@frontmcp/sdk 0.4.0 → 0.5.0

package/src/auth/authorization/transparent.authorization.d.ts

@@ -0,0 +1,130 @@
+import { AuthorizationBase } from './authorization.class';
+import { AuthorizationCreateCtx } from './authorization.types';
+import { AuthMode } from '../../common';
+/**
+ * Verified JWT payload from transparent auth provider
+ */
+export interface TransparentVerifiedPayload {
+    /** Subject identifier */
+    sub: string;
+    /** Issuer */
+    iss?: string;
+    /** Audience */
+    aud?: string | string[];
+    /** Expiration (seconds since epoch) */
+    exp?: number;
+    /** Issued at (seconds since epoch) */
+    iat?: number;
+    /** Scopes (space-separated or array) */
+    scope?: string | string[];
+    /** Display name */
+    name?: string;
+    /** Email */
+    email?: string;
+    /** Picture URL */
+    picture?: string;
+    /** Additional claims */
+    [key: string]: unknown;
+}
+/**
+ * Context for creating a TransparentAuthorization
+ */
+export interface TransparentAuthorizationCreateCtx {
+    /**
+     * The original bearer token (passed through to downstream)
+     */
+    token: string;
+    /**
+     * Verified JWT payload from the upstream provider
+     */
+    payload: TransparentVerifiedPayload;
+    /**
+     * Provider ID for this authorization
+     */
+    providerId: string;
+    /**
+     * Provider name for display/logging
+     */
+    providerName?: string;
+    /**
+     * Precomputed authorization projections
+     */
+    authorizedTools?: AuthorizationCreateCtx['authorizedTools'];
+    authorizedToolIds?: string[];
+    authorizedPrompts?: AuthorizationCreateCtx['authorizedPrompts'];
+    authorizedPromptIds?: string[];
+    authorizedApps?: AuthorizationCreateCtx['authorizedApps'];
+    authorizedAppIds?: string[];
+    authorizedResources?: string[];
+}
+/**
+ * TransparentAuthorization - Pass-through OAuth tokens
+ *
+ * In transparent mode:
+ * - The client's token is forwarded directly to downstream services
+ * - Token validation happens via the upstream provider's JWKS
+ * - getToken() returns the original bearer token
+ * - Ideal when the auth server is the source of truth
+ */
+export declare class TransparentAuthorization extends AuthorizationBase {
+    readonly mode: AuthMode;
+    /**
+     * Provider ID that issued the token
+     */
+    readonly providerId: string;
+    /**
+     * Provider display name
+     */
+    readonly providerName?: string;
+    private constructor();
+    /**
+     * Create a TransparentAuthorization from a verified JWT
+     *
+     * @param ctx - Creation context with token and verified payload
+     * @returns A new TransparentAuthorization instance
+     *
+     * @example
+     * ```typescript
+     * const auth = TransparentAuthorization.fromVerifiedToken({
+     *   token: bearerToken,
+     *   payload: verifiedClaims,
+     *   providerId: 'auth0',
+     * });
+     *
+     * // Pass token through to downstream
+     * const token = await auth.getToken();
+     * ```
+     */
+    static fromVerifiedToken(ctx: TransparentAuthorizationCreateCtx): TransparentAuthorization;
+    /**
+     * Get the original bearer token for pass-through
+     *
+     * In transparent mode, the same token is returned regardless of providerId
+     * since only one provider (the upstream) issued the token.
