db-mcp 1.0.1

package/dist/auth/TokenValidator.js

@@ -0,0 +1,235 @@
+/**
+ * db-mcp - Token Validator
+ *
+ * JWT access token validation using JWKS for signature verification.
+ * Supports RSA and EC algorithms commonly used with OAuth 2.0.
+ */
+import * as jose from "jose";
+import { InvalidTokenError, TokenExpiredError, InvalidSignatureError, JwksFetchError, } from "./errors.js";
+import { parseScopes } from "./scopes.js";
+import { createModuleLogger, ERROR_CODES } from "../utils/logger.js";
+const logger = createModuleLogger("AUTH");
+// =============================================================================
+// Token Validator
+// =============================================================================
+/**
+ * JWT Token Validator
+ *
+ * Validates OAuth 2.0 access tokens using JWKS for signature verification.
+ */
+export class TokenValidator {
+    /** Resolved configuration with all defaults applied */
+    jwksUri;
+    issuer;
+    audience;
+    clockTolerance;
+    jwksCacheTtl;
+    jwks = null;
+    jwksExpiry = 0;
+    constructor(config) {
+        this.jwksUri = config.jwksUri;
+        this.issuer = config.issuer;
+        this.audience = config.audience;
+        this.clockTolerance = config.clockTolerance ?? 60;
+        this.jwksCacheTtl = config.jwksCacheTtl ?? 3600;
+        logger.info(`Token Validator initialized for issuer: ${this.issuer}`, {
+            code: "AUTH_INIT",
+        });
+    }
+    /**
+     * Validate an access token
+     *
+     * @param token - The JWT access token
+     * @returns Validation result with claims or error
+     */
+    async validate(token) {
+        try {
+            // Get or refresh JWKS
+            const jwks = this.getJwks();
+            // Verify the token
+            const { payload } = await jose.jwtVerify(token, jwks, {
+                issuer: this.issuer,
+                audience: this.audience,
+                clockTolerance: this.clockTolerance,
+            });
+            // Extract and normalize claims
+            const claims = this.extractClaims(payload);
+            logger.info(`Token validated for subject: ${claims.sub}`, {
+                code: "AUTH_TOKEN_VALID",
+                sub: claims.sub,
+                scopes: claims.scopes.length,
+                exp: new Date(claims.exp * 1000).toISOString(),
+            });
+            return {
+                valid: true,
+                claims,
+            };
+        }
+        catch (error) {
+            return this.handleValidationError(error);
+        }
+    }
+    /**
+     * Get or refresh the JWKS
+     */
+    getJwks() {
+        // Check if JWKS is cached and valid
+        if (this.jwks && Date.now() < this.jwksExpiry) {
+            return this.jwks;
+        }
+        logger.info(`Fetching JWKS from: ${this.jwksUri}`, {
+            code: "AUTH_JWKS_FETCH",
+        });
+        try {
+            // Create JWKS remote key set
+            this.jwks = jose.createRemoteJWKSet(new URL(this.jwksUri), {
+                cooldownDuration: 30000, // 30 seconds between retries
+                cacheMaxAge: this.jwksCacheTtl * 1000,
+            });
+            this.jwksExpiry = Date.now() + this.jwksCacheTtl * 1000;
+            logger.info(`JWKS cached for ${String(this.jwksCacheTtl)}s`, {
+                code: "AUTH_JWKS_CACHED",
+            });
+            return this.jwks;
+        }
+        catch (error) {
+            const cause = error instanceof Error ? error : new Error(String(error));
+            logger.error(`Failed to fetch JWKS: ${this.jwksUri}`, {
+                code: ERROR_CODES.AUTH.JWKS_FETCH_FAILED.full,
+                error: cause,
+            });
+            throw new JwksFetchError(this.jwksUri, cause);
+        }
+    }
+    /**
+     * Extract and normalize token claims
+     */
+    extractClaims(payload) {
+        // Get scopes from 'scope' claim (space-delimited) or 'scopes' claim (array)
+        let scopes = [];
+        if (typeof payload["scope"] === "string") {
+            scopes = parseScopes(payload["scope"]);
+        }
+        else if (Array.isArray(payload["scopes"])) {
+            scopes = payload["scopes"].filter((s) => typeof s === "string");
+        }
+        else if (Array.isArray(payload["scope"])) {
+            scopes = payload["scope"].filter((s) => typeof s === "string");
+        }
+        return {
+            sub: payload.sub ?? "unknown",
+            scopes,
+            exp: payload.exp ?? 0,
+            iat: payload.iat ?? 0,
+            iss: payload.iss,
+            aud: payload.aud,
+            nbf: payload.nbf ?? undefined,
+            jti: payload.jti,
+            client_id: payload["client_id"],
+            // Include all other claims
+            ...payload,
+        };
+    }
+    /**
+     * Handle validation errors and convert to TokenValidationResult
+     */
+    handleValidationError(error) {
+        // Handle jose-specific errors
+        if (error instanceof jose.errors.JWTExpired) {
+            logger.warning("Token has expired", {
+                code: ERROR_CODES.AUTH.TOKEN_EXPIRED.full,
+                error: error,
+            });
+            return {
+                valid: false,
+                error: "Token has expired",
+                errorCode: ERROR_CODES.AUTH.TOKEN_EXPIRED.full,
+            };
+        }
+        if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            logger.warning(`Token claim validation failed: ${error.message}`, {
+                code: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+                error,
+            });
+            return {
+                valid: false,
+                error: `Token claim validation failed: ${error.message}`,
+                errorCode: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+            };
+        }
+        if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            logger.warning("Token signature verification failed", {
+                code: ERROR_CODES.AUTH.SIGNATURE_INVALID.full,
+                error,
+            });
+            return {
+                valid: false,
+                error: "Token signature verification failed",
+                errorCode: ERROR_CODES.AUTH.SIGNATURE_INVALID.full,
+            };
+        }
+        if (error instanceof jose.errors.JWKSNoMatchingKey) {
+            logger.warning("No matching key found in JWKS", {
+                code: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+                error,
+            });
+            return {
+                valid: false,
+                error: "No matching key found in JWKS",
+                errorCode: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+            };
+        }
+        // Handle other errors
+        const message = error instanceof Error ? error.message : String(error);
+        logger.error(`Token validation failed: ${message}`, {
+            code: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+            error: error instanceof Error ? error : undefined,
+        });
+        return {
+            valid: false,
+            error: `Token validation failed: ${message}`,
+            errorCode: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+        };
+    }
+    /**
+     * Refresh the JWKS cache
+     */
+    refreshJwks() {
+        this.jwks = null;
+        this.jwksExpiry = 0;
+        this.getJwks();
+        logger.info("JWKS cache refreshed", { code: "AUTH_JWKS_REFRESHED" });
+    }
+    /**
+     * Clear the JWKS cache
+     */
+    clearCache() {
+        this.jwks = null;
+        this.jwksExpiry = 0;
+        logger.info("Token validator cache cleared", {
+            code: "AUTH_CACHE_CLEARED",
+        });
+    }
+    /**
+     * Convert a validation error to the appropriate OAuth error class
+     */
+    static toOAuthError(result) {
+        if (result.errorCode === ERROR_CODES.AUTH.TOKEN_EXPIRED.full) {
+            return new TokenExpiredError();
+        }
+        if (result.errorCode === ERROR_CODES.AUTH.SIGNATURE_INVALID.full) {
+            return new InvalidSignatureError();
+        }
+        return new InvalidTokenError(result.error);
+    }
+}
+// =============================================================================
+// Factory Function
+// =============================================================================
+/**
+ * Create a Token Validator instance
+ */
+export function createTokenValidator(config) {
+    return new TokenValidator(config);
+}
+//# sourceMappingURL=TokenValidator.js.map

