ssh-mcp-pro 1.4.3 → 1.6.0

package/dist/remote/mcp-tools.js

@@ -9,6 +9,61 @@ const limitSchema = {
     maximum: 200,
     default: 50,
 };
+// Every hosted MCP tool returns structuredContent. Exposing the actual
+// top-level result shape helps clients validate responses and plan follow-up
+// calls without assuming an arbitrary JSON blob.
+const ACTION_OUTPUT_SCHEMA = {
+    type: "object",
+    properties: { action: { type: "object" } },
+    required: ["action"],
+};
+const REMOTE_OUTPUT_SCHEMAS = {
+    list_hosts: {
+        type: "object",
+        properties: { hosts: { type: "array", items: { type: "object" } } },
+        required: ["hosts"],
+    },
+    list_agents: {
+        type: "object",
+        properties: { agents: { type: "array", items: { type: "object" } } },
+        required: ["agents"],
+    },
+    create_enrollment_token: {
+        type: "object",
+        properties: {
+            agent_id: { type: "string" },
+            alias: { type: "string" },
+            commands: { type: "object" },
+            enrollment_token: { type: "string" },
+        },
+        required: ["agent_id", "alias", "commands", "enrollment_token"],
+    },
+    get_agent_install_command: {
+        type: "object",
+        properties: {
+            agent_id: { type: "string" },
+            alias: { type: "string" },
+            commands: { type: "object" },
+            token_recoverable: { type: "boolean" },
+        },
+        required: ["agent_id", "alias", "commands", "token_recoverable"],
+    },
+    update_agent_policy: {
+        type: "object",
+        properties: { agent: { type: "object" } },
+        required: ["agent"],
+    },
+    revoke_agent: {
+        type: "object",
+        properties: { agent: { type: "object" } },
+        required: ["agent"],
+    },
+    get_audit_events: {
+        type: "object",
+        properties: { events: { type: "array", items: { type: "object" } } },
+        required: ["events"],
+    },
+};
 const descriptors = {
     list_hosts: {
         description: "List enrolled host aliases available through outbound agents.",
@@ -106,12 +161,76 @@ const descriptors = {
             additionalProperties: false,
         },
     },
+    file_search: {
+        description: "Find file names in locally allowed folders without reading file contents. Optional root_path narrows the search; results and scan depth are bounded.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "name_pattern"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                name_pattern: {
+                    type: "string",
+                    minLength: 1,
+                    maxLength: 100,
+                    description: "Case-insensitive name fragment or * / ? wildcard pattern; cannot contain directory separators.",
+                },
+                root_path: {
+                    type: "string",
+                    minLength: 1,
+                    description: "Optional allowed folder. Omit to search all policy-allowed roots.",
+                },
+                max_depth: { type: "integer", minimum: 0, maximum: 5, default: 3 },
+                max_results: { type: "integer", minimum: 1, maximum: 50, default: 20 },
+                include_hidden: { type: "boolean", default: false },
+            },
+            additionalProperties: false,
+        },
+    },
+    file_content_search: {
+        description: "Find which allowed text files contain a literal phrase, with the first matching line and short snippet. " +
+            "Defaults to all names; optional name_pattern narrows files. Case-insensitive by default. " +
+            "Only scans up to 128 text files (128 KiB each); returns truncated when scan/output limits apply.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "query"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                query: {
+                    type: "string",
+                    minLength: 1,
+                    maxLength: 200,
+                    description: "Single-line literal text to find (not a regex).",
+                },
+                name_pattern: {
+                    type: "string",
+                    minLength: 1,
+                    maxLength: 100,
+                    description: "Optional filename fragment or * / ? wildcard; defaults to *.",
+                },
+                root_path: {
+                    type: "string",
+                    minLength: 1,
+                    description: "Optional allowed folder. Omit to search all locally approved roots.",
+                },
+                max_depth: { type: "integer", minimum: 0, maximum: 5, default: 3 },
+                max_results: { type: "integer", minimum: 1, maximum: 50, default: 20 },
+                include_hidden: { type: "boolean", default: false },