+     *
+     * @param _providerId - Ignored in transparent mode
+     * @returns The original bearer token
+     */
+    getToken(_providerId?: string): Promise<string>;
+    /**
+     * Parse scope claim from JWT payload
+     */
+    private static parseScopes;
+    /**
+     * Generate authorization ID from token signature
+     * Uses SHA-256 fingerprint of the token signature for uniqueness
+     */
+    private static generateAuthorizationId;
+    /**
+     * Get the issuer from the token claims
+     */
+    get issuer(): string | undefined;
+    /**
+     * Get the audience from the token claims
+     */
+    get audience(): string | string[] | undefined;
+    /**
+     * Check if the token was issued for a specific audience
+     */
+    hasAudience(aud: string): boolean;
+}

package/src/auth/authorization/transparent.authorization.js

@@ -0,0 +1,147 @@
+"use strict";
+// auth/authorization/transparent.authorization.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TransparentAuthorization = void 0;
+const crypto_1 = require("crypto");
+const authorization_class_1 = require("./authorization.class");
+/**
+ * TransparentAuthorization - Pass-through OAuth tokens
+ *
+ * In transparent mode:
+ * - The client's token is forwarded directly to downstream services
+ * - Token validation happens via the upstream provider's JWKS
+ * - getToken() returns the original bearer token
+ * - Ideal when the auth server is the source of truth
+ */
+class TransparentAuthorization extends authorization_class_1.AuthorizationBase {
+    mode = 'transparent';
+    /**
+     * Provider ID that issued the token
+     */
+    providerId;
+    /**
+     * Provider display name
+     */
+    providerName;
+    constructor(ctx) {
+        super(ctx);
+        this.providerId = ctx.providerId;
+        this.providerName = ctx.providerName;
+    }
+    /**
+     * Create a TransparentAuthorization from a verified JWT
+     *
+     * @param ctx - Creation context with token and verified payload
+     * @returns A new TransparentAuthorization instance
+     *
+     * @example
+     * ```typescript
+     * const auth = TransparentAuthorization.fromVerifiedToken({
+     *   token: bearerToken,
+     *   payload: verifiedClaims,
+     *   providerId: 'auth0',
+     * });
+     *
+     * // Pass token through to downstream
+     * const token = await auth.getToken();
+     * ```
+     */
+    static fromVerifiedToken(ctx) {
+        const { token, payload, providerId, providerName, ...projections } = ctx;
+        // Extract user identity from payload
+        const user = {
+            sub: payload.sub,
+            name: payload.name,
+            email: payload.email,
+            picture: payload.picture,
+            anonymous: false,
+        };
+        // Parse scopes from payload
+        const scopes = TransparentAuthorization.parseScopes(payload.scope);
+        // Calculate expiration from JWT exp claim
+        const expiresAt = payload.exp ? payload.exp * 1000 : undefined;
+        // Generate authorization ID from token signature fingerprint
+        const id = TransparentAuthorization.generateAuthorizationId(token);
+        // Create provider snapshot for this authorization
+        const providerSnapshot = {
+            id: providerId,
+            exp: expiresAt,
+            payload: payload,
+            embedMode: 'plain', // transparent mode keeps token in memory
+            token, // the original token
+        };
+        return new TransparentAuthorization({
+            id,
+            isAnonymous: false,
+            user,
+            claims: payload,
+            expiresAt,
+            scopes,
+            token,
+            providerId,
+            providerName,
+            authorizedProviders: { [providerId]: providerSnapshot },
+            authorizedProviderIds: [providerId],
+            ...projections,
+        });
+    }
+    /**
+     * Get the original bearer token for pass-through
+     *
+     * In transparent mode, the same token is returned regardless of providerId
+     * since only one provider (the upstream) issued the token.
+     *
+     * @param _providerId - Ignored in transparent mode
+     * @returns The original bearer token
+     */
+    async getToken(_providerId) {
+        if (!this.token) {
+            throw new Error('TransparentAuthorization: Token not available');
+        }
+        return this.token;
+    }
+    /**
+     * Parse scope claim from JWT payload
+     */
+    static parseScopes(scope) {
+        if (!scope)
+            return [];
+        if (Array.isArray(scope))
+            return scope;
+        return scope.split(/\s+/).filter(Boolean);
+    }
+    /**
+     * Generate authorization ID from token signature
+     * Uses SHA-256 fingerprint of the token signature for uniqueness
+     */
+    static generateAuthorizationId(token) {
+        const parts = token.split('.');
+        const signature = parts[2] || token;
+        return (0, crypto_1.createHash)('sha256').update(signature).digest('hex').substring(0, 16);
+    }
+    /**
+     * Get the issuer from the token claims
+     */
+    get issuer() {
+        return this.claims?.['iss'];