package/dist/auth/TokenValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenValidator.js","sourceRoot":"","sources":["../../src/auth/TokenValidator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAM7B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE1C,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACzB,uDAAuD;IACtC,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,YAAY,CAAS;IAE9B,IAAI,GAAgC,IAAI,CAAC;IACzC,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,MAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAEhD,MAAM,CAAC,IAAI,CAAC,2CAA2C,IAAI,CAAC,MAAM,EAAE,EAAE;YACpE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,sBAAsB;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,mBAAmB;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBACpD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;YAEH,+BAA+B;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAE3C,MAAM,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,GAAG,EAAE,EAAE;gBACxD,IAAI,EAAE,kBAAkB;gBACxB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;aAC/C,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,OAAO;QACb,oCAAoC;QACpC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,OAAO,EAAE,EAAE;YACjD,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,6BAA6B;YAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACzD,gBAAgB,EAAE,KAAK,EAAE,6BAA6B;gBACtD,WAAW,EAAE,IAAI,CAAC,YAAY,GAAG,IAAI;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAExD,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;gBAC3D,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAExE,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,OAAO,EAAE,EAAE;gBACpD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI;gBAC7C,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YAEH,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,OAAwB;QAC5C,4EAA4E;QAC5E,IAAI,MAAM,GAAa,EAAE,CAAC;QAE1B,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,SAAS;YAC7B,MAAM;YACN,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,SAAS;YAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,WAAW,CAAuB;YACrD,2BAA2B;YAC3B,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,KAAc;QAC1C,8BAA8B;QAC9B,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE;gBAClC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;gBACzC,KAAK,EAAE,KAAc;aACtB,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,EAAE;gBAChE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;gBACzC,KAAK;aACN,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,kCAAkC,KAAK,CAAC,OAAO,EAAE;gBACxD,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;aAC/C,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,8BAA8B,EAAE,CAAC;YAChE,MAAM,CAAC,OAAO,CAAC,qCAAqC,EAAE;gBACpD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI;gBAC7C,KAAK;aACN,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qCAAqC;gBAC5C,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI;aACnD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;gBAC9C,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;gBACzC,KAAK;aACN,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;aAC/C,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,EAAE,EAAE;YAClD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;YACzC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,4BAA4B,OAAO,EAAE;YAC5C,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CACjB,MAA6B;QAE7B,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7D,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACjE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA4B;IAE5B,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,74 @@
+/**
+ * db-mcp - OAuth Error Classes
+ *
+ * Module-prefixed error classes for OAuth 2.0 authentication
+ * and authorization failures.
+ */
+import { DbMcpError } from "../types/index.js";
+/**
+ * Base class for OAuth-related errors
+ */
+export declare class OAuthError extends DbMcpError {
+    /** HTTP status code for this error */
+    readonly httpStatus: number;
+    /** WWW-Authenticate header value */
+    readonly wwwAuthenticate?: string | undefined;
+    constructor(message: string, code: string, httpStatus: number, details?: Record<string, unknown>, wwwAuthenticate?: string);
+}
+/**
+ * Token is missing from the request
+ */
+export declare class TokenMissingError extends OAuthError {
+    constructor(realm?: string);
+}
+/**
+ * Token is invalid (malformed, wrong format, etc.)
+ */
+export declare class InvalidTokenError extends OAuthError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Token has expired
+ */
+export declare class TokenExpiredError extends OAuthError {
+    constructor(expiredAt?: Date);
+}
+/**
+ * Token signature is invalid
+ */
+export declare class InvalidSignatureError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Token does not have required scope
+ */
+export declare class InsufficientScopeError extends OAuthError {
+    constructor(requiredScope: string | string[], providedScopes?: string[]);
+}
+/**
+ * Failed to discover authorization server metadata
+ */
+export declare class AuthServerDiscoveryError extends OAuthError {
+    constructor(serverUrl: string, cause?: Error);
+}
+/**
+ * Failed to fetch JWKS
+ */
+export declare class JwksFetchError extends OAuthError {
+    constructor(jwksUri: string, cause?: Error);
+}
+/**
+ * Failed to register client
+ */
+export declare class ClientRegistrationError extends OAuthError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Check if an error is an OAuth error
+ */
+export declare function isOAuthError(error: unknown): error is OAuthError;
+/**
+ * Get WWW-Authenticate header for an OAuth error
+ */
+export declare function getWWWAuthenticateHeader(error: OAuthError, realm?: string): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,oCAAoC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;gBAG5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,CAAC,EAAE,MAAM;CAO3B;AAMD;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,KAAK,SAAW;CAU7B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBAE7C,OAAO,SAAyB,EAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAWpC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,SAAS,CAAC,EAAE,IAAI;CAU7B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;gBACvC,OAAO,SAAwC;CAU5D;AAMD;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE;CAexE;AAMD;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;gBAC1C,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAY7C;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAY3C;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EACjB,KAAK,SAAW,GACf,MAAM,CAER"}