+                case_sensitive: { type: "boolean", default: false },
+            },
+            additionalProperties: false,
+        },
+    },
     file_read: {
-        description: "Read a bounded text file from an allowed path.",
+        description: "Read an allowed text file; optional byte offsets and limits page large files.",
         inputSchema: {
             type: "object",
             required: ["agent_id_or_alias", "path"],
-            properties: { agent_id_or_alias: agentSelector, path: { type: "string", minLength: 1 } },
+            properties: {
+                agent_id_or_alias: agentSelector,
+                path: { type: "string", minLength: 1 },
+                offset_bytes: { type: "integer", minimum: 0, maximum: 2147483647 },
+                max_bytes: { type: "integer", minimum: 4, maximum: 1048576 },
+            },
             additionalProperties: false,
         },
     },
@@ -129,6 +248,22 @@ const descriptors = {
             additionalProperties: false,
         },
     },
+    file_replace: {
+        description: "Preview or apply one exact text replacement in an allowed existing file. Preview first (default); apply requires expected_sha256 from preview. Both files.read and files.write must be granted.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "path", "old_text", "new_text"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                path: { type: "string", minLength: 1 },
+                old_text: { type: "string", minLength: 1, maxLength: 20000 },
+                new_text: { type: "string", maxLength: 20000 },
+                dry_run: { type: "boolean", default: true },
+                expected_sha256: { type: "string", pattern: "^[a-f0-9]{64}$" },
+            },
+            additionalProperties: false,
+        },
+    },
     run_shell: {
         description: "Run a bounded shell command. Disabled unless shell.exec is explicitly granted.",
         inputSchema: {
@@ -143,6 +278,60 @@ const descriptors = {
             additionalProperties: false,
         },
     },
+    process_start: {
+        description: "Start a bounded interactive shell process on an enrolled agent. Use process_read to view output and process_stop to cancel. Requires shell.exec.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "command"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                command: { type: "string", minLength: 1, maxLength: 4096 },
+                cwd: { type: "string", minLength: 1 },
+                max_runtime_seconds: { type: "integer", minimum: 1, maximum: 600, default: 300 },
+            },
+            additionalProperties: false,
+        },
+    },
+    process_read: {
+        description: "Read cursor-paged output and status for a managed shell process owned by the current user.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "process_id"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                process_id: { type: "string", minLength: 1 },
+                cursor: { type: "integer", minimum: 0, default: 0 },
+                max_bytes: { type: "integer", minimum: 1024, maximum: 32768, default: 8192 },
+            },
+            additionalProperties: false,
+        },
+    },
+    process_input: {
+        description: "Send limited text to stdin of a running shell process owned by the current user.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "process_id", "input"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                process_id: { type: "string", minLength: 1 },
+                input: { type: "string", maxLength: 4096 },
+                close_stdin: { type: "boolean", default: false },
+            },
+            additionalProperties: false,
+        },
+    },
+    process_stop: {
+        description: "Terminate a managed shell process owned by the current user.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id_or_alias", "process_id"],
+            properties: {
+                agent_id_or_alias: agentSelector,
+                process_id: { type: "string", minLength: 1 },
+            },
+            additionalProperties: false,
+        },
+    },
     run_shell_as_root: {
         description: "Run a bounded privileged command. Disabled unless sudo.exec is explicitly granted.",
         inputSchema: {
@@ -198,13 +387,26 @@ const READ_ONLY_REMOTE_TOOLS = new Set([
     "tail_logs",
     "docker_ps",
     "docker_logs",
+    "file_search",
+    "file_content_search",
     "file_read",
+    "process_read",
     "get_audit_events",
 ]);
+// These hints communicate potential impact to AI clients, not the permission
+// decision. Arbitrary shell commands and administrative enrollment/policy
+// changes can mutate state even when an individual invocation does not.
