAAa,IACjB;AACA,UAAM,IAAI,MAAM,GAAG,IAAI,4CAA4C;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAa,UAAuB;AAC1D,QAAM,WAAW,IAAI,IAAI,OAAO,MAAM;AACtC,WAAS,WAAW;AACpB,SAAO;AACT;AAEA,SAAS,kBAAkB,UAA0B;AACnD,MACE,CAAC,SAAS,WAAW,GAAG,KACxB,SAAS,SAAS,GAAG,KACrB,SAAS,SAAS,GAAG,GACrB;AACA,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,SAAO,kBAAkB,QAAQ;AACnC;AAEA,SAAS,kBAAkB,UAA0B;AACnD,SAAO,aAAa,MAAM,MAAM,SAAS,QAAQ,QAAQ,EAAE;AAC7D;;;ACrNO,SAAS,oBACd,SACsB;AACtB,MACE,YAAY,QACZ,OAAO,YAAY,YACnB,OAAO,QAAQ,wBAAwB,cACvC,OAAO,QAAQ,gBAAgB,YAC/B;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,sBAAoB,QAAQ,aAAa;AACzC,MAAI,QAAQ,aAAa,QAAW;AAClC,sBAAkB,QAAQ,QAAQ;AAAA,EACpC;AACA,oBAAkB,QAAQ,gBAAgB,gBAAgB;AAC1D,oBAAkB,QAAQ,iBAAiB,iBAAiB;AAC5D,MACE,QAAQ,iBAAiB,WACxB,OAAO,QAAQ,iBAAiB,YAC/B,QAAQ,aAAa,KAAK,EAAE,WAAW,IACzC;AACA,UAAM,IAAI,UAAU,yCAAyC;AAAA,EAC/D;AACA,MAAI,QAAQ,4BAA4B,QAAW;AACjD,QAAI,EAAE,QAAQ,mCAAmC,MAAM;AACrD,YAAM,IAAI,UAAU,uCAAuC;AAAA,IAC7D;AACA;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAiC;AAAA,IACrC,qBAAqB,QAAQ;AAAA,IAC7B,eAAe,QAAQ;AAAA,IACvB,aAAa,QAAQ;AAAA,IACrB,GAAI,QAAQ,aAAa,UAAa,EAAE,UAAU,QAAQ,SAAS;AAAA,IACnE,GAAI,QAAQ,mBAAmB,UAAa;AAAA,MAC1C,gBAAgB,CAAC,GAAG,QAAQ,cAAc;AAAA,IAC5C;AAAA,IACA,GAAI,QAAQ,oBAAoB,UAAa;AAAA,MAC3C,iBAAiB,CAAC,GAAG,QAAQ,eAAe;AAAA,IAC9C;AAAA,IACA,GAAI,QAAQ,iBAAiB,UAAa;AAAA,MACxC,cAAc,QAAQ;AAAA,IACxB;AAAA,IACA,GAAI,QAAQ,4BAA4B,UAAa;AAAA,MACnD,yBAAyB,QAAQ;AAAA,IACnC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBACP,UACmC;AACnC,MACE,aAAa,QACb,OAAO,aAAa,YACpB,EAAE,YAAY,aACd,OAAO,SAAS,WAAW,UAC3B;AACA,UAAM,IAAI,UAAU,4CAA4C;AAAA,EAClE;AACA;AAAA,IACE,iBAAiB,SAAS,QAAQ,sBAAsB;AAAA,IACxD;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,UAA8B;AACvD,sBAAoB,iBAAiB,UAAU,UAAU,GAAG,UAAU;AACxE;AAEA,SAAS,kBACP,OACA,MACM;AACN,MACE,UAAU,WACT,CAAC,MAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,IACzE;AACA,UAAM,IAAI,UAAU,GAAG,IAAI,8BAA8B;AAAA,EAC3D;AACF;","names":["decodeSegment"]}