fastmcp/dist/chunk-DZYT6QAH.cjs.map

A TypeScript framework for building MCP servers.

{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/chunk-DZYT6QAH.cjs","../src/auth/helpers.ts","../src/auth/OAuthProxy.ts","../src/auth/OAuthProxyStateStore.ts","../src/auth/types.ts","../src/auth/utils/claimsExtractor.ts","../src/auth/utils/consent.ts","../src/auth/utils/jwtIssuer.ts","../src/auth/utils/pkce.ts","../src/auth/utils/tokenStore.ts","../src/auth/providers/AuthProvider.ts","../src/auth/providers/AzureProvider.ts","../src/auth/providers/GitHubProvider.ts","../src/auth/providers/GoogleProvider.ts","../src/auth/providers/OAuthProvider.ts","../src/auth/utils/diskStore.ts","../src/auth/utils/jwks.ts"],"names":[],"mappings":"AAAA;ACaO,SAAS,cAAA,CACd,OAAA,EACG;AACH,EAAA,GAAA,CAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,KAAA,CAAM,8BAA8B,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,OAAA;AACT;AAKO,SAAS,UAAA,CAAA,GACX,MAAA,EACmB;AACtB,EAAA,OAAO,CAAC,IAAA,EAAA,GACN,MAAA,CAAO,KAAA;AAAA,IAAM,CAAC,KAAA,EAAA,GACZ,OAAO,MAAA,IAAU,WAAA,EAAa,KAAA,CAAM,IAAI,EAAA,EAAI;AAAA,EAC9C,CAAA;AACJ;AAKO,SAAS,UAAA,CAAA,GACX,MAAA,EACmB;AACtB,EAAA,OAAO,CAAC,IAAA,EAAA,GACN,MAAA,CAAO,IAAA,CAAK,CAAC,KAAA,EAAA,GAAW,OAAO,MAAA,IAAU,WAAA,EAAa,KAAA,CAAM,IAAI,EAAA,EAAI,KAAM,CAAA;AAC9E;AAKO,SAAS,WAAA,CAAmC,IAAA,EAAkB;AACnE,EAAA,OAAO,KAAA,IAAS,KAAA,EAAA,GAAa,KAAA,IAAS,IAAA;AACxC;AAKO,SAAS,WAAA,CAAA,GACX,YAAA,EACmB;AACtB,EAAA,OAAO,CAAC,IAAA,EAAA,GAAqB;AAC3B,IAAA,GAAA,CAAI,CAAC,IAAA,EAAM,OAAO,KAAA;AAClB,IAAA,MAAM,KAAA,EAAQ,IAAA,CAAiC,IAAA;AAC/C,IAAA,OAAO,OAAO,KAAA,IAAS,SAAA,GAAY,YAAA,CAAa,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/D,CAAA;AACF;AAKO,SAAS,aAAA,CAAA,GACX,cAAA,EACmB;AACtB,EAAA,OAAO,CAAC,IAAA,EAAA,GAAqB;AAC3B,IAAA,GAAA,CAAI,CAAC,IAAA,EAAM,OAAO,KAAA;AAClB,IAAA,MAAM,WAAA,EAAc,IAAA,CAAiC,MAAA;AACrD,IAAA,GAAA,CAAI,CAAC,UAAA,EAAY,OAAO,KAAA;AAExB,IAAA,MAAM,SAAA,EAAW,KAAA,CAAM,OAAA,CAAQ,UAAU,EAAA,EACrC,IAAI,GAAA,CAAI,UAAU,EAAA,EAClB,WAAA,WAAsB,IAAA,EACpB,WAAA,kBACA,IAAI,GAAA,CAAI,CAAA;AAEd,IAAA,OAAO,cAAA,CAAe,KAAA,CAAM,CAAC,KAAA,EAAA,GAAU,QAAA,CAAS,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EAC5D,CAAA;AACF;ADjDA;AACA;AE9BA,gCAA4B;AAC5B,0BAAkB;AFgClB;AACA;AGvCA;AAUA,IAAM,mBAAA,EAAqB;AAAA,EACzB,MAAA,EAAQ,SAAA;AAAA,EACR,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EAAa;AACf,CAAA;AAEA,IAAM,iBAAA,EAAmB,MAAA,CACtB,KAAA,CAAM,CAAC,MAAA,CAAE,IAAA,CAAK,CAAA,EAAG,MAAA,CAAE,MAAA,CAAO,CAAC,CAAC,CAAA,CAC5B,SAAA,CAAU,CAAC,KAAA,EAAO,OAAA,EAAA,GAAY;AAC7B,EAAA,MAAM,KAAA,EAAO,MAAA,WAAiB,KAAA,EAAO,MAAA,EAAQ,IAAI,IAAA,CAAK,KAAK,CAAA;AAE3D,EAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG;AAChC,IAAA,OAAA,CAAQ,QAAA,CAAS;AAAA,MACf,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS;AAAA,IACX,CAAC,CAAA;AACD,IAAA,OAAO,MAAA,CAAE,KAAA;AAAA,EACX;AAEA,EAAA,OAAO,IAAA;AACT,CAAC,CAAA;AAEH,IAAM,wBAAA,EAA0B,MAAA,CAAE,MAAA,CAAO;AAAA,EACvC,WAAA,EAAa,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACjC,UAAA,EAAY,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAChC,QAAA,EAAU,MAAA,CAAE,KAAA,CAAM,MAAA,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACvC,IAAA,EAAM,MAAA,CAAE,MAAA,CAAO,MAAA,CAAE,MAAA,CAAO,CAAA,EAAG,MAAA,CAAE,OAAA,CAAQ,CAAC,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACjD,QAAA,EAAU,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAC9B,QAAA,EAAU,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAC9B,UAAA,EAAY,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAChC,KAAA,EAAO,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAC3B,WAAA,EAAa,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACjC,gBAAA,EAAkB,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACtC,OAAA,EAAS,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS;AAC/B,CAAC,CAAA;AAED,IAAM,4BAAA,EAAyD,MAAA,CAAE,MAAA,CAAO;AAAA,EACtE,WAAA,EAAa,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACtB,QAAA,EAAU,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACnB,YAAA,EAAc,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAClC,QAAA,EAAU,uBAAA,CAAwB,QAAA,CAAS,CAAA;AAAA,EAC3C,YAAA,EAAc,MAAA,CAAE,KAAA,CAAM,MAAA,CAAE,MAAA,CAAO,CAAC,CAAA;AAAA,EAChC,YAAA,EAAc;AAChB,CAAC,CAAA;AAED,IAAM,8BAAA,EAA6D,MAAA,CAAE,MAAA,CAAO;AAAA,EAC1E,WAAA,EAAa,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACtB,SAAA,EAAW,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACpB,OAAA,EAAS,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAC7B,QAAA,EAAU,gBAAA;AAAA,EACV,gBAAA,EAAkB,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACtC,YAAA,EAAc,MAAA,CAAE,MAAA,CAAO,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EAClC,KAAA,EAAO,MAAA,CAAE,KAAA,CAAM,MAAA,CAAE,MAAA,CAAO,CAAC,CAAA;AAAA,EACzB,SAAA,EAAW,MAAA,CAAE,MAAA,CAAO;AACtB,CAAC,CAAA;AAED,IAAM,wBAAA,EAAiD,MAAA,CAAE,MAAA,CAAO;AAAA,EAC9D,QAAA,EAAU,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACnB,IAAA,EAAM,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACf,aAAA,EAAe,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACxB,mBAAA,EAAqB,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EAC9B,SAAA,EAAW,gBAAA;AAAA,EACX,SAAA,EAAW,gBAAA;AAAA,EACX,aAAA,EAAe,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACxB,cAAA,EAAgB,6BAAA;AAAA,EAChB,IAAA,EAAM,MAAA,CAAE,OAAA,CAAQ,CAAA,CAAE,QAAA,CAAS;AAC7B,CAAC,CAAA;AAUD,IAAM,6BAAA,EAA+B,MAAA,CAAE,MAAA,CAAO;AAAA,EAC5C,SAAA