@frontmcp/sdk 0.6.1 → 0.6.2

package/src/auth/auth.utils.js

@@ -1,84 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.collectAuthMetadata = collectAuthMetadata;
-exports.normalizeAuth = normalizeAuth;
-exports.authDiscoveryDeps = authDiscoveryDeps;
-// auth/auth.utils.ts
-const utils_1 = require("../utils");
-const common_1 = require("../common");
-function collectAuthMetadata(cls) {
-    return Object.entries(common_1.FrontMcpAuthProviderTokens).reduce((metadata, [key, token]) => {
-        return Object.assign(metadata, {
-            [key]: (0, utils_1.getMetadata)(token, cls),
-        });
-    }, {});
-}
-function normalizeAuth(item) {
-    if ((0, utils_1.isClass)(item)) {
-        // read McpAuthMetadata from class
-        const metadata = collectAuthMetadata(item);
-        return { kind: common_1.AuthProviderKind.CLASS_TOKEN, provide: item, metadata };
-    }
-    if (item && typeof item === 'object') {
-        const { provide, useClass, useValue, useFactory, inject, ...metadata } = item;
-        if (!provide) {
-            const name = item?.name ?? '[object]';
-            throw new Error(`Auth '${name}' is missing 'provide'.`);
-        }
-        if (useClass) {
-            if (!(0, utils_1.isClass)(useClass)) {
-                throw new Error(`'useClass' on auth '${(0, utils_1.tokenName)(provide)}' must be a class.`);
-            }
-            return {
-                kind: common_1.AuthProviderKind.CLASS,
-                provide,
-                useClass,
-                metadata,
-            };
-        }
-        if (useFactory) {
-            if (typeof useFactory !== 'function') {
-                throw new Error(`'useFactory' on auth '${(0, utils_1.tokenName)(provide)}' must be a function.`);
-            }
-            const inj = typeof inject === 'function' ? inject : () => [];
-            return {
-                kind: common_1.AuthProviderKind.FACTORY,
-                provide,
-                inject: inj,
-                useFactory,
-                metadata,
-            };
-        }
-        if ('useValue' in item) {
-            return {
-                kind: common_1.AuthProviderKind.VALUE,
-                provide,
-                useValue,
-                metadata,
-            };
-        }
-    }
-    const name = item?.name ?? String(item);
-    throw new Error(`Invalid auth '${name}'. Expected a class or a auth object.`);
-}
-/**
- * For graph/cycle detection. Returns dependency tokens that should be graphed.
- * - VALUE: no deps
- * - FACTORY: only includes deps that are registered (others will be resolved)
- * - CLASS / CLASS_TOKEN: deps come from the class constructor or static with(...)
- */
-function authDiscoveryDeps(rec) {
-    switch (rec.kind) {
-        case common_1.AuthProviderKind.VALUE:
-        case common_1.AuthProviderKind.PRIMARY:
-            return [];
-        case common_1.AuthProviderKind.FACTORY: {
-            return [...rec.inject()];
-        }
-        case common_1.AuthProviderKind.CLASS:
-            return (0, utils_1.depsOfClass)(rec.useClass, 'discovery');
-        case common_1.AuthProviderKind.CLASS_TOKEN:
-            return (0, utils_1.depsOfClass)(rec.provide, 'discovery');
-    }
-}
-//# sourceMappingURL=auth.utils.js.map

package/src/auth/auth.utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.utils.js","sourceRoot":"","sources":["../../../src/auth/auth.utils.ts"],"names":[],"mappings":";;AAWA,kDAMC;AAED,sCAoDC;AAQD,8CAeC;AA9FD,qBAAqB;AACrB,oCAAwE;AACxE,sCAOmB;AAEnB,SAAgB,mBAAmB,CAAC,GAAqB;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,mCAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAClF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC7B,CAAC,GAAG,CAAC,EAAE,IAAA,mBAAW,EAAC,KAAK,EAAE,GAAG,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC,EAAE,EAA0B,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,aAAa,CAAC,IAAsB;IAClD,IAAI,IAAA,eAAO,EAAC,IAAI,CAAC,EAAE,CAAC;QAClB,kCAAkC;QAClC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,yBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAW,CAAC;QAErF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,IAAY,EAAE,IAAI,IAAI,UAAU,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAA,eAAO,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAA,iBAAS,EAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjF,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,yBAAgB,CAAC,KAAK;gBAC5B,OAAO;gBACP,QAAQ;gBACR,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAA,iBAAS,EAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAW,CAAC;YACtE,OAAO;gBACL,IAAI,EAAE,yBAAgB,CAAC,OAAO;gBAC9B,OAAO;gBACP,MAAM,EAAE,GAAG;gBACX,UAAU;gBACV,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,yBAAgB,CAAC,KAAK;gBAC5B,OAAO;gBACP,QAAQ;gBACR,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAI,IAAY,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,uCAAuC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAuB;IACvD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,yBAAgB,CAAC,KAAK,CAAC;QAC5B,KAAK,yBAAgB,CAAC,OAAO;YAC3B,OAAO,EAAE,CAAC;QAEZ,KAAK,yBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,yBAAgB,CAAC,KAAK;YACzB,OAAO,IAAA,mBAAW,EAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEhD,KAAK,yBAAgB,CAAC,WAAW;YAC/B,OAAO,IAAA,mBAAW,EAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;AACH,CAAC","sourcesContent":["// auth/auth.utils.ts\nimport { depsOfClass, isClass, tokenName, getMetadata } from '../utils';\nimport {\n  AuthProviderMetadata,\n  FrontMcpAuthProviderTokens,\n  AuthProviderType,\n  Token,\n  AuthProviderRecord,\n  AuthProviderKind,\n} from '../common';\n\nexport function collectAuthMetadata(cls: AuthProviderType): AuthProviderMetadata {\n  return Object.entries(FrontMcpAuthProviderTokens).reduce((metadata, [key, token]) => {\n    return Object.assign(metadata, {\n      [key]: getMetadata(token, cls),\n    });\n  }, {} as AuthProviderMetadata);\n}\n\nexport function normalizeAuth(item: AuthProviderType): AuthProviderRecord {\n  if (isClass(item)) {\n    // read McpAuthMetadata from class\n    const metadata = collectAuthMetadata(item);\n    return { kind: AuthProviderKind.CLASS_TOKEN, provide: item, metadata };\n  }\n  if (item && typeof item === 'object') {\n    const { provide, useClass, useValue, useFactory, inject, ...metadata } = item as any;\n\n    if (!provide) {\n      const name = (item as any)?.name ?? '[object]';\n      throw new Error(`Auth '${name}' is missing 'provide'.`);\n    }\n\n    if (useClass) {\n      if (!isClass(useClass)) {\n        throw new Error(`'useClass' on auth '${tokenName(provide)}' must be a class.`);\n      }\n      return {\n        kind: AuthProviderKind.CLASS,\n        provide,\n        useClass,\n        metadata,\n      };\n    }\n\n    if (useFactory) {\n      if (typeof useFactory !== 'function') {\n        throw new Error(`'useFactory' on auth '${tokenName(provide)}' must be a function.`);\n      }\n      const inj = typeof inject === 'function' ? inject : () => [] as const;\n      return {\n        kind: AuthProviderKind.FACTORY,\n        provide,\n        inject: inj,\n        useFactory,\n        metadata,\n      };\n    }\n\n    if ('useValue' in item) {\n      return {\n        kind: AuthProviderKind.VALUE,\n        provide,\n        useValue,\n        metadata,\n      };\n    }\n  }\n\n  const name = (item as any)?.name ?? String(item);\n  throw new Error(`Invalid auth '${name}'. Expected a class or a auth object.`);\n}\n\n/**\n * For graph/cycle detection. Returns dependency tokens that should be graphed.\n * - VALUE: no deps\n * - FACTORY: only includes deps that are registered (others will be resolved)\n * - CLASS / CLASS_TOKEN: deps come from the class constructor or static with(...)\n */\nexport function authDiscoveryDeps(rec: AuthProviderRecord): Token[] {\n  switch (rec.kind) {\n    case AuthProviderKind.VALUE:\n    case AuthProviderKind.PRIMARY:\n      return [];\n\n    case AuthProviderKind.FACTORY: {\n      return [...rec.inject()];\n    }\n    case AuthProviderKind.CLASS:\n      return depsOfClass(rec.useClass, 'discovery');\n\n    case AuthProviderKind.CLASS_TOKEN:\n      return depsOfClass(rec.provide, 'discovery');\n  }\n}\n"]}

package/src/auth/authorization/authorization.class.js

@@ -1,217 +0,0 @@
-"use strict";
-// auth/authorization/authorization.class.ts
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationBase = exports.getMachineId = void 0;
-const crypto_1 = require("crypto");
-const session_id_utils_1 = require("../session/utils/session-id.utils");
-const machine_id_1 = require("../machine-id");
-// Re-export getMachineId for backwards compatibility
-var machine_id_2 = require("../machine-id");
-Object.defineProperty(exports, "getMachineId", { enumerable: true, get: function () { return machine_id_2.getMachineId; } });
-/**
- * Base Authorization class - represents authenticated user context
- * Subclasses implement mode-specific behavior (Public, Transparent, Orchestrated)
- */
-class AuthorizationBase {
-    id;
-    isAnonymous;
-    user;
-    claims;
-    expiresAt;
-    scopes;
-    authorizedProviders;
-    authorizedProviderIds;
-    authorizedApps;
-    authorizedAppIds;
-    authorizedTools;
-    authorizedToolIds;
-    authorizedPrompts;
-    authorizedPromptIds;
-    authorizedResources;
-    /** The original bearer token (for transparent mode) */
-    token;
-    /** Active transport sessions for this authorization */
-    #sessions = new Map();
-    /** Creation timestamp */
-    createdAt;
-    constructor(ctx) {
-        this.id = ctx.id;
-        this.isAnonymous = ctx.isAnonymous;
-        this.user = ctx.user;
-        this.claims = ctx.claims;
-        this.expiresAt = ctx.expiresAt;
-        this.scopes = ctx.scopes ?? [];
-        this.token = ctx.token;
-        this.createdAt = Date.now();
-        // Initialize authorization projections
-        this.authorizedProviders = ctx.authorizedProviders ?? {};
-        this.authorizedProviderIds = ctx.authorizedProviderIds ?? Object.keys(this.authorizedProviders);
-        this.authorizedApps = ctx.authorizedApps ?? {};
-        this.authorizedAppIds = ctx.authorizedAppIds ?? Object.keys(this.authorizedApps);
-        this.authorizedTools = ctx.authorizedTools ?? {};
-        this.authorizedToolIds = ctx.authorizedToolIds ?? Object.keys(this.authorizedTools);
-        this.authorizedPrompts = ctx.authorizedPrompts ?? {};
-        this.authorizedPromptIds = ctx.authorizedPromptIds ?? Object.keys(this.authorizedPrompts);
-        this.authorizedResources = ctx.authorizedResources ?? [];
-    }
-    /**
-     * Create a new transport session for this authorization
-     * @param protocol - Transport protocol (sse, streamable-http, etc.)