+    }
+    /**
+     * Get the audience from the token claims
+     */
+    get audience() {
+        return this.claims?.['aud'];
+    }
+    /**
+     * Check if the token was issued for a specific audience
+     */
+    hasAudience(aud) {
+        const tokenAud = this.audience;
+        if (!tokenAud)
+            return false;
+        if (Array.isArray(tokenAud))
+            return tokenAud.includes(aud);
+        return tokenAud === aud;
+    }
+}
+exports.TransparentAuthorization = TransparentAuthorization;
+//# sourceMappingURL=transparent.authorization.js.map

package/src/auth/authorization/transparent.authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transparent.authorization.js","sourceRoot":"","sources":["../../../../src/auth/authorization/transparent.authorization.ts"],"names":[],"mappings":";AAAA,kDAAkD;;;AAElD,mCAAoC;AACpC,+DAA0D;AAmE1D;;;;;;;;GAQG;AACH,MAAa,wBAAyB,SAAQ,uCAAiB;IACpD,IAAI,GAAa,aAAa,CAAC;IAExC;;OAEG;IACM,UAAU,CAAS;IAE5B;;OAEG;IACM,YAAY,CAAU;IAE/B,YACE,GAGC;QAED,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAsC;QAC7D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC;QAEzE,qCAAqC;QACrC,MAAM,IAAI,GAAa;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,KAAK;SACjB,CAAC;QAEF,4BAA4B;QAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEnE,0CAA0C;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/D,6DAA6D;QAC7D,MAAM,EAAE,GAAG,wBAAwB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAEnE,kDAAkD;QAClD,MAAM,gBAAgB,GAAqB;YACzC,EAAE,EAAE,UAAU;YACd,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,OAAkC;YAC3C,SAAS,EAAE,OAAO,EAAE,yCAAyC;YAC7D,KAAK,EAAE,qBAAqB;SAC7B,CAAC;QAEF,OAAO,IAAI,wBAAwB,CAAC;YAClC,EAAE;YACF,WAAW,EAAE,KAAK;YAClB,IAAI;YACJ,MAAM,EAAE,OAAkC;YAC1C,SAAS;YACT,MAAM;YACN,KAAK;YACL,UAAU;YACV,YAAY;YACZ,mBAAmB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,gBAAgB,EAAE;YACvD,qBAAqB,EAAE,CAAC,UAAU,CAAC;YACnC,GAAG,WAAW;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAoB;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,WAAW,CAAC,KAAoC;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,uBAAuB,CAAC,KAAa;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QACpC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAuB,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAkC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAW;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3D,OAAO,QAAQ,KAAK,GAAG,CAAC;IAC1B,CAAC;CACF;AAlJD,4DAkJC","sourcesContent":["// auth/authorization/transparent.authorization.ts\n\nimport { createHash } from 'crypto';\nimport { AuthorizationBase } from './authorization.class';\nimport { AuthorizationCreateCtx, AuthUser } from './authorization.types';\nimport { ProviderSnapshot } from '../session/session.types';\nimport { AuthMode } from '../../common';\n\n/**\n * Verified JWT payload from transparent auth provider\n */\nexport interface TransparentVerifiedPayload {\n  /** Subject identifier */\n  sub: string;\n  /** Issuer */\n  iss?: string;\n  /** Audience */\n  aud?: string | string[];\n  /** Expiration (seconds since epoch) */\n  exp?: number;\n  /** Issued at (seconds since epoch) */\n  iat?: number;\n  /** Scopes (space-separated or array) */\n  scope?: string | string[];\n  /** Display name */\n  name?: string;\n  /** Email */\n  email?: string;\n  /** Picture URL */\n  picture?: string;\n  /** Additional claims */\n  [key: string]: unknown;\n}\n\n/**\n * Context for creating a TransparentAuthorization\n */\nexport interface TransparentAuthorizationCreateCtx {\n  /**\n   * The original bearer token (passed through to downstream)\n   */\n  token: string;\n\n  /**\n   * Verified JWT payload from the upstream provider\n   */\n  payload: TransparentVerifiedPayload;\n\n  /**\n   * Provider ID for this authorization\n   */\n  providerId: string;\n\n  /**\n   * Provider name for display/logging\n   */\n  providerName?: string;\n\n  /**\n   * Precomputed authorization projections\n   */\n  authorizedTools?: AuthorizationCreateCtx['authorizedTools'];\n  authorizedToolIds?: string[];\n  authorizedPrompts?: AuthorizationCreateCtx['authorizedPrompts'];\n  authorizedPromptIds?: string[];\n  authorizedApps?: AuthorizationCreateCtx['authorizedApps'];\n  authorizedAppIds?: string[];\n  authorizedResources?: string[];\n}\n\n/**\n * TransparentAuthorization - Pass-through OAuth tokens\n *\n * In transparent mode:\n * - The client's token is forwarded directly to downstream services\n * - Token validation happens via the upstream provider's JWKS\n * - getToken() returns the original bearer token\n * - Ideal when the auth server is the source of truth\n */\nexport class TransparentAuthorization extends AuthorizationBase {\n  readonly mode: AuthMode = 'transparent';\n\n  /**\n   * Provider ID that issued the token\n   */\n  readonly providerId: string;\n\n  /**\n   * Provider display name\n   */\n  readonly providerName?: string;\n\n  private constructor(\n    ctx: AuthorizationCreateCtx & {\n      providerId: string;\n      providerName?: string;\n    },\n  ) {\n    super(ctx);\n    this.providerId = ctx.providerId;\n    this.providerName = ctx.providerName;\n  }\n\n  /**\n   * Create a