tPjK6 UddlZddlZddlZddlZddlmZmZmZmZm Z ddl m Z m Z m Z ddl mZmZmZmZmZmZddlmZddlmZddlmZddlmZdd lmZdd lmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'dd l(m)Z)m*Z*m+Z+dd l,m-Z-dd l.m/Z/ddl0m1Z1ddl2m3Z3m4Z4m5Z5ddl6m7Z7ddl8m9Z9ddl:m;Z;ddlm?Z@ddl>mAZBddlCmDZDGddeZEGddeZFeGhdZHedeId<deJdzdeJdzfd ZKeGhd!ZLedeId"<eGd#d$hZMedeId%<eGhd&ZNedeId'<Gd(d)eZOGd*d+eOd,-ZPGd.d/ed,-ZQd0eJdzdeJdzfd1ZRd2eSeJeTfd3eSeJeTfdeSeJeTffd4ZUd5eTdeVfd6ZWd7eeSeJeJfddfd8ZXd7ee!eSeJeJfzdzddfd9ZYd:eTddfd;ZZd7eJeeeJeJfzdzde$e&zd?eVd@e]eJdzdeSeJeffdAZ^dBe=dCeJdzde=fdDZ_dEeJeeJeTfzdeSeJeTffdFZ`dGe-ddHfdIZadGe-ddJfdKZbdGe-ddLfdMZcdGe-ddNfdOZddGe-deFfdPZe ddGe-dQdRddSfdTZfdGe-dUeJddVfdWZgdGe-dUeJd>dXddYfdZZhdGe-dd[fd\ZidGe-dd]fd^ZjdGe-d_eJdUeJdd`fdaZk ddGe-dQdbddcfddZldGe-d_eJdUeJdeeJddf dfZm ddGe-dQdgddhfdiZndBe=de=fdjZo ddGe-dkeJdzde[efdlZpdGe-dUeJdedzfdmZqdGe-dneeJde[efdoZrdGe-dpeJde[eJfdqZsdGe-dreJde[eJfdsZtdGe-dte'de[efduZudGe-dveJddwfdxZvdGe-dUeJddyfdzZwdGe-dUeJfd{Zxd|Zy ddGe-dUeJd}eeJeJgedfdzdedzfd~ZzdGe-d>e$deJdefdZ{ ddGe-d>e$deJde|dUeJdzdef dZ}dGe-de|ddfdZ~dGe-dUeJde|dedzfdZ ddGe-d>e&deJd@e]eJdzdedzf dZdGe-dUeJdeTdzfdZdGe-dUeJdBe=ddfdZdBddeJdeJdzfdZdGe-deJdeJfdZdeJdeJdzfdZd_eJdUeJddfdZdeJdzdePdzfdZdeJdePdzfdZdGe-deJfdZdGe-deJfdZdGe-d_eJdUeJdeJddf dZdGe-d_eJdUeJdeJdzfdZdGe-d_eJdUeJdeVfdZdGe-d_eJdUeJddfdZ ddGe-d_eJdUeJdeJdeJdzde|dzde[eJdzdeVddfdZddePde|deVfdZdGe-d_eJdUeJdePdzfdZdGe-d_eJde[ePfdZdeSeJeTfdeJdeTfdZdeTdeeTdffdZ ddGe-dUeJd}eeJeJgedfdzde|fdZdGe-d_eJdddePdePdzf dZ dd_eJdddePdzdGe-dzdePdzf dZ dd_eJdzdddeeJePfdzdeJdzfdZdeJdzde|dzfdZdGe-d_eJde[eJfdZdGe-dUeJdeJdefdZ ddGe-dUeJdeJdeJdzdef dZdGe-de#fdZdeJdeSeJeJffdZdGe-d_eJdUeJdeSeJeJffdZdGe-d_eJdneeJdeSeJeSeJeJfffdZdGe-d_eJdUeJdeSeJeJfdeeJdeSeJeJff dZdGe-d_eJdUeJddfdZy)N) AwaitableCallableIterableMappingSequence)datetime timedeltatimezone) TYPE_CHECKINGAnyFinalProtocol TypedDictcast)verbose_proxy_logger)uuid)(MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS)get_async_httpx_client)#build_upstream_oauth2_token_request) LiteLLM_MCPServerTableMCPApprovalStatus MCPEnvVarMCPEnvVarScopeMCPSubmissionsSummaryNewMCPServerRequestSpecialMCPServerNameUpdateMCPServerRequestUserAPIKeyAuth) _get_salt_keydecrypt_value_helperencrypt_value_helper) PrismaClient)ObjectPermissionRepository) TableActions)MCPServerOAuthClientRepositoryMCPServerRepositoryMCPUserCredentialsRepository)TeamRepository)VerificationTokenRepository)httpxSpecialProvider)MCPCredentials)models)types) MCPServerc,eZdZUded<dededefdZy)_UserEnvVarsTransactionClient5TableActions[prisma_db_models.LiteLLM_MCPUserEnvVars]litellm_mcpuserenvvarsqueryargsreturnc KywN)selfr3r4s n/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/_experimental/mcp_server/db.py execute_rawz)_UserEnvVarsTransactionClient.execute_raw7N)__name__ __module__ __qualname____annotations__strobjectintr;r8r:r0r04sSSFsF6FcFrEr0c 6eZdZdefdZdededededzfdZy)_UserEnvVarsTransactionr5c Kywr7r8)r9s r: __aenter__z"_UserEnvVarsTransaction.__aenter__;r<r=exc_type exc_value tracebackNc Kywr7r8)r9rJrKrLs r: __aexit__z!_UserEnvVarsTransaction.__aexit__=r<r=)r>r?r@r0rIrCboolrNr8rEr:rGrG:s)D"?Dii6ifiY]`dYdirErG> issueraudience token_url dcr_bridge oauth2_flowregistration_urlauthorization_urlsubject_token_typetoken_exchange_profiletoken_exchange_endpointzfrozenset[str]_AUTH_FLOW_SCOPED_FIELDSvaluer5cLt|tsy|jxsdSr7) isinstancerBstrip)r[s r:_blank_to_noner_Ps eS ! ;;= D rE>rQrWrXrY_TOKEN_EXCHANGE_COLUMN_FIELDStrue_passthroughoauth_delegate_CLIENT_FORWARDED_AUTH_TYPES> expires_in access_token refresh_token_MINTED_TOKEN_CREDENTIAL_FIELDSceZdZUeed<y)_OAuthCredentialAccessTokenreN)r>r?r@rBrAr8rEr:riripsrEricPeZdZUeed<eed<eed<eed<eeed<eed<y)OAuthCredentialPayloadtyperf expires_at connected_atscopes server_idN)r>r?r@rBrAlistr8rEr:rkrkts' IO INrErkF)totalc6eZdZUeed<eed<eed<eed<y)_OAuthTokenRefreshResponsererfrdscopeN)r>r?r@rBrArDr8rEr:rtrt}sO JrErt auth_typec|tvry|S)a)Collapse the client-forwarded modes to one credential class; every other auth_type is its own class. Used so credential handling keys off whether the stored-credential shape actually changed, not off a raw auth_type inequality that treats true_passthrough<->oauth_delegate as a full reset.client_forwarded)rc)rvs r:_credential_auth_classrys00! rEmerged new_credscd|vrd|vr|S|jDcic]\}}|tvs||vs||c}}Scc}}w)zWhen the update rotates the client, drop stale minted token keys it did not itself set, so an old app's access/refresh token never rides forward under the new client. A no-op when no client key changed. client_id client_secret)itemsrg)rzr{keyr[s r:%_drop_stale_minted_on_client_rotationrsT)#y(H %+\\^ !sEsBa7aehlueuU   s<<ruc6|tjk7xr|dk7S)z``scope="user"`` entries are placeholders the user fills in; everything else (including a missing scope) is an admin-supplied global value.user)rr)rus r:_is_global_env_var_scopers N'' ' ;EVO;rEenv_varsc|D]?