-     * @param fingerprint - Optional client fingerprint for tracking
-     */
-    createTransportSession(protocol, fingerprint) {
-        const sessionId = (0, crypto_1.randomUUID)();
-        const session = {
-            id: sessionId,
-            authorizationId: this.id,
-            protocol,
-            createdAt: Date.now(),
-            expiresAt: this.expiresAt,
-            nodeId: (0, machine_id_1.getMachineId)(),
-            clientFingerprint: fingerprint,
-        };
-        this.#sessions.set(session.id, session);
-        return session;
-    }
-    /**
-     * Get existing transport session by ID
-     */
-    getTransportSession(sessionId) {
-        return this.#sessions.get(sessionId);
-    }
-    /**
-     * Get all active transport sessions
-     */
-    getAllSessions() {
-        return Array.from(this.#sessions.values());
-    }
-    /**
-     * Remove a transport session
-     */
-    removeTransportSession(sessionId) {
-        return this.#sessions.delete(sessionId);
-    }
-    /**
-     * Get count of active sessions
-     */
-    get sessionCount() {
-        return this.#sessions.size;
-    }
-    /**
-     * Check if a scope is granted
-     */
-    hasScope(scope) {
-        return this.scopes.includes(scope);
-    }
-    /**
-     * Check if all scopes are granted
-     */
-    hasAllScopes(scopes) {
-        return scopes.every((s) => this.scopes.includes(s));
-    }
-    /**
-     * Check if any scope is granted
-     */
-    hasAnyScope(scopes) {
-        return scopes.some((s) => this.scopes.includes(s));
-    }
-    /**
-     * Check if a tool is authorized
-     */
-    canAccessTool(toolId) {
-        return toolId in this.authorizedTools || this.authorizedToolIds.includes(toolId);
-    }
-    /**
-     * Check if a prompt is authorized
-     */
-    canAccessPrompt(promptId) {
-        return promptId in this.authorizedPrompts || this.authorizedPromptIds.includes(promptId);
-    }
-    /**
-     * Check if an app is authorized.
-     * Used for progressive authorization to determine if tools from this app can be executed.
-     * @param appId - App ID to check
-     */
-    isAppAuthorized(appId) {
-        return appId in this.authorizedApps || this.authorizedAppIds.includes(appId);
-    }
-    /**
-     * Build URL for progressive/incremental authorization.
-     * Used when a tool requires authorization for an app that was skipped during initial auth.
-     * @param appId - App ID that requires authorization
-     * @param baseUrl - Base URL of the server
-     */
-    getProgressiveAuthUrl(appId, baseUrl) {
-        return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&mode=incremental`;
-    }
-    /**
-     * Check if the authorization is expired
-     */
-    isExpired() {
-        if (!this.expiresAt)
-            return false;
-        return Date.now() > this.expiresAt;
-    }
-    /**
-     * Get time until expiration in milliseconds
-     * Returns undefined if no expiration, negative if expired
-     */
-    getTimeToExpiry() {
-        if (!this.expiresAt)
-            return undefined;
-        return this.expiresAt - Date.now();
-    }
-    /**
-     * Convert a transport session to encrypted session JWT
-     * This is what gets sent in the Mcp-Session-Id header
-     */
-    toSessionJwt(session) {
-        const payload = {
-            sid: session.id,
-            aid: this.id,
-            proto: session.protocol,
-            nid: session.nodeId,
-            iat: Math.floor(Date.now() / 1000),
-            exp: this.expiresAt ? Math.floor(this.expiresAt / 1000) : undefined,
-        };
-        return (0, session_id_utils_1.encryptJson)(payload);
-    }
-    /**
-     * Convert to LLM-safe context (no tokens exposed)
-     */
-    toLLMSafeContext(session) {
-        return {
-            authorizationId: this.id,
-            sessionId: session.id,
-            mode: this.mode,
-            isAnonymous: this.isAnonymous,
-            user: {
-                sub: this.user.sub,
-                name: this.user.name,
-            },
-            scopes: this.scopes,
-            authorizedToolIds: this.authorizedToolIds,
-            authorizedPromptIds: this.authorizedPromptIds,
-        };
-    }
-    /**
-     * Validate that no tokens are leaked in data
-     * Throws if JWT pattern detected
-     */
-    static validateNoTokenLeakage(data) {
-        const json = JSON.stringify(data);
-        // Detect JWT pattern (header.payload.signature)
-        if (/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/.test(json)) {
-            throw new Error('SECURITY: Token detected in data - potential LLM context leak');
-        }
-        // Detect sensitive field names
-        const sensitiveFields = ['access_token', 'refresh_token', 'id_token', 'tokenEnc', 'secretRefId'];
-        for (const field of sensitiveFields) {
-            if (json.includes(`"${field}"`)) {
-                throw new Error(`SECURITY: Sensitive field "${field}" detected - potential leak`);
-            }
-        }
-    }
-}
-exports.AuthorizationBase = AuthorizationBase;
-//# sourceMappingURL=authorization.class.js.map

package/src/auth/authorization/authorization.class.