@jbctechsolutions/mcp-office365 4.2.1 → 4.3.0

package/dist/registry/registry.js

@@ -108,7 +108,7 @@ export class ToolRegistry {
         // (onElicit), when the server is in elicit mode and the client can elicit.
         // Everything else runs the handler directly — an unchanged fast path.
         if (def.onElicit != null && ctx.confirmMode === 'elicit' && ctx.elicit != null) {
-            return this.dispatchWithElicitation(def, params, ctx, def.onElicit, ctx.elicit);
+            return this.dispatchWithElicitation(def, params, ctx, def.onElicit, ctx.elicit, options);
         }
         return def.handler(ctx, params);
     }
@@ -122,7 +122,7 @@ export class ToolRegistry {
      *
      * Fail-closed: the destructive action runs only on an explicit accept.
      */
-    async dispatchWithElicitation(def, prepareParams, ctx, link, elicit) {
+    async dispatchWithElicitation(def, prepareParams, ctx, link, elicit, options) {
         const prepareResult = await def.handler(ctx, prepareParams);
         const tokenIds = link.collectTokenIds(prepareResult);
         // No token in the prepare output → nothing to gate/execute; degrade.
@@ -138,6 +138,12 @@ export class ToolRegistry {
             if (confirmDef == null) {
                 return prepareResult;
             }
+            // Re-check the confirm tool against the surface (U6): a user whose
+            // entitlement excludes confirm_* must not execute it via inline accept.
+            // Degrade to the token flow (which dispatch() also blocks) rather than run.
+            if (!this.matches(confirmDef, options)) {
+                return prepareResult;
+            }
             // Only the param mapping/validation is guarded: a bad buildParams must
             // degrade (return the still-live token) rather than error out an accepted
             // action. The confirm handler runs OUTSIDE the guard so a genuine
@@ -172,11 +178,25 @@ export class ToolRegistry {
         if (options.readOnly === true && !isReadOnly(def)) {
             return false;
         }
+        // Exclusion wins over any inclusion (U6).
+        if (options.exclude != null && options.exclude.includes(def.name)) {
+            return false;
+        }
+        // Preset filter — the process-wide outer bound (`serve --preset`). A
+        // domain-less (empty-presets) tool is not subject to a domain cap. This
+        // composes with the per-user allow-list below, so an entitlement can only
+        // narrow within the preset cap, never exceed it.
         const presets = options.presets;
-        if (presets != null && presets.length > 0 && def.presets.length > 0) {
-            return def.presets.some((p) => presets.includes(p));
+        const presetOk = presets == null || presets.length === 0 || def.presets.length === 0
+            ? true
+            : def.presets.some((p) => presets.includes(p));
+        // Explicit allow-list mode (U6): exactly the listed tools (still capped by
+        // presets and read-only above); the empty-presets always-exposed bypass
+        // does not apply — a tool shows iff it is listed.
+        if (options.allow != null) {
+            return options.allow.includes(def.name) && presetOk;
         }
-        return true;
+        return presetOk;
     }
 }
 /**

