runbios-mcp 0.2.1-dev.62

package/dist/http/store.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Persistence for the hosted MCP OAuth 2.1 authorization server.
+ *
+ * Raw credentials (authorization codes, access tokens, refresh tokens,
+ * client secrets) are NEVER stored: only their sha256 hex digests are.
+ *
+ * PgStore is the production implementation (schema "mcp" on
+ * MCP_DATABASE_URL). MemoryStore implements the same interface so the OAuth
+ * flow is fully testable without Postgres or Docker.
+ */
+/** Minimal query surface of a pg.Pool, so this module never imports pg at runtime. */
+export interface SqlPool {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: Record<string, unknown>[];
+        rowCount: number | null;
+    }>;
+}
+export type RequestStatus = "pending" | "approved" | "denied" | "expired";
+export type TokenKind = "access" | "refresh";
+export interface OAuthClientRow {
+    client_id: string;
+    client_secret_hash: string | null;
+    client_name: string;
+    redirect_uris: string[];
+    token_endpoint_auth_method: string;
+    created_at: Date;
+    disabled_at: Date | null;
+}
+export interface OAuthRequestRow {
+    id: string;
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    state: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    status: RequestStatus;
+    created_at: Date;
+    expires_at: Date;
+}
+export interface OAuthGrantRow {
+    id: string;
+    client_id: string;
+    user_id: string;
+    user_email: string;
+    org_id: string;
+    workspace_id: string;
+    scopes: string[];
+    created_at: Date;
+    revoked_at: Date | null;
+    last_used_at: Date | null;
+}
+export interface OAuthCodeRow {
+    code_hash: string;
+    grant_id: string;
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    created_at: Date;
+    expires_at: Date;
+    used_at: Date | null;
+}
+export interface OAuthTokenRow {
+    token_hash: string;
+    kind: TokenKind;
+    grant_id: string;
+    family_id: string;
+    expires_at: Date;
+    created_at: Date;
+    revoked_at: Date | null;
+    replaced_by: string | null;
+}
+export interface McpStore {
+    migrate(): Promise<void>;
+    insertClient(row: Omit<OAuthClientRow, "created_at" | "disabled_at">): Promise<void>;
+    getClient(clientId: string): Promise<OAuthClientRow | null>;
+    insertRequest(row: Omit<OAuthRequestRow, "created_at">): Promise<void>;
+    getRequest(id: string): Promise<OAuthRequestRow | null>;
+    setRequestStatus(id: string, status: RequestStatus): Promise<void>;
+    insertGrant(row: Omit<OAuthGrantRow, "created_at" | "revoked_at" | "last_used_at">): Promise<void>;
+    getGrant(id: string): Promise<OAuthGrantRow | null>;
+    revokeGrant(id: string): Promise<void>;
+    /** Sets last_used_at, but only when it is null or older than minAgeMs. */
+    touchGrantLastUsed(id: string, minAgeMs: number): Promise<void>;
+    insertCode(row: Omit<OAuthCodeRow, "created_at" | "used_at">): Promise<void>;
+    getCode(codeHash: string): Promise<OAuthCodeRow | null>;
+    /** Atomically marks the code used. Returns the row, or null when missing or already used. */
+    consumeCode(codeHash: string): Promise<OAuthCodeRow | null>;
+    insertToken(row: Omit<OAuthTokenRow, "created_at" | "revoked_at" | "replaced_by">): Promise<void>;
+    getToken(tokenHash: string): Promise<OAuthTokenRow | null>;
+    revokeToken(tokenHash: string, replacedBy?: string): Promise<void>;
+    revokeFamily(familyId: string): Promise<void>;
+    revokeTokensForGrant(grantId: string): Promise<void>;
+    /** Removes rows that expired long ago; safe to call periodically. */
+    cleanupExpired(now?: Date): Promise<void>;
+}
+export declare class PgStore implements McpStore {
+    private readonly pool;
+    constructor(pool: SqlPool);
+    migrate(): Promise<void>;
+    insertClient(row: Omit<OAuthClientRow, "created_at" | "disabled_at">): Promise<void>;
+    getClient(clientId: string): Promise<OAuthClientRow | null>;
+    insertRequest(row: Omit<OAuthRequestRow, "created_at">): Promise<void>;
+    getRequest(id: string): Promise<OAuthRequestRow | null>;
+    setRequestStatus(id: string, status: RequestStatus): Promise<void>;
+    insertGrant(row: Omit<OAuthGrantRow, "created_at" | "revoked_at" | "last_used_at">): Promise<void>;
+    getGrant(id: string): Promise<OAuthGrantRow | null>;
+    revokeGrant(id: string): Promise<void>;
+    touchGrantLastUsed(id: string, minAgeMs: number): Promise<void>;
+    insertCode(row: Omit<OAuthCodeRow, "created_at" | "used_at">): Promise<void>;
+    private static codeFromRow;
+    getCode(codeHash: string): Promise<OAuthCodeRow | null>;
+    consumeCode(codeHash: string): Promise<OAuthCodeRow | null>;