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.class.js","sourceRoot":"","sources":["../../../../src/auth/authorization/authorization.class.ts"],"names":[],"mappings":";AAAA,4CAA4C;;;AAE5C,mCAAoC;AAWpC,wEAAgE;AAEhE,8CAA6C;AAE7C,qDAAqD;AACrD,4CAA6C;AAApC,0GAAA,YAAY,OAAA;AAErB;;;GAGG;AACH,MAAsB,iBAAiB;IAC5B,EAAE,CAAS;IAEX,WAAW,CAAU;IACrB,IAAI,CAAW;IACf,MAAM,CAA2B;IACjC,SAAS,CAAU;IACnB,MAAM,CAAW;IACjB,mBAAmB,CAAmC;IACtD,qBAAqB,CAAW;IAChC,cAAc,CAAoD;IAClE,gBAAgB,CAAW;IAC3B,eAAe,CAAiC;IAChD,iBAAiB,CAAW;IAC5B,iBAAiB,CAAmC;IACpD,mBAAmB,CAAW;IAC9B,mBAAmB,CAAW;IAEvC,uDAAuD;IACpC,KAAK,CAAU;IAElC,uDAAuD;IAC9C,SAAS,GAAkC,IAAI,GAAG,EAAE,CAAC;IAE9D,yBAAyB;IAChB,SAAS,CAAS;IAE3B,YAAsB,GAA2B;QAC/C,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5B,uCAAuC;QACvC,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,qBAAqB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChG,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpF,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1F,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,sBAAsB,CAAC,QAA2B,EAAE,WAAoB;QACtE,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC;QAE/B,MAAM,OAAO,GAAqB;YAChC,EAAE,EAAE,SAAS;YACb,eAAe,EAAE,IAAI,CAAC,EAAE;YACxB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAA,yBAAY,GAAE;YACtB,iBAAiB,EAAE,WAAW;SAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAWD;;OAEG;IACH,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgB;QAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAgB;QAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc;QAC1B,OAAO,MAAM,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,QAAgB;QAC9B,OAAO,QAAQ,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,KAAK,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,KAAa,EAAE,OAAe;QAClD,OAAO,GAAG,OAAO,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACxF,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,OAAyB;QACpC,MAAM,OAAO,GAAsB;YACjC,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,OAAO,CAAC,QAAQ;YACvB,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC;QACF,OAAO,IAAA,8BAAW,EAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAyB;QACxC,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,EAAE;YACxB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;aACrB;YACD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,sBAAsB,CAAC,IAAa;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,gDAAgD;QAChD,IAAI,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,+BAA+B;QAC/B,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QACjG,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,6BAA6B,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAxOD,8CAwOC","sourcesContent":["// auth/authorization/authorization.class.ts\n\nimport { randomUUID } from 'crypto';\nimport {\n  Authorization,\n  AuthorizationCreateCtx,\n  AuthorizedPrompt,\n  AuthorizedTool,\n  AuthUser,\n  LLMSafeAuthContext,\n} from './authorization.types';\nimport { TransportSession, TransportProtocol, SessionJwtPayload } from '../session';\nimport { ProviderSnapshot } from '../session/session.types';\nimport { encryptJson } from '../session/utils/session-id.utils';\nimport { AuthMode } from '../../common';\nimport { getMachineId } from '../machine-id';\n\n// Re-export getMachineId for backwards compatibility\nexport { getMachineId } from '../machine-id';\n\n/**\n * Base Authorization class - represents authenticated user context\n * Subclasses implement mode-specific behavior (Public, Transparent, Orchestrated)\n */\nexport abstract class AuthorizationBase implements Authorization {\n  readonly id: string;\n  abstract readonly mode: AuthMode;\n  readonly isAnonymous: boolean;\n  readonly user: AuthUser;\n  readonly claims?: Record<string, unknown>;\n  readonly expiresAt?: number;\n  readonly scopes: string[];\n  readonly authorizedProviders: Record<string, ProviderSnapshot>;\n  readonly authorizedProviderIds: string[];\n  readonly authorizedApps: Record<string, { id: string; toolIds: string[] }>;\n  readonly authorizedAppIds: string[];\n  readonly authorizedTools: Record<string, AuthorizedTool>;\n  readonly authorizedToolIds: string[];\n  readonly authorizedPrompts: Record<string, AuthorizedPrompt>;\n  readonly authorizedPromptIds: string[];\n  readonly authorizedResources: string[];\n\n  /** The original bearer token (for transparent mode) */\n  protected readonly token?: string;\n\n  /** Active transport sessions for this authorization */\n  readonly #sessions: Map<string, TransportSession> = new Map();\n\n  /** Creation timestamp */\n  readonly createdAt: number;\n\n  protected constructor(ctx: AuthorizationCreateCtx) {\n    this.id = ctx.id;\n    this.isAnonymous = ctx.isAnonymous;\n    this.user = ctx.user;\n    this.claims = ctx.claims;\n    this.expiresAt = ctx.expiresAt;\n    this.scopes = ctx.scopes ?? [];\n    this.token = ctx.token;\n    this.createdAt = Date.now();\n\n    // Initialize authorization projections\n    this.authorizedProviders = ctx.authorizedProviders ?? {};\n    this.authorizedProviderIds = ctx.authorizedProviderIds ?? Object.keys(this.authorizedProviders);\n    this.authorizedApps = ctx.authorizedApps ?? {};\n    this.authorizedAppIds = ctx.authorizedAppIds ?? Object.keys(this.authorizedApps);\n    this.authorizedTools = ctx.authorizedTools ?? {};\n    this.authorizedToolIds = ctx.authorizedToolIds ?? Object.keys(this.authorizedTools);\n    this.authorizedPrompts = ctx.authorizedPrompts ?? {};\n    this.authorizedPromptIds = ctx.authorizedPromptIds ?? Object.keys(this.authorizedPrompts);\n    this.authorizedResources = ctx.authorizedResources ?? [];\n  }\n\n  /**\n   * Create a new transport session for this authorization\n   * @param protocol - Transport protocol (sse, streamable-http, etc.)\n   * @param fingerprint - Optional client fingerprint for tracking\n   */\n  createTransportSession(protocol: TransportProtocol, fingerprint?: string): TransportSession {\n    const sessionId = randomUUID();\n\n    const session: TransportSession = {\n      id: sessionId,\n      authorizationId: this.id,\n      protocol,\n      createdAt: Date.now(),\n      expiresAt: this.expiresAt,\n      nodeId: getMachineId(),\n      clientFingerprint: fingerprint,\n    };\n\n    this.#sessions.set(session.id, session);\n    return session;\n  }\n\n  /**\n   * Get existing transport session by ID\n   */\n  getTransportSession(sessionId: string): TransportSession | undefined {\n    return this.#sessions.get(sessionId);\n  }\n\n  /**\n   * Get all active transport sessions\n   */\n  getAllSessions(): TransportSession[] {\n    return Array.from(this.#sessions.values());\n  }\n\n  /**\n   * Remove a transport session\n   */\n  removeTransportSession(sessionId: string): boolean {\n    return this.#sessions.delete(sessionId);\n  }\n\n  /**\n   * Get count of active sessions\n   */\n  get sessionCount(): number {\n    return this.