toolhome 0.5.0

package/dist/server/upstream/oauth-refresh.d.ts

@@ -0,0 +1,65 @@
+import type { CredentialPayload, CredentialRecord, ServerRecord } from '../domain/models.js';
+import type { Logger } from '../observability/logger.js';
+import type { Store } from '../storage/store.js';
+import type { UpstreamOAuthService } from './oauth-service.js';
+/**
+ * Seconds before `expiresAt` at which an OAuth credential becomes eligible
+ * for automatic refresh, so a near-expiry token is renewed before it is
+ * actually rejected by the upstream server.
+ */
+export declare const OAUTH_REFRESH_GRACE_SECONDS = 60;
+export interface OAuthRefreshCandidate {
+    credentialId: string;
+    server: ServerRecord;
+}
+export interface OAuthRefreshSelectionInput {
+    credentials: CredentialRecord[];
+    payloads: ReadonlyMap<string, CredentialPayload>;
+    servers: ServerRecord[];
+    /** Epoch milliseconds to evaluate expiry against. */
+    now: number;
+    graceSeconds: number;
+}
+/**
+ * Picks OAuth credentials that are due for a non-interactive refresh: attached
+ * to exactly one enabled remote MCP server, carrying both an access token and
+ * a refresh token, with an `expiresAt` at or before `now + graceSeconds`.
+ * Credentials without a refresh token or without an `expiresAt` are never
+ * schedulable and are excluded.
+ */
+export declare function selectDueOAuthCredentials(input: OAuthRefreshSelectionInput): OAuthRefreshCandidate[];
+/**
+ * Picks OAuth credentials that are already expired but carry no refresh token,
+ * attached to exactly one enabled remote MCP server. The sweep cannot refresh
+ * these; they are reported as auto-refresh failures so the event log explains
+ * why manual authorization is still required.
+ */
+export declare function selectExpiredUnrefreshableOAuthCredentials(input: OAuthRefreshSelectionInput): OAuthRefreshCandidate[];
+export interface OAuthRefreshSweepResult {
+    /** Credentials selected as due for refresh this sweep. */
+    due: number;
+    refreshed: number;
+    failed: number;
+    /** Credentials skipped because their payload changed mid-sweep. */
+    skipped: number;
+}
+/**
+ * Periodically sweeps stored OAuth credentials and refreshes expired or
+ * expiring access tokens through the non-interactive refresh-token grant,
+ * without any human action. Healthy credentials are left untouched; failures
+ * are recorded as events and never retried in a tight loop.
+ */
+export declare class OAuthRefreshSweeper {
+    #private;
+    constructor(store: Store, oauth: UpstreamOAuthService, logger: Logger, graceSeconds?: number);
+    /** Starts the interval timer plus one sweep shortly after startup. */
+    start(intervalSeconds: number): void;
+    /** Stops the timers and waits for an in-flight sweep so shutdown is clean. */
+    stop(): Promise<void>;
+    /**
+     * Runs one sweep immediately. Overlapping sweeps are deduped: a call while
+     * a sweep is in flight awaits that same sweep instead of starting a second.
+     */
+    sweep(now?: number): Promise<OAuthRefreshSweepResult>;
+}
+//# sourceMappingURL=oauth-refresh.d.ts.map

package/dist/server/upstream/oauth-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.d.ts","sourceRoot":"","sources":["../../../src/upstream/oauth-refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,0BAA0B,GAChC,qBAAqB,EAAE,CAezB;AAED;;;;;GAKG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,0BAA0B,GAChC,qBAAqB,EAAE,CAazB;AAyBD,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB;;IAU9B,YACE,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,SAA8B,EAM3C;IAED,sEAAsE;IACtE,KAAK,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAMnC;IAED,8EAA8E;IACxE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAO1B;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQxD;CAuGF"}