}t|jds|jd}|s2t||d<Ay)aUEncrypt ``scope="global"`` env var values in place before persisting. Global values hold admin-supplied secrets (API keys, passwords) that get interpolated into headers, so they are encrypted at rest like credentials and the per-user ``values_b64`` column. Per-user placeholders are not secrets and are stored verbatim. rur[N)rgetr!)rentryr[s r:_encrypt_global_env_var_valuesrsF9' '(:;  '" 1%8E'N 9rEc|sy|D]}t|t}|r|jdn t|dd}t |s?|r|jdn t|dd}|sbt |ddd}|8|r|jdn t|dd}t jd |d }|r||d<||_y) aDecrypt ``scope="global"`` env var values in place after reading the DB. Accepts ``MCPEnvVar`` models (``LiteLLM_MCPServerTable``) or plain dicts (raw rows / deserialized JSON). Global values are always stored encrypted, so a value that no longer decrypts (e.g. after a salt-key change) is dropped and a warning is logged rather than forwarding the ciphertext into upstream ``${NAME}`` headers, where it would silently fail. Nrur[mcp_global_env_vardebugFr[rexception_typereturn_original_valuenamezsMCP global env var %s failed to decrypt (LITELLM_SALT_KEY changed?); dropping it so ciphertext is not sent upstream) r]dictrgetattrrr rwarningr[)rris_dictrur[ decryptedrs r:decrypt_global_env_var_valuesrs $UD)&- '"75'43P'. &- '"75'43P ($""'   (/599V$WUFD5QD ( (L  I &E'N#EK3$rErowc,t|dd}|yt|tr5 tj|}t|tsy t|d|t|y#tj t f$rYywxYw#tt f$rY=A>BBnew_encryption_keyc|syt|tr tj|}|sy|}|Dcgc] }t |}}d}|D]z}t|jds|jd}|s2t|ddd}|&tjd|jd it|| |d<d }||r|SdS#tjt f$rYywxYwcc}w) aRe-encrypt ``scope="global"`` env var values for master-key rotation. Each global value is decrypted with the current salt key and re-encrypted under ``new_encryption_key``. Returns the rebuilt list when at least one value was rotated, else ``None`` so the caller can skip the DB write. A value that fails to decrypt is left untouched (and logged) so a corrupt entry is preserved for recovery rather than overwritten. NFrur[rrrzWrotate_mcp_server_credentials_master_key: could not decrypt global env var %s, skippingrrT) r]rBrrrrrrrr rrr!) rrentriesvrebuiltrotatedrr[rs r: _reencrypt_global_env_var_valuesrs (C  jj*G'./!d1g/G/G' '(:;  '" ($""'    ( (i &!  -iL^_g'(7'4'9$$i0   0sCC-C*)C*data exclude_unset fields_setcddlm}|rq||j}|jd}|j dd|vr|j ddd|vr |dg|d<dD]}||vs||i||<n&|jd }d|vrt |dd|d<|j d }|PtD]!}|j |d}|||vs|||<#t|t |d <||d |d <|j d ||d |d <|j d } | .| D cgc] } t| } } t| || |d <|j d||d|d<|j d||d|d<d|vr||dxsi|d<d|vr||dxsi|d<|st |dd|d<|Scc} w)a~ Helper function to prepare MCP server data for database operations. Handles JSON field serialization for mcp_info and env fields. Args: data: NewMCPServerRequest or UpdateMCPServerRequest object exclude_unset: When True, only fields the caller explicitly provided are included. Used for partial updates (PUT /v1/mcp/server) so omitted fields keep their existing DB value instead of being silently reset to a Pydantic schema default. ``exclude_none`` is not enough here: non-Optional fields (e.g. ``transport=MCPTransport.sse``, ``mcp_access_groups=[]``, ``allow_all_keys=False``) are backfilled with their default when omitted, and a non-None default survives the ``exclude_none`` filter and overwrites the row. Returns: Dict with properly serialized JSON fields r safe_dumpsNT)ralias allowed_tools)tool_name_to_display_nametool_name_to_description) exclude_none credentialsrencryption_keystatic_headersrmcp_infoenvrris_byokF) *litellm.litellm_core_utils.safe_json_dumpsrr model_dumprpoprr`encrypt_credentialsrrr) rrrr data_dictjson_map_fieldrte_field blob_valuerrserialized_env_varss r:_prepare_mcp_server_datar!sj.F   *JOO$O7 == ! )gZ.G MM'4 ( i 'Io,F,N)+Io &  /N*y/H/P,. .)  /OOO6 ) #!(w!=Ig #}5K 6 1H$48J%()*C&0 (# 1$7;_l_n#o - #-i .F#G - }}%&2&0;K1L&M "# ;D-- :SH7?%@!d1g%@%@&':; *+> ? *}}Z , *9Z+@ A *}}U'%i&67 %"i/1;IFa ) -&As9G!rrc|jd}|t|||d<|jd}|t|||d<|jd}|t|||d<|jd}|t|||d<|jd}|t|||d<|jd}|t|||d<|jd}|t|||d<|S) N auth_value)r[rr}r~client_private_keyaws_access_key_idaws_secret_access_keyaws_session_token)rr!) rrrr}r~rrrrs r:rrsA# 5J$8-% L!#{3I#7-$ K '???;M ';-( O$!,0D E%,@$-- () +/BC$+?#-, '($/??3J#K(/C'-0 +, +/BC$+?#-, '( rEblobcjt|trtj|}|St |}|Sr7)r]rBrrr)r parsed_blobs r:!_credentials_blob_to_mutable_dictrs5@J4QT@UDJJt,.>.A.A.CG NrEwherez7prisma_db_types.LiteLLM_MCPServerTableWhereInput | Nonez1Sequence[prisma_db_models.LiteLLM_MCPServerTable]cTKt|j|d{S7wNr)r find_manyrrs r:_db_find_mcp_server_rowsrs'+=9CC%CP PP P (&(rpz.prisma_db_models.LiteLLM_MCPServerTable | NonecXKt|jd|id{S7w)Nrpr)r find_uniquerrps r:_db_find_mcp_server_rowrs-+=9EE[ZcLdEe ee es !