#sessions.size;\n  }\n\n  /**\n   * Abstract: Get access token for a provider\n   * Implementation varies by mode:\n   * - Public: throws (no tokens)\n   * - Transparent: returns the original bearer token\n   * - Orchestrated: retrieves from vault/store\n   */\n  abstract getToken(providerId?: string): Promise<string>;\n\n  /**\n   * Check if a scope is granted\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope);\n  }\n\n  /**\n   * Check if all scopes are granted\n   */\n  hasAllScopes(scopes: string[]): boolean {\n    return scopes.every((s) => this.scopes.includes(s));\n  }\n\n  /**\n   * Check if any scope is granted\n   */\n  hasAnyScope(scopes: string[]): boolean {\n    return scopes.some((s) => this.scopes.includes(s));\n  }\n\n  /**\n   * Check if a tool is authorized\n   */\n  canAccessTool(toolId: string): boolean {\n    return toolId in this.authorizedTools || this.authorizedToolIds.includes(toolId);\n  }\n\n  /**\n   * Check if a prompt is authorized\n   */\n  canAccessPrompt(promptId: string): boolean {\n    return promptId in this.authorizedPrompts || this.authorizedPromptIds.includes(promptId);\n  }\n\n  /**\n   * Check if an app is authorized.\n   * Used for progressive authorization to determine if tools from this app can be executed.\n   * @param appId - App ID to check\n   */\n  isAppAuthorized(appId: string): boolean {\n    return appId in this.authorizedApps || this.authorizedAppIds.includes(appId);\n  }\n\n  /**\n   * Build URL for progressive/incremental authorization.\n   * Used when a tool requires authorization for an app that was skipped during initial auth.\n   * @param appId - App ID that requires authorization\n   * @param baseUrl - Base URL of the server\n   */\n  getProgressiveAuthUrl(appId: string, baseUrl: string): string {\n    return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&mode=incremental`;\n  }\n\n  /**\n   * Check if the authorization is expired\n   */\n  isExpired(): boolean {\n    if (!this.expiresAt) return false;\n    return Date.now() > this.expiresAt;\n  }\n\n  /**\n   * Get time until expiration in milliseconds\n   * Returns undefined if no expiration, negative if expired\n   */\n  getTimeToExpiry(): number | undefined {\n    if (!this.expiresAt) return undefined;\n    return this.expiresAt - Date.now();\n  }\n\n  /**\n   * Convert a transport session to encrypted session JWT\n   * This is what gets sent in the Mcp-Session-Id header\n   */\n  toSessionJwt(session: TransportSession): string {\n    const payload: SessionJwtPayload = {\n      sid: session.id,\n      aid: this.id,\n      proto: session.protocol,\n      nid: session.nodeId,\n      iat: Math.floor(Date.now() / 1000),\n      exp: this.expiresAt ? Math.floor(this.expiresAt / 1000) : undefined,\n    };\n    return encryptJson(payload);\n  }\n\n  /**\n   * Convert to LLM-safe context (no tokens exposed)\n   */\n  toLLMSafeContext(session: TransportSession): LLMSafeAuthContext {\n    return {\n      authorizationId: this.id,\n      sessionId: session.id,\n      mode: this.mode,\n      isAnonymous: this.isAnonymous,\n      user: {\n        sub: this.user.sub,\n        name: this.user.name,\n      },\n      scopes: this.scopes,\n      authorizedToolIds: this.authorizedToolIds,\n      authorizedPromptIds: this.authorizedPromptIds,\n    };\n  }\n\n  /**\n   * Validate that no tokens are leaked in data\n   * Throws if JWT pattern detected\n   */\n  static validateNoTokenLeakage(data: unknown): void {\n    const json = JSON.stringify(data);\n    // Detect JWT pattern (header.payload.signature)\n    if (/eyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/.test(json)) {\n      throw new Error('SECURITY: Token detected in data - potential LLM context leak');\n    }\n    // Detect sensitive field names\n    const sensitiveFields = ['access_token', 'refresh_token', 'id_token', 'tokenEnc', 'secretRefId'];\n    for (const field of sensitiveFields) {\n      if (json.includes(`\"${field}\"`)) {\n        throw new Error(`SECURITY: Sensitive field \"${field}\" detected - potential leak`);\n      }\n    }\n  }\n}\n"]}

package/src/auth/authorization/authorization.types.js

@@ -1,79 +0,0 @@
-"use strict";
-// auth/authorization/authorization.types.ts
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.progressiveAuthStateSchema = exports.appAuthorizationRecordSchema = exports.appAuthStateSchema = exports.AppAuthState = exports.llmSafeAuthContextSchema = exports.authModeSchema = exports.authorizedPromptSchema = exports.authorizedToolSchema = exports.authUserSchema = void 0;
-const zod_1 = require("zod");
-// ============================================
-// Zod Schemas
-// ============================================
-exports.authUserSchema = zod_1.z.object({
-    sub: zod_1.z.string(),
-    name: zod_1.z.string().optional(),
-    email: zod_1.z.string().email().optional(),
-    picture: zod_1.z.string().url().optional(),
-    anonymous: zod_1.z.boolean().optional(),
-});
-exports.authorizedToolSchema = zod_1.z.object({
-    executionPath: zod_1.z.tuple([zod_1.z.string(), zod_1.z.string()]),
-    scopes: zod_1.z.array(zod_1.z.string()).optional(),
-    details: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
-});
-exports.authorizedPromptSchema = zod_1.z.object({
-    executionPath: zod_1.z.tuple([zod_1.z.string(), zod_1.z.string()]),
-    scopes: zod_1.z.array(zod_1.z.string()).optional(),
-    details: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
-});
-exports.authModeSchema = zod_1.z.enum(['public', 'transparent', 'orchestrated']);
-exports.llmSafeAuthContextSchema = zod_1.z.object({
-    authorizationId: zod_1.z.string(),
-    sessionId: zod_1.z.string(),
-    mode: exports.authModeSchema,
-    isAnonymous: zod_1.z.boolean(),
-    user: zod_1.z.object({
-        sub: zod_1.z.string(),
-        name: zod_1.z.string().optional(),
-    }),
-    scopes: zod_1.z.array(zod_1.z.string()),
-    authorizedToolIds: zod_1.z.array(zod_1.z.string()),
-    authorizedPromptIds: zod_1.z.array(zod_1.z.string()),
-});
-// ============================================
-// Progressive/Incremental Authorization Types
-// ============================================
-/**
- * State of app authorization within a session.