TransparentAuthorization from a verified JWT\n   *\n   * @param ctx - Creation context with token and verified payload\n   * @returns A new TransparentAuthorization instance\n   *\n   * @example\n   * ```typescript\n   * const auth = TransparentAuthorization.fromVerifiedToken({\n   *   token: bearerToken,\n   *   payload: verifiedClaims,\n   *   providerId: 'auth0',\n   * });\n   *\n   * // Pass token through to downstream\n   * const token = await auth.getToken();\n   * ```\n   */\n  static fromVerifiedToken(ctx: TransparentAuthorizationCreateCtx): TransparentAuthorization {\n    const { token, payload, providerId, providerName, ...projections } = ctx;\n\n    // Extract user identity from payload\n    const user: AuthUser = {\n      sub: payload.sub,\n      name: payload.name,\n      email: payload.email,\n      picture: payload.picture,\n      anonymous: false,\n    };\n\n    // Parse scopes from payload\n    const scopes = TransparentAuthorization.parseScopes(payload.scope);\n\n    // Calculate expiration from JWT exp claim\n    const expiresAt = payload.exp ? payload.exp * 1000 : undefined;\n\n    // Generate authorization ID from token signature fingerprint\n    const id = TransparentAuthorization.generateAuthorizationId(token);\n\n    // Create provider snapshot for this authorization\n    const providerSnapshot: ProviderSnapshot = {\n      id: providerId,\n      exp: expiresAt,\n      payload: payload as Record<string, unknown>,\n      embedMode: 'plain', // transparent mode keeps token in memory\n      token, // the original token\n    };\n\n    return new TransparentAuthorization({\n      id,\n      isAnonymous: false,\n      user,\n      claims: payload as Record<string, unknown>,\n      expiresAt,\n      scopes,\n      token,\n      providerId,\n      providerName,\n      authorizedProviders: { [providerId]: providerSnapshot },\n      authorizedProviderIds: [providerId],\n      ...projections,\n    });\n  }\n\n  /**\n   * Get the original bearer token for pass-through\n   *\n   * In transparent mode, the same token is returned regardless of providerId\n   * since only one provider (the upstream) issued the token.\n   *\n   * @param _providerId - Ignored in transparent mode\n   * @returns The original bearer token\n   */\n  async getToken(_providerId?: string): Promise<string> {\n    if (!this.token) {\n      throw new Error('TransparentAuthorization: Token not available');\n    }\n    return this.token;\n  }\n\n  /**\n   * Parse scope claim from JWT payload\n   */\n  private static parseScopes(scope: string | string[] | undefined): string[] {\n    if (!scope) return [];\n    if (Array.isArray(scope)) return scope;\n    return scope.split(/\\s+/).filter(Boolean);\n  }\n\n  /**\n   * Generate authorization ID from token signature\n   * Uses SHA-256 fingerprint of the token signature for uniqueness\n   */\n  private static generateAuthorizationId(token: string): string {\n    const parts = token.split('.');\n    const signature = parts[2] || token;\n    return createHash('sha256').update(signature).digest('hex').substring(0, 16);\n  }\n\n  /**\n   * Get the issuer from the token claims\n   */\n  get issuer(): string | undefined {\n    return this.claims?.['iss'] as string | undefined;\n  }\n\n  /**\n   * Get the audience from the token claims\n   */\n  get audience(): string | string[] | undefined {\n    return this.claims?.['aud'] as string | string[] | undefined;\n  }\n\n  /**\n   * Check if the token was issued for a specific audience\n   */\n  hasAudience(aud: string): boolean {\n    const tokenAud = this.audience;\n    if (!tokenAud) return false;\n    if (Array.isArray(tokenAud)) return tokenAud.includes(aud);\n    return tokenAud === aud;\n  }\n}\n"]}

package/src/auth/consent/consent.types.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Consent Flow Types and Schemas
+ *
+ * Defines types for the tool consent flow that allows users to select
+ * which MCP tools they want to expose to the LLM.
+ */
+import { z } from 'zod';
+import { consentConfigSchema } from '../../common';
+export { consentConfigSchema };
+/**
+ * Tool consent item schema - represents a tool available for consent
+ */
+export declare const consentToolItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    appId: z.ZodString;
+    appName: z.ZodString;
+    defaultSelected: z.ZodDefault<z.ZodBoolean>;
+    requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    category: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Consent selection schema - user's tool selection
+ */
+export declare const consentSelectionSchema: z.ZodObject<{
+    selectedTools: z.ZodArray<z.ZodString>;
+    allSelected: z.ZodBoolean;
+    consentedAt: z.ZodString;
+    consentVersion: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Consent page state schema - stored in pending authorization
+ */
+export declare const consentStateSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    availableTools: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        appId: z.ZodString;
+        appName: z.ZodString;
+        defaultSelected: z.ZodDefault<z.ZodBoolean>;
