@frontmcp/auth 0.10.0 → 0.11.0

package/__test-utils__/assertion.helpers.d.ts

@@ -0,0 +1,2 @@
+export declare function assertDefined<T>(value: T | null | undefined, message?: string): asserts value is T;
+//# sourceMappingURL=assertion.helpers.d.ts.map

package/__test-utils__/assertion.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.helpers.d.ts","sourceRoot":"","sources":["../../src/__test-utils__/assertion.helpers.ts"],"names":[],"mappings":"AAAA,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAIlG"}

package/authorization/authorization.class.d.ts

@@ -0,0 +1,122 @@
+import { Authorization, AuthorizationCreateCtx, AuthorizedPrompt, AuthorizedTool, AuthUser, LLMSafeAuthContext, AuthMode } from './authorization.types';
+import type { TransportSession, TransportProtocol } from '../session/transport-session.types';
+import type { ProviderSnapshot } from '../session/session.types';
+export { getMachineId } from '../machine-id';
+/**
+ * Base Authorization class - represents authenticated user context
+ * Subclasses implement mode-specific behavior (Public, Transparent, Orchestrated)
+ */
+export declare abstract class AuthorizationBase implements Authorization {
+    #private;
+    readonly id: string;
+    abstract readonly mode: AuthMode;
+    readonly isAnonymous: boolean;
+    readonly user: AuthUser;
+    readonly claims?: Record<string, unknown>;
+    readonly expiresAt?: number;
+    readonly scopes: string[];
+    readonly authorizedProviders: Record<string, ProviderSnapshot>;
+    readonly authorizedProviderIds: string[];
+    readonly authorizedApps: Record<string, {
+        id: string;
+        toolIds: string[];
+    }>;
+    readonly authorizedAppIds: string[];
+    readonly authorizedTools: Record<string, AuthorizedTool>;
+    readonly authorizedToolIds: string[];
+    readonly authorizedPrompts: Record<string, AuthorizedPrompt>;
+    readonly authorizedPromptIds: string[];
+    readonly authorizedResources: string[];
+    /** The original bearer token (for transparent mode) */
+    protected readonly token?: string;
+    /** Creation timestamp */
+    readonly createdAt: number;
+    protected constructor(ctx: AuthorizationCreateCtx);
+    /**
+     * Create a new transport session for this authorization
+     * @param protocol - Transport protocol (sse, streamable-http, etc.)
+     * @param fingerprint - Optional client fingerprint for tracking
+     */
+    createTransportSession(protocol: TransportProtocol, fingerprint?: string): TransportSession;
+    /**
+     * Get existing transport session by ID
+     */
+    getTransportSession(sessionId: string): TransportSession | undefined;
+    /**
+     * Get all active transport sessions
+     */
+    getAllSessions(): TransportSession[];
+    /**
+     * Remove a transport session
+     */
+    removeTransportSession(sessionId: string): boolean;
+    /**
+     * Get count of active sessions
+     */
+    get sessionCount(): number;
+    /**
+     * Abstract: Get access token for a provider
+     * Implementation varies by mode:
+     * - Public: throws (no tokens)
+     * - Transparent: returns the original bearer token
+     * - Orchestrated: retrieves from vault/store
+     */
+    abstract getToken(providerId?: string): Promise<string>;
+    /**
+     * Check if a scope is granted
+     */
+    hasScope(scope: string): boolean;
+    /**
+     * Check if all scopes are granted
+     */
+    hasAllScopes(scopes: string[]): boolean;
+    /**
+     * Check if any scope is granted
+     */
+    hasAnyScope(scopes: string[]): boolean;
+    /**
+     * Check if a tool is authorized
+     */
+    canAccessTool(toolId: string): boolean;
+    /**
+     * Check if a prompt is authorized
+     */
+    canAccessPrompt(promptId: string): boolean;
+    /**
+     * Check if an app is authorized.
+     * Used for progressive authorization to determine if tools from this app can be executed.
+     * @param appId - App ID to check
+     */
+    isAppAuthorized(appId: string): boolean;
+    /**
+     * Build URL for progressive/incremental authorization.
+     * Used when a tool requires authorization for an app that was skipped during initial auth.
+     * @param appId - App ID that requires authorization
+     * @param baseUrl - Base URL of the server
+     */
+    getProgressiveAuthUrl(appId: string, baseUrl: string): string;
+    /**
+     * Check if the authorization is expired
+     */
+    isExpired(): boolean;
+    /**
+     * Get time until expiration in milliseconds
+     * Returns undefined if no expiration, negative if expired
+     */
+    getTimeToExpiry(): number | undefined;
+    /**
+     * Convert a transport session to encrypted session JWT
+     * This is what gets sent in the Mcp-Session-Id header
+     */
+    toSessionJwt(session: TransportSession): string;
+    /**
+     * Convert to LLM-safe context (no tokens exposed)
+     */
+    toLLMSafeContext(session: TransportSession): LLMSafeAuthContext;
+    /**
+     * Validate that no tokens are leaked in data
+     * Throws if JWT pattern detected
+     */
+    static validateNoTokenLeakage(data: unknown): void;
+}
+//# sourceMappingURL=authorization.class.d.ts.map