+    insertToken(row: Omit<OAuthTokenRow, "created_at" | "revoked_at" | "replaced_by">): Promise<void>;
+    getToken(tokenHash: string): Promise<OAuthTokenRow | null>;
+    revokeToken(tokenHash: string, replacedBy?: string): Promise<void>;
+    revokeFamily(familyId: string): Promise<void>;
+    revokeTokensForGrant(grantId: string): Promise<void>;
+    cleanupExpired(): Promise<void>;
+}
+export declare class MemoryStore implements McpStore {
+    private readonly now;
+    clients: Map<string, OAuthClientRow>;
+    requests: Map<string, OAuthRequestRow>;
+    grants: Map<string, OAuthGrantRow>;
+    codes: Map<string, OAuthCodeRow>;
+    tokens: Map<string, OAuthTokenRow>;
+    constructor(now?: () => Date);
+    migrate(): Promise<void>;
+    insertClient(row: Omit<OAuthClientRow, "created_at" | "disabled_at">): Promise<void>;
+    getClient(clientId: string): Promise<OAuthClientRow | null>;
+    insertRequest(row: Omit<OAuthRequestRow, "created_at">): Promise<void>;
+    getRequest(id: string): Promise<OAuthRequestRow | null>;
+    setRequestStatus(id: string, status: RequestStatus): Promise<void>;
+    insertGrant(row: Omit<OAuthGrantRow, "created_at" | "revoked_at" | "last_used_at">): Promise<void>;
+    getGrant(id: string): Promise<OAuthGrantRow | null>;
+    revokeGrant(id: string): Promise<void>;
+    touchGrantLastUsed(id: string, minAgeMs: number): Promise<void>;
+    insertCode(row: Omit<OAuthCodeRow, "created_at" | "used_at">): Promise<void>;
+    getCode(codeHash: string): Promise<OAuthCodeRow | null>;
+    consumeCode(codeHash: string): Promise<OAuthCodeRow | null>;
+    insertToken(row: Omit<OAuthTokenRow, "created_at" | "revoked_at" | "replaced_by">): Promise<void>;
+    getToken(tokenHash: string): Promise<OAuthTokenRow | null>;
+    revokeToken(tokenHash: string, replacedBy?: string): Promise<void>;
+    revokeFamily(familyId: string): Promise<void>;
+    revokeTokensForGrant(grantId: string): Promise<void>;
+    cleanupExpired(now?: Date): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/http/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/http/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sFAAsF;AACtF,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAChH;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0BAA0B,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,IAAI,CAAC;IACjB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;IACjB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAE5D,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxD,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxD,6FAA6F;IAC7F,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAE5D,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC3D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD,qEAAqE;IACrE,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AA2FD,qBAAa,OAAQ,YAAW,QAAQ;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,OAAO;IAEpC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IASpF,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAoB3D,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAStE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAuBvD,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IASlG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAuBnD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IASlF,OAAO,CAAC,MAAM,CAAC,WAAW;IAcpB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUvD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW3D,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAoB1D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASlE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7C,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpD,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CAOtC;AAID,qBAAa,WAAY,YAAW,QAAQ;IAO9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IANhC,OAAO,8BAAqC;IAC5C,QAAQ,+BAAsC;IAC9C,MAAM,6BAAoC;IAC1C,KAAK,4BAAmC;IACxC,MAAM,6BAAoC;gBAEb,GAAG,GAAE,MAAM,IAAuB;IAEzD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAExB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpF,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI3D,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAIvD,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAInD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS/D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIvD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAO3D,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAI1D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpD,cAAc,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAO5D"}

package/dist/http/store.js

@@ -0,0 +1,366 @@
+/**
+ * Persistence for the hosted MCP OAuth 2.1 authorization server.