package/dist/registry/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/registry/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAoBvD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAA4B,CAAC;IACnG,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;IAC1B,CAAC;IACD,OAAO,IAA2B,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,YAAY;IACN,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjE,yEAAyE;IACzE,QAAQ,CAAC,IAA+B;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,uDAAuD;IACvD,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,iDAAiD;IACjD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,OAAuB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACxC,MAAM,IAAI,GAAS;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;aACtC,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,SAAS,CAAC,IAAY,EAAE,OAAuB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAAa,EACb,GAAgB,EAChB,OAAuB;QAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAChC,8DAA8D;YAC9D,wEAAwE;YACxE,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yCAAyC,CAAC,CAAC;QAC1E,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,kCAAkC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE3C,8EAA8E;QAC9E,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,uBAAuB,CACnC,GAAmB,EACnB,aAAsB,EACtB,GAAgB,EAChB,IAAgB,EAChB,MAAgB;QAEhB,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACrD,qEAAqE;QACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAE1C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,uEAAuE;YACvE,0EAA0E;YAC1E,kEAAkE;YAClE,wEAAwE;YACxE,IAAI,aAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,wEAAwE;YACxE,oEAAoE;YACpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,2EAA2E;QAC3E,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,OAAuB;QACtC,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,OAAO,CAAC,GAAmB,EAAE,OAAuB;QAC1D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAmB;IACrC,OAAO,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAgB,EAAE,OAAe;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,qBAAqB,CAAC,GAAgB,EAAE,OAA2B;IAC1E,MAAM,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAClE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,uDAAuD,QAAQ,4CAA4C;iBACrH,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/registry/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA8BvD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAA4B,CAAC;IACnG,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;IAC1B,CAAC;IACD,OAAO,IAA2B,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,YAAY;IACN,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjE,yEAAyE;IACzE,QAAQ,CAAC,IAA+B;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,uDAAuD;IACvD,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,iDAAiD;IACjD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,OAAuB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACxC,MAAM,IAAI,GAAS;gBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;aACtC,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,SAAS,CAAC,IAAY,EAAE,OAAuB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAAa,EACb,GAAgB,EAChB,OAAuB;QAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAChC,8DAA8D;YAC9D,wEAAwE;YACxE,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yCAAyC,CAAC,CAAC;QAC1E,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,kCAAkC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAE3C,8EAA8E;QAC9E,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,uBAAuB,CACnC,GAAmB,EACnB,aAAsB,EACtB,GAAgB,EAChB,IAAgB,EAChB,MAAgB,EAChB,OAAuB;QAEvB,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACrD,qEAAqE;QACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAE1C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,mEAAmE;YACnE,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,uEAAuE;YACvE,0EAA0E;YAC1E,kEAAkE;YAClE,wEAAwE;YACxE,IAAI,aAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,wEAAwE;YACxE,oEAAoE;YACpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,2EAA2E;QAC3E,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,OAAuB;QACtC,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,OAAO,CAAC,GAAmB,EAAE,OAAuB;QAC1D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,0CAA0C;QAC1C,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,QAAQ,GACZ,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACjE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,2EAA2E;QAC3E,wEAAwE;QACxE,kDAAkD;QAClD,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QACtD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAmB;IACrC,OAAO,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAgB,EAAE,OAAe;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,qBAAqB,CAAC,GAAgB,EAAE,OAA2B;IAC1E,MAAM,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAClE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO;QACL,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,uDAAuD,QAAQ,4CAA4C;iBACrH,EAAE,IAAI,EAAE,CAAC,CAAC;aACZ,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/remote/auth/deny-list.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Revocation deny-list (U4 reads it; U7 fills it). Purging a user's tokens alone
+ * does not stop access — claude.ai may still hold a valid Entra token and an OBO
+ * would silently re-mint. The middleware rejects deny-listed identities before
+ * any OBO, per request from the store (never process-cached, so a later
+ * perf-motivated cache can't reintroduce a staleness window).
+ */
+import type { StateStore } from '../../state/store.js';
+/** Checks whether an Entra object id is revoked. */
+export interface DenyList {
+    isDenied(oid: string): boolean;
+}
+/**
+ * Store-backed deny-list (U7). Reads the durable deny-list per call — never
+ * process-cached — so a revocation takes effect on the next request and a later
+ * perf cache can't reintroduce a staleness window.
+ */
+export declare function createStoreDenyList(store: StateStore): DenyList;
+/**
+ * In-memory stub used until U7 wires a store-backed deny-list. Always empty —
+ * no user is revoked yet — but present so the middleware's rejection path exists
+ * and is testable from day one.
+ */
+export declare function createStubDenyList(): DenyList;
+//# sourceMappingURL=deny-list.d.ts.map

package/dist/remote/auth/deny-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-list.d.ts","sourceRoot":"","sources":["../../../src/remote/auth/deny-list.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,oDAAoD;AACpD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,QAAQ,CAG7C"}