 const DESTRUCTIVE_REMOTE_TOOLS = new Set([
+    "create_enrollment_token",
+    "run_shell",
+    "process_start",
+    "process_input",
+    "process_stop",
     "run_shell_as_root",
+    "update_agent_policy",
     "revoke_agent",
     "file_write",
+    "file_replace",
     "restart_service",
     "docker_restart",
 ]);
@@ -219,9 +421,11 @@ export function remoteToolAnnotations(name) {
 }
 export function listRemoteToolDescriptors(capabilities) {
     const allowed = new Set(capabilities);
-    return REMOTE_TOOLS.filter((name) => allowed.has(TOOL_CAPABILITY_MAP[name])).map((name) => ({
+    return REMOTE_TOOLS.filter((name) => allowed.has(TOOL_CAPABILITY_MAP[name]) &&
+        (name !== "file_replace" || allowed.has("files.read"))).map((name) => ({
         name,
         capability: TOOL_CAPABILITY_MAP[name],
+        outputSchema: REMOTE_OUTPUT_SCHEMAS[name] ?? ACTION_OUTPUT_SCHEMA,
         annotations: remoteToolAnnotations(name),
         ...descriptors[name],
     }));

package/dist/remote/mcp-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-tools.js","sourceRoot":"","sources":["../../src/remote/mcp-tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAgB/D,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,oDAAoD;CAClE,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,MAAM,WAAW,GAA8E;IAC7F,UAAU,EAAE;QACV,WAAW,EAAE,+DAA+D;QAC5E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD,WAAW,EAAE;QACX,WAAW,EAAE,kDAAkD;QAC/D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD,uBAAuB,EAAE;QACvB,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACjE,iBAAiB,EAAE;oBACjB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC;oBAC/C,OAAO,EAAE,WAAW;iBACrB;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,yBAAyB,EAAE;QACzB,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;YAChD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,iBAAiB,EAAE;QACjB,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE;YAC9E,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,8EAA8E;QAC3F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,cAAc,CAAC;YAC/C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC9C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACnE;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,eAAe,EAAE;QACf,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;YAC3F,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,mEAAmE;QAChF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;YAChD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,WAAW,EAAE;QACX,WAAW,EAAE,wDAAwD;QACrE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC;YAC5C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACnE;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,cAAc,EAAE;QACd,WAAW,EAAE,yEAAyE;QACtF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC;YAC5C,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;YAC7F,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,CAAC;YACvC,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;YACxF,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,UAAU,EAAE;QACV,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC;YAClD,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACzB;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,gFAAgF;QAC7F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACzC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;aAC/D;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,iBAAiB,EAAE;QACjB,WAAW,EACT,oFAAoF;QACtF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACzC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;aAC/D;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,mBAAmB,EAAE;QACnB,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,QAAQ,CAAC;YACzC,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,YAAY,EAAE;QACZ,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;YAChD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,gBAAgB,EAAE;QAChB,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,KAAK,EAAE,WAAW;aACnB;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAiB;IACrD,YAAY;IACZ,aAAa;IACb,2BAA2B;IAC3B,mBAAmB;IACnB,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAiB;IACvD,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,YAAY,EAAE,UAAU;QACxB,eAAe,EAAE,aAAa;QAC9B,aAAa,EAAE,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,YAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI;QACJ,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACrC,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC;QACxC,GAAG,WAAW,CAAC,IAAI,CAAC;KACrB,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"mcp-tools.js","sourceRoot":"","sources":["../../src/remote/mcp-tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiB/D,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,oDAAoD;CAClE,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,uEAAuE;AACvE,6EAA6E;AAC7E,iDAAiD;AACjD,MAAM,oBAAoB,GAA4B;IACpD,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