+ *
+ * Raw credentials (authorization codes, access tokens, refresh tokens,
+ * client secrets) are NEVER stored: only their sha256 hex digests are.
+ *
+ * PgStore is the production implementation (schema "mcp" on
+ * MCP_DATABASE_URL). MemoryStore implements the same interface so the OAuth
+ * flow is fully testable without Postgres or Docker.
+ */
+/* ─── Postgres implementation ─── */
+const MIGRATIONS = [
+    // The mcp schema is provisioned by the database bootstrap (owned by the
+    // service role, per the one-schema-per-service isolation contract), so the
+    // service only creates it when genuinely absent (local dev). An
+    // unconditional CREATE SCHEMA IF NOT EXISTS would demand database-level
+    // CREATE permission even when the schema already exists.
+    `DO $$ BEGIN
+     IF NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'mcp') THEN
+       CREATE SCHEMA mcp;
+     END IF;
+   END $$`,
+    `CREATE TABLE IF NOT EXISTS mcp.oauth_clients (
+     client_id text PRIMARY KEY,
+     client_secret_hash text,
+     client_name text NOT NULL DEFAULT 'MCP client',
+     redirect_uris jsonb NOT NULL DEFAULT '[]'::jsonb,
+     token_endpoint_auth_method text NOT NULL DEFAULT 'none',
+     created_at timestamptz NOT NULL DEFAULT now(),
+     disabled_at timestamptz
+   )`,
+    `CREATE TABLE IF NOT EXISTS mcp.oauth_requests (
+     id text PRIMARY KEY,
+     client_id text NOT NULL,
+     redirect_uri text NOT NULL,
+     scope text NOT NULL DEFAULT '',
+     state text NOT NULL DEFAULT '',
+     code_challenge text NOT NULL,
+     code_challenge_method text NOT NULL DEFAULT 'S256',
+     status text NOT NULL DEFAULT 'pending',
+     created_at timestamptz NOT NULL DEFAULT now(),
+     expires_at timestamptz NOT NULL
+   )`,
+    `CREATE INDEX IF NOT EXISTS oauth_requests_expires_at_idx ON mcp.oauth_requests (expires_at)`,
+    `CREATE TABLE IF NOT EXISTS mcp.oauth_grants (
+     id text PRIMARY KEY,
+     client_id text NOT NULL,
+     user_id text NOT NULL,
+     user_email text NOT NULL DEFAULT '',
+     org_id text NOT NULL DEFAULT '',
+     workspace_id text NOT NULL,
+     scopes jsonb NOT NULL DEFAULT '[]'::jsonb,
+     created_at timestamptz NOT NULL DEFAULT now(),
+     revoked_at timestamptz,
+     last_used_at timestamptz
+   )`,
+    `CREATE INDEX IF NOT EXISTS oauth_grants_user_id_idx ON mcp.oauth_grants (user_id)`,
+    `CREATE TABLE IF NOT EXISTS mcp.oauth_codes (
+     code_hash text PRIMARY KEY,
+     grant_id text NOT NULL,
+     client_id text NOT NULL,
+     redirect_uri text NOT NULL,
+     code_challenge text NOT NULL,
+     code_challenge_method text NOT NULL DEFAULT 'S256',
+     created_at timestamptz NOT NULL DEFAULT now(),
+     expires_at timestamptz NOT NULL,
+     used_at timestamptz
+   )`,
+    `CREATE INDEX IF NOT EXISTS oauth_codes_grant_id_idx ON mcp.oauth_codes (grant_id)`,
+    `CREATE INDEX IF NOT EXISTS oauth_codes_expires_at_idx ON mcp.oauth_codes (expires_at)`,
+    `CREATE TABLE IF NOT EXISTS mcp.oauth_tokens (
+     token_hash text PRIMARY KEY,
+     kind text NOT NULL,
+     grant_id text NOT NULL,
+     family_id text NOT NULL,
+     expires_at timestamptz NOT NULL,
+     created_at timestamptz NOT NULL DEFAULT now(),
+     revoked_at timestamptz,
+     replaced_by text
+   )`,
+    `CREATE INDEX IF NOT EXISTS oauth_tokens_grant_id_idx ON mcp.oauth_tokens (grant_id)`,
+    `CREATE INDEX IF NOT EXISTS oauth_tokens_family_id_idx ON mcp.oauth_tokens (family_id)`,
+    `CREATE INDEX IF NOT EXISTS oauth_tokens_expires_at_idx ON mcp.oauth_tokens (expires_at)`,
+];
+function asStringArray(value) {
+    if (Array.isArray(value))
+        return value.map((v) => String(v));
+    if (typeof value === "string") {
+        try {
+            const parsed = JSON.parse(value);
+            return Array.isArray(parsed) ? parsed.map((v) => String(v)) : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    return [];
+}
