studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/mcp/connector-manager.js

@@ -28,6 +28,10 @@ import { join } from 'path';
 import { homedir } from 'os';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { enforceConnectorConfig } from '../core/schemas/connector.js';
+import { McpOAuthProvider } from './oauth-provider.js';
+import { hasBrokerSupport } from './oauth-registry.js';
+import { log } from '../utils/log.js';
 export const CONNECTORS_DIR = join(homedir(), '.studiograph', 'connectors');
 // ── ConnectorManager ──────────────────────────────────────────────────────────
 export class ConnectorManager {
@@ -56,17 +60,48 @@ export class ConnectorManager {
     static loadWorkspaceConfigs(workspacePath) {
         return ConnectorManager._readDir(join(workspacePath, '.studiograph', 'connectors'));
     }
-    /** Save full config to homedir (mode 0600, never committed). */
+    /**
+     * Save full config to homedir (mode 0600, never committed).
+     *
+     * Phase 5 dual-write: when the encrypted store has been initialized,
+     * the connector's secret-bearing fields (`headers.Authorization`,
+     * `oauth.client_secret`) are mirrored into the store under
+     * workspace-scope keys (`connector.<name>.auth`,
+     * `connector.<name>.oauth_secret`). Failures never block the file
+     * write — see dual-write.ts. The legacy file remains authoritative
+     * through Phase 5; Phase 6 flipped the read path.
+     */
     static saveConfig(config) {
         mkdirSync(CONNECTORS_DIR, { recursive: true });
         const path = join(CONNECTORS_DIR, `${config.name}.json`);
         writeFileSync(path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        void ConnectorManager._dualWrite(config);
+    }
+    /**
+     * Lazy import of the dual-write helper so the secrets store is only
+     * loaded when the flag is on. Best-effort — failures log + swallow.
+     */
+    static async _dualWrite(config) {
+        try {
+            const { mirrorConnectorConfig } = await import('../core/secrets/dual-write.js');
+            await mirrorConnectorConfig(config);
+        }
+        catch (err) {
+            log.warn(`[secrets] dual-write connector ${config.name} mirror failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
     /** Save sanitized config to workspace .studiograph/connectors/ (git-tracked). */
     static saveWorkspaceConfig(config, workspacePath) {
         const dir = join(workspacePath, '.studiograph', 'connectors');
         mkdirSync(dir, { recursive: true });
         const stripped = ConnectorManager.stripSecrets(config);
+        // Phase 9c: strict-or-warn schema enforcement on the workspace-layer
+        // (the committed file). The stripped config SHOULD be free of literal
+        // secrets — any violation here means stripSecrets missed something,
+        // and in strict mode (default) we abort the write loudly. Callers
+        // translate the throw into 400/exit-1 for the user. Set
+        // STUDIOGRAPH_SCHEMA_STRICT=0 for the warn-mode fallback.
+        enforceConnectorConfig(stripped);
         const path = join(dir, `${config.name}.json`);
         writeFileSync(path, JSON.stringify(stripped, null, 2) + '\n');
     }
@@ -203,36 +238,159 @@ export class ConnectorManager {
      * For each connector config: connect to the MCP server, fetch its tool list,
      * and return tool objects with namespaced names.
      *
+     * Auth precedence (single rule across the codebase):
+     *   1. Per-user OAuth tokens (when `opts.userId` + `opts.authService` resolve
+     *      `hasOAuthTokens === true`) — restores the original `McpOAuthProvider`
+     *      design intent: tokens stored per `(user, connector)` are actually
+     *      *used* upstream. The provider's `tokens()` returns the user's row;
+     *      the SDK refreshes via `saveTokens` writing back to the same row.
+     *   2. Workspace static `Authorization` header (`config.headers.Authorization`)
+     *      — admin-configured shared identity. Used when the caller has no user
+     *      session (CLI, MCP server, agent pool spawned without `userId`) or
+     *      when the user hasn't bound their own OAuth credential yet.
+     *   3. Skip — `requiresOAuth` connector with neither per-user OAuth nor a
+     *      workspace header has no usable credential.
+     *
      * Failures are non-fatal — the connector is skipped with a console.warn.
      */
-    static async buildTools(configs, timeoutMs = 10_000) {
-        const tools = [];
-        for (const config of configs) {
-            // Skip connectors with unresolved env var placeholders in headers
-            const authHeader = config.headers?.['Authorization'] ?? '';
-            if (authHeader.includes('$') && ConnectorManager.resolveEnvVar(authHeader).includes('$')) {
-                continue;
-            }
-            // Skip OAuth connectors without auth headers — they need per-user tokens
-            if (config.requiresOAuth && !config.headers?.['Authorization']) {
-                continue;
-            }
+    static async buildTools(configs, opts) {
+        const timeoutMs = opts?.timeoutMs ?? 10_000;
+        const verbose = process.env.STUDIOGRAPH_VERBOSE === '1';
+        if (verbose) {
+            log.info(`[connectors] buildTools: ${configs.length} config(s), userId=${opts?.userId ?? 'none'}, authService=${opts?.authService ? 'present' : 'missing'}`);
+        }
+        // Load all connectors concurrently. Sequential was N × timeoutMs in the
+        // worst case (three dead MCP endpoints → 30s before the first chat callback).