*(*z1prisma_db_types.LiteLLM_MCPServerTableUpdateInputz'prisma_db_models.LiteLLM_MCPServerTablec~Kt|jd|i|d{}|td||S7w)Nrprrz'MCP server not found, passed server_id=)rupdate ValueError)rrprrs r:_db_update_mcp_server_rowrs^ HaanGoGvGvI& HwHBC {B9+NOO J Bs "=;=z9TableActions[prisma_db_models.LiteLLM_MCPUserCredentials]c0t|j}|Sr7)r'rrs r:_user_credential_actionsrs#OkO e  LrEr1c2|jj}|Sr7)rr2rs r:_user_env_var_actionsr sKXJZJZJqJqE LrEuser_idz2prisma_db_models.LiteLLM_MCPUserCredentials | Nonec^Kt|jd||did{S7w)Nuser_id_server_idrrpr)rrrrrps r:_db_find_user_credential_rowrs=*-8DD"i$PQE  s $-+-z;prisma_db_types.LiteLLM_MCPUserCredentialsWhereInput | Nonez5Sequence[prisma_db_models.LiteLLM_MCPUserCredentials]cTKt|j|d{S7wr)rrrs r:_db_find_user_credential_rowsrs'*-8BBBO OO Orcredential_b64ctKt|jd||di|||dd|idd{y7w)Nrr)rrprrcreaterr)rupsert)rrrprs r:_db_upsert_user_credential_rowr sV #= 1 8 8"i$PQ#&"0 (8   9   s .868z7prisma_db_types.LiteLLM_MCPUserEnvVarsWhereInput | Nonez1Sequence[prisma_db_models.LiteLLM_MCPUserEnvVars]cTKt|j|d{S7wr)rrrs r:_db_find_user_env_var_rowsr0s''}5??e?L LL Lrcgd}|D]9}|j|}|t|ts(t||dd||<;|S)zNDecrypt all secret fields in an MCPCredentials dict using the global salt key.)rr}r~rrrrrTrrr]rBr )r secret_fieldsfieldr[s r:decrypt_credentialsr7sZM&  E3!7!5&&* "K  rEapproval_statuscK|d|indddiddtjiigi}t||d{}|Dcgc]%}tj|j '}}|D]}t |j|S7Rcc}ww)a Returns mcp servers from the db, optionally filtered by approval_status. Pass approval_status=None to return every server except drafts, which back the admin OAuth session flow, are addressable only by their own server_id, and must never appear in a listing. NULL approval_status predates the approval workflow, so those rows are kept explicitly rather than dropped by a bare inequality, which SQL evaluates as NULL and would silently hide them. Nr ORnot)rdraftrrmodel_validaterrr)rr r mcp_servers mcp_servertablesrs r:get_all_mcp_serversrPs  & O,'.1BUL]LcLcDd0ef g   8 uMMKfqrXb+:::;P;P;RSrFr6%enn56 M Nrs 0B BB *B%!B B cKt||d{}|ytj|j}t |j |S7Aw)z@ Returns the matching mcp server from the db iff exists N)rrrrrr)rrprrs r:get_mcp_serverrjsP6mYOOJ)889N9N9PQE!%..1 L PsAAAA server_idscKt|jdd|iid{}g}|D]K}tj|j }t |j |j|M|S7Xw)zJ Returns the matching mcp servers from the db with the server_ids rpinrN)rrrrrrrappend)rr _mcp_serversfinal_mcp_servers _mcp_serverrs r:get_mcp_serversrvsTmTi $ + NL>@#( &55k6L6L6NO%enn5  '( Ns#BA>ABtokencKt|jd|iddid{}g}|"|j|jj}|xsgS70w)zH Returns the mcp servers from the db for the verification token robject_permissionTrincludeN)rrrr)rrverification_token_recordrs r:$get_mcp_servers_by_verificationtokenr#s{ 0 >JJ U   K %'K ,1J1\1\1h/AAMM  " $AA1Ateam_idcKt|jd|iddid{}g}|"|j|jj}|xsgS70w)z= Returns the mcp servers from the db for the team id r%rTr N)rrrr)rr% team_recordrs r:get_mcp_servers_by_teamr(s|DWWdCeCqCq w   DrD>K%'K;#@#@#L!33??  ">r$rcKt}g}|jr|t||jd{}|j|tj |vr;|j /t||j d{}|j|t|dkDrt||d{}|S77;7 w)z Get all the mcp servers filtered by the given user has access to. Following Least-Privilege Principle - the requestor should only be able to see the mcp servers that they have access to. Nr) setapi_keyr#rrall_team_serversr%r(lenr)rrmcp_server_idsrtoken_mcp_serversteam_mcp_serverss r:get_all_mcp_servers_for_userr1s'*eNK ||)Mm]a]i]i)j#j/0 0 0N Bt||G_,CMSWS_S_,`&`   ! !"2 3 >Q+M>JJ $k 'aKs42CB;A CB=2C4B?5C=C?C mcp_server_idz8Sequence[prisma_db_models.LiteLLM_ObjectPermissionTable]c|Kt|jjdd|iidddd{}|S7w)z Get all the object permissions records and the associated team and verficiationtoken records that have access to the mcp server rhasT)teamsverification_tokensr N)r#rr)rr2object_permission_recordss r:$get_objectpermissions_for_mcp_serverr8sZ)7==GG E=1 #' H  %$ s 1<:<z4Sequence[prisma_db_models.LiteLLM_VerificationToken]c|Kt|jjdd|iid{}|gS|S7 w)zE Get all the virtual keys that have access to the mcp server rr4rN)r)rr)rrp virtual_keyss r:get_virtualkeys_for_mcp_serverr;sX*-8>>HH E9- I   s -<: <c Kyw)z- Remove the mcp server from the team Nr8rs r:delete_mcp_server_from_teamr=r<r=c Kyw)z4 Remove the mcp server from the virtual key Nr8r8rEr:!delete_mcp_server_from_virtualkeyr?r<r=invalidate_token_cachecKt|jjd|id{}|g} t|j d|id{}|Dcgc]}|j }}t|dft|dft|dffD]"\}} |jd|id{$|r,|d d l m } | j}|D]} || |d{|S77cc}w#t $r!