package/authorization/authorization.class.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.class.d.ts","sourceRoot":"","sources":["../../src/authorization/authorization.class.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAqB,MAAM,oCAAoC,CAAC;AACjH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAMjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;GAGG;AACH,8BAAsB,iBAAkB,YAAW,aAAa;;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAEvC,uDAAuD;IACvD,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAKlC,yBAAyB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,SAAS,aAAa,GAAG,EAAE,sBAAsB;IAsBjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAiB3F;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIpE;;OAEG;IACH,cAAc,IAAI,gBAAgB,EAAE;IAIpC;;OAEG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIlD;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEvD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAIvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAItC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAItC;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC;;;;;OAKG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAI7D;;OAEG;IACH,SAAS,IAAI,OAAO;IAKpB;;;OAGG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAKrC;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM;IAY/C;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,kBAAkB;IAgB/D;;;OAGG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;CAcnD"}

package/authorization/authorization.types.d.ts

@@ -5,6 +5,8 @@
  * These types are portable and can be used across different implementations.
  */
 import { z } from 'zod';
+import type { ProviderSnapshot } from '../session/session.types';
+import type { TransportSession, TransportProtocol } from '../session/transport-session.types';
 /**
  * Authentication mode determining how tokens are handled
  */
@@ -198,7 +200,7 @@ export declare const progressiveAuthStateSchema: z.ZodObject<{
     initiallySkipped: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
 /**
- * Context for creating an authorization (portable version)
+ * Context for creating an authorization
  */
 export interface AuthorizationCreateCtx {
     /** Unique ID (typically token signature fingerprint) */
@@ -215,6 +217,10 @@ export interface AuthorizationCreateCtx {
     scopes?: string[];
     /** The original token (for transparent mode) */
     token?: string;
+    /** Authorized providers */
+    authorizedProviders?: Record<string, ProviderSnapshot>;
+    /** Authorized provider IDs */
+    authorizedProviderIds?: string[];
     /** Authorized apps */
     authorizedApps?: Record<string, {
         id: string;
@@ -233,4 +239,62 @@ export interface AuthorizationCreateCtx {
     /** Authorized resources */
     authorizedResources?: string[];
 }
+/**
+ * Authorization represents the authenticated user context.
+ * Created from JWT verification, independent of transport.
+ * One authorization can have multiple transport sessions.
+ */
+export interface Authorization {
+    /** Unique authorization ID (derived from token signature) */
+    readonly id: string;
+    /** Auth mode that created this authorization */
+    readonly mode: AuthMode;
+    /** Whether this is an anonymous/public authorization */
+    readonly isAnonymous: boolean;
+    /** User identity */
+    readonly user: AuthUser;
+    /** JWT claims */
+    readonly claims?: Record<string, unknown>;
+    /** Token expiration (epoch ms) */
+    readonly expiresAt?: number;
+    /** Granted scopes */
+    readonly scopes: string[];
+    /** Authorized providers (for orchestrated mode) */
+    readonly authorizedProviders: Record<string, ProviderSnapshot>;
+    /** Authorized provider IDs */
+    readonly authorizedProviderIds: string[];
+    /** Authorized apps */
+    readonly authorizedApps: Record<string, {
+        id: string;
+        toolIds: string[];
+    }>;
+    /** Authorized app IDs */
+    readonly authorizedAppIds: string[];
+    /** Authorized tools */
+    readonly authorizedTools: Record<string, AuthorizedTool>;
+    /** Authorized tool IDs */
+    readonly authorizedToolIds: string[];
+    /** Authorized prompts */
+    readonly authorizedPrompts: Record<string, AuthorizedPrompt>;
+    /** Authorized prompt IDs */
+    readonly authorizedPromptIds: string[];
+    /** Authorized resources */
+    readonly authorizedResources: string[];
+    /** Get access token for a provider (orchestrated mode) */
+    getToken(providerId?: string): Promise<string>;
+    /** Create a new transport session for this authorization */
+    createTransportSession(protocol: TransportProtocol, fingerprint?: string): TransportSession;
+    /** Get existing transport session by ID */
+    getTransportSession(sessionId: string): TransportSession | undefined;
+    /** Check if a scope is granted */
+    hasScope(scope: string): boolean;
+    /** Check if all scopes are granted */
+    hasAllScopes(scopes: string[]): boolean;
+    /** Check if any scope is granted */
+    hasAnyScope(scopes: string[]): boolean;
+    /** Check if a tool is authorized */
+    canAccessTool(toolId: string): boolean;
+    /** Check if a prompt is authorized */
+    canAccessPrompt(promptId: string): boolean;
+}
 //# sourceMappingURL=authorization.types.d.ts.map