- * Used for progressive authorization flow.
- */
-var AppAuthState;
-(function (AppAuthState) {
-    /** App has been fully authorized with tokens stored */
-    AppAuthState["AUTHORIZED"] = "authorized";
-    /** User explicitly skipped this app during initial auth */
-    AppAuthState["SKIPPED"] = "skipped";
-    /** App authorization is pending (not yet presented to user) */
-    AppAuthState["PENDING"] = "pending";
-})(AppAuthState || (exports.AppAuthState = AppAuthState = {}));
-/**
- * Zod schema for AppAuthState enum
- */
-exports.appAuthStateSchema = zod_1.z.nativeEnum(AppAuthState);
-/**
- * Zod schema for AppAuthorizationRecord
- */
-exports.appAuthorizationRecordSchema = zod_1.z.object({
-    appId: zod_1.z.string(),
-    state: exports.appAuthStateSchema,
-    stateChangedAt: zod_1.z.number(),
-    grantedScopes: zod_1.z.array(zod_1.z.string()).optional(),
-    authProviderId: zod_1.z.string().optional(),
-    toolIds: zod_1.z.array(zod_1.z.string()),
-});
-/**
- * Zod schema for ProgressiveAuthState
- */
-exports.progressiveAuthStateSchema = zod_1.z.object({
-    apps: zod_1.z.record(zod_1.z.string(), exports.appAuthorizationRecordSchema),
-    initiallyAuthorized: zod_1.z.array(zod_1.z.string()),
-    initiallySkipped: zod_1.z.array(zod_1.z.string()),
-});
-//# sourceMappingURL=authorization.types.js.map

package/src/auth/authorization/authorization.types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.types.js","sourceRoot":"","sources":["../../../../src/auth/authorization/authorization.types.ts"],"names":[],"mappings":";AAAA,4CAA4C;;;AAE5C,6BAAwB;AAiNxB,+CAA+C;AAC/C,cAAc;AACd,+CAA+C;AAElC,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;IACf,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEU,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAEnE,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,sBAAc;IACpB,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE;IACxB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC;QACb,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;QACf,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IACtC,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,+CAA+C;AAC/C,8CAA8C;AAC9C,+CAA+C;AAE/C;;;GAGG;AACH,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,uDAAuD;IACvD,yCAAyB,CAAA;IACzB,2DAA2D;IAC3D,mCAAmB,CAAA;IACnB,+DAA+D;IAC/D,mCAAmB,CAAA;AACrB,CAAC,EAPW,YAAY,4BAAZ,YAAY,QAOvB;AAmCD;;GAEG;AACU,QAAA,kBAAkB,GAAG,OAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAE7D;;GAEG;AACU,QAAA,4BAA4B,GAAG,OAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,0BAAkB;IACzB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,oCAA4B,CAAC;IACxD,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IACxC,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC","sourcesContent":["// auth/authorization/authorization.types.ts\n\nimport { z } from 'zod';\nimport { ProviderSnapshot } from '../session/session.types';\nimport { TransportSession, TransportProtocol } from '../session';\nimport type { AuthMode } from '../../common';\n\n/**\n * User identity from authentication\n */\nexport interface AuthUser {\n  /** Subject identifier */\n  sub: string;\n  /** Display name */\n  name?: string;\n  /** Email address */\n  email?: string;\n  /** Profile picture URL */\n  picture?: string;\n  /** Whether this is an anonymous user */\n  anonymous?: boolean;\n}\n\n/**\n * Authorized tool entry\n */\nexport interface AuthorizedTool {\n  /** Execution path: [appId, toolId] */\n  executionPath: [appId: string, toolId: string];\n  /** Required scopes for this tool */\n  scopes?: string[];\n  /** Additional tool metadata */\n  details?: Record<string, unknown>;\n}\n\n/**\n * Authorized prompt entry\n */\nexport interface AuthorizedPrompt {\n  /** Execution path: [appId, promptId] */\n  executionPath: [appId: string, promptId: string];\n  /** Required scopes for this prompt */\n  scopes?: string[];\n  /** Additional prompt metadata */\n  details?: Record<string, unknown>;\n}\n\n/**\n * Authorization represents the authenticated user context.\n * Created from JWT verification, independent of transport.\n * One authorization can have multiple transport sessions.