+        // Parallel collapses that to ~timeoutMs total since each connector's timer
+        // runs concurrently. Order is preserved in the flattened tool list since
+        // Promise.all resolves in input order.
+        //
+        // Per-connector containment: the entire body (auth resolution + connection)
+        // runs inside the try, so a throw from `resolveConnectorAuth` (e.g. an
+        // encrypted-row decrypt failure inside `hasOAuthTokens`) skips that one
+        // connector instead of rejecting the whole batch and starving the agent.
+        const results = await Promise.all(configs.map(async (config) => {
+            let decisionMode = 'unknown';
+            let timer;
             try {
-                const connectorTools = await Promise.race([
-                    ConnectorManager._buildConnectorTools(config),
-                    new Promise((_, reject) => setTimeout(() => reject(new Error('Connection timed out')), timeoutMs)),
+                const decision = ConnectorManager.resolveConnectorAuth(config, opts);
+                decisionMode = decision.mode;
+                if (verbose) {
+                    log.info(`[connectors] "${config.name}" → resolved as ${decision.mode}`);
+                }
+                if (decision.mode === 'skip-placeholder')
+                    return [];
+                if (decision.mode === 'skip-no-credential')
+                    return [];
+                const provider = decision.mode === 'user-oauth' ? decision.authProvider : undefined;
+                // Clear the timer on success so fast connectors don't leave a
+                // pending setTimeout sitting in the event loop until `timeoutMs`.
+                return await Promise.race([
+                    ConnectorManager._buildConnectorTools(config, provider),
+                    new Promise((_, reject) => {
+                        timer = setTimeout(() => reject(new Error('Connection timed out')), timeoutMs);
+                    }),
                 ]);
-                tools.push(...connectorTools);
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
-                // Suppress auth errors — these connectors need per-user OAuth tokens
-                if (/unauthorized|invalid.token|authorization.*required|403/i.test(msg))
-                    continue;
-                console.warn(`[connectors] Failed to connect to "${config.name}": ${msg}`);
+                const isAuthError = /unauthorized|invalid.token|authorization.*required|403/i.test(msg);
+                // Broker-mediated connectors (Asana, Figma) hit a known runtime
+                // gap when the user's tokens expire: the MCP SDK falls back to
+                // Dynamic Client Registration against the upstream because we
+                // don't carry the broker's client_secret in process, and the
+                // upstream rejects the instance redirect URI ("One or more
+                // redirect URIs are not allowed" / "redirect_uri" mismatch /
+                // "unregistered" client). Surface as a reconnect prompt
+                // instead of a generic failure — proper fix is refresh-via-
+                // broker (see connector_per_user_oauth_gap.md).
+                const isBrokerRedirectMismatch = decisionMode === 'user-oauth' &&
+                    hasBrokerSupport(config.url) &&
+                    /redirect.?uri|unregistered|not.allowed/i.test(msg);
+                if (isBrokerRedirectMismatch) {
+                    log.warn(`[connectors] Per-user OAuth tokens for "${config.name}" are stale and can't be refreshed automatically ` +
+                        `(broker refresh not yet implemented). User must reconnect from Settings → External Connectors.`);
+                    return [];
+                }
+                // Until 2026-05-13, ALL auth errors were silently suppressed
+                // (legacy behavior from before the runtime could actually do
+                // per-user OAuth). That's actively misleading now: when a user
+                // has bound tokens via the UI but the upstream rejects them,
+                // we need to surface that, not pretend the connector just
+                // doesn't exist. Only suppress when we knowingly used the
+                // workspace fallback path — that's the "admin-misconfigured
+                // header" case where the old behavior is still right.
+                if (isAuthError && decisionMode !== 'user-oauth')
+                    return [];
+                if (isAuthError && decisionMode === 'user-oauth') {
+                    log.warn(`[connectors] Per-user OAuth call to "${config.name}" failed (token rejected upstream): ${msg}. ` +
+                        `User may need to reconnect.`);
+                    return [];
+                }
+                log.warn(`[connectors] Failed to connect to "${config.name}": ${msg}`);
+                return [];
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
             }
+        }));
+        return results.flat();
+    }
+    /**
+     * Decide which credential to use for a connector. Public so the precedence
+     * rule can be unit-tested without spinning up a real MCP server.