,EAAW,gBAAA;AAAA,EACX,IAAA,EAAM,MAAA,CAAE,OAAA,CAAQ,IAAI;AACtB,CAAC,CAAA;AAED,IAAM,8BAAA,EAA6D,MAAA,CAAE,MAAA,CAAO;AAAA,EAC1E,iBAAA,EAAmB,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EAC5B,mBAAA,EAAqB,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EAC9B,yBAAA,EAA2B,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACpC,QAAA,EAAU,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACnB,YAAA,EAAc,MAAA,CAAE,OAAA,CAAQ,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACnC,SAAA,EAAW,gBAAA;AAAA,EACX,SAAA,EAAW,gBAAA;AAAA,EACX,EAAA,EAAI,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EACb,QAAA,EAAU,MAAA,CAAE,MAAA,CAAO,MAAA,CAAE,MAAA,CAAO,CAAA,EAAG,MAAA,CAAE,OAAA,CAAQ,CAAC,CAAA,CAAE,QAAA,CAAS,CAAA;AAAA,EACrD,kBAAA,EAAoB,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EAC7B,iBAAA,EAAmB,MAAA,CAAE,MAAA,CAAO,CAAA;AAAA,EAC5B,KAAA,EAAO,MAAA,CAAE,KAAA,CAAM,MAAA,CAAE,MAAA,CAAO,CAAC,CAAA;AAAA,EACzB,KAAA,EAAO,MAAA,CAAE,MAAA,CAAO;AAClB,CAAC,CAAA;AA2BM,IAAM,qBAAA,EAAN,MAA2B;AAAA,EACf;AAAA,EACA;AAAA,EAEjB,WAAA,CAAY,MAAA,EAAoC;AAC9C,IAAA,IAAA,CAAK,4BAAA,EAA8B,MAAA,CAAO,2BAAA;AAC1C,IAAA,IAAA,CAAK,aAAA,EAAe,MAAA,CAAO,YAAA;AAAA,EAC7B;AAAA,EAEA,qBAAA,CAAsB,MAAA,EAA8B;AAClD,IAAA,IAAA,CAAK,2BAAA,CAA4B,GAAA,CAAI,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAA,CAAkB,IAAA,EAAkD;AACxE,IAAA,MAAM,OAAA,EAAS,MAAM,IAAA,CAAK,eAAA;AAAA,MACxB,CAAA,EAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AAGF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AAGE,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AAGE,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AAGE,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAEA,EAAA;AAGE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAIF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEQ,EAAA;AACN,IAAA;AACA,IAAA;AACF,EAAA;AAEQ,EAAA;AACN,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACF,EAAA;AACF;AH3DO;AACA;AItQM;AACA;AACA;AACA;AACA;AJwQN;AACA;AK9QM;AACH,EAAA;AAAA;AAGS,iBAAA;AACf,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAED,EAAA;AAEE,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAC0D;AAC1D,MAAA;AAA4C;AAC5C,MAAA;AAAoC;AACpC,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAKE,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AAEE,MAAA;AACF,IAAA;AAIA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AAGA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AAGN,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMQ,EAAA;AACN,IAAA;AACE,MAAA;AACA,MAAA;AACE,QAAA;AACF,MAAA;AAGA,MAAA;AACA,MAAA;AACF,IAAA;AAEE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AAGN,IAAA;AAEA,IAAA;AAEE,MAAA;AACE,QAAA;AACF,MAAA;AAGA,MAAA;AACE,QAAA;AACF,MAAA;AAGA,MAAA;AAIE,QAAA;AACF,MAAA;AAGA,MAAA;AACE,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AAEE,MAAA;AACE,QAAA;AACF,MAAA;AAGA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEE,QAAA;AACF,MAAA;AACF,IAAA;AAGA,IAAA;AACF,EAAA;AACF;ALoNO;AACA;AM7ZP;AAOa;AACH,EAAA;AAER,EAAA;AACE,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAIE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AAAS,QAAA;AAET,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AAEA,IAAA;AAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAA;AAgKmC;AAAA;AAAA;AAAA;AAAA,uCAAA;AAK0C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAA;AAOW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8DAAA;AAaL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBxF,IAAA;AACJ,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACA,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACA,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AAGA,MAAA;AACA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AAEN,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKa,EAAA;AACX,IAAA;AACF,EAAA;AACF;AN+XO;AACA;AOjtBP;AACA;AAOM;AAgEO;AACH,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAER,EAAA;AACE,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AAIE,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAME,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAA;AAEA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAME,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAA;AAEA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACE,QAAA;AAAO,UAAA;AACE,UAAA;AACA,QAAA;AAEX,MAAA;AAEA,MAAA;AAGA,MAAA;AACA,MAAA;AACE,QAAA;AAAO,UAAA;AACE,UAAA;AACA,QAAA;AAEX,MAAA;AAGA,MAAA;AAA+B,QAAA;AAE/B,MAAA;AAGA,MAAA;AAEA,MAAA;AACE,QAAA;AAAO,UAAA;AACL,UAAA;AACO,UAAA;AACA,QAAA;AAEX,MAAA;AAEA,MAAA;AACE,QAAA;AAAO,UAAA;AACL,UAAA;AACO,UAAA;AACA,QAAA;AAEX,MAAA;AAEA,MAAA;AACE,QAAA;AAAO,UAAA;AACL,UAAA;AACO,UAAA;AACA,QAAA;AAEX,MAAA;AAEA,MAAA;AAAO,QAAA;AACL,QAAA;AAEF,MAAA;AACF,IAAA;AACE,MAAA;AAAO,QAAA;AAC2C,QAAA;AAElD,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKa,EAAA;AACX,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACF,EAAA;AACF;APumBO;AACA;AQx2BP;AAOa;AAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAOrB,EAAA;AAIE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,EAAA;AACE,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AAIA,IAAA;AACA,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,EAAA;AAKE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,EAAA;AACE,IAAA;AAKF,EAAA;AACF;AR00BO;AACA;ASp7BP;AACE;AACA;AACA;AACA;AACK;AAaM;AACH,kBAAA;AACA,EAAA;AACA,EAAA;AAER,EAAA;AACE,IAAA;AAEA,IAAA;AACA