package/dist/remote/auth/deny-list.js

@@ -0,0 +1,22 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Store-backed deny-list (U7). Reads the durable deny-list per call — never
+ * process-cached — so a revocation takes effect on the next request and a later
+ * perf cache can't reintroduce a staleness window.
+ */
+export function createStoreDenyList(store) {
+    return { isDenied: (oid) => store.isDenied(oid) };
+}
+/**
+ * In-memory stub used until U7 wires a store-backed deny-list. Always empty —
+ * no user is revoked yet — but present so the middleware's rejection path exists
+ * and is testable from day one.
+ */
+export function createStubDenyList() {
+    const denied = new Set();
+    return { isDenied: (oid) => denied.has(oid) };
+}
+//# sourceMappingURL=deny-list.js.map

package/dist/remote/auth/deny-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-list.js","sourceRoot":"","sources":["../../../src/remote/auth/deny-list.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACnD,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/remote/auth/metadata.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * RFC 9728 Protected Resource Metadata + the 401 `WWW-Authenticate` challenge
+ * (U4). This is the discovery handshake a claude.ai custom connector follows:
+ * an unauthenticated request gets a 401 pointing at the PRM document, which in
+ * turn points at the Entra authorization server. All values come from config —
+ * never from request headers (a `Host`-header value here would let a caller
+ * poison discovery).
+ */
+import type { RemoteAuthConfig } from '../config.js';
+/** RFC 9728 metadata path, and the path-suffixed variant claude.ai also probes. */
+export declare const PRM_PATH = "/.well-known/oauth-protected-resource";
+/** The Protected Resource Metadata document (RFC 9728). */
+export declare function protectedResourceMetadata(config: RemoteAuthConfig): Record<string, unknown>;
+/**
+ * The `WWW-Authenticate` header value for a 401, carrying the PRM URL so the
+ * client can discover the authorization server (RFC 9728 §5.1).
+ */
+export declare function wwwAuthenticate(config: RemoteAuthConfig, error?: string): string;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/remote/auth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/remote/auth/metadata.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,0CAA0C,CAAC;AAEhE,2DAA2D;AAC3D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ3F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAMhF"}

package/dist/remote/auth/metadata.js

@@ -0,0 +1,28 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/** RFC 9728 metadata path, and the path-suffixed variant claude.ai also probes. */
+export const PRM_PATH = '/.well-known/oauth-protected-resource';
+/** The Protected Resource Metadata document (RFC 9728). */
+export function protectedResourceMetadata(config) {
+    return {
+        resource: config.publicUrl,
+        // claude.ai uses only the first entry; pin it to the JP tenant issuer.
+        authorization_servers: [config.issuer],
+        scopes_supported: [config.requiredScope],
+        bearer_methods_supported: ['header'],
+    };
+}
+/**
+ * The `WWW-Authenticate` header value for a 401, carrying the PRM URL so the
+ * client can discover the authorization server (RFC 9728 §5.1).
+ */
+export function wwwAuthenticate(config, error) {
+    const params = [`resource_metadata="${config.publicUrl}${PRM_PATH}"`];
+    if (error != null) {
+        params.unshift(`error="${error}"`);
+    }
+    return `Bearer ${params.join(', ')}`;
+}
+//# sourceMappingURL=metadata.js.map

package/dist/remote/auth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/remote/auth/metadata.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAEhE,2DAA2D;AAC3D,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,uEAAuE;QACvE,qBAAqB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACtC,gBAAgB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;QACxC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAwB,EAAE,KAAc;IACtE,MAAM,MAAM,GAAG,CAAC,sBAAsB,MAAM,CAAC,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC;IACtE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACvC,CAAC"}