+     *
+     * Returns one of:
+     *   - `{ mode: 'user-oauth', authProvider }`: per-user OAuth tokens win. The
+     *     transport will read tokens via the provider's `tokens()` and refresh
+     *     back to the user's row.
+     *   - `{ mode: 'workspace-header' }`: the workspace static `Authorization`
+     *     header is used. The transport gets the header directly; the OAuth
+     *     machinery is not touched.
+     *   - `{ mode: 'skip-placeholder' }`: the workspace header contains an
+     *     unresolved `$ENV_VAR` placeholder — nothing usable, skip silently.
+     *   - `{ mode: 'skip-no-credential' }`: connector requires OAuth but has
+     *     neither per-user tokens nor a workspace header.
+     */
+    static resolveConnectorAuth(config, opts) {
+        // Unresolved env-var placeholder in the header — nothing usable.
+        const authHeader = config.headers?.['Authorization'] ?? '';
+        if (authHeader.includes('$') && ConnectorManager.resolveEnvVar(authHeader).includes('$')) {
+            return { mode: 'skip-placeholder' };
+        }
+        const userHasOAuth = !!opts?.userId &&
+            !!opts?.authService &&
+            opts.authService.hasOAuthTokens(opts.userId, config.name);
+        const hasWorkspaceHeader = !!config.headers?.['Authorization'];
+        // Precedence: per-user OAuth wins over workspace header. See the
+        // 2026-05-13 design note in AGENTS.md (Per-user MCP OAuth).
+        if (userHasOAuth) {
+            const oauthCreds = ConnectorManager._resolveOAuthCredentials(config);
+            const provider = new McpOAuthProvider(config.name, opts.userId, opts.authService, opts?.serverUrl ?? '', oauthCreds);
+            return { mode: 'user-oauth', authProvider: provider };
+        }
+        if (hasWorkspaceHeader)
+            return { mode: 'workspace-header' };
+        if (config.requiresOAuth)
+            return { mode: 'skip-no-credential' };
+        // No auth needed (open MCP server).
+        return { mode: 'workspace-header' };
+    }
+    /** Resolve OAuth credentials from a connector config or fall back to broker. */
+    static _resolveOAuthCredentials(config) {
+        if (config.oauth?.client_id) {
+            return {
+                client_id: config.oauth.client_id,
+                client_secret: config.oauth.client_secret,
+            };
         }
-        return tools;
+        // Broker-supported connectors don't carry credentials locally — the broker
+        // holds the client secret. McpOAuthProvider tolerates `undefined` here
+        // because at runtime it only needs `tokens()`, which reads the user's row.
+        if (hasBrokerSupport(config.url))
+            return undefined;
+        return undefined;
     }
     // ── private helpers ───────────────────────────────────────────────────────
     static _readDir(dir) {
@@ -252,7 +410,7 @@ export class ConnectorManager {
             try {
                 const raw = JSON.parse(readFileSync(join(dir, entry), 'utf-8'));
                 if (typeof raw.name !== 'string' || !raw.name) {
-                    console.warn(`[connectors] Skipping malformed config (missing name): ${entry}`);
+                    log.warn(`[connectors] Skipping malformed config (missing name): ${entry}`);
                     continue;
                 }
                 if (!ConnectorManager._validate(raw, entry))
@@ -260,7 +418,7 @@ export class ConnectorManager {
                 configs.push(raw);
             }
             catch {
-                console.warn(`[connectors] Could not parse ${entry} — skipping`);
+                log.warn(`[connectors] Could not parse ${entry} — skipping`);
             }
         }
         return configs;
@@ -281,21 +439,42 @@ export class ConnectorManager {
     }
     static _validate(config, filename) {
         if (!config.url) {
-            console.warn(`[connectors] connector "${config.name}" missing "url" — skipping`);
+            // Partially-configured connectors (added in the UI but never given a
+            // URL) are an expected idle state — connector status is surfaced in
+            // the Settings UI, no need to warn on every boot. Verbose mode keeps
+            // the visibility for debugging.
+            if (process.env.STUDIOGRAPH_VERBOSE === '1') {
+                log.warn(`[connectors] connector "${config.name}" missing "url" — skipping`);
+            }
             return false;
         }
         return true;
     }
-    static async _buildConnectorTools(config) {
+    static async _buildConnectorTools(config, authProvider) {
         const client = new Client({ name: 'studiograph', version: '1.0.0' });
-        const headers = {};
-        if (config.headers) {
-            for (const [key, value] of Object.entries(config.headers)) {
-                headers[key] = ConnectorManager.resolveEnvVar(value);
+        // When per-user OAuth wins, hand the transport the OAuthClientProvider —
+        // it manages the Authorization header from `provider.tokens()`, including
+        // refreshing via `saveTokens` writing back to the user's row. We
+        // deliberately do NOT also pass the workspace static header in this case
+        // (precedence rule: user OAuth wins outright).