+        requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        category: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    preselectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    groupByApp: z.ZodDefault<z.ZodBoolean>;
+    customMessage: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Auth provider item for federated login UI
+ */
+export declare const federatedProviderItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+    type: z.ZodEnum<{
+        remote: "remote";
+        transparent: "transparent";
+        local: "local";
+    }>;
+    providerUrl: z.ZodOptional<z.ZodString>;
+    appIds: z.ZodArray<z.ZodString>;
+    appNames: z.ZodArray<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    isPrimary: z.ZodBoolean;
+    isOptional: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * Federated login state schema
+ */
+export declare const federatedLoginStateSchema: z.ZodObject<{
+    providers: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+        type: z.ZodEnum<{
+            remote: "remote";
+            transparent: "transparent";
+            local: "local";
+        }>;
+        providerUrl: z.ZodOptional<z.ZodString>;
+        appIds: z.ZodArray<z.ZodString>;
+        appNames: z.ZodArray<z.ZodString>;
+        scopes: z.ZodArray<z.ZodString>;
+        isPrimary: z.ZodBoolean;
+        isOptional: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    primaryProviderId: z.ZodOptional<z.ZodString>;
+    allowSkip: z.ZodDefault<z.ZodBoolean>;
+    preselectedProviders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Federated login selection schema
+ */
+export declare const federatedSelectionSchema: z.ZodObject<{
+    selectedProviders: z.ZodArray<z.ZodString>;
+    skippedProviders: z.ZodArray<z.ZodString>;
+    providerMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type ConsentToolItem = z.infer<typeof consentToolItemSchema>;
+export type ConsentSelection = z.infer<typeof consentSelectionSchema>;
+export type ConsentState = z.infer<typeof consentStateSchema>;
+export type ConsentConfig = z.infer<typeof consentConfigSchema>;
+export type ConsentConfigInput = z.input<typeof consentConfigSchema>;
+export type FederatedProviderItem = z.infer<typeof federatedProviderItemSchema>;
+export type FederatedLoginState = z.infer<typeof federatedLoginStateSchema>;
+export type FederatedSelection = z.infer<typeof federatedSelectionSchema>;

package/src/auth/consent/consent.types.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.federatedSelectionSchema = exports.federatedLoginStateSchema = exports.federatedProviderItemSchema = exports.consentStateSchema = exports.consentSelectionSchema = exports.consentToolItemSchema = exports.consentConfigSchema = void 0;
+/**
+ * Consent Flow Types and Schemas
+ *
+ * Defines types for the tool consent flow that allows users to select
+ * which MCP tools they want to expose to the LLM.
+ */
+const zod_1 = require("zod");
+const common_1 = require("../../common");
+Object.defineProperty(exports, "consentConfigSchema", { enumerable: true, get: function () { return common_1.consentConfigSchema; } });
+// ============================================
+// Consent Configuration Schemas
+// ============================================
+/**
+ * Tool consent item schema - represents a tool available for consent
+ */
+exports.consentToolItemSchema = zod_1.z.object({
+    /** Tool ID (e.g., 'slack:send_message') */
+    id: zod_1.z.string().min(1),
+    /** Tool name for display */
+    name: zod_1.z.string().min(1),
+    /** Tool description */
+    description: zod_1.z.string().optional(),
+    /** App ID this tool belongs to */
+    appId: zod_1.z.string().min(1),
+    /** App name for display */
+    appName: zod_1.z.string().min(1),
+    /** Whether the tool is selected by default */
+    defaultSelected: zod_1.z.boolean().default(true),
+    /** Whether this tool requires specific scopes */
+    requiredScopes: zod_1.z.array(zod_1.z.string()).optional(),
+    /** Category for grouping (e.g., 'read', 'write', 'admin') */
+    category: zod_1.z.string().optional(),
+});
+/**
+ * Consent selection schema - user's tool selection
+ */
+exports.consentSelectionSchema = zod_1.z.object({
+    /** Selected tool IDs */
+    selectedTools: zod_1.z.array(zod_1.z.string()),
+    /** Whether all tools were selected */
+    allSelected: zod_1.z.boolean(),
+    /** Timestamp when consent was given */
+    consentedAt: zod_1.z.string().datetime(),
+    /** Consent version for tracking changes */
+    consentVersion: zod_1.z.string().default('1.0'),
+});
+/**
+ * Consent page state schema - stored in pending authorization
+ */
+exports.consentStateSchema = zod_1.z.object({
+    /** Whether consent flow is enabled */
+    enabled: zod_1.z.boolean(),
+    /** Available tools for consent */
+    availableTools: zod_1.z.array(exports.consentToolItemSchema),
+    /** Pre-selected tools (from previous consent or defaults) */
+    preselectedTools: zod_1.z.array(zod_1.z.string()).optional(),
+    /** Whether to show all tools or group by app */
+    groupByApp: zod_1.z.boolean().default(true),
+    /** Custom consent message */
+    customMessage: zod_1.z.string().optional(),
+});