}tjd||Yd}~d}~wwxYw7l#t $r"}tjd|| |Yd}~d}~wwxYw7nw) a Delete the mcp server from the db by server_id The server-row delete is the commit point. Per-user credential and env var rows have no FK cascade, so they are cleaned up afterwards on a best-effort basis: a transient failure there leaves only orphaned rows pointing at a now-missing server and must not turn a successful delete into a caller-visible error. Each table is cleaned independently so a failure on one still attempts the other. Each enumerated credential row's user also gets their cached per-user token invalidated (legacy cache + v2 store, via invalidate_token_cache, defaulting to the manager's shared invalidation): the caches are keyed by (user_id, server_id), so without this a re-created server reusing the same server_id would serve tokens minted for the deleted server until TTL. Returns the deleted mcp server record if it exists, otherwise None rprNzaMCP server %s deleted but per-user credential enumeration failed; cached tokens expire by TTL: %s credentialzenv varz OAuth clientzhMCP server %s deleted but per-user %s cleanup failed; orphaned rows can be removed on a later delete: %srglobal_mcp_server_manager)r&rdeleterrr Exceptionrrrr delete_many9litellm.proxy._experimental.mcp_server.mcp_server_managerrD!invalidate_user_oauth_token_cache) rrpr@deleted_servercredential_user_idscredential_rowsremodellabelrDrs r:delete_mcp_serverrPs.#6m"D"J"J"Q"Q  #R#N !)+ [s\i{I6i7V8O;J"J33;;"J "J&m 4l C "= 19 = ( 7 H  LE5 ''{I.F'GGG   %-*C)d)d&. A,Wi@@@ A UV8#K  ( (s   H $,,I   As+EC0E C9C2C9 C43C95,E"D(9D&:D(>)E'E( E2C94C99 D#DED##E&D(( E1E EEE touched_bycK|j"ttj|_t |}||d<||d<t |j j|d{}t||S7w)z2 Create a new mcp server record in the db N created_by updated_by)r) rprBruuid4rr&rrr)rrrQrnew_mcp_servers r:create_mcp_serverrWGs  ~~TZZ\*05I)Il(Il:Mm:\:b:b:i:i ;j;5N&n5  5sA,B.B/B ttl_secondscNK|xs+|jxsttj}t ||d{t ||d{}|#t j|jS|j|tjd} t|||d{S7v7d7#t$r[t ||d{7}||jtjk7rt j|jcYSwxYww)a Persist a short-lived draft row backing the admin OAuth "Authorize & Fetch Token" flow. The draft lives in the database rather than in process memory so that the /register, /authorize and /token legs resolve it whichever worker or replica accepts each request. Writing is strictly create-if-absent. Any existing row for the id is returned untouched, which covers both a live draft for this same session and a real server the edit form is re-authorizing against its own id, where writing a draft would collide on the primary key. Each click of Authorize mints a fresh id, so nothing is lost by never overwriting, and it is what makes concurrent callers sharing one id safe rather than mutually destructive. N)rpr )r)rprBrrU _prune_expired_draft_mcp_serversrrrr model_copyrr rWrFr ) rrrQrXrpdraft_idexisting draft_payloadraceds r:create_draft_mcp_serverr`_s& F4>>FS5FH *=+ FFF3M8LLH&44X5H5H5JKK??]n]t]t2u?vM I&}mZPPPGLQ I5]HMMM =E115F5L5LL %44U5E5E5GHHIsg?D%B8D%B:A D%#B>3B<4B>7D%:D%<B>>D"CAD"D%!D""D%cVKtjtjt t d|z }t |dtjid{}|D]=}|j|j|ks t||jd{?y7G7 w)avDrop drafts already past ``ttl_seconds``, so abandoned OAuth sessions do not accumulate. Runs on each draft write rather than on a schedule, mirroring the in-memory cache this replaces, which pruned on every store. Expired drafts are unreadable by then anyway, so the only thing at stake is row count, and the work is bounded by how often admins authorize. secondsr rN) rnowr utcr maxrrr  updated_atrPrp)rrXcutoffdraftsrs r:rZrZsLL.3q+CV1WWF3 "3"9"9:FB >> %#..6*A#M3==A A A B  Bs0AB)B%B)4B)B)B'B)'B)cTKtjtjt t d|z }t ||tjd|idd{}|sytj|dj}t|j|S7Dw)a Return the draft row for ``server_id`` if it has not yet aged past ``ttl_seconds``, else None. Age is enforced in the query rather than by a sweeper so an expired draft is unreadable the moment it lapses, regardless of which process last ran a cleanup. rbrcgte)rpr rhrNr)rrer rfr rgrrr rrrrr)rrprXri draft_rowsrs r:get_draft_mcp_serverrnsLL.3q+CV1WWF6"066 &/ J )88A9Q9Q9STE!%..1 LsAB(!B&"AB(c Kddlm}t|d|}d}d|vxr|ddu}tt|j z}d|vxr|ddu} d|v} |j s|s|s| s| rt||jd{}t|j xr/|xr+t|j t|j k7} t| xr|xr|j|dk7} |rtt|ddnd} t| xr#| duxrt|jd| k7}| r d|vrd|d<| s| s|r;|jtDcic]}||vs||t||dk(r|dc}|rd|vr}|{|j rot#|j }t|j zrCtD]/}|j%|d}|||vst||d+|||<1|||d<d|vr|d|r|j rx| svt#|j }t#|d}t'i|||}tD]/}|j%|d}|||vst||d+|||<1|||d<||d <d|vr|ddd lm}|d|d<t-|j.jd |ji| d{}t1||S7|cc}w7w) z2 Update a new mcp server record in the db rrT)rrNrurlrPrT)Jsonrpr)rrrrOr`keysrvrrpryrpr_rrrrZrrrrprismarqr&rr)rrrQrrrr]has_credentialsexplicit_te_write url_providedissuer_providedauth_type_changed url_changed old_issuerissuer_changedrexisting_credsr legacy_valuer{rzrqupdated_mcp_servers r:update_mcp_serverrsF 0DU_`IH*i7`Im 6  )Yu-=SXZ^A_-_t   ]);@TYaYmYm:8;O;OP (>+>+>+@ @9 7-11(DA + 0IgV^`hjnNoNw*6Ih' 7(2.'AIm $  !i &>&J ,, %!B8CWCW!X#DY}E]#^ !FFeFe[dFegp q !