;IAC1C,QAAQ,EAAE,CAAC,QAAQ,CAAC;CACrB,CAAC;AAEF,MAAM,qBAAqB,GAA6D;IACtF,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnE,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpE,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SACrC;QACD,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC;KAChE;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SACvC;QACD,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,mBAAmB,CAAC;KACjE;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACzC,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACzC,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpE,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB;CACF,CAAC;AAEF,MAAM,WAAW,GAGb;IACF,UAAU,EAAE;QACV,WAAW,EAAE,+DAA+D;QAC5E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD,WAAW,EAAE;QACX,WAAW,EAAE,kDAAkD;QAC/D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD,uBAAuB,EAAE;QACvB,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;gBACtD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACjE,iBAAiB,EAAE;oBACjB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC;oBAC/C,OAAO,EAAE,WAAW;iBACrB;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,yBAAyB,EAAE;QACzB,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;YAChD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,iBAAiB,EAAE;QACjB,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE;YAC9E,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,8EAA8E;QAC3F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,cAAc,CAAC;YAC/C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC9C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACnE;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,eAAe,EAAE;QACf,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;YAC3F,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,mEAAmE;QAChF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;YAChD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,WAAW,EAAE;QACX,WAAW,EAAE,wDAAwD;QACrE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC;YAC5C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACnE;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,cAAc,EAAE;QACd,WAAW,EAAE,yEAAyE;QACtF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC;YAC5C,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;YAC7F,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,WAAW,EAAE;QACX,WAAW,EACT,sJAAsJ;QACxJ,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,cAAc,CAAC;YAC/C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,SAAS,EAAE,GAAG;oBACd,WAAW,EACT,gGAAgG;iBACnG;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,mEAAmE;iBACjF;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;gBAClE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtE,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;aACpD;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,mBAAmB,EAAE;QACnB,WAAW,EACT,0GAA0G;YAC1G,2FAA2F;YAC3F,kGAAkG;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC;YACxC,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,iDAAiD;iBAC/D;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,8DAA8D;iBAC5E;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,qEAAqE;iBACnF;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;gBAClE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtE,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;gBACnD,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;aACpD;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,+EAA+E;QAC5F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,CAAC;YACvC,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;gBAClE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE;aAC7D;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,UAAU,EAAE;QACV,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,EAAE,SAAS,CAAC;YAClD,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACzB;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,YAAY,EAAE;QACZ,WAAW,EACT,iMAAiM;QACnM,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;YAC/D,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC3C,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE;aAC/D;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,SAAS,EAAE;QACT,WAAW,EAAE,gFAAgF;QAC7F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACzC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;aAC/D;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,aAAa,EAAE;QACb,WAAW,EACT,kJAAkJ;QACpJ,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC1D,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACrC,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;aACjF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,YAAY,EAAE;QACZ,WAAW,EACT,4FAA4F;QAC9F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC;YAC7C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;gBACnD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;aAC7E;