\n */\nexport interface Authorization {\n  /** Unique authorization ID (derived from token signature) */\n  readonly id: string;\n\n  /** Auth mode that created this authorization */\n  readonly mode: AuthMode;\n\n  /** Whether this is an anonymous/public authorization */\n  readonly isAnonymous: boolean;\n\n  /** User identity */\n  readonly user: AuthUser;\n\n  /** JWT claims */\n  readonly claims?: Record<string, unknown>;\n\n  /** Token expiration (epoch ms) */\n  readonly expiresAt?: number;\n\n  /** Granted scopes */\n  readonly scopes: string[];\n\n  /** Authorized providers (for orchestrated mode) */\n  readonly authorizedProviders: Record<string, ProviderSnapshot>;\n\n  /** Authorized provider IDs */\n  readonly authorizedProviderIds: string[];\n\n  /** Authorized apps */\n  readonly authorizedApps: Record<string, { id: string; toolIds: string[] }>;\n\n  /** Authorized app IDs */\n  readonly authorizedAppIds: string[];\n\n  /** Authorized tools */\n  readonly authorizedTools: Record<string, AuthorizedTool>;\n\n  /** Authorized tool IDs */\n  readonly authorizedToolIds: string[];\n\n  /** Authorized prompts */\n  readonly authorizedPrompts: Record<string, AuthorizedPrompt>;\n\n  /** Authorized prompt IDs */\n  readonly authorizedPromptIds: string[];\n\n  /** Authorized resources */\n  readonly authorizedResources: string[];\n\n  /**\n   * Get access token for a provider (orchestrated mode)\n   * @param providerId - Provider ID, defaults to primary\n   */\n  getToken(providerId?: string): Promise<string>;\n\n  /**\n   * Create a new transport session for this authorization\n   * @param protocol - Transport protocol (sse, streamable-http, etc.)\n   * @param fingerprint - Optional client fingerprint for tracking\n   */\n  createTransportSession(protocol: TransportProtocol, fingerprint?: string): TransportSession;\n\n  /**\n   * Get existing transport session by ID\n   * @param sessionId - Session ID to retrieve\n   */\n  getTransportSession(sessionId: string): TransportSession | undefined;\n\n  /**\n   * Check if a scope is granted\n   * @param scope - Scope to check\n   */\n  hasScope(scope: string): boolean;\n\n  /**\n   * Check if all scopes are granted\n   * @param scopes - Scopes to check\n   */\n  hasAllScopes(scopes: string[]): boolean;\n\n  /**\n   * Check if any scope is granted\n   * @param scopes - Scopes to check\n   */\n  hasAnyScope(scopes: string[]): boolean;\n\n  /**\n   * Check if a tool is authorized\n   * @param toolId - Tool ID to check\n   */\n  canAccessTool(toolId: string): boolean;\n\n  /**\n   * Check if a prompt is authorized\n   * @param promptId - Prompt ID to check\n   */\n  canAccessPrompt(promptId: string): boolean;\n}\n\n/**\n * Context for creating an authorization\n */\nexport interface AuthorizationCreateCtx {\n  /** Unique ID (typically token signature fingerprint) */\n  id: string;\n  /** Whether this is anonymous */\n  isAnonymous: boolean;\n  /** User identity */\n  user: AuthUser;\n  /** JWT claims */\n  claims?: Record<string, unknown>;\n  /** Token expiration (epoch ms) */\n  expiresAt?: number;\n  /** Granted scopes */\n  scopes?: string[];\n  /** The original token (for transparent mode) */\n  token?: string;\n  /** Authorized providers */\n  authorizedProviders?: Record<string, ProviderSnapshot>;\n  /** Authorized provider IDs */\n  authorizedProviderIds?: string[];\n  /** Authorized apps */\n  authorizedApps?: Record<string, { id: string; toolIds: string[] }>;\n  /** Authorized app IDs */\n  authorizedAppIds?: string[];\n  /** Authorized tools */\n  authorizedTools?: Record<string, AuthorizedTool>;\n  /** Authorized tool IDs */\n  authorizedToolIds?: string[];\n  /** Authorized prompts */\n  authorizedPrompts?: Record<string, AuthorizedPrompt>;\n  /** Authorized prompt IDs */\n  authorizedPromptIds?: string[];\n  /** Authorized resources */\n  authorizedResources?: string[];\n}\n\n/**\n * LLM-safe session context (no tokens exposed)\n */\nexport interface LLMSafeAuthContext {\n  /** Authorization ID */\n  authorizationId: string;\n  /** Session ID */\n  sessionId: string;\n  /** Auth mode */\n  mode: AuthMode;\n  /** Whether anonymous */\n  isAnonymous: boolean;\n  /** User (sub and name only) */\n  user: { sub: string; name?: string };\n  /** Granted scopes */\n  scopes: string[];\n  /** Authorized tool IDs */\n  authorizedToolIds: string[];\n  /** Authorized prompt IDs */\n  authorizedPromptIds: string[];\n}\n\n// ============================================\n// Zod Schemas\n// ============================================\n\nexport const authUserSchema = z.object({\n  sub: z.string(),\n  name: z.string().optional(),\n  email: z.string().email().optional(),\n  picture: z.string().url().optional(),\n  anonymous: z.boolean().optional(),\n});\n\nexport const authorizedToolSchema = z.object({\n  executionPath: z.tuple([z.string(), z.string()]),\n  scopes: z.array(z.string()).optional(),\n  details: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const authorizedPromptSchema = z.object({\n  executionPath: z.tuple([z.string(), z.string()]),\n  scopes: z.array(z.string()).optional(),\n  details: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const authModeSchema = z.enum(['public', 'transparent', 'orchestrated']);\n\nexport const llmSafeAuthContextSchema = z.object({\n  authorizationId: z.string(),\n  sessionId: z.string(),\n  mode: authModeSchema,\n  isAnonymous: z.boolean(),\n  user: z.object({\n    sub: z.string(),\n    name: z.string().optional(),\n  }),\n  scopes: z.array(z.string()),\n  authorizedToolIds: z.array(z.string()),\n  authorizedPromptIds: z.array(z.string()),\n});\n\n// ============================================\n// Progressive/Incremental Authorization Types\n// ============================================\n\n/**\n * State of app authorization within a session.