+// ============================================
+// Federated Login Schemas
+// ============================================
+/**
+ * Auth provider item for federated login UI
+ */
+exports.federatedProviderItemSchema = zod_1.z.object({
+    /** Provider ID (derived or explicit) */
+    id: zod_1.z.string().min(1),
+    /** Provider display name */
+    name: zod_1.z.string().min(1),
+    /** Provider description */
+    description: zod_1.z.string().optional(),
+    /** Provider icon URL or emoji */
+    icon: zod_1.z.string().optional(),
+    /** Provider type */
+    type: zod_1.z.enum(['local', 'remote', 'transparent']),
+    /** OAuth provider URL (for remote providers) */
+    providerUrl: zod_1.z.string().url().optional(),
+    /** Apps using this provider */
+    appIds: zod_1.z.array(zod_1.z.string()),
+    /** App names using this provider */
+    appNames: zod_1.z.array(zod_1.z.string()),
+    /** Scopes required by this provider */
+    scopes: zod_1.z.array(zod_1.z.string()),
+    /** Whether this is the primary/parent provider */
+    isPrimary: zod_1.z.boolean(),
+    /** Whether this provider is optional (can be skipped) */
+    isOptional: zod_1.z.boolean().default(false),
+});
+/**
+ * Federated login state schema
+ */
+exports.federatedLoginStateSchema = zod_1.z.object({
+    /** All available providers */
+    providers: zod_1.z.array(exports.federatedProviderItemSchema),
+    /** Primary provider ID (if any) */
+    primaryProviderId: zod_1.z.string().optional(),
+    /** Whether user can skip optional providers */
+    allowSkip: zod_1.z.boolean().default(true),
+    /** Pre-selected provider IDs (from previous session) */
+    preselectedProviders: zod_1.z.array(zod_1.z.string()).optional(),
+});
+/**
+ * Federated login selection schema
+ */
+exports.federatedSelectionSchema = zod_1.z.object({
+    /** Selected provider IDs */
+    selectedProviders: zod_1.z.array(zod_1.z.string()),
+    /** Skipped provider IDs */
+    skippedProviders: zod_1.z.array(zod_1.z.string()),
+    /** Provider-specific metadata */
+    providerMetadata: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+});
+//# sourceMappingURL=consent.types.js.map

package/src/auth/consent/consent.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.types.js","sourceRoot":"","sources":["../../../../src/auth/consent/consent.types.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAAwB;AACxB,yCAAmD;AAG1C,oGAHA,4BAAmB,OAGA;AAE5B,+CAA+C;AAC/C,gCAAgC;AAChC,+CAA+C;AAE/C;;GAEG;AACU,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,2CAA2C;IAC3C,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,4BAA4B;IAC5B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,uBAAuB;IACvB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,kCAAkC;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,2BAA2B;IAC3B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,8CAA8C;IAC9C,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,iDAAiD;IACjD,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,6DAA6D;IAC7D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,wBAAwB;IACxB,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAClC,sCAAsC;IACtC,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE;IACxB,uCAAuC;IACvC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,sCAAsC;IACtC,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,kCAAkC;IAClC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,6BAAqB,CAAC;IAC9C,6DAA6D;IAC7D,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,gDAAgD;IAChD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,6BAA6B;IAC7B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AACH,+CAA+C;AAC/C,0BAA0B;AAC1B,+CAA+C;AAE/C;;GAEG;AACU,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,wCAAwC;IACxC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,4BAA4B;IAC5B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,2BAA2B;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,iCAAiC;IACjC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,oBAAoB;IACpB,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChD,gDAAgD;IAChD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxC,+BAA+B;IAC/B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,uCAAuC;IACvC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,kDAAkD;IAClD,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;IACtB,yDAAyD;IACzD,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACvC,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,8BAA8B;IAC9B,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,mCAA2B,CAAC;IAC/C,mCAAmC;IACnC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,+CAA+C;IAC/C,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,wDAAwD;IACxD,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,4BAA4B;IAC5B,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IACtC,2BAA2B;IAC3B,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IACrC,iCAAiC;IACjC,gBAAgB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC","sourcesContent":["/**\n * Consent Flow Types and Schemas\n *\n * Defines types for the tool consent flow that allows users to select\n * which MCP tools they want to expose to the LLM.