+        //
+        // When user OAuth is absent, headers from config are passed verbatim —
+        // env-placeholder resolution preserved.
+        const transportOpts = {};
+        if (authProvider) {
+            transportOpts.authProvider = authProvider;
+        }
+        else {
+            const headers = {};
+            if (config.headers) {
+                for (const [key, value] of Object.entries(config.headers)) {
+                    headers[key] = ConnectorManager.resolveEnvVar(value);
+                }
             }
+            if (Object.keys(headers).length > 0)
+                transportOpts.requestInit = { headers };
         }
-        const requestInit = Object.keys(headers).length > 0 ? { headers } : {};
-        const transport = new StreamableHTTPClientTransport(new URL(config.url), { requestInit });
+        const transport = new StreamableHTTPClientTransport(new URL(config.url), transportOpts);
         await client.connect(transport);
         const { tools: remoteTools } = await client.listTools();
         const label = config.description ?? config.name;

package/dist/mcp/connector-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"connector-manager.js","sourceRoot":"","sources":["../../src/mcp/connector-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AAsB5E,iFAAiF;AAEjF,MAAM,OAAO,gBAAgB;IAE3B,6EAA6E;IAE7E;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,aAAsB;QACvC,MAAM,gBAAgB,GAAG,aAAa;YACpC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,aAAqB;QAC/C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,UAAU,CAAC,MAAuB;QACvC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;QACzD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,mBAAmB,CAAC,MAAuB,EAAE,aAAqB;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAC9D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,aAAsB;QACtD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,UAAU,CAAC,IAAY,EAAE,aAAsB;QACpD,IAAI,QAAQ,GAA2B,IAAI,CAAC;QAC5C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,GAA2B,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,MAAuB;QACzC,MAAM,QAAQ,GAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE5D,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,OAAO,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAQ,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnF,QAAQ,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,MAAM,eAAe,EAAE,CAAC;QACnF,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,4EAA4E;IAE5E;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CAAC,IAAY,EAAE,WAAoB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAE3E,+BAA+B;QAC/B,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;iBAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;iBACjD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAgB,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI;gBACJ,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC;aACnD,CAAC,CAAC,CAAC;YACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAC9H,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO,CAAC,EAAE,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,WAAW,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAC,MAAW;QAC/C,MAAM,MAAM,GAAQ,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACpD,IAAI,MAAM,CAAC,WAAW;YAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAChE,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAC1C,MAAM,CAAC,UAAU,CAAC,MAAW;QACnC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,aAAa,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,6EAA6E;IAE7E;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAA0B,EAAE,SAAS,GAAG,MAAM;QACpE,MAAM,KAAK,GAAU,EAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,kEAAkE;YAClE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzF,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBACxC,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,CAAC;oBAC7C,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,SAAS,CAAC,CACvE;iBACF,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,qEAAqE;gBACrE,IAAI,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClF,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IAErE,MAAM,CAAC,QAAQ,CAAC,GAAW;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACxD,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAoB,CAAC;gBACnF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9C,OAAO,CAAC,IAAI,CAAC,0DAA0D,KAAK,EAAE,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;oBAAE,SAAS;gBACtD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,gCAAgC,KAAK,aAAa,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,IAAqB,EAAE,OAAwB;QACnE,MAAM,MAAM,GAAoB,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACxC,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAI,KAAgC,EAAE,CAAC;gBAC/E,CAAC;qBAAM,CAAC;oBACL,MAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,MAAuB,EAAE,QAAgB;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,IAAI,4BAA4B,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAuB;QAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAgB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;QAEhD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAS,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE;YACnD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE;YAChE,UAAU,EAAG,IAAI,CAAC,WAAW;YAE7B,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAW,EAAE,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC7E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAiB;yBACnC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;yBACvB,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;wBACnF,OAAO,EAAE,MAAM;qBAChB,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;wBAChG,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}