package/dist/server/upstream/oauth-refresh.js

@@ -0,0 +1,240 @@
+import { errorMessage } from '../domain/errors.js';
+/**
+ * Seconds before `expiresAt` at which an OAuth credential becomes eligible
+ * for automatic refresh, so a near-expiry token is renewed before it is
+ * actually rejected by the upstream server.
+ */
+export const OAUTH_REFRESH_GRACE_SECONDS = 60;
+/**
+ * Picks OAuth credentials that are due for a non-interactive refresh: attached
+ * to exactly one enabled remote MCP server, carrying both an access token and
+ * a refresh token, with an `expiresAt` at or before `now + graceSeconds`.
+ * Credentials without a refresh token or without an `expiresAt` are never
+ * schedulable and are excluded.
+ */
+export function selectDueOAuthCredentials(input) {
+    const deadline = input.now + input.graceSeconds * 1000;
+    const attachments = attachmentIndex(input.servers);
+    const due = [];
+    for (const credential of input.credentials) {
+        const payload = input.payloads.get(credential.id);
+        if (!payload || payload.type !== 'oauth')
+            continue;
+        if (!payload.accessToken || !payload.refreshToken)
+            continue;
+        if (payload.expiresAt === undefined)
+            continue;
+        if (Date.parse(payload.expiresAt) > deadline)
+            continue;
+        const server = soleEnabledRemoteServer(attachments, credential.id);
+        if (!server)
+            continue;
+        due.push({ credentialId: credential.id, server });
+    }
+    return due;
+}
+/**
+ * Picks OAuth credentials that are already expired but carry no refresh token,
+ * attached to exactly one enabled remote MCP server. The sweep cannot refresh
+ * these; they are reported as auto-refresh failures so the event log explains
+ * why manual authorization is still required.
+ */
+export function selectExpiredUnrefreshableOAuthCredentials(input) {
+    const attachments = attachmentIndex(input.servers);
+    const stalled = [];
+    for (const credential of input.credentials) {
+        const payload = input.payloads.get(credential.id);
+        if (!payload || payload.type !== 'oauth')
+            continue;
+        if (!payload.accessToken || payload.refreshToken !== undefined)
+            continue;
+        if (payload.expiresAt === undefined || Date.parse(payload.expiresAt) > input.now)
+            continue;
+        const server = soleEnabledRemoteServer(attachments, credential.id);
+        if (!server)
+            continue;
+        stalled.push({ credentialId: credential.id, server });
+    }
+    return stalled;
+}
+function attachmentIndex(servers) {
+    const attachments = new Map();
+    for (const server of servers) {
+        if (server.credentialId === null)
+            continue;
+        const list = attachments.get(server.credentialId);
+        if (list)
+            list.push(server);
+        else
+            attachments.set(server.credentialId, [server]);
+    }
+    return attachments;
+}
+function soleEnabledRemoteServer(attachments, credentialId) {
+    const attached = attachments.get(credentialId);
+    if (!attached || attached.length !== 1)
+        return null;
+    const server = attached[0];
+    if (!server.enabled)
+        return null;
+    if (server.kind !== 'remote' || server.transport.type !== 'streamable-http')
+        return null;
+    return server;
+}
+/**
+ * Periodically sweeps stored OAuth credentials and refreshes expired or
+ * expiring access tokens through the non-interactive refresh-token grant,
+ * without any human action. Healthy credentials are left untouched; failures
+ * are recorded as events and never retried in a tight loop.
+ */
+export class OAuthRefreshSweeper {
+    #store;
+    #oauth;
+    #logger;
+    #graceSeconds;
+    #running = null;
+    #timer;
+    #startup;
+    #stopped = false;
+    constructor(store, oauth, logger, graceSeconds = OAUTH_REFRESH_GRACE_SECONDS) {
+        this.#store = store;
+        this.#oauth = oauth;
+        this.#logger = logger;
+        this.#graceSeconds = graceSeconds;
+    }
+    /** Starts the interval timer plus one sweep shortly after startup. */
+    start(intervalSeconds) {
+        if (this.#timer)
+            return;
+        this.#timer = setInterval(() => void this.#tick(), intervalSeconds * 1_000);
+        this.#timer.unref?.();
+        this.#startup = setTimeout(() => void this.#tick(), 0);
+        this.#startup.unref?.();
+    }
+    /** Stops the timers and waits for an in-flight sweep so shutdown is clean. */
+    async stop() {
+        this.#stopped = true;
+        if (this.#timer)
+            clearInterval(this.#timer);
+        if (this.#startup)
+            clearTimeout(this.#startup);
+        this.#timer = undefined;
+        this.#startup = undefined;
+        await this.#running;
+    }
+    /**
+     * Runs one sweep immediately. Overlapping sweeps are deduped: a call while
