@frontmcp/auth 1.7.0 → 1.7.2

package/authorization/authorization.class.d.ts

@@ -90,10 +90,19 @@ export declare abstract class AuthorizationBase implements Authorization {
     /**
      * Build URL for progressive/incremental authorization.
      * Used when a tool requires authorization for an app that was skipped during initial auth.
+     *
+     * The URL only SKIPS the login step when it carries a valid incremental
+     * ticket (GHSA-2c4g-9c8x-6m8g) — mint one with
+     * {@link signIncrementalAuthTicket} using the server signing secret and pass
+     * it here. Without a ticket the link still works, but the user completes an
+     * ordinary login; `mode=incremental` alone is no longer an authorization
+     * signal and is not emitted.
+     *
      * @param appId - App ID that requires authorization
      * @param baseUrl - Base URL of the server
+     * @param ticket - Signed incremental-authorization ticket for this subject
      */
-    getProgressiveAuthUrl(appId: string, baseUrl: string): string;
+    getProgressiveAuthUrl(appId: string, baseUrl: string, ticket?: string): string;
     /**
      * Check if the authorization is expired
      */

package/authorization/authorization.class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.class.d.ts","sourceRoot":"","sources":["../../src/authorization/authorization.class.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAqB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEjH,OAAO,KAAK,EACV,QAAQ,EACR,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,8BAAsB,iBAAkB,YAAW,aAAa;;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAEvC,uDAAuD;IACvD,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAKlC,yBAAyB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,SAAS,aAAa,GAAG,EAAE,sBAAsB;IAsBjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAiB3F;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIpE;;OAEG;IACH,cAAc,IAAI,gBAAgB,EAAE;IAIpC;;OAEG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIlD;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEvD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAIvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAItC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAItC;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC;;;;;OAKG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAI7D;;OAEG;IACH,SAAS,IAAI,OAAO;IAKpB;;;OAGG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAKrC;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM;IAY/C;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,kBAAkB;IAgB/D;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAW1B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;CAiDnD"}
+{"version":3,"file":"authorization.class.d.ts","sourceRoot":"","sources":["../../src/authorization/authorization.class.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAqB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEjH,OAAO,KAAK,EACV,QAAQ,EACR,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,8BAAsB,iBAAkB,YAAW,aAAa;;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAEvC,uDAAuD;IACvD,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAKlC,yBAAyB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,SAAS,aAAa,GAAG,EAAE,sBAAsB;IAsBjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAiB3F;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIpE;;OAEG;IACH,cAAc,IAAI,gBAAgB,EAAE;IAIpC;;OAEG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIlD;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAEvD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAIvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;IAItC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAItC;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAM9E;;OAEG;IACH,SAAS,IAAI,OAAO;IAKpB;;;OAGG;IACH,eAAe,IAAI,MAAM,GAAG,SAAS;IAKrC;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM;IAY/C;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,kBAAkB;IAgB/D;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAW1B;;;OAGG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;CAiDnD"}

package/esm/index.mjs

@@ -1326,8 +1326,6 @@ function buildIncrementalAuthPage(params) {
 
       <form method="GET" action="${escapeHtml3(callbackPath)}" class="flex gap-3 pt-4 border-t border-gray-100">
         <input type="hidden" name="pending_auth_id" value="${escapeHtml3(sessionHint)}">
-        <input type="hidden" name="app_id" value="${escapeHtml3(app.appId)}">
-        <input type="hidden" name="incremental" value="true">
         <button type="button" onclick="window.close()"
           class="flex-1 px-4 py-2.5 text-gray-600 hover:text-gray-900 hover:bg-gray-100 font-medium rounded-lg transition-colors">
           Cancel
@@ -1811,6 +1809,7 @@ function buildPendingRecord(params) {
     createdAt: now,
     expiresAt: now + PENDING_AUTH_TTL_MS,
     isIncremental: params.isIncremental,
+    incrementalSub: params.incrementalSub,
     targetAppId: params.targetAppId,
     targetToolId: params.targetToolId,
     existingSessionId: params.existingSessionId,
@@ -2952,6 +2951,44 @@ function buildCredentialResumeUrl(basePath, token) {
   return `${trimmed}/oauth/connect?token=${encodeURIComponent(token)}`;
 }
 