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,aAAa,EAAE;QACb,WAAW,EAAE,kFAAkF;QAC/F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC;YACtD,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC5C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC1C,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;aACjD;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,YAAY,EAAE;QACZ,WAAW,EAAE,8DAA8D;QAC3E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC;YAC7C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;aAC7C;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,iBAAiB,EAAE;QACjB,WAAW,EACT,oFAAoF;QACtF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YAC1C,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;gBACzC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACvB,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;aAC/D;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,mBAAmB,EAAE;QACnB,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,EAAE,QAAQ,CAAC;YACzC,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,YAAY,EAAE;QACZ,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,CAAC,mBAAmB,CAAC;YAC/B,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE;YAChD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD,gBAAgB,EAAE;QAChB,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,iBAAiB,EAAE,aAAa;gBAChC,KAAK,EAAE,WAAW;aACnB;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAiB;IACrD,YAAY;IACZ,aAAa;IACb,2BAA2B;IAC3B,mBAAmB;IACnB,WAAW;IACX,WAAW;IACX,aAAa;IACb,aAAa;IACb,qBAAqB;IACrB,WAAW;IACX,cAAc;IACd,kBAAkB;CACnB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAiB;IACvD,yBAAyB;IACzB,WAAW;IACX,eAAe;IACf,eAAe;IACf,cAAc;IACd,mBAAmB;IACnB,qBAAqB;IACrB,cAAc;IACd,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,YAAY,EAAE,UAAU;QACxB,eAAe,EAAE,aAAa;QAC9B,aAAa,EAAE,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,YAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CACzD,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,IAAI;QACJ,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACrC,YAAY,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,oBAAoB;QACjE,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC;QACxC,GAAG,WAAW,CAAC,IAAI,CAAC;KACrB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/remote/oauth-handler.d.ts

@@ -21,6 +21,7 @@ export declare class OAuthHandler {
     private readonly getJwtKeyPair;
     private readonly audit;
     private readonly registrationAttempts;
+    private readonly refreshTokenResponseField;
     private transactionCookie;
     private matchingBrowser;
     constructor(config: RemoteConfig, store: RemoteStore, authorizeTransactions: Map<string, PendingAuthorize>, getJwtKeyPair: () => JwtKeyPair, audit: (event: Omit<AuditEvent, "id" | "createdAt">) => void);
@@ -71,8 +72,12 @@ export declare class OAuthHandler {
     };
     private isGitHubUserAllowed;
     private issueAuthorizationCode;
+    /** Explicit OAuth revocation; RFC 7009 never reveals token validity. */
+    handleRevoke(req: IncomingMessage, res: ServerResponse): Promise<void>;
     /** POST /oauth/token */
     handleToken(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    /** Rotate a bearer refresh token exactly once; all descendants die on replay. */
+    private refreshAccessToken;
     private userFromId;
     /** Remove expired pending authorization transactions. */
     cleanupExpired(now?: number): void;

package/dist/remote/oauth-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-handler.d.ts","sourceRoot":"","sources":["../../src/remote/oauth-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,EAOL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAarB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,UAAU,EAGV,YAAY,EACb,MAAM,YAAY,CAAC;AAIpB,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,qBAAa,YAAY;IAerB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAlBxB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2D;IAEhG,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,eAAe;gBAOJ,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACpD,aAAa,EAAE,MAAM,UAAU,EAC/B,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI;IAG/E,gDAAgD;IAChD,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAUpD,kDAAkD;IAClD,2BAA2B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAgBtD,2BAA2B;IACrB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAuD9E,2BAA2B;IACrB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAmI/E;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IA2BxB,oFAAoF;IAC9E,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC7E,OAAO,CAAC,uBAAuB;IAiC/B,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,qBAAqB;IAuB7B,kFAAkF;IAClF,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,qBAAqB;IAc7B,iCAAiC;IAC3B,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpF,iCAAiC;IAC3B,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9E,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsCxD,kFAAkF;IAClF,OAAO,CAAC,oBAAoB;IAa5B,cAAc,IAAI,UAAU,GAAG,SAAS;IAQxC,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG;QACxC,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB;IAqBD,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;YAQhC,eAAe;IAkC7B,cAAc,IAAI,UAAU,GAAG,SAAS;IAOxC,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG;QACxC,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB;IAgBD,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,sBAAsB;IAoB9B,wBAAwB;IAClB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IA6C3E,OAAO,CAAC,UAAU;IA8BlB,yDAAyD;IACzD,cAAc,CAAC,GAAG,SAAa,GAAG,IAAI;IAWtC,2BAA2B;IACrB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CASrD"}