+{"version":3,"file":"connector-manager.js","sourceRoot":"","sources":["../../src/mcp/connector-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AAsB5E,iFAAiF;AAEjF,MAAM,OAAO,gBAAgB;IAE3B,6EAA6E;IAE7E;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,aAAsB;QACvC,MAAM,gBAAgB,GAAG,aAAa;YACpC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,aAAqB;QAC/C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,UAAU,CAAC,MAAuB;QACvC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;QACzD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,KAAK,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAuB;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAChF,MAAM,qBAAqB,CAAC,MAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,IAAI,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,mBAAmB,CAAC,MAAuB,EAAE,aAAqB;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAC9D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,wDAAwD;QACxD,0DAA0D;QAC1D,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,aAAsB;QACtD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,UAAU,CAAC,IAAY,EAAE,aAAsB;QACpD,IAAI,QAAQ,GAA2B,IAAI,CAAC;QAC5C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,GAA2B,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,MAAuB;QACzC,MAAM,QAAQ,GAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE5D,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,OAAO,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAQ,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnF,QAAQ,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,MAAM,eAAe,EAAE,CAAC;QACnF,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,aAAa,CAAC,KAAa;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,4EAA4E;IAE5E;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CAAC,IAAY,EAAE,WAAoB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAE3E,+BAA+B;QAC/B,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;iBAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;iBACjD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAgB,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI;gBACJ,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC;aACnD,CAAC,CAAC,CAAC;YACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAC9H,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO,CAAC,EAAE,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,WAAW,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAC,MAAW;QAC/C,MAAM,MAAM,GAAQ,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACpD,IAAI,MAAM,CAAC,WAAW;YAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAChE,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAC1C,MAAM,CAAC,UAAU,CAAC,MAAW;QACnC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,aAAa,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,OAA0B,EAC1B,IAQC;QAED,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CACN,4BAA4B,OAAO,CAAC,MAAM,sBAAsB,IAAI,EAAE,MAAM,IAAI,MAAM,iBAAiB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CACnJ,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,8EAA8E;QAC9E,2EAA2E;QAC3E,yEAAyE;QACzE,uCAAuC;QACvC,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,YAAY,GAAW,SAAS,CAAC;YACrC,IAAI,KAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC7B,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,IAAI,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,kBAAkB;oBAAE,OAAO,EAAE,CAAC;gBACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB;oBAAE,OAAO,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpF,8DAA8D;gBAC9D,kEAAkE;gBAClE,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;oBACxB,gBAAgB,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC;oBACvD,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;wBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBACjF,CAAC,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,WAAW,GAAG,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxF,gEAAgE;gBAChE,+DAA+D;gBAC/D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,wDAAwD;gBACxD,4DAA4D;gBAC5D,gDAAgD;gBAChD,MAAM,wBAAwB,GAC5B,YAAY,KAAK,YAAY;oBAC7B,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC;oBAC5B,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,IAAI,wBAAwB,EAAE,CAAC;oBAC7B,GAAG,CAAC,IAAI,CACN,2CAA2C,MAAM,CAAC,IAAI,mDAAmD;wBACvG,gGAAgG,CACnG,CAAC;oBACF,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,6DAA6D;gBAC7D,6DAA6D;gBAC7D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,0DAA0D;gBAC1D,0DAA0D;gBAC1D,4DAA4D;gBAC5D,sDAAsD;gBACtD,IAAI,WAAW,IAAI,YAAY,KAAK,YAAY;oBAAE,OAAO,EAAE,CAAC;gBAC5D,IAAI,WAAW,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;oBACjD,GAAG,CAAC,IAAI,CACN,wCAAwC,MAAM,CAAC,IAAI,uCAAuC,GAAG,IAAI;wBAC/F,6BAA6B,CAChC,CAAC;oBACF,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,oBAAoB,CACzB,MAAuB,EACvB,IAAyE;QAOzE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,CAAC,IAAI,EAAE,MAAM;YACd,CAAC,CAAC,IAAI,EAAE,WAAW;YACnB,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAE/D,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CACnC,MAAM,CAAC,IAAI,EACX,IAAK,CAAC,MAAO,EACb,IAAK,CAAC,WAAY,EAClB,IAAI,EAAE,SAAS,IAAI,EAAE,EACrB,UAAU,CACX,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,kBAAkB;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAE5D,IAAI,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;QAEhE,oCAAoC;QACpC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IACtC,CAAC;IAED,gFAAgF;IACxE,MAAM,CAAC,wBAAwB,CAAC,MAAuB;QAC7D,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;gBACjC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;aAC1C,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAErE,MAAM,CAAC,QAAQ,CAAC,GAAW;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACxD,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAoB,CAAC;gBACnF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9C,GAAG,CAAC,IAAI,CAAC,0DAA0D,KAAK,EAAE,CAAC,CAAC;oBAC5E,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;oBAAE,SAAS;gBACtD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,gCAAgC,KAAK,aAAa,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,IAAqB,EAAE,OAAwB;QACnE,MAAM,MAAM,GAAoB,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACxC,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAI,KAAgC,EAAE,CAAC;gBAC/E,CAAC;qBAAM,CAAC;oBACL,MAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,MAAuB,EAAE,QAAgB;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,gCAAgC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,IAAI,4BAA4B,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CACvC,MAAuB,EACvB,YAAkC;QAElC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,yEAAyE;QACzE,+CAA+C;QAC/C,EAAE;QACF,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,aAAa,GAAsE,EAAE,CAAC;QAC5F,IAAI