,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACD,IAAA;AAEA,IAAA;AACC,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AAEA,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAA6B,QAAA;AAC3B,QAAA;AAEF,MAAA;AACA,MAAA;AACF,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACA,IAAA;AACE,MAAA;AACD,IAAA;AAED,IAAA;AACA,IAAA;AAGA,IAAA;AAKA,IAAA;AACF,EAAA;AACF;AAKa;AACH,kBAAA;AACA,kBAAA;AAER,EAAA;AAEE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACA,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AACE,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AACF;AT03BO;AACA;AE9iCD;AACJ,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACD;AAMY;AACH,kBAAA;AACA,kBAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,kBAAA;AACA,EAAA;AACA,EAAA;AAER,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AAAiB;AACjB,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AAIA,IAAA;AAGA,IAAA;AAEE,MAAA;AAKA,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACA,MAAA;AACD,IAAA;AACD,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AAEE,MAAA;AAEA,MAAA;AAA+B,QAAA;AACP,QAAA;AACF,QAAA;AAErB,MAAA;AACH,IAAA;AAGA,IAAA;AAKA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAEE,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAKA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAMA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAGA,IAAA;AAGA,IAAA;AACE,MAAA;AAA2B,QAAA;AACzB,QAAA;AAEF,MAAA;AACF,IAAA;AAGA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAGE,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAKA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAKA,IAAA;AACA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAOA,IAAA;AAEA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACE,QAAA;AAAU,UAAA;AACR,UAAA;AACA,QAAA;AAEJ,MAAA;AAEA,MAAA;AAAwB,QAAA;AACd,QAAA;AACG,QAAA;AAEb,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AAGA,IAAA;AAEE,MAAA;AAAkB,QAAA;AACL,QAAA;AAEb,MAAA;AACF,IAAA;AAEE,MAAA;AAAgC,QAAA;AACU,QAAA;AACF,QAAA;AAExC,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAqBE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAmC,QAAA;AACjC,QAAA;AAEF,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAKA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAKA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAGA,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AAAS,QAAA;AAET,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAKA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AAEE,MAAA;AAEA,MAAA;AAGE,QAAA;AAAU,UAAA;AACR,UAAA;AACA,QAAA;AAEJ,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAyB,QAAA;AACvB,QAAA;AAEF,MAAA;AACA,MAAA;AAEA,MAAA;AAA0B,QAAA;AACf,UAAA;AACwB,QAAA;AACjC,QAAA;AAED,MAAA;AACH,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACA,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAGE,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAIA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAEE,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACE,QAAA;AAAU,UAAA;AACR,UAAA;AAC4B,QAAA;AAEhC,MAAA;AACF,IAAA;AAMA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAU,QAAA;AACa,QAAA;AACD,QAAA;AACF,QAAA;AACJ,QAAA;AACI,QAAA;AACA,QAAA;AACE,QAAA;AACL,QAAA;AACM,QAAA;AACK,QAAA;AAE5B,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AAAiD;AAEjD,MAAA;AACA,MAAA;AACA,MAAA;AAA0B;AAC1B,MAAA;AACA,MAAA;AACA,MAAA;AAAoC,QAAA;AAClC,QAAA;AAEF,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAEA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AAKN,IAAA;AACE,MAAA;AAAQ,QAAA;AACN,QAAA;AAEF,MAAA;AACD,IAAA;AACH,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAGE,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAe,QAAA;AAEf,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAIE,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AAED,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACE,QAAA;AAIA,QAAA;AACA,QAAA;AACF,MAAA;AACE,QAAA;AACF,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AAGE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AAA4C,QAAA;AAC3B,QAAA;AAEjB,MAAA;AACA,MAAA;AAEE,QAAA;AACE,UAAA;AACE,YAAA;AAAiB,UAAA;AACnB,QAAA;AAEJ,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAIE,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAAe,QAAA;AAEf,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMQ,EAAA;AACN,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAGE,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AAED,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACE,QAAA;AAIA,QAAA;AACA,QAAA;AACF,MAAA;AACE,QAAA;AACF,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAGE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAMA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAAU,QAAA;AACR,QAAA;AAEF,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAIA,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AAIE,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AAGA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AAIA,IAAA;AAOA,IAAA;AACA,IAAA;AACA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AAAA,QAAA;AACE,QAAA;AACoB,QAAA;AACkC,QAAA;AACjD,QAAA;AACiB,QAAA;AAExB,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AAAoC,QAAA;AAClC,QAAA;AACe,QAAA;AACC,QAAA;AAElB,MAAA;AACA,MAAA;AAGA,MAAA;AAAwB,QAAA;AACD,QAAA;AACrB,UAAA;AACE,UAAA;AACoB,UAAA;AACmC,UAAA;AAClD,UAAA;AACiB,UAAA;AACtB,QAAA;AACF,QAAA;AAEF,MAAA;AAEA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAME,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAEA,IAAA;AAEA,IAAA;AACA,IAAA;AAMA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACA,MAAA;AAAA,QAAA;AACE,QAAA;AACoB,QAAA;AACkC,QAAA;AACjD,QAAA;AACiB,QAAA;AAExB,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAAoC,QAAA;AAClC,QAAA;AACe,QAAA;AACC,QAAA;AAElB,MAAA;AACA,MAAA;AAEA,MAAA;AAAwB,QAAA;AACD,QAAA;AACrB,UAAA;AACE,UAAA;AACoB,UAAA;AACmC,UAAA;AAClD,UAAA;AACiB,UAAA;AACtB,QAAA;AACF,QAAA;AAEF,MAAA;AAEA,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AASE,IAAA;AAKA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AAGD,IAAA;AACE,MAAA;AACA,MAAA;AAEA,MAAA;AAAgB,QAAA;AAC8B,QAAA;AAGxC,QAAA;AACgC,QAAA;AAGhC,QAAA;AAC0C,QAAA;AAChB,QAAA;AAEhC,MAAA;AAEA,MAAA;AACF,IAAA;AAGA,IAAA;AACA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AAIA,IAAA;AACE,MAAA;AAAkC,QAAA;AAElC,MAAA;AACE,QAAA;AACE,UAAA;AAAmC,QAAA;AAEvC,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AAAqB,QAAA;AACnB,QAAA;AAEF,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AAAS,QAAA;AAET,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAIE,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AAED,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACE,QAAA;AAIA,QAAA;AACA,QAAA;AACF,MAAA;AACE,QAAA;AACF,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAIA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AACN,IAAA;AACE,MAAA;AACC,IAAA;AACL,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBQ,EAAA;AACN,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AAGA,IAAA;AACE,MAAA;AACF,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AAA+B,MAAA;AAE/B,IAAA;AACF,EAAA;AACF;AAKa;AACX,EAAA;AAKE,IAAA;AAJO,IAAA;AACA,IAAA;AACA,IAAA;AAGP,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AACF;AF4qBO;AACA;AUzhEe;AAGV,EAAA;AAAA;AAAA;AAAA;AAII,EAAA;AACZ,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AACF,EAAA;AAEQ,EAAA;AAER,EAAA;AACE,IAAA;AAEF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AAGE,IAAA;AAEE,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AAYE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AAAmB,QAAA;AACyB,QAAA;AACpB,QAAA;AAExB,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AASU,EAAA;AACR,IAAA;AACE,MAAA;AACA,MAAA;AAGA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAUF;AVk/DO;AACA;AWnpEM;AACH,EAAA;AAER,EAAA;AACE,IAAA;AACA,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AAAsB;AAAA;AAAA;AAIpB,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AACF;AXgpEO;AACA;AY/rEM;AACX,EAAA;AACE,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AAAsB;AAAA;AAAA;AAIpB,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AACF;AZ6rEO;AACA;AajuEM;AACX,EAAA;AACE,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AAAsB;AAAA;AAAA;AAIpB,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AACF;Ab+tEO;AACA;Ac1wEM;AAGD,EAAA;AAEV,EAAA;AACE,IAAA;AACA,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AAAsB;AAAA;AAAA;AAIpB,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAED,IAAA;AACH,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AAEU,EAAA;AACR,IAAA;AACF,EAAA;AACF;AdowEO;AACA;Ae1zEP;AACA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACK;AACP;AAgCa;AACH,kBAAA;AACA,EAAA;AACA,EAAA;AAER,EAAA;AACE,IAAA;AACA,IAAA;AAGA,IAAA;AAGA,IAAA;AACA,IAAA;AACE,MAAA;AACC,IAAA;AACL,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AAEA,MAAA;AACE,QAAA;AACE,UAAA;AAAA,QAAA;AAGF,QAAA;AACE,UAAA;AACA,UAAA;AACA,UAAA;AAEA,UAAA;AACE,YAAA;AAAiB,UAAA;AACnB,QAAA;AAGA,UAAA;AACA,UAAA;AACE,YAAA;AAAmC,UAAA;AAC7B,UAAA;AAER,QAAA;AAEJ,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AAEE,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AAGA,MAAA;AACE,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AACF,IAAA;AAEE,MAAA;AACE,QAAA;AACF,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AAEA,IAAA;AACA,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,EAAA;AACE,IAAA;AAIA,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AACE,MAAA;AACE,QAAA;AACF,MAAA;AACA,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AAEA,MAAA;AACF,IAAA;AACE,MAAA;AACA,MAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACE,MAAA;AACE,QAAA;AACF,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKQ,EAAA;AAEN,IAAA;AACA,IAAA;AACF,EAAA;AACF;Af0vEO;AACA;AgB56EM;AACH,EAAA;AACA,EAAA;AACA,kBAAA;AACA,EAAA;AAER,EAAA;AACE,IAAA;AACE,MAAA;AAAe;AACf,MAAA;AAAkB;AAClB,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAKA,EAAA;AACE,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AACE,IAAA;AAGA,IAAA;AACE,MAAA;AACA,MAAA;AAAA,QAAA;AAC2B,QAAA;AAE3B,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBA,EAAA;AACE,IAAA;AAEE,MAAA;AAGA,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AAAoC,QAAA;AAClC,QAAA;AACK,QAAA;AAEP,MAAA;AAIA,MAAA;AAAwC,QAAA;AACzB,QAAA;AAC2B,QAAA;AAC3B,QAAA;AACA,QAAA;AACA,QAAA;AACO,QAAA;AACgB,QAAA;AACjC;AACL,MAAA;AAEA,MAAA;AAAO,QAAA;AACL,QAAA;AAEF,MAAA;AACF,IAAA;AACE,MAAA;AAAO,QAAA;AACmB,QAAA;AAE1B,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMA,EAAA;AACE,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACA,MAAA;AAGA,MAAA;AAA2B,QAAA;AACE,QAAA;AAC3B,UAAA;AAC2B,UAAA;AACK,QAAA;AAElC,MAAA;AACF,IAAA;AACE,MAAA;AAAU,QAAA;AACR;AAAA;AAAA;AAAA;AAAA,gBAAA;AAIF,MAAA;AACF,IAAA;AACF,EAAA;AAAA;AAAA;AAAA;AAAA;AAMQ,EAAA;AACN,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACE,MAAA;AACF,IAAA;AAEA,IAAA;AACF,EAAA;AACF;AhB25EO;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/fastmcp/fastmcp/dist/chunk-DZYT6QAH.cjs","sourcesContent":[null,"/**\n * Authentication Helper Functions\n * Utility functions for use with canAccess on tools, resources, and prompts\n */\n\nimport type { OAuthSession } from \"./providers/AuthProvider.js\";\n\ntype SessionAuth = Record<string, unknown> | undefined;\n\n/**\n * Extract and type-cast OAuth session from canAccess context.