+export class PgStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async migrate() {
+        for (const sql of MIGRATIONS) {
+            await this.pool.query(sql);
+        }
+    }
+    async insertClient(row) {
+        await this.pool.query(`INSERT INTO mcp.oauth_clients
+         (client_id, client_secret_hash, client_name, redirect_uris, token_endpoint_auth_method)
+       VALUES ($1, $2, $3, $4::jsonb, $5)`, [row.client_id, row.client_secret_hash, row.client_name, JSON.stringify(row.redirect_uris), row.token_endpoint_auth_method]);
+    }
+    async getClient(clientId) {
+        const { rows } = await this.pool.query(`SELECT client_id, client_secret_hash, client_name, redirect_uris,
+              token_endpoint_auth_method, created_at, disabled_at
+         FROM mcp.oauth_clients WHERE client_id = $1`, [clientId]);
+        if (!rows[0])
+            return null;
+        const r = rows[0];
+        return {
+            client_id: String(r.client_id),
+            client_secret_hash: r.client_secret_hash ?? null,
+            client_name: String(r.client_name),
+            redirect_uris: asStringArray(r.redirect_uris),
+            token_endpoint_auth_method: String(r.token_endpoint_auth_method),
+            created_at: r.created_at,
+            disabled_at: r.disabled_at ?? null,
+        };
+    }
+    async insertRequest(row) {
+        await this.pool.query(`INSERT INTO mcp.oauth_requests
+         (id, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, status, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [row.id, row.client_id, row.redirect_uri, row.scope, row.state, row.code_challenge, row.code_challenge_method, row.status, row.expires_at]);
+    }
+    async getRequest(id) {
+        const { rows } = await this.pool.query(`SELECT id, client_id, redirect_uri, scope, state, code_challenge,
+              code_challenge_method, status, created_at, expires_at
+         FROM mcp.oauth_requests WHERE id = $1`, [id]);
+        if (!rows[0])
+            return null;
+        const r = rows[0];
+        return {
+            id: String(r.id),
+            client_id: String(r.client_id),
+            redirect_uri: String(r.redirect_uri),
+            scope: String(r.scope ?? ""),
+            state: String(r.state ?? ""),
+            code_challenge: String(r.code_challenge),
+            code_challenge_method: String(r.code_challenge_method),
+            status: String(r.status),
+            created_at: r.created_at,
+            expires_at: r.expires_at,
+        };
+    }
+    async setRequestStatus(id, status) {
+        await this.pool.query(`UPDATE mcp.oauth_requests SET status = $2 WHERE id = $1`, [id, status]);
+    }
+    async insertGrant(row) {
+        await this.pool.query(`INSERT INTO mcp.oauth_grants
+         (id, client_id, user_id, user_email, org_id, workspace_id, scopes)
+       VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`, [row.id, row.client_id, row.user_id, row.user_email, row.org_id, row.workspace_id, JSON.stringify(row.scopes)]);
+    }
+    async getGrant(id) {
+        const { rows } = await this.pool.query(`SELECT id, client_id, user_id, user_email, org_id, workspace_id, scopes,
+              created_at, revoked_at, last_used_at
+         FROM mcp.oauth_grants WHERE id = $1`, [id]);
+        if (!rows[0])
+            return null;
+        const r = rows[0];
+        return {
+            id: String(r.id),
+            client_id: String(r.client_id),
+            user_id: String(r.user_id),
+            user_email: String(r.user_email ?? ""),
+            org_id: String(r.org_id ?? ""),
+            workspace_id: String(r.workspace_id),
+            scopes: asStringArray(r.scopes),
+            created_at: r.created_at,
+            revoked_at: r.revoked_at ?? null,
+            last_used_at: r.last_used_at ?? null,
+        };
+    }
+    async revokeGrant(id) {
+        await this.pool.query(`UPDATE mcp.oauth_grants SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL`, [id]);