\n * Used for progressive authorization flow.\n */\nexport enum AppAuthState {\n  /** App has been fully authorized with tokens stored */\n  AUTHORIZED = 'authorized',\n  /** User explicitly skipped this app during initial auth */\n  SKIPPED = 'skipped',\n  /** App authorization is pending (not yet presented to user) */\n  PENDING = 'pending',\n}\n\n/**\n * App authorization record with state tracking.\n * Stored server-side, NOT in JWT.\n */\nexport interface AppAuthorizationRecord {\n  /** App ID */\n  appId: string;\n  /** Current authorization state */\n  state: AppAuthState;\n  /** When the state was last changed (epoch ms) */\n  stateChangedAt: number;\n  /** Scopes granted for this app */\n  grantedScopes?: string[];\n  /** Auth provider ID used for this app */\n  authProviderId?: string;\n  /** Tool IDs accessible through this app authorization */\n  toolIds: string[];\n}\n\n/**\n * Progressive auth session state.\n * Tracks which apps are authorized, skipped, or pending.\n * Stored server-side for security.\n */\nexport interface ProgressiveAuthState {\n  /** App authorization records by app ID */\n  apps: Record<string, AppAuthorizationRecord>;\n  /** Apps authorized during initial auth */\n  initiallyAuthorized: string[];\n  /** Apps skipped during initial auth */\n  initiallySkipped: string[];\n}\n\n/**\n * Zod schema for AppAuthState enum\n */\nexport const appAuthStateSchema = z.nativeEnum(AppAuthState);\n\n/**\n * Zod schema for AppAuthorizationRecord\n */\nexport const appAuthorizationRecordSchema = z.object({\n  appId: z.string(),\n  state: appAuthStateSchema,\n  stateChangedAt: z.number(),\n  grantedScopes: z.array(z.string()).optional(),\n  authProviderId: z.string().optional(),\n  toolIds: z.array(z.string()),\n});\n\n/**\n * Zod schema for ProgressiveAuthState\n */\nexport const progressiveAuthStateSchema = z.object({\n  apps: z.record(z.string(), appAuthorizationRecordSchema),\n  initiallyAuthorized: z.array(z.string()),\n  initiallySkipped: z.array(z.string()),\n});\n"]}

package/src/auth/authorization/index.js

@@ -1,19 +0,0 @@
-"use strict";
-// auth/authorization/index.ts
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrchestratedAuthorization = exports.TransparentAuthorization = exports.PublicAuthorization = exports.getMachineId = exports.AuthorizationBase = void 0;
-const tslib_1 = require("tslib");
-// Types
-tslib_1.__exportStar(require("./authorization.types"), exports);
-// Base class
-var authorization_class_1 = require("./authorization.class");
-Object.defineProperty(exports, "AuthorizationBase", { enumerable: true, get: function () { return authorization_class_1.AuthorizationBase; } });
-Object.defineProperty(exports, "getMachineId", { enumerable: true, get: function () { return authorization_class_1.getMachineId; } });
-// Mode-specific implementations
-var public_authorization_1 = require("./public.authorization");
-Object.defineProperty(exports, "PublicAuthorization", { enumerable: true, get: function () { return public_authorization_1.PublicAuthorization; } });
-var transparent_authorization_1 = require("./transparent.authorization");
-Object.defineProperty(exports, "TransparentAuthorization", { enumerable: true, get: function () { return transparent_authorization_1.TransparentAuthorization; } });
-var orchestrated_authorization_1 = require("./orchestrated.authorization");
-Object.defineProperty(exports, "OrchestratedAuthorization", { enumerable: true, get: function () { return orchestrated_authorization_1.OrchestratedAuthorization; } });
-//# sourceMappingURL=index.js.map

package/src/auth/authorization/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/auth/authorization/index.ts"],"names":[],"mappings":";AAAA,8BAA8B;;;;AAE9B,QAAQ;AACR,gEAAsC;AAEtC,aAAa;AACb,6DAAwE;AAA/D,wHAAA,iBAAiB,OAAA;AAAE,mHAAA,YAAY,OAAA;AAExC,gCAAgC;AAChC,+DAA2F;AAAlF,2HAAA,mBAAmB,OAAA;AAC5B,yEAIqC;AAHnC,qIAAA,wBAAwB,OAAA;AAI1B,2EAMsC;AALpC,uIAAA,yBAAyB,OAAA","sourcesContent":["// auth/authorization/index.ts\n\n// Types\nexport * from './authorization.types';\n\n// Base class\nexport { AuthorizationBase, getMachineId } from './authorization.class';\n\n// Mode-specific implementations\nexport { PublicAuthorization, PublicAuthorizationCreateCtx } from './public.authorization';\nexport {\n  TransparentAuthorization,\n  TransparentAuthorizationCreateCtx,\n  TransparentVerifiedPayload,\n} from './transparent.authorization';\nexport {\n  OrchestratedAuthorization,\n  OrchestratedAuthorizationCreateCtx,\n  OrchestratedProviderState,\n  TokenStore,\n  TokenRefreshCallback,\n} from './orchestrated.authorization';\n"]}