\n * Throws if session is undefined (use with canAccess: requireAuth).\n */\nexport function getAuthSession<T extends OAuthSession = OAuthSession>(\n  session: SessionAuth,\n): T {\n  if (!session) {\n    throw new Error(\"Session is not authenticated\");\n  }\n  return session as T;\n}\n\n/**\n * Combines multiple canAccess checks with AND logic.\n */\nexport function requireAll<T extends SessionAuth>(\n  ...checks: Array<((auth: T) => boolean) | boolean>\n): (auth: T) => boolean {\n  return (auth: T): boolean =>\n    checks.every((check) =>\n      typeof check === \"function\" ? check(auth) : check,\n    );\n}\n\n/**\n * Combines multiple canAccess checks with OR logic.\n */\nexport function requireAny<T extends SessionAuth>(\n  ...checks: Array<((auth: T) => boolean) | boolean>\n): (auth: T) => boolean {\n  return (auth: T): boolean =>\n    checks.some((check) => (typeof check === \"function\" ? check(auth) : check));\n}\n\n/**\n * Requires any authenticated session.\n */\nexport function requireAuth<T extends SessionAuth>(auth: T): boolean {\n  return auth !== undefined && auth !== null;\n}\n\n/**\n * Requires session to have a specific role (OR logic for multiple roles).\n */\nexport function requireRole<T extends SessionAuth>(\n  ...allowedRoles: string[]\n): (auth: T) => boolean {\n  return (auth: T): boolean => {\n    if (!auth) return false;\n    const role = (auth as Record<string, unknown>).role;\n    return typeof role === \"string\" && allowedRoles.includes(role);\n  };\n}\n\n/**\n * Requires session to have specific scopes.\n */\nexport function requireScopes<T extends SessionAuth>(\n  ...requiredScopes: string[]\n): (auth: T) => boolean {\n  return (auth: T): boolean => {\n    if (!auth) return false;\n    const authScopes = (auth as Record<string, unknown>).scopes;\n    if (!authScopes) return false;\n\n    const scopeSet = Array.isArray(authScopes)\n      ? new Set(authScopes)\n      : authScopes instanceof Set\n        ? authScopes\n        : new Set();\n\n    return requiredScopes.every((scope) => scopeSet.has(scope));\n  };\n}\n","/**\n * OAuth 2.1 Proxy Implementation\n * Provides DCR-compatible interface for non-DCR OAuth providers\n */\n\nimport { randomBytes } from \"crypto\";\nimport { z } from \"zod\";\n\nimport type {\n  AuthorizationParams,\n  ClientCode,\n  DCRRequest,\n  DCRResponse,\n  OAuthError,\n  OAuthProxyConfig,\n  OAuthTransaction,\n  ProxyDCRClient,\n  RefreshRequest,\n  TokenRequest,\n  TokenResponse,\n  TokenStorage,\n  UpstreamTokenSet,\n} from \"./types.js\";\n\nimport { OAuthProxyStateStore } from \"./OAuthProxyStateStore.js\";\nimport {\n  DEFAULT_ACCESS_TOKEN_TTL,\n  DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH,\n  DEFAULT_AUTHORIZATION_CODE_TTL,\n  DEFAULT_REFRESH_TOKEN_TTL,\n  DEFAULT_TRANSACTION_TTL,\n} from \"./types.js\";\nimport { ClaimsExtractor } from \"./utils/claimsExtractor.js\";\nimport { ConsentManager } from \"./utils/consent.js\";\nimport { JWTIssuer } from \"./utils/jwtIssuer.js\";\nimport { PKCEUtils } from \"./utils/pkce.js\";\nimport {\n  EncryptedTokenStorage,\n  MemoryTokenStorage,\n} from \"./utils/tokenStore.js\";\n\n/**\n * Authorization request parameters owned by the proxy. Entries in\n * `extraAuthorizationParams` with these keys are ignored so configuration\n * can never override the security-critical core of the upstream request.\n */\nconst RESERVED_AUTHORIZATION_PARAMS: ReadonlySet<string> = new Set([\n  \"client_id\",\n  \"code_challenge\",\n  \"code_challenge_method\",\n  \"redirect_uri\",\n  \"response_type\",\n  \"scope\",\n  \"state\",\n]);\n\n/**\n * OAuth 2.1 Proxy\n * Acts as transparent intermediary between MCP clients and upstream OAuth providers\n */\nexport class OAuthProxy {\n  private claimsExtractor: ClaimsExtractor | null = null;\n  private cleanupInterval: NodeJS.Timeout | null = null;\n  private config: OAuthProxyConfig;\n  private consentManager: ConsentManager;\n  private jwtIssuer?: JWTIssuer;\n  /**\n   * Keyed by proxy-issued client_id for authorize/token-exchange lookups and\n   * for the defence-in-depth callback checks. A registration never changes\n   * after it is written, so caching it locally cannot go stale; it is also\n   * persisted, so another instance can hydrate it.