+    }
+    async touchGrantLastUsed(id, minAgeMs) {
+        await this.pool.query(`UPDATE mcp.oauth_grants
+          SET last_used_at = now()
+        WHERE id = $1
+          AND (last_used_at IS NULL OR last_used_at < now() - ($2 || ' milliseconds')::interval)`, [id, String(Math.max(0, Math.floor(minAgeMs)))]);
+    }
+    async insertCode(row) {
+        await this.pool.query(`INSERT INTO mcp.oauth_codes
+         (code_hash, grant_id, client_id, redirect_uri, code_challenge, code_challenge_method, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`, [row.code_hash, row.grant_id, row.client_id, row.redirect_uri, row.code_challenge, row.code_challenge_method, row.expires_at]);
+    }
+    static codeFromRow(r) {
+        return {
+            code_hash: String(r.code_hash),
+            grant_id: String(r.grant_id),
+            client_id: String(r.client_id),
+            redirect_uri: String(r.redirect_uri),
+            code_challenge: String(r.code_challenge),
+            code_challenge_method: String(r.code_challenge_method),
+            created_at: r.created_at,
+            expires_at: r.expires_at,
+            used_at: r.used_at ?? null,
+        };
+    }
+    async getCode(codeHash) {
+        const { rows } = await this.pool.query(`SELECT code_hash, grant_id, client_id, redirect_uri, code_challenge,
+              code_challenge_method, created_at, expires_at, used_at
+         FROM mcp.oauth_codes WHERE code_hash = $1`, [codeHash]);
+        return rows[0] ? PgStore.codeFromRow(rows[0]) : null;
+    }
+    async consumeCode(codeHash) {
+        const { rows } = await this.pool.query(`UPDATE mcp.oauth_codes SET used_at = now()
+        WHERE code_hash = $1 AND used_at IS NULL
+        RETURNING code_hash, grant_id, client_id, redirect_uri, code_challenge,
+                  code_challenge_method, created_at, expires_at, used_at`, [codeHash]);
+        return rows[0] ? PgStore.codeFromRow(rows[0]) : null;
+    }
+    async insertToken(row) {
+        await this.pool.query(`INSERT INTO mcp.oauth_tokens (token_hash, kind, grant_id, family_id, expires_at)
+       VALUES ($1, $2, $3, $4, $5)`, [row.token_hash, row.kind, row.grant_id, row.family_id, row.expires_at]);
+    }
+    async getToken(tokenHash) {
+        const { rows } = await this.pool.query(`SELECT token_hash, kind, grant_id, family_id, expires_at, created_at, revoked_at, replaced_by
+         FROM mcp.oauth_tokens WHERE token_hash = $1`, [tokenHash]);
+        if (!rows[0])
+            return null;
+        const r = rows[0];
+        return {
+            token_hash: String(r.token_hash),
+            kind: String(r.kind),
+            grant_id: String(r.grant_id),
+            family_id: String(r.family_id),
+            expires_at: r.expires_at,
+            created_at: r.created_at,
+            revoked_at: r.revoked_at ?? null,
+            replaced_by: r.replaced_by ?? null,
+        };
+    }
+    async revokeToken(tokenHash, replacedBy) {
+        await this.pool.query(`UPDATE mcp.oauth_tokens
+          SET revoked_at = now(), replaced_by = COALESCE($2, replaced_by)
+        WHERE token_hash = $1 AND revoked_at IS NULL`, [tokenHash, replacedBy ?? null]);
+    }
+    async revokeFamily(familyId) {
+        await this.pool.query(`UPDATE mcp.oauth_tokens SET revoked_at = now() WHERE family_id = $1 AND revoked_at IS NULL`, [familyId]);
+    }
+    async revokeTokensForGrant(grantId) {
+        await this.pool.query(`UPDATE mcp.oauth_tokens SET revoked_at = now() WHERE grant_id = $1 AND revoked_at IS NULL`, [grantId]);
+    }
+    async cleanupExpired() {
+        await this.pool.query(`DELETE FROM mcp.oauth_requests WHERE expires_at < now() - interval '1 day'`);
+        await this.pool.query(`DELETE FROM mcp.oauth_codes WHERE expires_at < now() - interval '1 day'`);
+        // Expired token rows are kept for a week so refresh-reuse detection still
+        // observes recently rotated-out tokens, then removed.