package/dist/remote/auth/middleware.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Bearer-auth middleware for `/mcp` (U4). Verifies the Entra JWT on every
+ * request (never trusts a session for auth), rejects deny-listed identities, and
+ * attaches an AuthInfo-compatible identity to the request for downstream units
+ * (U5 OBO). Authorization denials are logged as security events — never with any
+ * token material — as the only detection surface during the pilot.
+ */
+import type { NextFunction, Request, Response } from 'express';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { RemoteAuthConfig } from '../config.js';
+import type { DenyList } from './deny-list.js';
+import { type RemoteIdentity } from './verify.js';
+/** Attach the validated identity (and SDK-compatible auth info) to the request. */
+declare module 'express-serve-static-core' {
+    interface Request {
+        remoteIdentity?: RemoteIdentity;
+        auth?: AuthInfo;
+    }
+}
+type Verify = (token: string) => Promise<RemoteIdentity>;
+/**
+ * Express middleware requiring a valid, member, non-deny-listed Entra token.
+ * A missing/invalid token → 401 + WWW-Authenticate (RFC 9728 discovery); an
+ * authenticated-but-unauthorized identity → 403 (no re-auth loop).
+ */
+export declare function createAuthMiddleware(config: RemoteAuthConfig, verify: Verify, denyList: DenyList): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/remote/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/remote/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAA0C,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1F,mFAAmF;AACnF,OAAO,QAAQ,2BAA2B,CAAC;IACzC,UAAU,OAAO;QACf,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,IAAI,CAAC,EAAE,QAAQ,CAAC;KACjB;CACF;AAED,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAyBzD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,IAEJ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiD9E"}