+     * a sweep is in flight awaits that same sweep instead of starting a second.
+     */
+    sweep(now = Date.now()) {
+        if (this.#stopped)
+            return Promise.resolve({ due: 0, refreshed: 0, failed: 0, skipped: 0 });
+        if (this.#running)
+            return this.#running;
+        const operation = this.#sweepNow(now).finally(() => {
+            this.#running = null;
+        });
+        this.#running = operation;
+        return operation;
+    }
+    async #tick() {
+        try {
+            await this.sweep();
+        }
+        catch (error) {
+            this.#logger.warn('OAuth credential auto-refresh sweep failed', {
+                error: errorMessage(error),
+            });
+        }
+    }
+    async #sweepNow(now) {
+        const credentials = this.#store.listCredentials();
+        const payloads = new Map();
+        for (const credential of credentials) {
+            const payload = this.#store.getCredentialPayload(credential.id);
+            if (payload)
+                payloads.set(credential.id, payload);
+        }
+        const servers = this.#store.listServers();
+        const selection = {
+            credentials,
+            payloads,
+            servers,
+            now,
+            graceSeconds: this.#graceSeconds,
+        };
+        const due = selectDueOAuthCredentials(selection);
+        const stalled = selectExpiredUnrefreshableOAuthCredentials(selection);
+        let refreshed = 0;
+        let failed = 0;
+        let skipped = 0;
+        for (const candidate of stalled) {
+            failed += 1;
+            this.#store.appendEvent({
+                level: 'warn',
+                type: 'credential.auto_refresh_failed',
+                serverId: candidate.server.id,
+                message: `OAuth credential for ${candidate.server.slug} expired without a refresh token; manual authorization required`,
+                detail: { credentialId: candidate.credentialId, reason: 'missing-refresh-token' },
+            });
+        }
+        for (const candidate of due) {
+            const selected = payloads.get(candidate.credentialId);
+            const outcome = await this.#refreshCandidate(candidate, selected);
+            if (outcome === 'refreshed')
+                refreshed += 1;
+            else if (outcome === 'failed')
+                failed += 1;
+            else
+                skipped += 1;
+        }
+        return { due: due.length, refreshed, failed, skipped };
+    }
+    async #refreshCandidate(candidate, selectedPayload) {
+        const before = this.#store.getCredentialPayload(candidate.credentialId);
+        if (before?.type !== 'oauth' ||
+            (selectedPayload?.type === 'oauth' && before.accessToken !== selectedPayload.accessToken)) {
+            // A concurrent refresh (e.g. a 401-driven one) already replaced the
+            // token since selection; do not refresh the same credential twice.
+            return 'skipped';
+        }
+        try {
+            const result = await this.#oauth.begin(candidate.credentialId, {});
+            if (result.status === 'authorized') {
+                this.#store.appendEvent({
+                    level: 'info',
+                    type: 'credential.auto_refreshed',
+                    serverId: candidate.server.id,
+                    message: `Auto-refreshed OAuth credential for ${candidate.server.slug}`,
+                    detail: { credentialId: candidate.credentialId },
+                });
+                return 'refreshed';
+            }
+            // begin() fell through to the interactive flow because the refresh grant
+            // was rejected. Restore the pre-sweep payload so the credential keeps
+            // its expired status; the manual authorize flow remains the fallback.
+            if (before.type === 'oauth') {
+                this.#store.updateCredential(candidate.credentialId, { payload: before });
+            }
+            this.#store.appendEvent({
+                level: 'warn',
+                type: 'credential.auto_refresh_failed',
+                serverId: candidate.server.id,
+                message: `Auto-refresh of OAuth credential for ${candidate.server.slug} failed; manual authorization required`,
+                detail: { credentialId: candidate.credentialId, reason: 'refresh-rejected' },
+            });
+            return 'failed';
+        }
+        catch (error) {
+            this.#store.appendEvent({
+                level: 'warn',
+                type: 'credential.auto_refresh_failed',
+                serverId: candidate.server.id,
+                message: `Auto-refresh of OAuth credential for ${candidate.server.slug} failed`,
+                detail: { credentialId: candidate.credentialId, error: errorMessage(error) },
+            });
+            return 'failed';
+        }
+    }
+}
+//# sourceMappingURL=oauth-refresh.js.map