package/authorization/authorization.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.types.d.ts","sourceRoot":"","sources":["../../src/authorization/authorization.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,cAAc;;;;EAAoD,CAAC;AAMhF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;iBAMzB,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,wBAAwB;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0BAA0B;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;iBAYnC,CAAC;AAMH;;;GAGG;AACH,oBAAY,YAAY;IACtB,uDAAuD;IACvD,UAAU,eAAe;IACzB,2DAA2D;IAC3D,OAAO,YAAY;IACnB,+DAA+D;IAC/D,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,gCAA6B,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;iBAOvC,CAAC;AAEH;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAIrC,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnE,yBAAyB;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,0BAA0B;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,2BAA2B;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC"}
+{"version":3,"file":"authorization.types.d.ts","sourceRoot":"","sources":["../../src/authorization/authorization.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAM9F;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,cAAc;;;;EAAoD,CAAC;AAMhF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;iBAMzB,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,wBAAwB;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0BAA0B;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;iBAYnC,CAAC;AAMH;;;GAGG;AACH,oBAAY,YAAY;IACtB,uDAAuD;IACvD,UAAU,eAAe;IACzB,2DAA2D;IAC3D,OAAO,YAAY;IACnB,+DAA+D;IAC/D,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,gCAA6B,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;iBAOvC,CAAC;AAEH;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAIrC,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvD,8BAA8B;IAC9B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,sBAAsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnE,yBAAyB;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,0BAA0B;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,2BAA2B;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAMD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iBAAiB;IACjB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,kCAAkC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/D,8BAA8B;IAC9B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACzC,sBAAsB;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3E,yBAAyB;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpC,uBAAuB;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzD,0BAA0B;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACrC,yBAAyB;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,4BAA4B;IAC5B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,4DAA4D;IAC5D,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC5F,2CAA2C;IAC3C,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACrE,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,sCAAsC;IACtC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACxC,oCAAoC;IACpC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,oCAAoC;IACpC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5C"}