+        await this.pool.query(`DELETE FROM mcp.oauth_tokens WHERE expires_at < now() - interval '7 days'`);
+    }
+}
+/* ─── In-memory implementation (tests) ─── */
+export class MemoryStore {
+    now;
+    clients = new Map();
+    requests = new Map();
+    grants = new Map();
+    codes = new Map();
+    tokens = new Map();
+    constructor(now = () => new Date()) {
+        this.now = now;
+    }
+    async migrate() { }
+    async insertClient(row) {
+        this.clients.set(row.client_id, { ...row, created_at: this.now(), disabled_at: null });
+    }
+    async getClient(clientId) {
+        return this.clients.get(clientId) ?? null;
+    }
+    async insertRequest(row) {
+        this.requests.set(row.id, { ...row, created_at: this.now() });
+    }
+    async getRequest(id) {
+        return this.requests.get(id) ?? null;
+    }
+    async setRequestStatus(id, status) {
+        const row = this.requests.get(id);
+        if (row)
+            row.status = status;
+    }
+    async insertGrant(row) {
+        this.grants.set(row.id, { ...row, created_at: this.now(), revoked_at: null, last_used_at: null });
+    }
+    async getGrant(id) {
+        return this.grants.get(id) ?? null;
+    }
+    async revokeGrant(id) {
+        const row = this.grants.get(id);
+        if (row && !row.revoked_at)
+            row.revoked_at = this.now();
+    }
+    async touchGrantLastUsed(id, minAgeMs) {
+        const row = this.grants.get(id);
+        if (!row)
+            return;
+        const t = this.now();
+        if (!row.last_used_at || t.getTime() - row.last_used_at.getTime() >= minAgeMs) {
+            row.last_used_at = t;
+        }
+    }
+    async insertCode(row) {
+        this.codes.set(row.code_hash, { ...row, created_at: this.now(), used_at: null });
+    }
+    async getCode(codeHash) {
+        return this.codes.get(codeHash) ?? null;
+    }
+    async consumeCode(codeHash) {
+        const row = this.codes.get(codeHash);
+        if (!row || row.used_at)
+            return null;
+        row.used_at = this.now();
+        return row;
+    }
+    async insertToken(row) {
+        this.tokens.set(row.token_hash, { ...row, created_at: this.now(), revoked_at: null, replaced_by: null });
+    }
+    async getToken(tokenHash) {
+        return this.tokens.get(tokenHash) ?? null;
+    }
+    async revokeToken(tokenHash, replacedBy) {
+        const row = this.tokens.get(tokenHash);
+        if (row && !row.revoked_at) {
+            row.revoked_at = this.now();
+            if (replacedBy)
+                row.replaced_by = replacedBy;
+        }
+    }
+    async revokeFamily(familyId) {
+        for (const row of this.tokens.values()) {
+            if (row.family_id === familyId && !row.revoked_at)
+                row.revoked_at = this.now();
+        }
+    }
+    async revokeTokensForGrant(grantId) {
+        for (const row of this.tokens.values()) {
+            if (row.grant_id === grantId && !row.revoked_at)
+                row.revoked_at = this.now();
+        }
+    }
+    async cleanupExpired(now = this.now()) {
+        const dayAgo = now.getTime() - 24 * 3600_000;
+        const weekAgo = now.getTime() - 7 * 24 * 3600_000;
+        for (const [k, v] of this.requests)
+            if (v.expires_at.getTime() < dayAgo)
+                this.requests.delete(k);
+        for (const [k, v] of this.codes)
+            if (v.expires_at.getTime() < dayAgo)
+                this.codes.delete(k);
+        for (const [k, v] of this.tokens)
+            if (v.expires_at.getTime() < weekAgo)
+                this.tokens.delete(k);
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/http/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/http/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoGH,qCAAqC;AAErC,MAAM,UAAU,GAAa;IAC3B,wEAAwE;IACxE,2EAA2E;IAC3E,gEAAgE;IAChE,wEAAwE;IACxE,yDAAyD;IACzD;;;;UAIQ;IACR;;;;;;;;KAQG;IACH;;;;;;;;;;;KAWG;IACH,6FAA6F;IAC7F;;;;;;;;;;;KAWG;IACH,mFAAmF;IACnF;;;;;;;;;;KAUG;IACH,mFAAmF;IACnF,uFAAuF;IACvF;;;;;;;;;KASG;IACH,qFAAqF;IACrF,uFAAuF;IACvF,yFAAyF;CAC1F,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,OAAO,OAAO;IACW;IAA7B,YAA6B,IAAa;QAAb,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;IAE9C,KAAK,CAAC,OAAO;QACX,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAuD;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;0CAEoC,EACpC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC,CAC5H,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;qDAE+C,EAC/C,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,kBAAkB,EAAG,CAAC,CAAC,kBAAoC,IAAI,IAAI;YACnE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;YAClC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;YAC7C,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAChE,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,WAAW,EAAG,CAAC,CAAC,WAA2B,IAAI,IAAI;SACpD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAwC;QAC1D