>;H#)::h#=L$0$I5#Hh=E.: (+;,6f+= -()Il  !i &>&F#': - EXYfEgEmEmEtEtDNN+ FuF@ &&89 AP2 B@sXBL LCL  !LA$L &L + L 9A;L 5L : L A&L .L/L L cvKt|jd|id{}|y|jS7w)a_Read the persisted (encrypted) DCR OAuth client blob for a server from the server-scoped store, or None. Config.yaml-declared servers have no LiteLLM_MCPServerTable row, so their dynamically registered client lives here keyed by server_id. The returned value is the raw credentials blob for ``_get_persisted_dcr_credentials`` to parse.rprN)rrr)rrprs r:'get_mcp_server_oauth_client_credentialsr6sI NiNki0k1H2C { ?? H2s !979cKddlm}ttd i|t }||}t |j d|i||dd|idd {y 7w) aPersist a server's dynamically registered OAuth client (RFC 7591 DCR) in the server-scoped store keyed by server_id, independent of any LiteLLM_MCPServerTable row. client_id/client_secret are encrypted at rest with the same salt key used for the server row's credentials blob, so ``_apply_persisted_dcr_credentials`` decrypts them the same way regardless of which store a server's client came from.rrrrp)rprrrrNr8)rrrr+rrr)rrprr encryptedrs r:*upsert_mcp_server_oauth_client_credentialsrDsmF*~7T 7TeretuIY'D %m 4 ; ;I&$-dC$d+  < sAA AA z!str | Mapping[str, object] | Nonenew_master_keyc|syddlm}t|}tt t |}t ||}||S)aHDecrypt an at-rest MCP credentials blob with the current key and re-encrypt it under new_master_key, returning the serialized blob or None when there is nothing to rotate. Shared by every table that stores an encrypted MCP credentials blob so a master-key rotation covers them uniformly and cannot silently skip one.Nrr)rr)rrrrrr+r)rrr creds_dictrrs r:_reencrypt_mcp_credentials_blobrYs@ E9+FJ*tNJ7WXI*yQ_`I i  rEcKddlm}t|d{}d}|D]}i}t|j|}|||d<t |j |} | || |d<|sH||d<t|jd|ji|d{|dz }t|jd{} d} | D]R} t| j|}|t|jd| jid|id{| dz } Ttjd || y777z7*w) NrrrrrTrprrbzarotate_mcp_server_credentials_master_key: rotated %d MCP server row(s) and %d OAuth-client row(s))rrrrrrrrrrprrrinfo) rrQrrrupdatedr update_datarotated_credentialsrotated_env_vars oauth_clients oauth_updated oauth_clients r:(rotate_mcp_server_credentials_master_keyrjsE7 FFKG! &( =j>T>TVde  *)    1 '*[v[ikUMM% =l>V>VXfg  & )-8?? 6 67!45@     kMG$ U sGD?D6BD?D9'D?D;AD?D=$D?9D?;D?=D?storedct|ddd}||S tj|jS#tj t ttf$rYywxYw)aNRead back a value persisted in ``LiteLLM_MCPUserCredentials.credential_b64``. Tries nacl decryption first (current write format). Falls back to a plain ``urlsafe_b64decode`` for rows persisted by older code that wrote the credential without encryption. Returns ``None`` when neither path yields a valid string. mcp_user_credentialrFrN) r base64urlsafe_b64decodedecodebinasciiErrorUnicodeDecodeErrorrr)rrs r:_decode_user_credentialrsg, !# I ''/6688 NN. I Fs"8#AAc2tjd||y)zMLog the one credential state that otherwise reads as "user never authorized".zMCP user credential for user=%s server=%s could not be decrypted (likely written under a previous LITELLM_SALT_KEY); the user is treated as not connected and must re-authorize.N)rrrs r:_warn_undecryptable_credentialrs   b rEdecodedc|y tj|}t |t r|j ddk(r|Sy#ttf$rYywxYw)aZReturn the OAuth2 payload dict if ``decoded`` holds one, else ``None``. A row is considered an OAuth2 credential iff its decoded value parses as a JSON object with ``"type": "oauth2"``. Plain BYOK credentials (which share the same column) decode to a non-JSON string and return ``None``. Callers that need to tell an unreadable row from a readable non-OAuth2 one pass the result of :func:`_decode_user_credential` so a single decode answers both questions: ``None`` there means the value can be neither decrypted nor base64-decoded, so no caller can ever recover it. Nrloauth2)rrrrr]rr)rparseds r:_parse_oauth_payloadrs\G$&$FJJv$6($B   "sAAAc*tt|S)zAReturn the OAuth2 payload dict held in ``stored``, else ``None``.)rr)rs r:_decode_oauth_payloadrs  7 ? @@rEcKt|d{}d}d}|D]}t|j}|1tjd|j |j |dz }Kt||}t|jd|j |j did|i d{|dz }tjd ||y77%w) a}Re-encrypt every ``LiteLLM_MCPUserCredentials`` row with ``new_master_key``. Reads each ``credential_b64`` with the current salt key (falling back to legacy plain base64 for unmigrated rows) and writes it back encrypted under the new master key. Rows that are unreadable under both paths are logged and skipped so one corrupt row does not abort the rotation. Nrzirotate_mcp_user_credentials_master_key: could not decode credential for user_id=%s server_id=%s, skippingrbrrrrrzErotate_mcp_user_credentials_master_key: rotated %d row(s), skipped %d) rrrrrrrpr!rrrrrrowsrskippedr plaintext re_encrypteds r:&rotate_mcp_user_credentials_master_keyrs6mDDDGG+C,>,>?   ( (C    qLG +I.Y &}5<<#"{{!