\n   */\n  private registeredClientsByClientId: Map<string, ProxyDCRClient> = new Map();\n  private stateStore: OAuthProxyStateStore;\n  private tokenStorage: TokenStorage;\n\n  constructor(config: OAuthProxyConfig) {\n    this.config = {\n      authorizationCodeTtl: DEFAULT_AUTHORIZATION_CODE_TTL,\n      consentRequired: true,\n      enableTokenSwap: true, // Enabled by default for security\n      redirectPath: \"/oauth/callback\",\n      transactionTtl: DEFAULT_TRANSACTION_TTL,\n      upstreamTokenEndpointAuthMethod: \"client_secret_basic\",\n      ...config,\n    };\n\n    // Set up token storage with encryption by default (matches Python's secure defaults)\n    let storage = config.tokenStorage || new MemoryTokenStorage();\n\n    // Wrap storage with encryption if not already encrypted\n    // Check if it's already an EncryptedTokenStorage instance\n    const isAlreadyEncrypted =\n      storage.constructor.name === \"EncryptedTokenStorage\";\n\n    if (!isAlreadyEncrypted && config.encryptionKey !== false) {\n      // Auto-generate encryption key if not provided\n      const encryptionKey =\n        typeof config.encryptionKey === \"string\"\n          ? config.encryptionKey\n          : this.generateSigningKey();\n\n      storage = new EncryptedTokenStorage(storage, encryptionKey);\n    }\n\n    this.tokenStorage = storage;\n    this.stateStore = new OAuthProxyStateStore({\n      registeredClientsByClientId: this.registeredClientsByClientId,\n      tokenStorage: this.tokenStorage,\n    });\n    this.consentManager = new ConsentManager(\n      config.consentSigningKey || this.generateSigningKey(),\n    );\n\n    // Initialize JWT issuer if token swap is enabled\n    if (this.config.enableTokenSwap) {\n      // Auto-generate signing key if not provided\n      const signingKey = this.config.jwtSigningKey || this.generateSigningKey();\n\n      this.jwtIssuer = new JWTIssuer({\n        audience: this.config.baseUrl,\n        issuer: this.config.baseUrl,\n        signingKey: signingKey,\n      });\n    }\n\n    // Initialize claims extractor (enabled by default)\n    const claimsConfig =\n      config.customClaimsPassthrough !== undefined\n        ? config.customClaimsPassthrough\n        : true; // Default: enabled\n\n    if (claimsConfig !== false) {\n      this.claimsExtractor = new ClaimsExtractor(claimsConfig);\n    }\n\n    // Start periodic cleanup\n    this.startCleanup();\n  }\n\n  /**\n   * OAuth authorization endpoint\n   */\n  async authorize(params: AuthorizationParams): Promise<Response> {\n    // Validate parameters\n    if (!params.client_id || !params.redirect_uri || !params.response_type) {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"Missing required parameters\",\n      );\n    }\n\n    if (params.response_type !== \"code\") {\n      throw new OAuthProxyError(\n        \"unsupported_response_type\",\n        \"Only 'code' response type is supported\",\n      );\n    }\n\n    // RFC 6749 §5.2 - reject unknown clients with invalid_client.\n    // MCP clients receive a proxy-issued client_id during DCR (not the upstream\n    // provider's credentials), so we look up by that proxy client_id.\n    const registeredClient =\n      await this.stateStore.getRegisteredClientByClientId(params.client_id);\n    if (!registeredClient) {\n      throw new OAuthProxyError(\"invalid_client\", \"Unknown client_id\");\n    }\n\n    // RFC 6749 §3.1.2.3 / RFC 6819 §4.1.5 - the redirect_uri MUST be one\n    // that was registered by this specific client. Skipping this check is\n    // CWE-601: an attacker can steal an authorization code by passing their\n    // own URL as redirect_uri.\n    if (!registeredClient.redirectUris.includes(params.redirect_uri)) {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"redirect_uri is not registered for this client\",\n      );\n    }\n\n    // Validate PKCE if provided\n    if (params.code_challenge && !params.code_challenge_method) {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"code_challenge_method required when code_challenge is present\",\n      );\n    }\n\n    // Create transaction\n    const transaction = await this.createTransaction(params);\n\n    // If consent required, show consent screen\n    if (this.config.consentRequired && !transaction.consentGiven) {\n      return this.consentManager.createConsentResponse(\n        transaction,\n        this.getProviderName(),\n      );\n    }\n\n    // Redirect to upstream provider\n    return this.redirectToUpstream(transaction);\n  }\n\n  /**\n   * Stop cleanup interval and destroy resources\n   */\n  destroy(): void {\n    if (this.cleanupInterval) {\n      clearInterval(this.cleanupInterval);\n      this.cleanupInterval = null;\n    }\n\n    this.registeredClientsByClientId.clear();\n  }\n\n  /**\n   * Token endpoint - exchange authorization code for tokens\n   */\n  async exchangeAuthorizationCode(\n    request: TokenRequest,\n  ): Promise<TokenResponse> {\n    if (request.grant_type !== \"authorization_code\") {\n      throw new OAuthProxyError(\n        \"unsupported_grant_type\",\n        \"Only authorization_code grant type is supported\",\n      );\n    }\n\n    // RFC 6749 §5.2 - reject unknown clients. Only proxy-issued client_ids\n    // (obtained via DCR) are accepted, so stolen codes cannot be exchanged by\n    // arbitrary callers.\n    const registeredClient =\n      await this.stateStore.getRegisteredClientByClientId(request.client_id);\n    if (!registeredClient) {\n      throw new OAuthProxyError(\"invalid_client\", \"Unknown client_id\");\n    }\n\n    // Consume the code atomically: whoever takes it owns this exchange, so two\n    // concurrent requests — on this instance or another one sharing the\n    // storage — cannot both redeem it (RFC 6749 §4.1.2).