+// libs/auth/src/session/incremental-auth-ticket.ts
+import { randomUUID as randomUUID3, signData as signData2, verifyData as verifyData2 } from "@frontmcp/utils";
+var DEFAULT_INCREMENTAL_TICKET_TTL_MS = 3e5;
+function signIncrementalAuthTicket(input, secret) {
+  const payload = {
+    sub: input.sub,
+    appId: input.appId,
+    ...input.toolId !== void 0 ? { toolId: input.toolId } : {},
+    ...input.priorAppIds !== void 0 ? { priorAppIds: input.priorAppIds } : {},
+    jti: randomUUID3(),
+    exp: Date.now() + (input.ttlMs ?? DEFAULT_INCREMENTAL_TICKET_TTL_MS)
+  };
+  const signedJson = signData2(payload, { secret });
+  return Buffer.from(signedJson, "utf8").toString("base64url");
+}
+function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
+  let signedJson;
+  try {
+    signedJson = Buffer.from(token, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  const payload = verifyData2(signedJson, { secret });
+  if (!payload) return null;
+  if (typeof payload.sub !== "string" || payload.sub.length === 0) return null;
+  if (typeof payload.appId !== "string" || payload.appId.length === 0) return null;
+  if (typeof payload.jti !== "string" || payload.jti.length === 0) return null;
+  if (!Number.isFinite(payload.exp)) return null;
+  if (payload.toolId !== void 0 && typeof payload.toolId !== "string") return null;
+  if (payload.priorAppIds !== void 0 && (!Array.isArray(payload.priorAppIds) || payload.priorAppIds.some((id) => typeof id !== "string"))) {
+    return null;
+  }
+  if (now >= payload.exp) {
+    return null;
+  }
+  return payload;
+}
+
 // libs/auth/src/session/credentials-accessor.ts
 var CREDENTIALS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:CREDENTIALS_ACCESSOR");
 
@@ -3416,8 +3453,8 @@ var redisConfigSchema = z4.object({
 
 // libs/auth/src/session/session-crypto.ts
 import {
-  signData as signData2,
-  verifyData as verifyData2,
+  signData as signData3,
+  verifyData as verifyData3,
   isSignedData,
   verifyOrParseData,
   getEnv as getEnv2,
@@ -3584,10 +3621,10 @@ function resolveConfig(config) {
   return { secret: getSigningSecret(config) };
 }
 function signSession(session, config) {
-  return signData2(session, resolveConfig(config));
+  return signData3(session, resolveConfig(config));
 }
 function verifySession(signedData, config) {
-  return verifyData2(signedData, resolveConfig(config));
+  return verifyData3(signedData, resolveConfig(config));
 }
 function verifyOrParseSession(data, config) {
   return verifyOrParseData(data, resolveConfig(config));
@@ -3717,7 +3754,7 @@ var SessionRateLimiter = class {
 var defaultSessionRateLimiter = new SessionRateLimiter();
 
 // libs/auth/src/session/session.transport.ts
-import { randomUUID as randomUUID3 } from "@frontmcp/utils";
+import { randomUUID as randomUUID4 } from "@frontmcp/utils";
 var TransportIdGenerator = class {
   /**
    * Create a transport session ID.
@@ -3726,7 +3763,7 @@ var TransportIdGenerator = class {
    * @returns A transport session ID (UUID without dashes)
    */
   static createId() {
-    return randomUUID3().replace(/-/g, "");
+    return randomUUID4().replace(/-/g, "");
   }
 };
 
@@ -3863,7 +3900,7 @@ import { TypedStorage as TypedStorage4 } from "@frontmcp/utils";
 import { EncryptedTypedStorage, EncryptedStorageError } from "@frontmcp/utils";
 