,YAAY,EAAE,CAAC;YACjB,aAAa,CAAC,YAAY,GAAG,YAAY,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,WAAW,GAAG,EAAE,OAAO,EAAE,CAAC;QAC/E,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;QACxF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;QAEhD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAS,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;YAC3C,KAAK,EAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE;YACnD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE;YAChE,UAAU,EAAG,IAAI,CAAC,WAAW;YAE7B,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAW,EAAE,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC7E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAiB;yBACnC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;yBACvB,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;wBACnF,OAAO,EAAE,MAAM;qBAChB,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;wBAChG,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/mcp/oauth-provider.d.ts

@@ -33,8 +33,3 @@ export declare class McpOAuthProvider implements OAuthClientProvider {
     saveCodeVerifier(codeVerifier: string): void;
     codeVerifier(): string;
 }
-/** Decode the state parameter from an OAuth callback. */
-export declare function decodeOAuthState(state: string): {
-    connectorName: string;
-    userId: number;
-} | null;

package/dist/mcp/oauth-provider.js

@@ -36,14 +36,16 @@ export class McpOAuthProvider {
         };
     }
     state() {
-        // Encode user+connector+origin in state.
-        // When using auth.studiograph.com relay, the proxy reads `o` to redirect back.
-        // Our own callback reads `c` and `u`.
-        return Buffer.from(JSON.stringify({
-            c: this.connectorName,
-            u: this.userId,
-            o: this.serverUrl,
-        })).toString('base64url');
+        // HMAC-signed so the callback/claim handlers can verify the state was
+        // minted by this instance. Without the signature, an attacker who
+        // controls a callback URL could forge {c, u, o} and bind their tokens
+        // against a victim's userId. The signing key is HKDF-derived from the
+        // workspace master key in AuthService — see src/mcp/state-signer.ts.
+        return this.authService.signOAuthState({
+            connectorName: this.connectorName,
+            userId: this.userId,
+            origin: this.serverUrl,
+        });
     }
     clientInformation() {
         // Pre-registered credentials take priority
@@ -86,18 +88,4 @@ export class McpOAuthProvider {
         return data?.codeVerifier ?? '';
     }
 }
-/** Decode the state parameter from an OAuth callback. */
-export function decodeOAuthState(state) {
-    try {
-        const parsed = JSON.parse(Buffer.from(state, 'base64url').toString());
-        // Support both formats: { c, u, o } (compact) and { connectorName, userId } (legacy)
-        return {
-            connectorName: parsed.c ?? parsed.connectorName,
-            userId: parsed.u ?? parsed.userId,
-        };
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=oauth-provider.js.map

package/dist/mcp/oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/mcp/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,OAAO,gBAAgB;IAOjB;IACA;IACA;IACA;IATV,qFAAqF;IACrF,gBAAgB,GAAkB,IAAI,CAAC;IAE/B,aAAa,CAAoB;IAEzC,YACU,aAAqB,EACrB,MAAc,EACd,WAAwB,EACxB,SAAiB,EACzB,gBAAmC;QAJ3B,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAa;QACxB,cAAS,GAAT,SAAS,CAAQ;QAGzB,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;IACxC,CAAC;IAED,IAAI,WAAW;QACb,2EAA2E;QAC3E,IAAI,IAAI,CAAC,aAAa,EAAE,YAAY;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QAC7E,OAAO,GAAG,IAAI,CAAC,SAAS,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,cAAc;QAChB,OAAO;YACL,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5C,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;SAC9F,CAAC;IACJ,CAAC;IAED,KAAK;QACH,yCAAyC;QACzC,+EAA+E;QAC/E,sCAAsC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,CAAC,EAAE,IAAI,CAAC,aAAa;YACrB,CAAC,EAAE,IAAI,CAAC,MAAM;YACd,CAAC,EAAE,IAAI,CAAC,SAAS;SAClB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAED,iBAAiB;QACf,2CAA2C;QAC3C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS;gBACvC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa;aACjB,CAAC;QACnC,CAAC;QACD,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;IACvC,CAAC;IAED,qBAAqB,CAAC,UAAuC;QAC3D,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,6CAA6C;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,MAAmB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IAClC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtE,qFAAqF;QACrF,OAAO;YACL,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,aAAa;YAC/C,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM;SAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/mcp/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,OAAO,gBAAgB;IAOjB;IACA;IACA;IACA;IATV,qFAAqF;IACrF,gBAAgB,GAAkB,IAAI,CAAC;IAE/B,aAAa,CAAoB;IAEzC,YACU,aAAqB,EACrB,MAAc,EACd,WAAwB,EACxB,SAAiB,EACzB,gBAAmC;QAJ3B,kBAAa,GAAb,aAAa,CAAQ;QACrB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAa;QACxB,cAAS,GAAT,SAAS,CAAQ;QAGzB,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;IACxC,CAAC;IAED,IAAI,WAAW;QACb,2EAA2E;QAC3E,IAAI,IAAI,CAAC,aAAa,EAAE,YAAY;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;QAC7E,OAAO,GAAG,IAAI,CAAC,SAAS,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,cAAc;QAChB,OAAO;YACL,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5C,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;SAC9F,CAAC;IACJ,CAAC;IAED,KAAK;QACH,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;QACf,2CAA2C;QAC3C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS;gBACvC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa;aACjB,CAAC;QACnC,CAAC;QACD,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;IACvC,CAAC;IAED,qBAAqB,CAAC,UAAuC;QAC3D,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,6CAA6C;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,MAAmB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IAClC,CAAC;CACF"}

package/dist/mcp/oauth-registry.d.ts

@@ -1,16 +1,47 @@
 /**
  * OAuth Broker Registry
  *
- * Maps MCP server hostnames to broker connector names.