package/dist/server/upstream/oauth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.js","sourceRoot":"","sources":["../../../src/upstream/oauth-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAgB9C;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAiC;IAEjC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IACvD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnD,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,SAAS;QAC5D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QAC9C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ;YAAE,SAAS;QACvD,MAAM,MAAM,GAAG,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0CAA0C,CACxD,KAAiC;IAEjC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnD,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS;QACzE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG;YAAE,SAAS;QAC3F,MAAM,MAAM,GAAG,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YACvB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC9B,WAAwC,EACxC,YAAoB;IAEpB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAQ;IACd,MAAM,CAAuB;IAC7B,OAAO,CAAS;IAChB,aAAa,CAAS;IAC/B,QAAQ,GAA4C,IAAI,CAAC;IACzD,MAAM,CAA6B;IACnC,QAAQ,CAA6B;IACrC,QAAQ,GAAG,KAAK,CAAC;IAEjB,YACE,KAAY,EACZ,KAA2B,EAC3B,MAAc,EACd,YAAY,GAAG,2BAA2B;QAE1C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,eAAuB;QAC3B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,eAAe,GAAG,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBAC9D,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;QACtD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,SAAS,GAA+B;YAC5C,WAAW;YACX,QAAQ;YACR,OAAO;YACP,GAAG;YACH,YAAY,EAAE,IAAI,CAAC,aAAa;SACjC,CAAC;QACF,MAAM,GAAG,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,0CAA0C,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC7B,OAAO,EAAE,wBAAwB,SAAS,CAAC,MAAM,CAAC,IAAI,iEAAiE;gBACvH,MAAM,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,OAAO,KAAK,WAAW;gBAAE,SAAS,IAAI,CAAC,CAAC;iBACvC,IAAI,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,CAAC,CAAC;;gBACtC,OAAO,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,SAAgC,EAChC,eAA8C;QAE9C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxE,IACE,MAAM,EAAE,IAAI,KAAK,OAAO;YACxB,CAAC,eAAe,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,eAAe,CAAC,WAAW,CAAC,EACzF,CAAC;YACD,oEAAoE;YACpE,mEAAmE;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;oBACtB,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,2BAA2B;oBACjC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;oBAC7B,OAAO,EAAE,uCAAuC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;oBACvE,MAAM,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE;iBACjD,CAAC,CAAC;gBACH,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC7B,OAAO,EAAE,wCAAwC,SAAS,CAAC,MAAM,CAAC,IAAI,wCAAwC;gBAC9G,MAAM,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE;aAC7E,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,gCAAgC;gBACtC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC7B,OAAO,EAAE,wCAAwC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS;gBAC/E,MAAM,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;aAC7E,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/server/upstream/oauth-routes.d.ts