$& #L1=    1 +,O3E s"CCBC.C/$CCcKt|d{}d}d}|D]}t|jddd}|1tjd|j |j |dz }Ot|| }t|jd |j |j d id |i d{|dz }tjd||y77%w)abRe-encrypt every ``LiteLLM_MCPUserEnvVars`` row with ``new_master_key``. Reads each ``values_b64`` blob with the current salt key and writes it back encrypted under the new master key. Rows that fail to decrypt are logged and skipped so one corrupt row does not abort the rotation nor overwrite values that may still be recoverable. Nrmcp_user_env_varsrFrzerotate_mcp_user_env_vars_master_key: could not decrypt env vars for user_id=%s server_id=%s, skippingrbrrr values_b64rzBrotate_mcp_user_env_vars_master_key: rotated %d row(s), skipped %d) rr rrrrrpr!rrrrs r:#rotate_mcp_user_env_vars_master_keyrs3=AADGG(..#""'    ( (w    qLG +I.Y #M299#"{{!$&  -:    1 34L;B& s"CCB C2C3$CCrBcRKt|}t||||d{y7w)z.Store a user credential for a BYOK MCP server.N)r!r)rrrprBencodeds r:store_user_credentialr+s&**5G (G TTTs '%'chKt|||d{}|yt|jS7w)z2Return credential for a user+server pair, or None.N)rrrrrrprs r:get_user_credentialr7s84M7IVVC { "3#5#5 66Ws 202c@Kt|||d{}|duS7w)z@Return True if the user has a stored credential for this server.N)rrs r:has_user_credentialrDs) 4M7IVVC d?Ws  c`Kt|jd||did{y7w)z:Delete the user's stored credential for a BYOK MCP server.rrrN)rrErs r:delete_user_credentialrNs7 #= 1 8 8"i$PQ 9 s $.,.rerfrdroskip_byok_guardcdKd}|>tjtjt |zj }d|tjtjj d} |r|| d<|r|| d<|r|| d<|sft |||d{} | t| jnd} | 6t| +| rtd|d |d tjd ||ttj| } t!|||| d{y77w) zPersist an OAuth2 access token for a user+server pair. The payload is JSON-serialised and stored encrypted in the same ``credential_b64`` column used by BYOK. A ``"type": "oauth2"`` key differentiates it from plain BYOK API keys. Nrcr)rlrernrfrmrozExisting credential for user z and server zA could not be verified as an OAuth2 token. Refusing to overwrite.zstore_user_oauth_credential: existing credential for user=%s server=%s could not be decrypted (likely written under a previous LITELLM_SALT_KEY); replacing it with the newly authorized OAuth2 token.)rrer rfr isoformatrrrrrrrr!rdumpsr) rrrprerfrdrorrmpayloadr]rrs r:store_user_oauth_credentialr\sG""Jll8<<09Z3PP[[] $ X\\2<<>.G #0  *  "  <]GU^ __MUMa01H1HIgk  $8$A$I  3G9L k"-. ! ( (1  *$**W*=>G (G TTT/`.Us%BD0!D,"BD0&D.'D0.D0credbuffer_secondsc>|jd}|sy tj|}|j |j t j }tjt j t|z|kDS#ttf$rYywxYw)aReturn True if the OAuth2 credential's access_token has expired. Checks the ``expires_at`` ISO-format string stored in the credential payload. Returns False when ``expires_at`` is absent or unparseable (treat as non-expired). With ``buffer_seconds`` > 0, a token that is still valid but expires within the buffer is also treated as expired, so callers can refresh proactively instead of handing back a token that may lapse mid-request. rmFtzinforc) rr fromisoformatrreplacer rfrer rr)rrrmexp_dts r:is_oauth_credential_expiredrs.J '' 3 == ^^8<<^8F||HLL)In,MMPVVV  "sA3B BBcKt|||d{}|yt|j}| t||t |S75w)zGReturn the decoded OAuth2 payload dict for a user+server pair, or None.N)rrrrr)rrrprrs r:get_user_oauth_credentialrsQ4M7IVVC {,S-?-?@G&w :  (( WsA A 6A cKt|d|id{}g}|D]]}t|j}|t||jt |}|>|j|d<|j |_|S7jw)zHReturn all OAuth2 credential payloads for a user, tagged with server_id.rNrp)rrrrrprr)rrrresultsrrrs r:list_user_oauth_credentialsrs 6miQXEYZZD35G )#*<*<= ? *7CMM B&w/ ? "}} w  N[sBA?A+Bcredsrcf|j|}t|ts|St||ddS)zReturn one credential field decrypted with the global salt key; non-string and legacy plaintext values come back unchanged (decrypt_value_helper returns the original on failure).rTrr)rrr[s r:_decrypted_credential_fieldrs:99U#E eS !  "  rEserver.ct|dd}t|tr tj|}n|}t|t r|ni}t|ddt|ddt|ddt|ddt|ddt|ddt|d dt|d dt|d t|d |jd |jdf S#t $rd}YwxYw)aaThe upstream-OAuth-token-determining fields of an MCP server: the resource/audience (url, or spec_path for OpenAPI servers, plus the RFC 8707 upstream_resource sent on the authorize and token legs), the OAuth mode/grant (auth_type, oauth2_flow), the authorization-server endpoints, and the OAuth client + scopes. Mirrors the dashboard's getOAuthAuthorizationIdentity. When any of these change on a server update, previously stored per-user tokens were minted for the old identity and are stale. Excludes transport and delegate_auth_to_upstream, which do not affect what token is minted (RFC 8693). client_id/client_secret are compared decrypted: stored values are NaCl-encrypted with a fresh nonce on every write, so comparing ciphertext would flag every routine save as an identity change and purge tokens that are still valid.rNrp spec_pathrvrTrPrVrRrUr}r~roupstream_resource) rr]rBrrrrrr)rrrrs r:mcp_oauth_token_identityrs6=$7E% /3zz%/@F5?5M6SUJt$ T* T* t,$'+T2 T**D1#J <#J@x *+    F sC## C10C1cKt|d|id{}|Dcgc]}t|j|}}|syt|j |d|Dcgc]}|j c}idd{}|ddlm}|j}|D]}||j |d{|t|k7r!tjd||t||S7cc}wcc}w7w7Ew) aDelete every stored per-user OAuth token for a server and invalidate each user's cached token everywhere it can be