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;mDAE6C,EAC7C,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAC3I,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;+CAEyC,EACzC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACpC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;YACxC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACtD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAkB;YACzC,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,UAAU,EAAE,CAAC,CAAC,UAAkB;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,MAAqB;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAsE;QACtF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;kDAE4C,EAC5C,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC/G,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;6CAEuC,EACvC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YACtC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YAC9B,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACpC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/B,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,UAAU,EAAG,CAAC,CAAC,UAA0B,IAAI,IAAI;YACjD,YAAY,EAAG,CAAC,CAAC,YAA4B,IAAI,IAAI;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,qFAAqF,EACrF,CAAC,EAAE,CAAC,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,QAAgB;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;;iGAG2F,EAC3F,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAiD;QAChE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;2CAEqC,EACrC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC,UAAU,CAAC,CAC9H,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,CAA0B;QACnD,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACpC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;YACxC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACtD,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,OAAO,EAAG,CAAC,CAAC,OAAuB,IAAI,IAAI;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;mDAE6C,EAC7C,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;;;yEAGmE,EACnE,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAqE;QACrF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;mCAC6B,EAC7B,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACpC;qDAC+C,EAC/C,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;YAChC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAc;YACjC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,UAAU,EAAE,CAAC,CAAC,UAAkB;YAChC,UAAU,EAAG,CAAC,CAAC,UAA0B,IAAI,IAAI;YACjD,WAAW,EAAG,CAAC,CAAC,WAA6B,IAAI,IAAI;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,UAAmB;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;qDAE+C,EAC/C,CAAC,SAAS,EAAE,UAAU,IAAI,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,4FAA4F,EAC5F,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,2FAA2F,EAC3F,CAAC,OAAO,CAAC,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACpG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACjG,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;IACrG,CAAC;CACF;AAED,8CAA8C;AAE9C,MAAM,OAAO,WAAW;IAOO;IAN7B,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC9C,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IACxC,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE1C,YAA6B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAAlC,QAAG,GAAH,GAAG,CAA+B;IAAG,CAAC;IAEnE,KAAK,CAAC,OAAO,KAAmB,CAAC;IAEjC,KAAK,CAAC,YAAY,CAAC,GAAuD;QACxE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAwC;QAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,MAAqB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAsE;QACtF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,QAAgB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC9E,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAiD;QAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACrC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAqE;QACrF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,UAAmB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,UAAU;gBAAE,GAAG,CAAC,WAAW,GAAG,UAAU,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAY,IAAI,CAAC,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QAClD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjG,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { buildAuthenticationHeaders } from "./auth.js";
+import { resolveBaseURL } from "./config.js";
+import { BiosClient } from "./api-client.js";
+import { createBiosMcpServer } from "./server.js";
+// RUNBIOS_* is the canonical environment prefix; the legacy BIOS_* names keep
+// working so existing MCP client configs never break.
+function envValue(name) {
+    return process.env[`RUNBIOS_${name}`] ?? process.env[`BIOS_${name}`] ?? "";
+}
+const BASE_URL = resolveBaseURL();
+// Derives the console origin from the API base so every channel build points
+// users at ITS environment's dashboard (api-dev → platform-dev, api-staging →
+// platform-staging, api → platform). Non-runbios bases fall back to prod.