package/dist/remote/auth/middleware.js

@@ -0,0 +1,82 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+import { AuthChallengeError, AuthForbiddenError } from './verify.js';
+import { wwwAuthenticate } from './metadata.js';
+/** Logs an authorization denial (reason + oid when known, no token material). */
+function logDenial(reason, oid) {
+    const who = oid != null ? ` oid=${oid}` : '';
+    process.stderr.write(`[mcp-office365] auth denied: reason=${reason}${who} at=${new Date().toISOString()}\n`);
+}
+function challenge(res, config, reason) {
+    logDenial(reason);
+    res
+        .status(401)
+        .set('WWW-Authenticate', wwwAuthenticate(config, 'invalid_token'))
+        .json({ jsonrpc: '2.0', error: { code: -32001, message: 'Unauthorized.' }, id: null });
+}
+function forbidden(res, reason, oid) {
+    logDenial(reason, oid);
+    res
+        .status(403)
+        .json({ jsonrpc: '2.0', error: { code: -32002, message: 'Forbidden.' }, id: null });
+}
+/**
+ * Express middleware requiring a valid, member, non-deny-listed Entra token.
+ * A missing/invalid token → 401 + WWW-Authenticate (RFC 9728 discovery); an
+ * authenticated-but-unauthorized identity → 403 (no re-auth loop).
+ */
+export function createAuthMiddleware(config, verify, denyList) {
+    return async (req, res, next) => {
+        // Whole-body guard: any unexpected throw (incl. a future store-backed
+        // deny-list in U7) fails closed to 401 rather than becoming an uncaught
+        // rejection that hangs the request.
+        try {
+            const header = req.headers.authorization;
+            // RFC 6750 auth-scheme is case-insensitive; trim the token.
+            const match = header != null ? /^Bearer[ ]+(.+)$/i.exec(header) : null;
+            const token = match?.[1]?.trim();
+            if (token == null || token === '') {
+                challenge(res, config, 'missing_token');
+                return;
+            }
+            let identity;
+            try {
+                identity = await verify(token);
+            }
+            catch (error) {
+                if (error instanceof AuthForbiddenError) {
+                    forbidden(res, error.reason);
+                }
+                else if (error instanceof AuthChallengeError) {
+                    challenge(res, config, error.reason);
+                }
+                else {
+                    challenge(res, config, 'verification_error');
+                }
+                return;
+            }
+            // Deny-list is read per request from the store (U7) — never process-cached.
+            if (denyList.isDenied(identity.oid)) {
+                forbidden(res, 'deny_listed', identity.oid);
+                return;
+            }
+            req.remoteIdentity = identity;
+            // AuthInfo-compatible shape the SDK exposes to tool handlers as extra.authInfo.
+            req.auth = {
+                token,
+                clientId: '',
+                scopes: [...identity.scopes],
+                ...(identity.expiresAt != null ? { expiresAt: identity.expiresAt } : {}),
+                resource: new URL(config.publicUrl),
+                extra: { oid: identity.oid, tid: identity.tid, homeAccountId: identity.homeAccountId },
+            };
+            next();
+        }
+        catch {
+            challenge(res, config, 'auth_error');
+        }
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/remote/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/remote/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAuB,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAYhD,iFAAiF;AACjF,SAAS,SAAS,CAAC,MAAc,EAAE,GAAY;IAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uCAAuC,MAAM,GAAG,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CACvF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,MAAwB,EAAE,MAAc;IACxE,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;SACjE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,MAAc,EAAE,GAAY;IAC5D,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvB,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAwB,EACxB,MAAc,EACd,QAAkB;IAElB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,sEAAsE;QACtE,wEAAwE;QACxE,oCAAoC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACzC,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACjC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,IAAI,QAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;qBAAM,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,4EAA4E;YAC5E,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC;YAC9B,gFAAgF;YAChF,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK;gBACL,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC5B,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;gBACnC,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE;aACvF,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/remote/auth/obo.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+import type { RemoteAuthConfig } from '../config.js';
+import { type OutlookMcpError } from '../../utils/errors.js';
+/** Confidential-client credential for OBO. Certificate is the production choice. */
+export type OboCredential = {
+    readonly kind: 'secret';
+    readonly clientSecret: string;
+} | {
+    readonly kind: 'certificate';
+    readonly thumbprint: string;
+    readonly privateKey: string;
+};
+/** Exchanges a validated inbound assertion for a per-user Graph token. */
+export interface OboClient {
+    acquireGraphToken(userAssertion: string): Promise<string>;
+}
+/**
+ * Loads the OBO credential from the environment, preferring a certificate.
+ * Returns null when none is configured (OBO disabled — U4 auth still works, but
+ * tool calls fail fast until the credential is provisioned in U9).
+ */
+export declare function loadOboCredential(env?: NodeJS.ProcessEnv): OboCredential | null;
+/**
+ * Builds the process-wide OBO client (one confidential-client app; per-user
+ * isolation is per-assertion, not per-instance).
+ */
+export declare function createOboClient(config: RemoteAuthConfig, credential: OboCredential): OboClient;
+/**
+ * Maps an OBO failure to a typed error. Consent/interaction failures need the
+ * user (or admin) to act; transient failures are retriable. The raw AADSTS code
+ * is surfaced in the message (never token material) so a broken flow is
+ * diagnosable — MSAL otherwise swallows 4xx detail.
+ */
+export declare function mapOboError(error: unknown): OutlookMcpError;
+//# sourceMappingURL=obo.d.ts.map

package/dist/remote/auth/obo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obo.d.ts","sourceRoot":"","sources":["../../../src/remote/auth/obo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAsC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAKjG,oFAAoF;AACpF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,GAAG,IAAI,CAW5F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,GAAG,SAAS,CAgC9F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAwB3D"}