+{"version":3,"file":"oauth-handler.d.ts","sourceRoot":"","sources":["../../src/remote/oauth-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,EAOL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAarB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,UAAU,EAIV,YAAY,EACb,MAAM,YAAY,CAAC;AAIpB,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,qBAAa,YAAY;IAgBrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAnBxB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2D;IAChG,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAmB;IAE7D,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,eAAe;gBAOJ,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,WAAW,EAClB,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACpD,aAAa,EAAE,MAAM,UAAU,EAC/B,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI;IAG/E,gDAAgD;IAChD,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAUpD,kDAAkD;IAClD,2BAA2B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiBtD,2BAA2B;IACrB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAmE9E,2BAA2B;IACrB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAmI/E;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IA2BxB,oFAAoF;IAC9E,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC7E,OAAO,CAAC,uBAAuB;IAiC/B,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,qBAAqB;IAuB7B,kFAAkF;IAClF,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,qBAAqB;IAc7B,iCAAiC;IAC3B,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpF,iCAAiC;IAC3B,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9E,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD,kFAAkF;IAClF,OAAO,CAAC,oBAAoB;IAa5B,cAAc,IAAI,UAAU,GAAG,SAAS;IAQxC,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG;QACxC,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB;IAqBD,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;YAQhC,eAAe;IAI7B,cAAc,IAAI,UAAU,GAAG,SAAS;IAOxC,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG;QACxC,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB;IAgBD,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,sBAAsB;IAoB9B,wEAAwE;IAClE,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E,wBAAwB;IAClB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D3E,iFAAiF;YACnE,kBAAkB;IA2EhC,OAAO,CAAC,UAAU;IA8BlB,yDAAyD;IACzD,cAAc,CAAC,GAAG,SAAa,GAAG,IAAI;IAWtC,2BAA2B;IACrB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CASrD"}

package/dist/remote/oauth-handler.js

@@ -2,6 +2,7 @@ import { escape as escapeHtml } from "html-escaper";
 import { URL } from "node:url";
 import { hashSecret, id, issueAccessToken, nowIso, publicJwkFromPem, randomToken, } from "./crypto.js";
 import { asString, asStringArray, addNoStore, isSafeRedirectUri, pkceChallenge, readJson, readJsonOrForm, redirect, safeError, scopeList, } from "./http-util.js";
+import { exchangeGitHubIdentity, exchangeGoogleIdentity } from "./oauth-provider-exchange.js";
 import { REMOTE_SCOPES } from "./types.js";
 import { jsonResponse } from "./util.js";
 /** Handles OAuth 2.0 authorization code flow with PKCE and GitHub identity. */
@@ -12,6 +13,7 @@ export class OAuthHandler {
     getJwtKeyPair;
     audit;
     registrationAttempts = new Map();
+    refreshTokenResponseField = "refresh_token";
     transactionCookie(value) {
         const secure = this.config.publicBaseUrl.startsWith("https://") ? "; Secure" : "";
         return `ssh_mcp_oauth_tx=${value}; Path=/oauth; HttpOnly; SameSite=Lax; Max-Age=300${secure}`;
@@ -45,10 +47,11 @@ export class OAuthHandler {
             authorization_response_iss_parameter_supported: true,
             authorization_endpoint: `${this.config.publicBaseUrl}/oauth/authorize`,
             token_endpoint: `${this.config.publicBaseUrl}/oauth/token`,
+            revocation_endpoint: `${this.config.publicBaseUrl}/oauth/revoke`,
             registration_endpoint: `${this.config.publicBaseUrl}/oauth/register`,
             jwks_uri: `${this.config.publicBaseUrl}/oauth/jwks.json`,
             response_types_supported: ["code"],
-            grant_types_supported: ["authorization_code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
             code_challenge_methods_supported: ["S256"],
             token_endpoint_auth_methods_supported: ["none"],