served from (the legacy per-user token cache and the v2 per-user OAuth token store), so no user keeps a token minted for a superseded configuration. Called when a server update changes a mint-relevant field (see mcp_oauth_token_identity). Returns the number of rows removed. LiteLLM_MCPUserCredentials also stores BYOK API keys in the same column; only rows whose payload decodes as an OAuth2 credential (see _decode_oauth_payload) are deleted, because a config change only invalidates minted tokens, never a user's own stored key. Rows are therefore deleted per (user_id, server_id) pair rather than by a blanket server_id filter. An OAuth row inserted while the purge runs for a user not yet enumerated survives; a re-auth completing in the window for an already-enumerated user is deleted along with the stale row (the pair delete cannot tell them apart), which costs that user one extra re-auth and nothing else. invalidate_token_cache is injectable for tests; it defaults to the manager's shared invalidate_user_oauth_token_cache, the single invalidation point for per-user tokens.rpNrr)rprrrCzMCP server %s: purge removed %d OAuth credential row(s) but %d were enumerated; row(s) were deleted concurrently during the purge) rrrrrGrrHrDrIr-rr)rrpr@rr oauth_rows deleted_countrDs r:'purge_user_oauth_credentials_for_serverrs*6mkS\E]^^D(,f0EcFXFX0Y0efJf !9-!H!T!T%4Q[9\##++9\2]^"U"M% ";!\!\=$S[[)<<<=J'$$ @    O   1_f:] =sNC8C(C8C*C*C8C/ .C8<C4=3C80C618C8* C86C8r.c K|jd}t|ddxs t|dd}t|dd}t|dd}t|dd}|stjd ||y|stjd |y t |t|d d|| } d|d | j } t tj} | j|ddi| j| d{} | j| j} | jd}|stjd||yd}| jd} | t|nd}| jdxs|}| jd}t%|t&r|r|j)ndxs|jd}t+|||||||dd{tj,d||t/|||d{S7#t$r"}tjd|||Yd}~yd}~wwxYw#t t"f$rYwxYw7v7Lw)uAttempt to refresh a per-user OAuth2 token using its stored refresh_token. POSTs to ``server.effective_token_url`` with ``grant_type=refresh_token``. On success: persists the new credential via ``store_user_oauth_credential`` and returns the updated payload dict. On failure (network error, invalid_grant, missing refresh_token, …): logs a warning and returns ``None`` — the caller is responsible for clearing the stale credential and triggering re-authentication. rfeffective_token_urlNrRrprr}r~zGrefresh_user_oauth_token: no refresh_token stored for user=%s server=%sz?refresh_user_oauth_token: server=%s has no token_url configuredtoken_endpoint_auth_method) auth_methodr}r~) grant_typerf) llm_providerAcceptzapplication/json)headersrzJrefresh_user_oauth_token: refresh request failed for user=%s server=%s: %srezSrefresh_user_oauth_token: token response missing access_token for user=%s server=%srdruroT)rrrprerfrdrorz?refresh_user_oauth_token: refreshed token for user=%s server=%s)rrrrrbodyrr* Oauth2Checkpostrraise_for_statusrrFrrDrrr]rBsplitrrr)rrrrrfrRrpr}r~ token_request token_data async_clientresponserexcrerd raw_expiresnew_refresh_token raw_scoperos r:refresh_user_oauth_tokenr7s (,xx'@M#*63H$#O#uSZ[acnptSuI#FKL $$ a   !J,/K )4)@S%d ,088O+D+U xx(I5? 35OT]  1cg lpltltmF &#!'   I +='9M MMq  $$ X     , z "     NsBI A*H5H 6$H>IH=(A3II+III H H:H50I5H::I=I IIIIcK|r|jdsyt|ts|S|jdsy|ddlm}|d}t ||||d{}|r|jdsy|S7w) a!Return an OAuth2 credential whose access_token is good for the next request. Returns the credential unchanged while its token is valid for at least ``MCP_PER_USER_TOKEN_EXPIRY_BUFFER_SECONDS``. Only when the token is expired (or expiring within that buffer) and a refresh_token is stored does it mint a new one via ``refresh_user_oauth_token``. Returns None when there is no usable token (missing token, expired with no refresh_token, or a failed refresh). The refresh_token is only ever sent to the server's token_url inside ``refresh_user_oauth_token``; it is never exposed to the caller beyond the cred dict it already holds. ``prisma_client`` is fetched lazily and only when a refresh actually happens, so the valid-token path never requires a DB handle. reN)rrfrget_prisma_client_or_throwz3Database not connected. Cannot refresh OAuth token.)rrrr)rrrlitellm.proxy.utilsrr)rrrrr refresheds r:resolve_valid_user_oauth_tokenrs& txx/ &tD=??D>D ?DD=DD D D D D:D50D=5D::D=rmcB|sy tj|}|j |j t j}t|tjt jz j}|dkDr|SdS#ttf$rYywxYw)zNSeconds until ``expires_at`` (ISO 8601), or None when absent/past/unparseable.Nrr) rrrrrrr rfrDre total_seconds)rmr remainings r:rrs '' 3}}x||4FX\\(,,%??NNPQI!A 9/4/  "sB BBcK|sgSt||tjdd{}|Dcgc]}|jc}S7cc}ww)zGReturn active BYOM servers submitted by this user (creator visibility).) submitted_byr N)rractiverp)rrrrs r:,get_active_submitted_mcp_server_ids_for_userrsT  0#077 D&* *cCMM ** +s %A AA AA A cKtjtj}t ||t j ||dd{}tj|j}t|j|S7>w)z2Set approval_status=active and record reviewed_at.r  reviewed_atrTN) rrer rfrrrrrrrr)rrprQrerrs r:approve_mcp_serverr 0st hll+C4077$ G*889K9K9MNE!