 // libs/auth/src/session/storage/storage-token-store.ts
-import { randomUUID as randomUUID4, TypedStorage as TypedStorage2 } from "@frontmcp/utils";
+import { randomUUID as randomUUID5, TypedStorage as TypedStorage2 } from "@frontmcp/utils";
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -3881,7 +3918,7 @@ var StorageTokenStore = class {
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return randomUUID4();
+    return randomUUID5();
   }
   /**
    * Store an encrypted token blob.
@@ -3944,7 +3981,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-import { randomUUID as randomUUID5, TypedStorage as TypedStorage3 } from "@frontmcp/utils";
+import { randomUUID as randomUUID6, TypedStorage as TypedStorage3 } from "@frontmcp/utils";
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -3964,7 +4001,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: randomUUID5(),
+      id: randomUUID6(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -4038,7 +4075,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: randomUUID5(),
+      id: randomUUID6(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4267,7 +4304,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-import { randomUUID as randomUUID6, RedisStorageAdapter as RedisStorageAdapter2 } from "@frontmcp/utils";
+import { randomUUID as randomUUID7, RedisStorageAdapter as RedisStorageAdapter2 } from "@frontmcp/utils";
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -4478,7 +4515,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return randomUUID6();
+    return randomUUID7();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -4514,7 +4551,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-import { randomUUID as randomUUID7, VercelKvStorageAdapter } from "@frontmcp/utils";
+import { randomUUID as randomUUID8, VercelKvStorageAdapter } from "@frontmcp/utils";
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -4708,7 +4745,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return randomUUID7();
+    return randomUUID8();
   }
   /**
    * Disconnect from Vercel KV
@@ -5214,7 +5251,7 @@ var StorageOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/federated-auth.session.ts
-import { randomUUID as randomUUID8 } from "@frontmcp/utils";
+import { randomUUID as randomUUID9 } from "@frontmcp/utils";
 function toSessionRecord(session) {
   return {
     ...session,
@@ -5289,7 +5326,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: randomUUID8(),
+      id: randomUUID9(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -5321,7 +5358,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: randomUUID8(),
+    id: randomUUID9(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -5489,7 +5526,7 @@ var StorageConsentStore = class {
 
 // libs/auth/src/session/encrypted-authorization-vault.ts
 import { z as z5 } from "@frontmcp/lazy-zod";
-import { AsyncLocalStorage, randomUUID as randomUUID9 } from "@frontmcp/utils";
+import { AsyncLocalStorage, randomUUID as randomUUID10 } from "@frontmcp/utils";
 var redisVaultEntrySchema = z5.object({
   /** Vault ID */
   id: z5.string(),
@@ -5650,7 +5687,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: randomUUID9(),
+      id: randomUUID10(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -5709,7 +5746,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: randomUUID9(),
+      id: randomUUID10(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -5972,7 +6009,7 @@ var progressiveAuthStateSchema = z6.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-import { base64urlDecode as base64urlDecode4, getMachineId as getMachineId2, randomUUID as randomUUID10 } from "@frontmcp/utils";
+import { base64urlDecode as base64urlDecode4, getMachineId as getMachineId2, randomUUID as randomUUID11 } from "@frontmcp/utils";
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -6020,7 +6057,7 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = randomUUID10();
+    const sessionId = randomUUID11();
     const session = {
       id: sessionId,
       authorizationId: this.id,
@@ -6098,11 +6135,22 @@ var AuthorizationBase = class _AuthorizationBase {
   /**
    * Build URL for progressive/incremental authorization.
    * Used when a tool requires authorization for an app that was skipped during initial auth.
+   *
+   * The URL only SKIPS the login step when it carries a valid incremental
+   * ticket (GHSA-2c4g-9c8x-6m8g) — mint one with
+   * {@link signIncrementalAuthTicket} using the server signing secret and pass
+   * it here. Without a ticket the link still works, but the user completes an
+   * ordinary login; `mode=incremental` alone is no longer an authorization
+   * signal and is not emitted.
+   *
    * @param appId - App ID that requires authorization
    * @param baseUrl - Base URL of the server
+   * @param ticket - Signed incremental-authorization ticket for this subject
    */
-  getProgressiveAuthUrl(appId, baseUrl) {
-    return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&mode=incremental`;
+  getProgressiveAuthUrl(appId, baseUrl, ticket) {
+    const params = new URLSearchParams({ app: appId });
+    if (ticket) params.set("ticket", ticket);
+    return `${baseUrl}/oauth/authorize?${params.toString()}`;
   }
   /**
    * Check if the authorization is expired
@@ -6209,7 +6257,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-import { randomUUID as randomUUID11 } from "@frontmcp/utils";
+import { randomUUID as randomUUID12 } from "@frontmcp/utils";
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -6245,7 +6293,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = randomUUID11();
+    const uuid = randomUUID12();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -10861,6 +10909,7 @@ export {
   CredentialProviderAlreadyRegisteredError,
   CredentialStorageError,
   CredentialsAccessorImpl,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS,
   DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME,
   DcrClientRegistry,
@@ -11104,6 +11153,7 @@ export {
   sessionIdPayloadSchema,
   sessionJwtPayloadSchema,
   signCredentialResumeToken,
+  signIncrementalAuthTicket,
   signSession,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,
@@ -11132,6 +11182,7 @@ export {
   vaultConsentRecordSchema,
   vaultFederatedRecordSchema,
   verifyCredentialResumeToken,
+  verifyIncrementalAuthTicket,
   verifyOrParseSession,
   verifyPkce,
   verifySession,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.0",
-    "@frontmcp/storage-sqlite": "1.7.0",
+    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/storage-sqlite": "1.7.2",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.7.0",
-    "@frontmcp/utils": "1.7.0",
+    "@frontmcp/di": "1.7.2",
+    "@frontmcp/utils": "1.7.2",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/index.d.ts