package/dist/remote/auth/obo.js

@@ -0,0 +1,114 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * On-Behalf-Of token exchange (U5). The API app is a confidential client: it
+ * exchanges the inbound user assertion (the Entra JWT U4 validated) for a
+ * delegated Microsoft Graph token for that same user. Per-user isolation comes
+ * from the assertion — MSAL caches each user's OBO result separately, keyed by
+ * their identity, so one user's token can never satisfy another's request.
+ *
+ * The confidential credential (certificate preferred; secret supported for the
+ * pilot) lives only in the environment. When neither is configured, OBO fails
+ * fast with actionable guidance rather than silently degrading.
+ */
+import { ConfidentialClientApplication } from '@azure/msal-node';
+import { GraphAuthRequiredError, GraphError } from '../../utils/errors.js';
+/** `.default` returns exactly the app's admin-consented Graph scopes. */
+const GRAPH_DEFAULT_SCOPE = ['https://graph.microsoft.com/.default'];
+/**
+ * Loads the OBO credential from the environment, preferring a certificate.
+ * Returns null when none is configured (OBO disabled — U4 auth still works, but
+ * tool calls fail fast until the credential is provisioned in U9).
+ */
+export function loadOboCredential(env = process.env) {
+    const thumbprint = env.OUTLOOK_MCP_CONNECTOR_CERT_THUMBPRINT?.trim();
+    const privateKey = env.OUTLOOK_MCP_CONNECTOR_CERT_KEY?.trim();
+    if (thumbprint != null && thumbprint !== '' && privateKey != null && privateKey !== '') {
+        return { kind: 'certificate', thumbprint, privateKey };
+    }
+    const secret = env.OUTLOOK_MCP_CONNECTOR_CLIENT_SECRET?.trim();
+    if (secret != null && secret !== '') {
+        return { kind: 'secret', clientSecret: secret };
+    }
+    return null;
+}
+/**
+ * Builds the process-wide OBO client (one confidential-client app; per-user
+ * isolation is per-assertion, not per-instance).
+ */
+export function createOboClient(config, credential) {
+    const authConfig = {
+        clientId: config.apiClientId,
+        authority: `https://login.microsoftonline.com/${config.tenantId}`,
+        ...(credential.kind === 'secret'
+            ? { clientSecret: credential.clientSecret }
+            : {
+                clientCertificate: {
+                    thumbprint: credential.thumbprint,
+                    privateKey: credential.privateKey,
+                },
+            }),
+    };
+    const cca = new ConfidentialClientApplication({ auth: authConfig });
+    return {
+        async acquireGraphToken(userAssertion) {
+            let result;
+            try {
+                result = await cca.acquireTokenOnBehalfOf({
+                    oboAssertion: userAssertion,
+                    scopes: GRAPH_DEFAULT_SCOPE,
+                });
+            }
+            catch (error) {
+                throw mapOboError(error);
+            }
+            if (result?.accessToken == null || result.accessToken === '') {
+                throw new GraphAuthRequiredError('session_expired');
+            }
+            return result.accessToken;
+        },
+    };
+}
+/**
+ * Maps an OBO failure to a typed error. Consent/interaction failures need the
+ * user (or admin) to act; transient failures are retriable. The raw AADSTS code
+ * is surfaced in the message (never token material) so a broken flow is
+ * diagnosable — MSAL otherwise swallows 4xx detail.
+ */
+export function mapOboError(error) {
+    // MSAL spreads detail across message / errorCode / errorMessage — search all.
+    const message = errorText(error);
+    const code = /AADSTS\d+/.exec(message)?.[0];
+    // Missing consent for a scope — needs admin consent (see provisioning runbook).
+    if (code === 'AADSTS65001') {
+        return new GraphError(`On-Behalf-Of failed: consent missing for a Graph scope (${code}). Grant admin ` +
+            `consent for the connector API app — see docs/remote/provisioning.md.`);
+    }
+    // Conditional Access / MFA / password change / revoked — the user must re-auth.
+    if (code === 'AADSTS50076' || code === 'AADSTS50079' || /interaction_required|invalid_grant/i.test(message)) {
+        return new GraphAuthRequiredError('session_expired');
+    }
+    // Expired confidential credential — total outage until the cert/secret rotates.
+    if (code === 'AADSTS7000222' || code === 'AADSTS7000215') {
+        return new GraphError(`On-Behalf-Of failed: the connector's confidential credential is invalid or ` +
+            `expired (${code}). Rotate it per docs/remote/provisioning.md.`);
+    }
+    return new GraphError(`On-Behalf-Of exchange failed${code != null ? ` (${code})` : ''}.`);
+}
+/** Combined error text across MSAL's message / errorCode / errorMessage fields. */
+function errorText(error) {
+    const parts = [];
+    if (error instanceof Error)
+        parts.push(error.message);
+    if (error != null && typeof error === 'object') {
+        const e = error;
+        if (typeof e.errorCode === 'string')
+            parts.push(e.errorCode);
+        if (typeof e.errorMessage === 'string')
+            parts.push(e.errorMessage);
+    }
+    return parts.length > 0 ? parts.join(' ') : String(error);
+}
+//# sourceMappingURL=obo.js.map