@@ -0,0 +1,17 @@
+import type { Logger } from '../observability/logger.js';
+import type { UpstreamOAuthService } from './oauth-service.js';
+interface HonoLike {
+    get(path: string, handler: (context: HonoContext) => Response | Promise<Response>): void;
+}
+interface HonoContext {
+    req: {
+        param(name: string): string;
+        query(name: string): string | undefined;
+    };
+}
+export declare function mountUpstreamOAuthRoutes(app: HonoLike, options: {
+    oauth: UpstreamOAuthService;
+    logger: Logger;
+}): void;
+export {};
+//# sourceMappingURL=oauth-routes.d.ts.map

package/dist/server/upstream/oauth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.d.ts","sourceRoot":"","sources":["../../../src/upstream/oauth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,UAAU,QAAQ;IAChB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;CAC1F;AAED,UAAU,WAAW;IACnB,GAAG,EAAE;QACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QAC5B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KACzC,CAAC;CACH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvD,IAAI,CA+DN"}

package/dist/server/upstream/oauth-routes.js

@@ -0,0 +1,87 @@
+export function mountUpstreamOAuthRoutes(app, options) {
+    app.get('/oauth/upstream/client/:credentialId', (context) => {
+        try {
+            return new Response(JSON.stringify(options.oauth.metadata(context.req.param('credentialId'))), {
+                status: 200,
+                headers: {
+                    'content-type': 'application/json',
+                    'cache-control': 'public, max-age=300',
+                },
+            });
+        }
+        catch {
+            return new Response(JSON.stringify({ error: 'client_metadata_not_found' }), {
+                status: 404,
+                headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+            });
+        }
+    });
+    app.get('/oauth/upstream/callback/:credentialId', async (context) => {
+        const credentialId = context.req.param('credentialId');
+        if (context.req.query('error')) {
+            return htmlPage('Authorization was not completed', 'Return to ToolHome and start the authorization flow again.', 400);
+        }
+        const code = context.req.query('code');
+        const state = context.req.query('state');
+        if (!code || !state) {
+            return htmlPage('Invalid authorization callback', 'The callback is missing required parameters. Return to ToolHome and try again.', 400);
+        }
+        try {
+            const issuer = context.req.query('iss');
+            const result = await options.oauth.callback(credentialId, {
+                code,
+                state,
+                ...(issuer === undefined ? {} : { iss: issuer }),
+            });
+            return htmlPage('Authorization complete', `${result.server.name} is connected. You can close this window.`, 200);
+        }
+        catch (error) {
+            options.logger.warn('Upstream OAuth callback failed', {
+                credentialId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return htmlPage('Authorization failed', 'The authorization response could not be verified. Return to ToolHome and try again.', 400);
+        }
+    });
+}
+function htmlPage(title, message, status) {
+    return new Response(`<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>${escapeHtml(title)} · ToolHome</title>
+    <style>
+      :root { color-scheme: light dark; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+      * { box-sizing: border-box; }
+      body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #f5f5f2; color: #171714; }
+      main { width: min(520px, calc(100vw - 40px)); padding: 40px; border: 1px solid #d9d9d2; border-radius: 18px; background: #fff; }
+      p:first-child { margin: 0 0 24px; color: #6e6e67; font: 600 12px/1 ui-monospace, SFMono-Regular, monospace; letter-spacing: .12em; text-transform: uppercase; }
+      h1 { margin: 0 0 12px; font-size: 28px; letter-spacing: -.03em; }
+      p:last-child { margin: 0; color: #62625c; line-height: 1.6; }
+      @media (prefers-color-scheme: dark) {
+        body { background: #11110f; color: #f3f3ee; }
+        main { background: #191917; border-color: #34342f; }
+        p:first-child, p:last-child { color: #aaa99f; }
+      }
+    </style>
+  </head>
+  <body><main><p>ToolHome</p><h1>${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p></main></body>
+</html>`, {
+        status,
+        headers: {
+            'content-type': 'text/html; charset=utf-8',
+            'cache-control': 'no-store',
+            'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'",
+        },
+    });
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#039;');
+}
+//# sourceMappingURL=oauth-routes.js.map

package/dist/server/upstream/oauth-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../../src/upstream/oauth-routes.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,wBAAwB,CACtC,GAAa,EACb,OAAwD;IAExD,GAAG,CAAC,GAAG,CAAC,sCAAsC,EAAE,CAAC,OAAO,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EACzE;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,qBAAqB;iBACvC;aACF,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,EAAE;gBAC1E,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,QAAQ,CACb,iCAAiC,EACjC,4DAA4D,EAC5D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,QAAQ,CACb,gCAAgC,EAChC,gFAAgF,EAChF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;gBACxD,IAAI;gBACJ,KAAK;gBACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,QAAQ,CACb,wBAAwB,EACxB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,2CAA2C,EAChE,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACpD,YAAY;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,QAAQ,CACb,sBAAsB,EACtB,qFAAqF,EACrF,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc;IAC9D,OAAO,IAAI,QAAQ,CACjB;;;;;aAKS,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;mCAgBK,UAAU,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC;QAC1E,EACJ;QACE,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,yBAAyB,EACvB,wFAAwF;SAC3F;KACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC"}