+function platformOriginFromApiBase(apiBase) {
+    try {
+        const u = new URL(apiBase);
+        if (u.host.match(/^api(-[a-z0-9]+)?\.runbios\.ai$/)) {
+            return `${u.protocol}//${u.host.replace(/^api/, "platform")}`;
+        }
+    }
+    catch { /* fall through */ }
+    return "https://platform-dev.runbios.ai";
+}
+const API_KEY = envValue("API_KEY");
+const ACCESS_TOKEN = envValue("ACCESS_TOKEN");
+const ORG_ID = envValue("ORG_ID");
+const WORKSPACE_ID = envValue("WORKSPACE_ID");
+const INFERENCE_KEY = envValue("INFERENCE_KEY");
+const INFERENCE_BASE_URL = (envValue("INFERENCE_BASE_URL") || BASE_URL).replace(/\/+$/, "");
+// Optional, per-deployment capability hints the console's "connect via MCP"
+// flow can emit alongside the inference key. They only make chat_with_inference
+// ADVERTISE honestly (omit tools for a text-only deployment; note no-image in
+// the messages description) — the /v1 endpoint still enforces at runtime, so an
+// unset/wrong value never blocks a valid call. Parsed as tri-state: an unset
+// env is `undefined` (full schema), only an explicit "false"/"0"/"no" disables.
+function envBoolOrUndefined(name) {
+    const raw = envValue(name).trim().toLowerCase();
+    if (raw === "")
+        return undefined;
+    return !(raw === "false" || raw === "0" || raw === "no");
+}
+const INFERENCE_SUPPORTS_IMAGES = envBoolOrUndefined("INFERENCE_SUPPORTS_IMAGES");
+const INFERENCE_SUPPORTS_TOOLS = envBoolOrUndefined("INFERENCE_SUPPORTS_TOOLS");
+const INFERENCE_TIMEOUT_MS = Math.max(1_000, Number.parseInt(envValue("INFERENCE_TIMEOUT_MS") || "900000", 10) || 900_000);
+/* ─── Start server ─── */
+async function main() {
+    if (!API_KEY && !ACCESS_TOKEN) {
+        console.error("Error: RUNBIOS_API_KEY or RUNBIOS_ACCESS_TOKEN is required.\n" +
+            "Set it in your MCP client config:\n" +
+            '  "env": { "RUNBIOS_API_KEY": "bios-..." }\n' +
+            "(the legacy BIOS_* variable names also still work)\n" +
+            `Create an API key at: ${platformOriginFromApiBase(BASE_URL)}/dashboard/api-keys`);
+        process.exit(1);
+    }
+    const client = new BiosClient({
+        baseUrl: BASE_URL,
+        authHeaders: buildAuthenticationHeaders(API_KEY, ACCESS_TOKEN),
+        orgId: ORG_ID,
+        workspaceId: WORKSPACE_ID,
+        inferenceBaseUrl: INFERENCE_BASE_URL,
+        inferenceAuthHeader: INFERENCE_KEY ? `Bearer ${INFERENCE_KEY}` : "",
+        // Serverless fallback: with no dedicated deployment key, a workspace
+        // platform API key (serverless scope) authenticates model-ID-routed
+        // catalog calls on the unified /v1 endpoint. Access-token auth cannot mint
+        // a serverless bearer here, so it is left unset (dedicated-only).
+        serverlessAuthHeader: !INFERENCE_KEY && API_KEY ? `Bearer ${API_KEY}` : "",
+        inferenceTimeoutMs: INFERENCE_TIMEOUT_MS,
+    });
+    const server = createBiosMcpServer(client, undefined, {
+        supportsImages: INFERENCE_SUPPORTS_IMAGES,
+        supportsTools: INFERENCE_SUPPORTS_TOOLS,
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,8EAA8E;AAC9E,sDAAsD;AACtD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;AAElC,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,yBAAyB,CAAC,OAAe;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,EAAE,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,OAAO,iCAAiC,CAAC;AAC3C,CAAC;AACD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AACpC,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClC,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;AAChD,MAAM,kBAAkB,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5F,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;AAClF,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;AAChF,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CACnC,KAAK,EACL,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,IAAI,OAAO,CAC7E,CAAC;AAEF,0BAA0B;AAE1B,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CACX,+DAA+D;YAC7D,qCAAqC;YACrC,8CAA8C;YAC9C,sDAAsD;YACtD,yBAAyB,yBAAyB,CAAC,QAAQ,CAAC,qBAAqB,CACpF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC;QAC9D,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,YAAY;QACzB,gBAAgB,EAAE,kBAAkB;QACpC,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE;QACnE,qEAAqE;QACrE,oEAAoE;QACpE,2EAA2E;QAC3E,kEAAkE;QAClE,oBAAoB,EAAE,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1E,kBAAkB,EAAE,oBAAoB;KACzC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE;QACpD,cAAc,EAAE,yBAAyB;QACzC,aAAa,EAAE,wBAAwB;KACxC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC"}