package/dist/remote/auth/obo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obo.js","sourceRoot":"","sources":["../../../src/remote/auth/obo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,6BAA6B,EAAsB,MAAM,kBAAkB,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AAEjG,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAYrE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,UAAU,GAAG,GAAG,CAAC,qCAAqC,EAAE,IAAI,EAAE,CAAC;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAwB,EAAE,UAAyB;IACjF,MAAM,UAAU,GAA0B;QACxC,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,SAAS,EAAE,qCAAqC,MAAM,CAAC,QAAQ,EAAE;QACjE,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ;YAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;YAC3C,CAAC,CAAC;gBACE,iBAAiB,EAAE;oBACjB,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC;aACF,CAAC;KACP,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,6BAA6B,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEpE,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,aAAqB;YAC3C,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC;oBACxC,YAAY,EAAE,aAAa;oBAC3B,MAAM,EAAE,mBAAmB;iBAC5B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,MAAM,EAAE,WAAW,IAAI,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,8EAA8E;IAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5C,gFAAgF;IAChF,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,IAAI,UAAU,CACnB,2DAA2D,IAAI,iBAAiB;YAC9E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,aAAa,IAAI,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5G,OAAO,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IACD,gFAAgF;IAChF,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QACzD,OAAO,IAAI,UAAU,CACnB,6EAA6E;YAC3E,YAAY,IAAI,+CAA+C,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,+BAA+B,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5F,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,KAAwD,CAAC;QACnE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC"}

package/dist/remote/auth/verify.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Entra JWT validation for remote mode (U4). Fail-closed member-only enforcement:
+ * a token is accepted only on a positive delegated-member signal, and any absent
+ * optional claim is treated as rejection — never as pass. Signature keys come
+ * from the configured tenant JWKS only (never the token's own `iss`).
+ */
+import { jwtVerify } from 'jose';
+import type { RemoteAuthConfig } from '../config.js';
+/** Validated caller identity attached to the request for downstream units. */
+export interface RemoteIdentity {
+    /** Entra object id (stable user id). */
+    readonly oid: string;
+    /** Tenant id. */
+    readonly tid: string;
+    /** MSAL homeAccountId form (`<oid>.<tid>`) — the per-user state key (U5). */
+    readonly homeAccountId: string;
+    /** Delegated scopes on the token. */
+    readonly scopes: readonly string[];
+    /** Expiry (seconds since epoch), when present. */
+    readonly expiresAt?: number;
+}
+/** Token failed validation — respond 401 so the client re-authenticates. */
+export declare class AuthChallengeError extends Error {
+    readonly reason: string;
+    constructor(reason: string, message?: string);
+}
+/** Authenticated but not authorized (guest, app-only, wrong scope, deny-listed) — respond 403. */
+export declare class AuthForbiddenError extends Error {
+    readonly reason: string;
+    constructor(reason: string, message?: string);
+}
+/** Key source — the tenant JWKS by default; tests inject a local key set. */
+export type KeySource = Parameters<typeof jwtVerify>[1];
+/**
+ * Builds a verifier that resolves a bearer token to a {@link RemoteIdentity} or
+ * throws {@link AuthChallengeError} (401) / {@link AuthForbiddenError} (403).
+ */
+export declare function createTokenVerifier(config: RemoteAuthConfig, keySource?: KeySource): (token: string) => Promise<RemoteIdentity>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/remote/auth/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/remote/auth/verify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,EAAsB,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKrD,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iBAAiB;IACjB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,4EAA4E;AAC5E,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAK7C;AAED,kGAAkG;AAClG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAK7C;AAED,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAExD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,gBAAgB,EACxB,SAAS,CAAC,EAAE,SAAS,GACpB,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CA6D5C"}