package/authorization/index.d.ts

@@ -1,9 +1,18 @@
 /**
  * Authorization Module
  *
- * Core types for authorization, user identity, and progressive auth.
+ * Core types, base class, and mode-specific implementations for authorization.
  */
-export type { AuthMode, AuthUser, AuthorizedTool, AuthorizedPrompt, LLMSafeAuthContext, AppAuthorizationRecord, ProgressiveAuthState, AuthorizationCreateCtx, } from './authorization.types';
+export type { AuthMode, AuthUser, AuthorizedTool, AuthorizedPrompt, LLMSafeAuthContext, AppAuthorizationRecord, ProgressiveAuthState, AuthorizationCreateCtx, Authorization, } from './authorization.types';
 export { AppAuthState } from './authorization.types';
 export { authModeSchema, authUserSchema, authorizedToolSchema, authorizedPromptSchema, llmSafeAuthContextSchema, appAuthStateSchema, appAuthorizationRecordSchema, progressiveAuthStateSchema, } from './authorization.types';
+export { AuthorizationBase, getMachineId } from './authorization.class';
+export { PublicAuthorization } from './public.authorization';
+export type { PublicAuthorizationCreateCtx } from './public.authorization';
+export { TransparentAuthorization } from './transparent.authorization';
+export type { TransparentAuthorizationCreateCtx, TransparentVerifiedPayload } from './transparent.authorization';
+export { OrchestratedAuthorization } from './orchestrated.authorization';
+export type { OrchestratedAuthorizationCreateCtx, OrchestratedProviderState, TokenStore as OrchestratedTokenStore, TokenRefreshCallback, } from './orchestrated.authorization';
+export type { OrchestratedAuthAccessor } from './orchestrated.accessor';
+export { OrchestratedAuthAccessorAdapter, NullOrchestratedAuthAccessor, ORCHESTRATED_AUTH_ACCESSOR, } from './orchestrated.accessor';
 //# sourceMappingURL=index.d.ts.map

package/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,YAAY,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,YAAY,EACV,kCAAkC,EAClC,yBAAyB,EACzB,UAAU,IAAI,sBAAsB,EACpC,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAGtC,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC"}