             scopes_supported: REMOTE_SCOPES,
@@ -74,13 +77,22 @@ export class OAuthHandler {
         if (this.store.countOAuthClients() >= this.config.maxOAuthClients) {
             throw safeError("FORBIDDEN", "OAuth client registration limit reached", 429);
         }
+        const grantTypes = body.grant_types === undefined
+            ? ["authorization_code", "refresh_token"]
+            : asStringArray(body.grant_types);
+        if ((!Array.isArray(body.grant_types) && body.grant_types !== undefined) ||
+            !grantTypes.includes("authorization_code") ||
+            grantTypes.some((grant) => !["authorization_code", "refresh_token"].includes(grant)) ||
+            new Set(grantTypes).size !== grantTypes.length) {
+            throw safeError("INVALID_CLIENT", "Unsupported OAuth grant_types");
+        }
         const now = nowIso();
         const client = {
             id: id("clirow"),
             clientId: id("cli"),
             clientName: asString(body.client_name) ?? "ChatGPT Connector",
             redirectUris,
-            grantTypes: ["authorization_code"],
+            grantTypes,
             responseTypes: ["code"],
             tokenEndpointAuthMethod: "none",
             createdAt: now,
@@ -315,7 +327,7 @@ export class OAuthHandler {
             clientId,
             clientName: "Restored ChatGPT Connector",
             redirectUris: [redirectUri],
-            grantTypes: ["authorization_code"],
+            grantTypes: ["authorization_code", "refresh_token"],
             responseTypes: ["code"],
             tokenEndpointAuthMethod: "none",
             createdAt: nowIso(),
@@ -390,40 +402,9 @@ export class OAuthHandler {
     }
     async fetchGoogleUser(code) {
         const testUser = this.testGoogleUser();
-        if (testUser) {
+        if (testUser)
             return testUser;
-        }
-        if (!this.config.googleClientId || !this.config.googleClientSecret) {
-            throw safeError("FORBIDDEN", "Google OAuth is not configured", 503);
-        }
-        const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-                code,
-                client_id: this.config.googleClientId,
-                client_secret: this.config.googleClientSecret,
-                redirect_uri: this.config.googleCallbackUrl,
-                grant_type: "authorization_code",
-            }).toString(),
-        });
-        const tokenPayload = (await tokenResponse.json());
-        const accessToken = asString(tokenPayload.access_token);
-        if (!accessToken) {
-            throw safeError("INVALID_TOKEN", "Google OAuth token exchange failed", 502);
-        }
-        const userResponse = await fetch("https://openidconnect.googleapis.com/v1/userinfo", {
-            headers: { Authorization: `Bearer ${accessToken}` },
-        });
-        const userPayload = (await userResponse.json());
-        const googleSub = asString(userPayload.sub);
-        const email = asString(userPayload.email);
-        const name = asString(userPayload.name) ?? email ?? "Google User";
-        const picture = asString(userPayload.picture);
-        if (!googleSub || !email) {
-            throw safeError("INVALID_TOKEN", "Google OAuth user response missing valid identity", 502);
-        }
-        return { id: googleSub, email, name, picture };
+        return exchangeGoogleIdentity(this.config, code);
     }
     /** Fixture identities must never bypass provider login on public-facing hosts. */
     allowFixtureIdentity() {
@@ -472,35 +453,7 @@ export class OAuthHandler {
             this.config.allowedGoogleEmails.includes(user.email));
     }
     async fetchGitHubUser(code) {
-        const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
-            method: "POST",
-            headers: { Accept: "application/json", "Content-Type": "application/json" },
-            body: JSON.stringify({
-                client_id: this.config.githubClientId,
-                client_secret: this.config.githubClientSecret,
-                code,
-                redirect_uri: this.config.githubCallbackUrl,
-            }),
-        });
-        const tokenPayload = (await tokenResponse.json());
-        const accessToken = asString(tokenPayload.access_token);
-        if (!accessToken) {
-            throw safeError("INVALID_TOKEN", "GitHub OAuth token exchange failed", 502);
-        }
-        const userResponse = await fetch("https://api.github.com/user", {
-            headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/vnd.github+json" },
-        });
-        const userPayload = (await userResponse.json());
-        const githubId = userPayload.id;
-        const githubLogin = userPayload.login;
-        if (typeof githubId !== "number" ||
-            !Number.isSafeInteger(githubId) ||
-            githubId <= 0 ||
-            typeof githubLogin !== "string" ||
-            !githubLogin) {