- * When a connector URL matches, OAuth is handled by the hosted broker
- * at auth.studiograph.com — no client secrets needed on the instance.
+ * Catalog of MCP servers with pre-registered OAuth apps on the
+ * `auth.studiograph.com` broker. Two responsibilities, both driven by
+ * the same array below:
+ *
+ *   1. RUNTIME — when a user-imported connector's URL matches one of
+ *      these hostnames, OAuth gets routed through the broker (which
+ *      holds the client secret) instead of expecting per-instance
+ *      credentials. See `getBrokerConnectUrl`.
+ *   2. CATALOG — Settings → External Connectors lists these as
+ *      "available to one-click add" tiles so an owner doesn't have to
+ *      know the canonical URL or paste JSON. See
+ *      `listAvailableBrokerConnectors`.
+ *
+ * Adding a new entry is a deliberate decision, not a default workflow.
+ * See AGENTS.md § "Broker strategy" for when to do it and the costs
+ * involved (provider relationship, rate-limit exposure, single point
+ * of compromise).
  */
 declare const BROKER_URL = "https://auth.studiograph.com";
-/**
- * MCP server hostnames with pre-registered OAuth apps on the broker.
- * Value is the connector name used in broker routes.
- */
-export declare const BROKER_CONNECTORS: Record<string, string>;
+export interface BrokerConnector {
+    /** Hostname extracted from connector URLs for runtime routing. */
+    hostname: string;
+    /** Slug used in the broker's `/connect/:name` and `/callback/:name`. */
+    name: string;
+    /** User-facing display label for the catalog tile. */
+    displayName: string;
+    /**
+     * Canonical MCP server URL the catalog tile imports when an owner
+     * clicks "Add". Verified periodically — providers move endpoints
+     * occasionally and a stale value here surfaces as an import failure.
+     */
+    serverUrl: string;
+    /**
+     * If true, the catalog suppresses the tile even though the runtime
+     * still routes OAuth through the broker should someone manually
+     * configure it. Use for entries where the OAuth app is registered
+     * but the upstream MCP server isn't generally available yet.
+     */
+    catalogHidden?: boolean;
+}
+export declare const BROKER_CONNECTORS: readonly BrokerConnector[];
 /**
  * Check if a connector URL has broker support.
  * Returns the broker connect URL, or undefined if not supported.
@@ -20,5 +51,12 @@ export declare function getBrokerConnectUrl(connectorUrl: string, state: string)
  * Check if a connector URL is supported by the broker.
  */
 export declare function hasBrokerSupport(connectorUrl: string): boolean;
+/**
+ * Catalog entries owners can one-click add. Drops `catalogHidden`
+ * connectors and anything callers have already configured (the names
+ * passed in are case-normalized — connector names are url-safe slugs
+ * but the import form may capitalize the display label).
+ */
+export declare function listAvailableBrokerConnectors(configuredNames?: ReadonlySet<string>): Array<Pick<BrokerConnector, 'name' | 'displayName' | 'serverUrl'>>;
 /** Broker base URL for claim retrieval. */
 export { BROKER_URL };

package/dist/mcp/oauth-registry.js

@@ -1,19 +1,45 @@
 /**
  * OAuth Broker Registry
  *
- * Maps MCP server hostnames to broker connector names.
- * When a connector URL matches, OAuth is handled by the hosted broker
- * at auth.studiograph.com — no client secrets needed on the instance.