package/authorization/orchestrated.accessor.d.ts

@@ -0,0 +1,161 @@
+/**
+ * OrchestratedAuthAccessor - Interface for accessing orchestrated authorization
+ *
+ * This interface provides the runtime API for tools to access upstream provider
+ * tokens in orchestrated mode. It supports:
+ * - Token retrieval by provider ID
+ * - App token retrieval for progressive auth
+ * - Automatic token refresh
+ * - Authorization checks
+ */
+import { Token } from '@frontmcp/di';
+/**
+ * OrchestratedAuthAccessor - Runtime accessor for orchestrated authorization.
+ *
+ * Available in tool execution via `this.orchestration`:
+ * ```typescript
+ * @Tool({ name: 'my_tool' })
+ * class MyTool extends ToolContext {
+ *   async execute(input: Input) {
+ *     // Get upstream provider token
+ *     const githubToken = await this.orchestration.getToken('github');
+ *
+ *     // Check if provider is authorized
+ *     const hasSlack = await this.orchestration.hasProvider('slack');
+ *
+ *     // Get app-specific token (progressive auth)
+ *     const jiraToken = await this.orchestration.getAppToken('jira');
+ *   }
+ * }
+ * ```
+ */
+export interface OrchestratedAuthAccessor {
+    /**
+     * Get access token for an upstream provider.
+     *
+     * @param providerId - Provider ID (e.g., 'github', 'slack')
+     * @returns Access token string
+     * @throws Error if provider not authorized or token unavailable
+     *
+     * @example
+     * ```typescript
+     * const token = await this.orchestration.getToken('github');
+     * const response = await fetch('https://api.github.com/user', {
+     *   headers: { Authorization: `Bearer ${token}` },
+     * });
+     * ```
+     */
+    getToken(providerId?: string): Promise<string>;
+    /**
+     * Try to get access token, returning null if not available.
+     *
+     * @param providerId - Provider ID
+     * @returns Access token or null
+     */
+    tryGetToken(providerId?: string): Promise<string | null>;
+    /**
+     * Get access token for a specific app (progressive authorization).
+     *
+     * @param appId - App ID
+     * @returns Access token or null if app not authorized
+     */
+    getAppToken(appId: string): Promise<string | null>;
+    /**
+     * Check if a provider is authorized.
+     *
+     * @param providerId - Provider ID
+     * @returns true if provider has tokens stored
+     */
+    hasProvider(providerId: string): boolean;
+    /**
+     * Get all authorized provider IDs.
+     */
+    getProviderIds(): string[];
+    /**
+     * Check if an app is authorized.
+     *
+     * @param appId - App ID
+     * @returns true if app is authorized
+     */
+    isAppAuthorized(appId: string): boolean;
+    /**
+     * Get all authorized app IDs.
+     */
+    getAllAuthorizedAppIds(): string[];
+    /**
+     * Get tool IDs authorized through a specific app.
+     *
+     * @param appId - App ID
+     * @returns Tool IDs or undefined if app not authorized
+     */
+    getAppToolIds(appId: string): string[] | undefined;
+    /**
+     * Get the primary provider ID (default for getToken).
+     */
+    readonly primaryProviderId?: string;
+    /**
+     * Get the issuer (local orchestrator).
+     */
+    readonly issuer?: string;
+    /**
+     * Get authorization ID.
+     */
+    readonly authorizationId: string;
+    /**
+     * Check if user is authenticated (not anonymous).
+     */
+    readonly isAuthenticated: boolean;
+}
+/**
+ * DI Token for OrchestratedAuthAccessor
+ */
+export declare const ORCHESTRATED_AUTH_ACCESSOR: Token<OrchestratedAuthAccessor>;
+/**
+ * Null implementation for when orchestrated auth is not available.
+ */
+export declare class NullOrchestratedAuthAccessor implements OrchestratedAuthAccessor {
+    readonly primaryProviderId: undefined;
+    readonly issuer: undefined;
+    readonly authorizationId = "null";
+    readonly isAuthenticated = false;
+    getToken(providerId?: string): Promise<string>;
+    tryGetToken(providerId?: string): Promise<string | null>;
+    getAppToken(appId: string): Promise<string | null>;
+    hasProvider(providerId: string): boolean;
+    getProviderIds(): string[];
+    isAppAuthorized(appId: string): boolean;
+    getAllAuthorizedAppIds(): string[];
+    getAppToolIds(appId: string): string[] | undefined;
+}
+/**
+ * Adapter that wraps OrchestratedAuthorization as OrchestratedAuthAccessor.
+ */
+export declare class OrchestratedAuthAccessorAdapter implements OrchestratedAuthAccessor {
+    private readonly authorization;
+    constructor(authorization: {
+        readonly id: string;
+        readonly isAnonymous: boolean;
+        readonly primaryProviderId?: string;
+        readonly issuer?: string;
+        hasProvider(providerId: string): boolean;
+        getProviderIds(): string[];
+        getToken(providerId?: string): Promise<string>;
+        getAppToken(appId: string): Promise<string | null>;
+        isAppAuthorized(appId: string): boolean;
+        getAllAuthorizedAppIds(): string[];
+        getAppToolIds(appId: string): string[] | undefined;
+    });
+    get primaryProviderId(): string | undefined;
+    get issuer(): string | undefined;
+    get authorizationId(): string;
+    get isAuthenticated(): boolean;
+    getToken(providerId?: string): Promise<string>;
+    tryGetToken(providerId?: string): Promise<string | null>;
+    getAppToken(appId: string): Promise<string | null>;
+    hasProvider(providerId: string): boolean;
+    getProviderIds(): string[];
+    isAppAuthorized(appId: string): boolean;
+    getAllAuthorizedAppIds(): string[];
+    getAppToolIds(appId: string): string[] | undefined;
+}
+//# sourceMappingURL=orchestrated.accessor.d.ts.map

package/authorization/orchestrated.accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrated.accessor.d.ts","sourceRoot":"","sources":["../../src/authorization/orchestrated.accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C;;;;;OAKG;IACH,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAEzC;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAExC;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnD;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAElC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAErC;;GAEG;AACH,qBAAa,4BAA6B,YAAW,wBAAwB;IAC3E,QAAQ,CAAC,iBAAiB,YAAa;IACvC,QAAQ,CAAC,MAAM,YAAa;IAC5B,QAAQ,CAAC,eAAe,UAAU;IAClC,QAAQ,CAAC,eAAe,SAAS;IAE3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD;AAED;;GAEG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IAE5E,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE;QAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,cAAc,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACnD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,sBAAsB,IAAI,MAAM,EAAE,CAAC;QACnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;KACpD;IAGH,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD"}