-            throw safeError("INVALID_TOKEN", "GitHub OAuth user response missing valid identity", 502);
-        }
-        return { id: String(githubId), login: githubLogin };
+        return exchangeGitHubIdentity(this.config, code);
     }
     testGitHubUser() {
         if (!this.allowFixtureIdentity())
@@ -548,9 +501,24 @@ export class OAuthHandler {
         this.store.insertAuthorizationCode(record);
         return code;
     }
+    /** Explicit OAuth revocation; RFC 7009 never reveals token validity. */
+    async handleRevoke(req, res) {
+        const body = await readJsonOrForm(req);
+        const token = body.token ?? "";
+        const clientId = body.client_id ?? "";
+        if (/^[a-zA-Z0-9_-]{32,128}$/u.test(token) && clientId) {
+            this.store.revokeRefreshFamily(hashSecret(token), clientId, nowIso());
+        }
+        res.writeHead(200, { "Cache-Control": "no-store", Pragma: "no-cache" });
+        res.end();
+    }
     /** POST /oauth/token */
     async handleToken(req, res) {
         const body = await readJsonOrForm(req);
+        if (body.grant_type === "refresh_token") {
+            await this.refreshAccessToken(res, body);
+            return;
+        }
         if (body.grant_type !== "authorization_code") {
             throw safeError("INVALID_CLIENT", "grant_type must be authorization_code");
         }
@@ -582,8 +550,85 @@ export class OAuthHandler {
             throw safeError("INVALID_TOKEN", "Authorization code is expired or already used");
         }
         const token = await issueAccessToken(this.config, jwtKeyPair, user, scopes);
+        const refreshToken = client.grantTypes.includes("refresh_token") ? randomToken(32) : undefined;
+        if (refreshToken) {
+            this.store.createRefreshToken({
+                tokenHash: hashSecret(refreshToken),
+                familyId: id("refreshfam"),
+                clientId,
+                userId: codeRecord.userId,
+                resource: codeRecord.resource,
+                scope: scopes.join(" "),
+                expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
+                createdAt: nowIso(),
+            });
+        }
+        jsonResponse(res, 200, {
+            access_token: token.token,
+            ...(refreshToken ? { refresh_token: refreshToken } : {}),
+            token_type: "Bearer",
+            expires_in: this.config.accessTokenTtlSeconds,
+            scope: scopes.join(" "),
+        }, addNoStore());
+    }
+    /** Rotate a bearer refresh token exactly once; all descendants die on replay. */
+    async refreshAccessToken(res, body) {
+        const clientId = body.client_id ?? "";
+        const raw = body.refresh_token ?? "";
+        const client = this.store.getClient(clientId);
+        const invalidGrant = () => jsonResponse(res, 400, { error: "invalid_grant" }, addNoStore());
+        if (!client ||
+            !client.grantTypes.includes("refresh_token") ||
+            !/^[a-zA-Z0-9_-]{32,128}$/u.test(raw)) {
+            invalidGrant();
+            return;
+        }
+        const old = this.store.getRefreshTokenByHash(hashSecret(raw));
+        if (!old) {
+            invalidGrant();
+            return;
+        }
+        if (old.clientId !== clientId || old.resource !== this.config.mcpResourceUrl) {
+            invalidGrant();
+            return;
+        }
+        const now = nowIso();
+        if (old.expiresAt <= now || old.revokedAt) {
+            invalidGrant();
+            return;
+        }
+        const user = this.userFromId(old.userId);
+        if ((user.githubId &&
+            !this.isGitHubUserAllowed({ id: user.githubId, login: user.githubLogin ?? "" })) ||
+            (user.googleId &&
+                !this.isGoogleUserAllowed({
+                    id: user.googleId,
+                    email: user.email ?? "",
+                    name: user.displayName ?? "",
+                }))) {
+            invalidGrant();
+            return;
+        }
+        const scopes = scopeList(old.scope);
+        const token = await issueAccessToken(this.config, this.getJwtKeyPair(), user, scopes);
+        const newRaw = randomToken(32);
+        const successor = {
+            tokenHash: hashSecret(newRaw),
+            familyId: old.familyId,
+            clientId: old.clientId,
+            userId: old.userId,
+            resource: old.resource,
+            scope: old.scope,
+            expiresAt: old.expiresAt,
+            createdAt: now,
+        };
+        if (!this.store.rotateRefreshToken(old.tokenHash, clientId, successor, now)) {
+            invalidGrant();
+            return;
+        }
         jsonResponse(res, 200, {
             access_token: token.token,
+            [this.refreshTokenResponseField]: newRaw,
             token_type: "Bearer",
             expires_in: this.config.accessTokenTtlSeconds,
             scope: scopes.join(" "),