+ * Catalog of MCP servers with pre-registered OAuth apps on the
+ * `auth.studiograph.com` broker. Two responsibilities, both driven by
+ * the same array below:
+ *
+ *   1. RUNTIME — when a user-imported connector's URL matches one of
+ *      these hostnames, OAuth gets routed through the broker (which
+ *      holds the client secret) instead of expecting per-instance
+ *      credentials. See `getBrokerConnectUrl`.
+ *   2. CATALOG — Settings → External Connectors lists these as
+ *      "available to one-click add" tiles so an owner doesn't have to
+ *      know the canonical URL or paste JSON. See
+ *      `listAvailableBrokerConnectors`.
+ *
+ * Adding a new entry is a deliberate decision, not a default workflow.
+ * See AGENTS.md § "Broker strategy" for when to do it and the costs
+ * involved (provider relationship, rate-limit exposure, single point
+ * of compromise).
  */
 const BROKER_URL = 'https://auth.studiograph.com';
-/**
- * MCP server hostnames with pre-registered OAuth apps on the broker.
- * Value is the connector name used in broker routes.
- */
-export const BROKER_CONNECTORS = {
-    'mcp.asana.com': 'asana',
-    'mcp.figma.com': 'figma',
-};
+export const BROKER_CONNECTORS = [
+    {
+        hostname: 'mcp.asana.com',
+        name: 'asana',
+        displayName: 'Asana',
+        serverUrl: 'https://mcp.asana.com/sse',
+    },
+    {
+        hostname: 'mcp.figma.com',
+        name: 'figma',
+        displayName: 'Figma',
+        serverUrl: 'https://mcp.figma.com/v1/mcp',
+        // Figma's MCP server is pending GA; keep the OAuth app registered
+        // for early-access workspaces but don't surface the catalog tile
+        // until the endpoint is publicly available.
+        catalogHidden: true,
+    },
+];
+/** Internal lookup — hostname → slug. Rebuilt from BROKER_CONNECTORS. */
+const BROKER_HOSTS = new Map(BROKER_CONNECTORS.map(c => [c.hostname, c.name]));
 /**
  * Check if a connector URL has broker support.
  * Returns the broker connect URL, or undefined if not supported.
@@ -21,7 +47,7 @@ export const BROKER_CONNECTORS = {
 export function getBrokerConnectUrl(connectorUrl, state) {
     try {
         const hostname = new URL(connectorUrl).hostname;
-        const connectorName = BROKER_CONNECTORS[hostname];
+        const connectorName = BROKER_HOSTS.get(hostname);
         if (!connectorName)
             return undefined;
         return `${BROKER_URL}/connect/${connectorName}?state=${encodeURIComponent(state)}`;
@@ -35,12 +61,25 @@ export function getBrokerConnectUrl(connectorUrl, state) {
  */
 export function hasBrokerSupport(connectorUrl) {
     try {
-        return new URL(connectorUrl).hostname in BROKER_CONNECTORS;
+        return BROKER_HOSTS.has(new URL(connectorUrl).hostname);
     }
     catch {
         return false;
     }
 }
+/**
+ * Catalog entries owners can one-click add. Drops `catalogHidden`
+ * connectors and anything callers have already configured (the names
+ * passed in are case-normalized — connector names are url-safe slugs
+ * but the import form may capitalize the display label).
+ */
+export function listAvailableBrokerConnectors(configuredNames = new Set()) {
+    const normalized = new Set([...configuredNames].map(n => n.toLowerCase()));
+    return BROKER_CONNECTORS
+        .filter(c => !c.catalogHidden)
+        .filter(c => !normalized.has(c.name.toLowerCase()) && !normalized.has(c.displayName.toLowerCase()))
+        .map(({ name, displayName, serverUrl }) => ({ name, displayName, serverUrl }));
+}
 /** Broker base URL for claim retrieval. */
 export { BROKER_URL };
 //# sourceMappingURL=oauth-registry.js.map

package/dist/mcp/oauth-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-registry.js","sourceRoot":"","sources":["../../src/mcp/oauth-registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,eAAe,EAAE,OAAO;IACxB,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,KAAa;IACrE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;QAChD,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QACrC,OAAO,GAAG,UAAU,YAAY,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"oauth-registry.js","sourceRoot":"","sources":["../../src/mcp/oauth-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAwBlD,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D;QACE,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,2BAA2B;KACvC;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,8BAA8B;QACzC,kEAAkE;QAClE,iEAAiE;QACjE,4CAA4C;QAC5C,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE/E;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,KAAa;IACrE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;QAChD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QACrC,OAAO,GAAG,UAAU,YAAY,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,kBAAuC,IAAI,GAAG,EAAE;IAEhD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,iBAAiB;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;SAClG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,2CAA2C;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC"}