\n */\nimport { z } from 'zod';\nimport { consentConfigSchema } from '../../common';\n\n// Re-export schema for tests\nexport { consentConfigSchema };\n\n// ============================================\n// Consent Configuration Schemas\n// ============================================\n\n/**\n * Tool consent item schema - represents a tool available for consent\n */\nexport const consentToolItemSchema = z.object({\n  /** Tool ID (e.g., 'slack:send_message') */\n  id: z.string().min(1),\n  /** Tool name for display */\n  name: z.string().min(1),\n  /** Tool description */\n  description: z.string().optional(),\n  /** App ID this tool belongs to */\n  appId: z.string().min(1),\n  /** App name for display */\n  appName: z.string().min(1),\n  /** Whether the tool is selected by default */\n  defaultSelected: z.boolean().default(true),\n  /** Whether this tool requires specific scopes */\n  requiredScopes: z.array(z.string()).optional(),\n  /** Category for grouping (e.g., 'read', 'write', 'admin') */\n  category: z.string().optional(),\n});\n\n/**\n * Consent selection schema - user's tool selection\n */\nexport const consentSelectionSchema = z.object({\n  /** Selected tool IDs */\n  selectedTools: z.array(z.string()),\n  /** Whether all tools were selected */\n  allSelected: z.boolean(),\n  /** Timestamp when consent was given */\n  consentedAt: z.string().datetime(),\n  /** Consent version for tracking changes */\n  consentVersion: z.string().default('1.0'),\n});\n\n/**\n * Consent page state schema - stored in pending authorization\n */\nexport const consentStateSchema = z.object({\n  /** Whether consent flow is enabled */\n  enabled: z.boolean(),\n  /** Available tools for consent */\n  availableTools: z.array(consentToolItemSchema),\n  /** Pre-selected tools (from previous consent or defaults) */\n  preselectedTools: z.array(z.string()).optional(),\n  /** Whether to show all tools or group by app */\n  groupByApp: z.boolean().default(true),\n  /** Custom consent message */\n  customMessage: z.string().optional(),\n});\n// ============================================\n// Federated Login Schemas\n// ============================================\n\n/**\n * Auth provider item for federated login UI\n */\nexport const federatedProviderItemSchema = z.object({\n  /** Provider ID (derived or explicit) */\n  id: z.string().min(1),\n  /** Provider display name */\n  name: z.string().min(1),\n  /** Provider description */\n  description: z.string().optional(),\n  /** Provider icon URL or emoji */\n  icon: z.string().optional(),\n  /** Provider type */\n  type: z.enum(['local', 'remote', 'transparent']),\n  /** OAuth provider URL (for remote providers) */\n  providerUrl: z.string().url().optional(),\n  /** Apps using this provider */\n  appIds: z.array(z.string()),\n  /** App names using this provider */\n  appNames: z.array(z.string()),\n  /** Scopes required by this provider */\n  scopes: z.array(z.string()),\n  /** Whether this is the primary/parent provider */\n  isPrimary: z.boolean(),\n  /** Whether this provider is optional (can be skipped) */\n  isOptional: z.boolean().default(false),\n});\n\n/**\n * Federated login state schema\n */\nexport const federatedLoginStateSchema = z.object({\n  /** All available providers */\n  providers: z.array(federatedProviderItemSchema),\n  /** Primary provider ID (if any) */\n  primaryProviderId: z.string().optional(),\n  /** Whether user can skip optional providers */\n  allowSkip: z.boolean().default(true),\n  /** Pre-selected provider IDs (from previous session) */\n  preselectedProviders: z.array(z.string()).optional(),\n});\n\n/**\n * Federated login selection schema\n */\nexport const federatedSelectionSchema = z.object({\n  /** Selected provider IDs */\n  selectedProviders: z.array(z.string()),\n  /** Skipped provider IDs */\n  skippedProviders: z.array(z.string()),\n  /** Provider-specific metadata */\n  providerMetadata: z.record(z.string(), z.unknown()).optional(),\n});\n\n// ============================================\n// Type Exports\n// ============================================\n\nexport type ConsentToolItem = z.infer<typeof consentToolItemSchema>;\nexport type ConsentSelection = z.infer<typeof consentSelectionSchema>;\nexport type ConsentState = z.infer<typeof consentStateSchema>;\nexport type ConsentConfig = z.infer<typeof consentConfigSchema>;\nexport type ConsentConfigInput = z.input<typeof consentConfigSchema>;\n\nexport type FederatedProviderItem = z.infer<typeof federatedProviderItemSchema>;\nexport type FederatedLoginState = z.infer<typeof federatedLoginStateSchema>;\nexport type FederatedSelection = z.infer<typeof federatedSelectionSchema>;\n"]}

package/src/auth/consent/index.d.ts

@@ -0,0 +1 @@
+export { consentToolItemSchema, consentSelectionSchema, consentStateSchema, federatedProviderItemSchema, federatedLoginStateSchema, federatedSelectionSchema, ConsentToolItem, ConsentSelection, ConsentState, ConsentConfig, ConsentConfigInput, FederatedProviderItem, FederatedLoginState, FederatedSelection, } from './consent.types';