@@ -34,8 +34,8 @@ export { JwksService, trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from '.
 export type { JwksServiceOptions, ProviderVerifyRef, VerifyResult } from './jwks';
 export { CDN, DEFAULT_THEME, baseLayout, createLayout, authLayout, centeredCardLayout, wideLayout, extraWideLayout, escapeHtml, buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildConnectPage, buildConnectSuccessPage, buildErrorPage, renderToHtml, renderLocalLoginPage, toLoginExtraFields, } from './ui';
 export type { ThemeColors, ThemeFonts, ThemeConfig, BaseLayoutOptions, AppAuthCard, ProviderCard, ToolCard, LoginExtraField, ConsentHiddenField, } from './ui';
-export { InMemoryAuthorizationStore, RedisAuthorizationStore, StorageAuthorizationStore, verifyPkce, generatePkceChallenge, generateAuthorizationCode, generateRefreshTokenValue, buildCodeRecord, buildPendingRecord, buildRefreshTokenRecord, pkceChallengeSchema, authorizationCodeRecordSchema, credentialTypeSchema, oauthCredentialSchema, apiKeyCredentialSchema, basicAuthCredentialSchema, bearerCredentialSchema, privateKeyCredentialSchema, mtlsCredentialSchema, customCredentialSchema, sshKeyCredentialSchema, serviceAccountCredentialSchema, pkceOAuthCredentialSchema, credentialSchema, appCredentialSchema, vaultConsentRecordSchema, vaultFederatedRecordSchema, pendingIncrementalAuthSchema, authorizationVaultEntrySchema, InMemoryAuthorizationVault, StorageAuthorizationVault, EncryptedTypedStorage, EncryptedStorageError, encryptedDataSchema, encryptedVaultEntrySchema, VaultEncryption, TokenVault, StorageTokenStore, TypedStorage, hkdfSha256, encryptValue, decryptValue, encryptAesGcm, decryptAesGcm, TinyTtlCache, transportProtocolSchema, sseTransportStateSchema, streamableHttpTransportStateSchema, statefulHttpTransportStateSchema, statelessHttpTransportStateSchema, legacySseTransportStateSchema, transportStateSchema, transportSessionSchema, sessionJwtPayloadSchema, encryptedBlobSchema, storedSessionSchema, redisConfigSchema, signSession, verifySession, isSignedSession, verifyOrParseSession, SessionRateLimiter, defaultSessionRateLimiter, TransportIdGenerator, isJwt, getTokenSignatureFingerprint, deriveTypedUser, extractBearerToken, getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey, RedisSessionStore, VercelKvSessionStore, InMemoryOrchestratedTokenStore, StorageOrchestratedTokenStore, InMemoryFederatedAuthSessionStore, StorageFederatedAuthSessionStore, toSessionRecord, fromSessionRecord, createFederatedAuthSession, isSessionComplete, getNextProvider, completeCurrentProvider, startNextProvider, InMemoryConsentStore, StorageConsentStore, consentRecordKey, createTokenStorageAdapter, isRedisTokenStorage, isSqliteTokenStorage, isPersistentTokenStorage, redisVaultEntrySchema, EncryptedRedisVault, createEncryptedVault, toEpochSeconds, isSoonExpiring, isSoonExpiringProvider, tryJwtExp, SessionCredentialVault, createSessionCredentialVault, signCredentialResumeToken, verifyCredentialResumeToken, buildCredentialResumeUrl, DEFAULT_RESUME_TTL_MS, CREDENTIALS_ACCESSOR, CredentialsAccessorImpl, EncryptedStorageSecureStoreBackend, SECURE_STORE_ACCESSOR, SecureStoreAccessorImpl, createSecureStore, } from './session';