package/dist/server/upstream/oauth-service.d.ts

@@ -0,0 +1,143 @@
+import type { ServerRecord } from '../domain/models.js';
+import type { Logger } from '../observability/logger.js';
+import type { Store } from '../storage/store.js';
+import type { UpstreamManager } from './manager.js';
+export declare class UpstreamOAuthService {
+    #private;
+    constructor(store: Store, publicUrl: URL, upstreams: UpstreamManager, logger: Logger, urlClientId?: boolean);
+    metadata(credentialId: string): {
+        redirect_uris: string[];
+        token_endpoint_auth_method?: string | undefined;
+        grant_types?: string[] | undefined;
+        response_types?: string[] | undefined;
+        application_type?: string | undefined;
+        client_name?: string | undefined;
+        client_uri?: string | undefined;
+        logo_uri?: string | undefined;
+        scope?: string | undefined;
+        contacts?: string[] | undefined;
+        tos_uri?: string | undefined;
+        policy_uri?: string | undefined;
+        jwks_uri?: string | undefined;
+        jwks?: any;
+        software_id?: string | undefined;
+        software_version?: string | undefined;
+        software_statement?: string | undefined;
+    };
+    begin(credentialId: string, value?: unknown): Promise<{
+        status: string;
+        credential: {
+            id: string;
+            name: string;
+            type: "api-key" | "bearer" | "env" | "headers" | "oauth";
+            status: "expired" | "invalid" | "pending" | "ready";
+            expiresAt: string | null;
+            createdAt: string;
+            updatedAt: string;
+        } | null;
+        serverId: string;
+        connection: {
+            refreshed: boolean;
+            reason: string;
+        } | {
+            reason?: undefined;
+            refreshed: boolean;
+        };
+        authorizationUrl?: undefined;
+        callbackUrl?: undefined;
+    } | {
+        connection?: undefined;
+        status: string;
+        credential: {
+            id: string;
+            name: string;
+            type: "api-key" | "bearer" | "env" | "headers" | "oauth";
+            status: "expired" | "invalid" | "pending" | "ready";
+            expiresAt: string | null;
+            createdAt: string;
+            updatedAt: string;
+        } | null;
+        serverId: string;
+        authorizationUrl: string;
+        callbackUrl: string;
+    }>;
+    callback(credentialId: string, input: {
+        code: string;
+        state: string;
+        iss?: string;
+    }): Promise<{
+        status: string;
+        server: {
+            id: string;
+            slug: string;
+            name: string;
+            kind: "home" | "remote";
+            transport: {
+                type: "streamable-http";
+                url: string;
+                protocolMode: "auto" | "legacy" | "modern";
+                allowSseFallback: boolean;
+                headers: Record<string, string>;
+            } | {
+                type: "stdio";
+                command: string;
+                args: string[];
+                cwd?: string | undefined;
+                env: Record<string, string>;
+                protocolMode: "auto" | "legacy" | "modern";
+            };
+            credentialId: string | null;
+            enabled: boolean;
+            settings: {
+                connectTimeoutMs: number;
+                requestTimeoutMs: number;
+                maxTotalTimeoutMs: number;
+                maxConcurrency: number;
+                restart: "always" | "never" | "on-failure";
+                urlClientId?: boolean | undefined;
+            };
+            createdAt: string;
+            updatedAt: string;
+        } & {
+            transport: Extract<ServerRecord['transport'], {
+                type: 'streamable-http';
+            }>;
+        };
+        credential: {
+            id: string;
+            name: string;
+            type: "api-key" | "bearer" | "env" | "headers" | "oauth";
+            status: "expired" | "invalid" | "pending" | "ready";
+            expiresAt: string | null;
+            createdAt: string;
+            updatedAt: string;
+        } | null;
+        connection: {
+            refreshed: boolean;
+            reason: string;
+        } | {
+            reason?: undefined;
+            refreshed: boolean;
+        };
+    }>;
+    revoke(credentialId: string): Promise<{
+        revoked: boolean;
+        remoteRevocationSupported: boolean;
+        remoteRevoked: boolean;
+        attempts: {
+            tokenType: 'refresh_token' | 'access_token';
+            ok: boolean;
+            status?: number;
+        }[];
+        credential: {
+            id: string;
+            name: string;
+            type: "api-key" | "bearer" | "env" | "headers" | "oauth";
+            status: "expired" | "invalid" | "pending" | "ready";
+            expiresAt: string | null;
+            createdAt: string;
+            updatedAt: string;
+        } | null;
+    }>;
+}
+//# sourceMappingURL=oauth-service.d.ts.map

package/dist/server/upstream/oauth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../../../src/upstream/oauth-service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQpD,qBAAa,oBAAoB;;IAO/B,YACE,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,GAAG,EACd,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,EACd,WAAW,UAAO,EAOnB;IAQD,QAAQ,CAAC,YAAY,EAAE,MAAM;;;;;;;;;;;;;;;;;;MAE5B;IAEK,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,GAAE,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDpD;IAEK,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA6H5E,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE;gBAAE,IAAI,EAAE,iBAAiB,CAAA;aAAE,CAAC;;;;;;;;;;;;;;;;;;OA9F3E;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM;;;;;uBAYlB,eAAe,GAAG,cAAc;gBACvC,OAAO;qBACF,MAAM;;;;;;;;;;;OAqClB;CA+FF"}