%..1 LsAB B ?B  review_notesc(Ktjtj}tj ||d}|||d<t |||d{}tj|j}t|j|S7>w)zBSet approval_status=rejected, record reviewed_at and review_notes.rNr ) rrer rfrrejectedrrrrrr)rrprQr rerrrs r:reject_mcp_serverrEshll+C,55 FD +^4]ItTTG)889K9K9MNE!%..1 LUsABB?BcKt|jdddiiddidd{}|Dcgc]%}tj|j '}}|D]}t |j td|D}td|D}td |D}tt||||| S7cc}ww) z Returns all MCP servers that were submitted by non-admin users (submitted_at IS NOT NULL), along with a summary count breakdown by approval_status. Mirrors get_guardrail_submissions() from guardrail_endpoints.py. submitted_atr Ndesci)rordertakec3\K|]$}|jtjk(s!d&ywrbN)r rpending_review.0is r: z&get_mcp_submissions..ms$cqQ->->BSBbBb-bc",,c3\K|]$}|jtjk(s!d&ywr)r rrrs r:rz&get_mcp_submissions..ns$ZaA,=,=ARAYAY,YZrc3\K|]$}|jtjk(s!d&ywr)r rr rs r:rz&get_mcp_submissions..os$^a.?.?CTC]C].]!^r)rrrrr r) rrrrrrrsumrr-)rrrritempendingrr s r:get_mcp_submissionsr"ZsLeLit}-v& FDTXXa*99!,,.IXEX5%dmm45cEccGZ5ZZF^U^^H %j  FYs!'CC C*C A.C CcLt|ddd}||rtjdiS tj|}t|tsiS|jDcic]\}}t|t|c}}S#t t f$ricYSwxYwcc}}w)zLDecrypt a ``values_b64`` blob and parse it as a flat ``{name: value}`` dict.rrFrzMCP per-user env vars failed to decrypt (LITELLM_SALT_KEY changed?); treating as unset so the user is prompted to re-enter them rather than silently forwarding ciphertext) r rrrrrrr]rrrB)rrrkrs r:_decode_user_env_varsr%}s+ # I   ( (K   I& fd # '-||~ 6tq!CFCFN 66  "  7sB &B  BBcKt|jd||did{}|iSt|jS7w)zIReturn the calling user's env var dict for ``server_id`` (empty if none).rrrN)rrr%rrs r:get_user_env_varsr'sU -];GG"i$PQHC {  00 s$AAAcKt|}|siSt||d|idd{}|Dcic]"}|jt|j$c}S72cc}ww)zReturn ``{server_id: {var_name: value}}`` for one user across many servers. Servers with no stored row are simply absent from the result. rrN)rqrrpr%r)rrridsrrs r:get_user_env_vars_bulkr*sbj!C  2=geikndoBpqqDLP QSCMM0@ @ QQr Qs $A AA 'AA A updates allowed_namescKt|}tjtj|d|j dj dd}t|4d{}|jd|d{|jjd ||d i d{}|t|jni} i| |jD cic] \} } | |vs | | } } } ttj | } |jj#d ||d i||| d d | idd{dddd{| S777cc} } w7"7#1d{7swY SxYww)aMerge ``updates`` into the user's stored env vars for ``server_id`` and return the resulting set. The read-modify-write runs inside a transaction guarded by a ``(user_id, server_id)`` advisory lock so two concurrent writes from the same user can't drop one update. Names outside ``allowed_names`` are pruned, so an admin retiring a user-scoped variable also clears its stored value. :) digest_sizebigT)signedNz(SELECT pg_advisory_xact_lock($1::bigint)rrr)rrprrrr)r*rD from_byteshashlibblake2bencodedigestrr;r2rr%rrr!rrr)rrrpr+r,allowedlock_keyrrr]r$rrzrs r:merge_user_env_varsr:s'Gnn7)1YK0779qIPPR %H '}5  nnGRRRKMKdKdKpKp&G)(TULqL F DG?/?XZ*AX*A*A*G*G*IZ$!QQRY\AZZ-djj.@A''..&G)(TU '!*") (1 /    & M' RF [     & MsA)F+E,F/E+E(E+.E/4E+# E!0E!5AE+E'E+ FE)FE+E+!E+)F+E>1E4 2E>9Fc\Kt|j||dd{y7w)zRemove the calling user's env var values for ``server_id``. Uses ``delete_many`` so a missing row is a no-op; real DB errors still propagate to the caller instead of being silently swallowed. rrN)rrGrs r:delete_user_env_varsr<s* . : :WclAm : nnns ",*,)FNr7)NNNF)r)rrr4rcollections.abcrrrrrrr r typingr r r rrrlitellm._loggingr litellm._uuidrlitellm.constantsr&litellm.llms.custom_httpx.http_handlerr2litellm.proxy._experimental.mcp_server.oauth_utilsrlitellm.proxy._typesrrrrrrrrr0litellm.proxy.common_utils.encrypt_decrypt_utilsrr r!rr"1litellm.repositories.object_permission_repositoryr#%litellm.repositories.prisma_protocolsr$'litellm.repositories.table_repositoriesr%r&r'$litellm.repositories.team_repositoryr(2litellm.repositories.verification_token_repositoryr)litellm.types.llms.custom_httpr*litellm.types.mcpr+rsr,prisma_db_modelsr-prisma_db_types+litellm.types.mcp_server.mcp_server_managerr.r0rG frozensetrZrArBr_r`rcrgrirkrtryrrCrrOrrrrrqrr*rrrrrrrrrrrrrrrrrrrrrr#r(r1r8r;r=r?rPrWrDr`rZrnrrrrrrrrrrrrrrrrrrrrtuplerrrrrrrr rr"r%r'r*r:r<r8rEr:rRsA   LL22GG1FIb    -X> @@,1/EGHG jhj 5>  5% 01  !#*!t!:C:u%569BCUWgBh8ie$45i / @<*-:=9LPPP HP=P  *- := OR   $HLMM DM9M6#'4Z !4   I_bfIf 8C=UYZpUq(lSV[_`c[d*PTUXPY&  !:%%03%?%*,/;&\c LPAAA%c3Z4%@ADHAd" AH':HK:! 'I'I 'I'I 'I Tz 'I  'ITB,BUXB]aB,,/>Ad"<#' zz zzC4 z d" zz  Z] bhkobo ,/>L *!4!FI!4Z!"-,-\_-qt-`CC$J,CCD#*1G$1N0A#A*@4*GA % %^a%P)\)[^)X U U  U U U  U 7 7  7 7 4Z 7    &!%!#!<U<U <U<U <U : <U d <U I <U<U <U~&<cZ^* ) )  ) )d" )   !( tCK'8   "V"fck0B"PLP---%c3Z4%@ADH- -`iNiN iN iN ! iN d" iN`*. % % % !4 '% $& % d" %VEIB 4ZB Bc#99:TAB 4Z BJ 0t 0d 0++ + #Y+$ 2 $ *   *F7#7$sCx.74 1 1  1 1 #s(^ 1 R R  R  R #tCH~  R (( ((#s(^ ( C= (  #s(^ (V o o  o o orE