-export type { AuthorizationStore, PkceChallenge, AuthorizationCodeRecord, PendingAuthorizationRecord, RefreshTokenRecord, ConsentStateRecord, FederatedLoginStateRecord, CreateCodeRecordParams, CreatePendingRecordParams, CreateRefreshTokenRecordParams, StorageAuthorizationStoreOptions, CredentialType, OAuthCredential, ApiKeyCredential, BasicAuthCredential, BearerCredential, PrivateKeyCredential, MtlsCredential, CustomCredential, SshKeyCredential, ServiceAccountCredential, PkceOAuthCredential, Credential, AppCredential, VaultConsentRecord, VaultFederatedRecord, PendingIncrementalAuth, AuthorizationVaultEntry, AuthorizationVault, InMemoryAuthorizationVaultOptions, EncryptedData, VaultKeyDerivationClaims, VaultEncryptionConfig, EncryptedVaultEntry, VaultSensitiveData, EncBlob, VaultKey, SecretRecord, TokenStore, TypedStorageOptions, TypedSetOptions, TypedSetEntry, EncryptedTypedStorageOptions, EncryptedSetOptions, EncryptedSetEntry, EncryptionKey, StoredEncryptedBlob, ClientKeyBinding, StorageTokenStoreOptions, StorageAuthorizationVaultOptions, EncryptedBlob, TransportProtocol, SessionStorageMode, TransportSession, TransportState, SseTransportState, StreamableHttpTransportState, StatefulHttpTransportState, StatelessHttpTransportState, LegacySseTransportState, SessionJwtPayload, StatelessSessionJwtPayload, StoredSession, TransportEncryptedBlob, SessionStore, SessionStorageConfig, RedisConfig, SessionSecurityConfig, SessionMode, ProviderEmbedMode, SessionEncBlob, ProviderSnapshot, CreateSessionArgs, SignedSession, SessionSigningConfig, SessionRateLimiterConfig, RateLimitResult, RedisSessionStoreConfig, VercelKvSessionConfig, InMemoryOrchestratedTokenStoreOptions, StorageOrchestratedTokenStoreOptions, StorageFederatedAuthSessionStoreOptions, ProviderPkce, ProviderTokens, ProviderUserInfo, CompletedProvider, FederatedAuthSession, FederatedAuthSessionRecord, FederatedAuthSessionStore, FederatedAuthSessionCreateParams, ConsentStore, RememberedConsentRecord, StorageConsentStoreOptions, RedisVaultEntry, EncryptionContext, TokenRefreshCtx, TokenRefreshResult, TokenRefresher, StoredCredential, SessionCredentialVaultOptions, CreateSessionCredentialVaultOptions, CredentialResumePayload, CredentialsAccessor, CredentialValue, CredentialNotConnected, CredentialConnected, RequireConnectResult, RequireConnectOptions, CredentialsAccessorDeps, SecureStoreBackend, SecureStoreScope, SecureStoreScopeRef, EncryptedStorageSecureStoreBackendOptions, SecureStoreAccessor, SecureStoreSetOptions, SecureStoreAccessorDeps, CreateSecureStoreOptions, ResolvedSecureStore, SecureStoreBackendKind, } from './session';