package/src/auth/consent/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.federatedSelectionSchema = exports.federatedLoginStateSchema = exports.federatedProviderItemSchema = exports.consentStateSchema = exports.consentSelectionSchema = exports.consentToolItemSchema = void 0;
+// Consent Module Exports
+var consent_types_1 = require("./consent.types");
+// Schemas
+Object.defineProperty(exports, "consentToolItemSchema", { enumerable: true, get: function () { return consent_types_1.consentToolItemSchema; } });
+Object.defineProperty(exports, "consentSelectionSchema", { enumerable: true, get: function () { return consent_types_1.consentSelectionSchema; } });
+Object.defineProperty(exports, "consentStateSchema", { enumerable: true, get: function () { return consent_types_1.consentStateSchema; } });
+Object.defineProperty(exports, "federatedProviderItemSchema", { enumerable: true, get: function () { return consent_types_1.federatedProviderItemSchema; } });
+Object.defineProperty(exports, "federatedLoginStateSchema", { enumerable: true, get: function () { return consent_types_1.federatedLoginStateSchema; } });
+Object.defineProperty(exports, "federatedSelectionSchema", { enumerable: true, get: function () { return consent_types_1.federatedSelectionSchema; } });
+//# sourceMappingURL=index.js.map

package/src/auth/consent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/auth/consent/index.ts"],"names":[],"mappings":";;;AAAA,yBAAyB;AACzB,iDAiByB;AAhBvB,UAAU;AACV,sHAAA,qBAAqB,OAAA;AACrB,uHAAA,sBAAsB,OAAA;AACtB,mHAAA,kBAAkB,OAAA;AAClB,4HAAA,2BAA2B,OAAA;AAC3B,0HAAA,yBAAyB,OAAA;AACzB,yHAAA,wBAAwB,OAAA","sourcesContent":["// Consent Module Exports\nexport {\n  // Schemas\n  consentToolItemSchema,\n  consentSelectionSchema,\n  consentStateSchema,\n  federatedProviderItemSchema,\n  federatedLoginStateSchema,\n  federatedSelectionSchema,\n  // Types\n  ConsentToolItem,\n  ConsentSelection,\n  ConsentState,\n  ConsentConfig,\n  ConsentConfigInput,\n  FederatedProviderItem,\n  FederatedLoginState,\n  FederatedSelection,\n} from './consent.types';\n"]}

package/src/auth/detection/auth-provider-detection.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Auth Provider Detection
+ *
+ * Detects unique auth providers across nested apps and determines
+ * if orchestrated mode is required at the parent scope level.
+ *
+ * When multiple apps have different auth providers, the parent MUST
+ * use orchestrated mode to properly manage tokens for each provider.
+ */
+import { z } from 'zod';
+import { AuthOptions } from '../../common';
+/**
+ * Schema for a detected auth provider
+ */
+export declare const detectedAuthProviderSchema: z.ZodObject<{
+    id: z.ZodString;
+    providerUrl: z.ZodOptional<z.ZodString>;
+    mode: z.ZodEnum<{
+        public: "public";
+        transparent: "transparent";
+        orchestrated: "orchestrated";
+    }>;
+    appIds: z.ZodArray<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    isParentProvider: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * Schema for auth provider detection result
+ */
+export declare const authProviderDetectionResultSchema: z.ZodObject<{
+    providers: z.ZodMap<z.ZodString, z.ZodObject<{
+        id: z.ZodString;
+        providerUrl: z.ZodOptional<z.ZodString>;
+        mode: z.ZodEnum<{
+            public: "public";
+            transparent: "transparent";
+            orchestrated: "orchestrated";
+        }>;
+        appIds: z.ZodArray<z.ZodString>;
+        scopes: z.ZodArray<z.ZodString>;
+        isParentProvider: z.ZodBoolean;
+    }, z.core.$strip>>;
+    requiresOrchestration: z.ZodBoolean;
+    parentProviderId: z.ZodOptional<z.ZodString>;
+    childProviderIds: z.ZodArray<z.ZodString>;
+    uniqueProviderCount: z.ZodNumber;
+    validationErrors: z.ZodArray<z.ZodString>;
+    warnings: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type DetectedAuthProvider = z.infer<typeof detectedAuthProviderSchema>;
+export type AuthProviderDetectionResult = z.infer<typeof authProviderDetectionResultSchema>;
+/**
+ * App auth info for detection (minimal interface)
+ */
+export interface AppAuthInfo {
+    id: string;
+    name: string;
+    auth?: AuthOptions;
+}
+/**
+ * Derive a stable provider ID from auth options
+ */
+export declare function deriveProviderId(options: AuthOptions): string;
+/**
+ * Detect all unique auth providers across parent and apps
+ *
+ * @param parentAuth - Parent scope's auth options (may be undefined)
+ * @param apps - Array of app auth info
+ * @returns Detection result with providers, validation, and requirements
+ */
+export declare function detectAuthProviders(parentAuth: AuthOptions | undefined, apps: AppAuthInfo[]): AuthProviderDetectionResult;
+/**
+ * Check if a specific app requires orchestration
+ * (i.e., has a different provider than parent)
+ */
+export declare function appRequiresOrchestration(appAuth: AuthOptions | undefined, parentAuth: AuthOptions | undefined): boolean;
+/**
+ * Get all OAuth scopes needed for a provider across all apps
+ */
+export declare function getProviderScopes(detection: AuthProviderDetectionResult, providerId: string): string[];
+/**
+ * Get apps that use a specific provider
+ */
+export declare function getProviderApps(detection: AuthProviderDetectionResult, providerId: string): string[];