\n    const consumed = await this.stateStore.consumeClientCode(request.code);\n    if (!consumed) {\n      throw new OAuthProxyError(\n        \"invalid_grant\",\n        \"Invalid or expired authorization code\",\n      );\n    }\n\n    // Put a tombstone back — whether the code was live or already spent — so\n    // later attempts get the precise \"already used\" error rather than looking\n    // like an unknown code. It replaces the record instead of amending it, so\n    // the upstream tokens stop being stored the moment they are handed over,\n    // and a spent code can never be resurrected.\n    await this.stateStore.markClientCodeSpent(request.code, consumed.expiresAt);\n\n    if (consumed.status === \"spent\") {\n      throw new OAuthProxyError(\n        \"invalid_grant\",\n        \"Authorization code already used\",\n      );\n    }\n\n    const clientCode = consumed.clientCode;\n\n    // Validate client\n    if (clientCode.clientId !== request.client_id) {\n      throw new OAuthProxyError(\"invalid_client\", \"Client ID mismatch\");\n    }\n\n    // Validate PKCE if used\n    if (clientCode.codeChallenge) {\n      if (!request.code_verifier) {\n        throw new OAuthProxyError(\n          \"invalid_request\",\n          \"code_verifier required for PKCE\",\n        );\n      }\n\n      const valid = PKCEUtils.validateChallenge(\n        request.code_verifier,\n        clientCode.codeChallenge,\n        clientCode.codeChallengeMethod,\n      );\n\n      if (!valid) {\n        throw new OAuthProxyError(\"invalid_grant\", \"Invalid PKCE verifier\");\n      }\n    }\n\n    // Return tokens based on token swap setting\n    if (this.config.enableTokenSwap && this.jwtIssuer) {\n      // Token swap pattern: issue short-lived JWTs and store upstream tokens\n      return await this.issueSwappedTokens(\n        clientCode.clientId,\n        clientCode.upstreamTokens,\n      );\n    } else {\n      // Pass-through pattern: return upstream tokens directly\n      const response: TokenResponse = {\n        access_token: clientCode.upstreamTokens.accessToken,\n        expires_in: clientCode.upstreamTokens.expiresIn,\n        token_type: clientCode.upstreamTokens.tokenType,\n      };\n\n      if (clientCode.upstreamTokens.refreshToken) {\n        response.refresh_token = clientCode.upstreamTokens.refreshToken;\n      }\n\n      if (clientCode.upstreamTokens.idToken) {\n        response.id_token = clientCode.upstreamTokens.idToken;\n      }\n\n      if (clientCode.upstreamTokens.scope.length > 0) {\n        response.scope = clientCode.upstreamTokens.scope.join(\" \");\n      }\n\n      return response;\n    }\n  }\n\n  /**\n   * Token endpoint - refresh access token\n   */\n  async exchangeRefreshToken(request: RefreshRequest): Promise<TokenResponse> {\n    if (request.grant_type !== \"refresh_token\") {\n      throw new OAuthProxyError(\n        \"unsupported_grant_type\",\n        \"Only refresh_token grant type is supported\",\n      );\n    }\n\n    // Check for swap mode\n    if (this.config.enableTokenSwap && this.jwtIssuer) {\n      return await this.handleSwapModeRefresh(request);\n    }\n\n    // Passthrough mode: forward refresh token directly to upstream\n    return await this.handlePassthroughRefresh(request);\n  }\n\n  /**\n   * Get OAuth discovery metadata\n   */\n  getAuthorizationServerMetadata(): {\n    authorizationEndpoint: string;\n    codeChallengeMethodsSupported?: string[];\n    dpopSigningAlgValuesSupported?: string[];\n    grantTypesSupported?: string[];\n    introspectionEndpoint?: string;\n    issuer: string;\n    jwksUri?: string;\n    opPolicyUri?: string;\n    opTosUri?: string;\n    registrationEndpoint?: string;\n    responseModesSupported?: string[];\n    responseTypesSupported: string[];\n    revocationEndpoint?: string;\n    scopesSupported?: string[];\n    serviceDocumentation?: string;\n    tokenEndpoint: string;\n    tokenEndpointAuthMethodsSupported?: string[];\n    tokenEndpointAuthSigningAlgValuesSupported?: string[];\n    uiLocalesSupported?: string[];\n  } {\n    return {\n      authorizationEndpoint: `${this.config.baseUrl}/oauth/authorize`,\n      codeChallengeMethodsSupported: [\"S256\", \"plain\"],\n      grantTypesSupported: [\"authorization_code\", \"refresh_token\"],\n      issuer: this.config.baseUrl,\n      registrationEndpoint: `${this.config.baseUrl}/oauth/register`,\n      responseTypesSupported: [\"code\"],\n      scopesSupported: this.config.scopes || [],\n      tokenEndpoint: `${this.config.baseUrl}/oauth/token`,\n      tokenEndpointAuthMethodsSupported: [\n        \"client_secret_basic\",\n        \"client_secret_post\",\n      ],\n    };\n  }\n\n  /**\n   * Handle OAuth callback from upstream provider\n   */\n  async handleCallback(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    const error = url.searchParams.get(\"error\");\n\n    // Check for errors from upstream\n    if (error) {\n      const errorDescription = url.searchParams.get(\"error_description\");\n      throw new OAuthProxyError(error, errorDescription || undefined);\n    }\n\n    if (!code || !state) {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"Missing code or state parameter\",\n      );\n    }\n\n    // Consume the transaction: a callback is single-use, so taking it here\n    // prevents the same state from being replayed against this or any other\n    // instance sharing the storage.