+export { InMemoryAuthorizationStore, RedisAuthorizationStore, StorageAuthorizationStore, verifyPkce, generatePkceChallenge, generateAuthorizationCode, generateRefreshTokenValue, buildCodeRecord, buildPendingRecord, buildRefreshTokenRecord, pkceChallengeSchema, authorizationCodeRecordSchema, credentialTypeSchema, oauthCredentialSchema, apiKeyCredentialSchema, basicAuthCredentialSchema, bearerCredentialSchema, privateKeyCredentialSchema, mtlsCredentialSchema, customCredentialSchema, sshKeyCredentialSchema, serviceAccountCredentialSchema, pkceOAuthCredentialSchema, credentialSchema, appCredentialSchema, vaultConsentRecordSchema, vaultFederatedRecordSchema, pendingIncrementalAuthSchema, authorizationVaultEntrySchema, InMemoryAuthorizationVault, StorageAuthorizationVault, EncryptedTypedStorage, EncryptedStorageError, encryptedDataSchema, encryptedVaultEntrySchema, VaultEncryption, TokenVault, StorageTokenStore, TypedStorage, hkdfSha256, encryptValue, decryptValue, encryptAesGcm, decryptAesGcm, TinyTtlCache, transportProtocolSchema, sseTransportStateSchema, streamableHttpTransportStateSchema, statefulHttpTransportStateSchema, statelessHttpTransportStateSchema, legacySseTransportStateSchema, transportStateSchema, transportSessionSchema, sessionJwtPayloadSchema, encryptedBlobSchema, storedSessionSchema, redisConfigSchema, signSession, verifySession, isSignedSession, verifyOrParseSession, SessionRateLimiter, defaultSessionRateLimiter, TransportIdGenerator, isJwt, getTokenSignatureFingerprint, deriveTypedUser, extractBearerToken, getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey, RedisSessionStore, VercelKvSessionStore, InMemoryOrchestratedTokenStore, StorageOrchestratedTokenStore, InMemoryFederatedAuthSessionStore, StorageFederatedAuthSessionStore, toSessionRecord, fromSessionRecord, createFederatedAuthSession, isSessionComplete, getNextProvider, completeCurrentProvider, startNextProvider, InMemoryConsentStore, StorageConsentStore, consentRecordKey, createTokenStorageAdapter, isRedisTokenStorage, isSqliteTokenStorage, isPersistentTokenStorage, redisVaultEntrySchema, EncryptedRedisVault, createEncryptedVault, toEpochSeconds, isSoonExpiring, isSoonExpiringProvider, tryJwtExp, SessionCredentialVault, createSessionCredentialVault, signCredentialResumeToken, verifyCredentialResumeToken, buildCredentialResumeUrl, DEFAULT_RESUME_TTL_MS, signIncrementalAuthTicket, verifyIncrementalAuthTicket, DEFAULT_INCREMENTAL_TICKET_TTL_MS, CREDENTIALS_ACCESSOR, CredentialsAccessorImpl, EncryptedStorageSecureStoreBackend, SECURE_STORE_ACCESSOR, SecureStoreAccessorImpl, createSecureStore, } from './session';
+export type { AuthorizationStore, PkceChallenge, AuthorizationCodeRecord, PendingAuthorizationRecord, RefreshTokenRecord, ConsentStateRecord, FederatedLoginStateRecord, CreateCodeRecordParams, CreatePendingRecordParams, CreateRefreshTokenRecordParams, StorageAuthorizationStoreOptions, CredentialType, OAuthCredential, ApiKeyCredential, BasicAuthCredential, BearerCredential, PrivateKeyCredential, MtlsCredential, CustomCredential, SshKeyCredential, ServiceAccountCredential, PkceOAuthCredential, Credential, AppCredential, VaultConsentRecord, VaultFederatedRecord, PendingIncrementalAuth, AuthorizationVaultEntry, AuthorizationVault, InMemoryAuthorizationVaultOptions, EncryptedData, VaultKeyDerivationClaims, VaultEncryptionConfig, EncryptedVaultEntry, VaultSensitiveData, EncBlob, VaultKey, SecretRecord, TokenStore, TypedStorageOptions, TypedSetOptions, TypedSetEntry, EncryptedTypedStorageOptions, EncryptedSetOptions, EncryptedSetEntry, EncryptionKey, StoredEncryptedBlob, ClientKeyBinding, StorageTokenStoreOptions, StorageAuthorizationVaultOptions, EncryptedBlob, TransportProtocol, SessionStorageMode, TransportSession, TransportState, SseTransportState, StreamableHttpTransportState, StatefulHttpTransportState, StatelessHttpTransportState, LegacySseTransportState, SessionJwtPayload, StatelessSessionJwtPayload, StoredSession, TransportEncryptedBlob, SessionStore, SessionStorageConfig, RedisConfig, SessionSecurityConfig, SessionMode, ProviderEmbedMode, SessionEncBlob, ProviderSnapshot, CreateSessionArgs, SignedSession, SessionSigningConfig, SessionRateLimiterConfig, RateLimitResult, RedisSessionStoreConfig, VercelKvSessionConfig, InMemoryOrchestratedTokenStoreOptions, StorageOrchestratedTokenStoreOptions, StorageFederatedAuthSessionStoreOptions, ProviderPkce, ProviderTokens, ProviderUserInfo, CompletedProvider, FederatedAuthSession, FederatedAuthSessionRecord, FederatedAuthSessionStore, FederatedAuthSessionCreateParams, ConsentStore, RememberedConsentRecord, StorageConsentStoreOptions, RedisVaultEntry, EncryptionContext, TokenRefreshCtx, TokenRefreshResult, TokenRefresher, StoredCredential, SessionCredentialVaultOptions, CreateSessionCredentialVaultOptions, CredentialResumePayload, IncrementalAuthTicketPayload, CredentialsAccessor, CredentialValue, CredentialNotConnected, CredentialConnected, RequireConnectResult, RequireConnectOptions, CredentialsAccessorDeps, SecureStoreBackend, SecureStoreScope, SecureStoreScopeRef, EncryptedStorageSecureStoreBackendOptions, SecureStoreAccessor, SecureStoreSetOptions, SecureStoreAccessorDeps, CreateSecureStoreOptions, ResolvedSecureStore, SecureStoreBackendKind, } from './session';
 export { type AuthMode, type AuthUser, type AuthorizedTool, type AuthorizedPrompt, type LLMSafeAuthContext, type AppAuthorizationRecord, type ProgressiveAuthState, type AuthorizationCreateCtx, type Authorization, AppAuthState, authModeSchema, authUserSchema, authorizedToolSchema, authorizedPromptSchema, llmSafeAuthContextSchema, appAuthStateSchema, appAuthorizationRecordSchema, progressiveAuthStateSchema, AuthorizationBase, PublicAuthorization, type PublicAuthorizationCreateCtx, TransparentAuthorization, type TransparentAuthorizationCreateCtx, type TransparentVerifiedPayload, OrchestratedAuthorization, type OrchestratedAuthorizationCreateCtx, type OrchestratedProviderState, type OrchestratedTokenStore, type TokenRefreshCallback, type OrchestratedAuthAccessor, OrchestratedAuthAccessorAdapter, NullOrchestratedAuthAccessor, ORCHESTRATED_AUTH_ACCESSOR, DcrClientRegistry, type RegisteredClient, type PreRegisteredClientInput, type DcrRegistryConfig, } from './authorization';
 export type { AuthLogger } from './common';
 export type { RawZodShape } from './common';

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EAEV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EAEV,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}