\n    const transaction = await this.stateStore.consumeTransaction(state);\n    if (!transaction) {\n      throw new OAuthProxyError(\"invalid_request\", \"Invalid or expired state\");\n    }\n\n    // Defense-in-depth: the transaction's stored callback URL must still be\n    // registered. Guards against any code path that could persist an\n    // unvalidated URI, and against registration being revoked mid-flow.\n    if (!(await this.stateStore.isTransactionCallbackRegistered(transaction))) {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"Transaction callback URL is not registered\",\n      );\n    }\n\n    // Exchange code with upstream provider\n    const upstreamTokens = await this.exchangeUpstreamCode(code, transaction);\n\n    // Generate authorization code for client\n    const clientCode = await this.generateAuthorizationCode(\n      transaction,\n      upstreamTokens,\n    );\n\n    // Redirect to client callback with code\n    const redirectUrl = new URL(transaction.clientCallbackUrl);\n    redirectUrl.searchParams.set(\"code\", clientCode);\n    redirectUrl.searchParams.set(\"state\", transaction.state);\n\n    return new Response(null, {\n      headers: {\n        Location: redirectUrl.toString(),\n      },\n      status: 302,\n    });\n  }\n\n  /**\n   * Handle consent form submission\n   */\n  async handleConsent(request: Request): Promise<Response> {\n    const formData = await request.formData();\n    const transactionId = formData.get(\"transaction_id\");\n    const action = formData.get(\"action\");\n\n    if (typeof transactionId !== \"string\" || !transactionId) {\n      throw new OAuthProxyError(\"invalid_request\", \"Missing transaction_id\");\n    }\n\n    // Require the choice to be explicit. Anything else used to fall through to\n    // the approve branch, so a submission that lost the field — or never sent\n    // one — granted access the user never clicked for.\n    if (action !== \"approve\" && action !== \"deny\") {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"action must be 'approve' or 'deny'\",\n      );\n    }\n\n    const transaction = await this.stateStore.getTransaction(transactionId);\n    if (!transaction) {\n      throw new OAuthProxyError(\n        \"invalid_request\",\n        \"Invalid or expired transaction\",\n      );\n    }\n\n    if (action === \"deny\") {\n      // User denied consent\n      await this.stateStore.deleteTransaction(transactionId);\n      // Defense-in-depth: never redirect to an unregistered URI.\n      if (\n        !(await this.stateStore.isTransactionCallbackRegistered(transaction))\n      ) {\n        throw new OAuthProxyError(\n          \"invalid_request\",\n          \"Transaction callback URL is not registered\",\n        );\n      }\n      const redirectUrl = new URL(transaction.clientCallbackUrl);\n      redirectUrl.searchParams.set(\"error\", \"access_denied\");\n      redirectUrl.searchParams.set(\n        \"error_description\",\n        \"User denied authorization\",\n      );\n      redirectUrl.searchParams.set(\"state\", transaction.state);\n\n      return new Response(null, {\n        headers: {\n          Location: redirectUrl.toString(),\n        },\n        status: 302,\n      });\n    }\n\n    // User approved, mark consent and redirect to upstream\n    const approvedTransaction = {\n      ...transaction,\n      consentGiven: true,\n    };\n    await this.stateStore.saveTransaction(approvedTransaction);\n\n    return this.redirectToUpstream(approvedTransaction);\n  }\n\n  /**\n   * Load upstream tokens from a FastMCP JWT\n   */\n  async loadUpstreamTokens(\n    fastmcpToken: string,\n  ): Promise<null | UpstreamTokenSet> {\n    if (!this.jwtIssuer) {\n      return null;\n    }\n\n    // Verify FastMCP JWT\n    const result = await this.jwtIssuer.verify(fastmcpToken);\n    if (!result.valid || !result.claims?.jti) {\n      return null;\n    }\n\n    // Look up token mapping\n    const mapping = (await this.tokenStorage.get(\n      `mapping:${result.claims.jti}`,\n    )) as {\n      upstreamTokenKey: string;\n    } | null;\n\n    if (!mapping) {\n      return null;\n    }\n\n    // Retrieve upstream tokens\n    const upstreamTokens = (await this.tokenStorage.get(\n      `upstream:${mapping.upstreamTokenKey}`,\n    )) as null | UpstreamTokenSet;\n\n    return upstreamTokens;\n  }\n\n  /**\n   * RFC 7591 Dynamic Client Registration\n   */\n  async registerClient(request: DCRRequest): Promise<DCRResponse> {\n    // Validate required fields\n    if (!request.redirect_uris || request.redirect_uris.length === 0) {\n      throw new OAuthProxyError(\n        \"invalid_client_metadata\",\n        \"redirect_uris is required\",\n      );\n    }\n\n    // Validate redirect URIs\n    for (const uri of request.redirect_uris) {\n      if (!this.validateRedirectUri(uri)) {\n        throw new OAuthProxyError(\n          \"invalid_redirect_uri\",\n          `Invalid redirect URI: ${uri}`,\n        );\n      }\n    }\n\n    // Generate proxy-specific credentials for this MCP client.\n    // We deliberately do NOT return the upstream provider