package/dist/auth/errors.js

@@ -0,0 +1,133 @@
+/**
+ * db-mcp - OAuth Error Classes
+ *
+ * Module-prefixed error classes for OAuth 2.0 authentication
+ * and authorization failures.
+ */
+import { DbMcpError } from "../types/index.js";
+import { ERROR_CODES } from "../utils/logger.js";
+// =============================================================================
+// Base OAuth Error
+// =============================================================================
+/**
+ * Base class for OAuth-related errors
+ */
+export class OAuthError extends DbMcpError {
+    /** HTTP status code for this error */
+    httpStatus;
+    /** WWW-Authenticate header value */
+    wwwAuthenticate;
+    constructor(message, code, httpStatus, details, wwwAuthenticate) {
+        super(message, code, details);
+        this.name = "OAuthError";
+        this.httpStatus = httpStatus;
+        this.wwwAuthenticate = wwwAuthenticate;
+    }
+}
+// =============================================================================
+// Authentication Errors (401)
+// =============================================================================
+/**
+ * Token is missing from the request
+ */
+export class TokenMissingError extends OAuthError {
+    constructor(realm = "db-mcp") {
+        super("No access token provided", ERROR_CODES.AUTH.TOKEN_MISSING.full, 401, undefined, `Bearer realm="${realm}"`);
+        this.name = "TokenMissingError";
+    }
+}
+/**
+ * Token is invalid (malformed, wrong format, etc.)
+ */
+export class InvalidTokenError extends OAuthError {
+    constructor(message = "Invalid access token", details) {
+        super(message, ERROR_CODES.AUTH.TOKEN_INVALID.full, 401, details, 'Bearer error="invalid_token"');
+        this.name = "InvalidTokenError";
+    }
+}
+/**
+ * Token has expired
+ */
+export class TokenExpiredError extends OAuthError {
+    constructor(expiredAt) {
+        super("Access token has expired", ERROR_CODES.AUTH.TOKEN_EXPIRED.full, 401, expiredAt ? { expiredAt: expiredAt.toISOString() } : undefined, 'Bearer error="invalid_token", error_description="Token has expired"');
+        this.name = "TokenExpiredError";
+    }
+}
+/**
+ * Token signature is invalid
+ */
+export class InvalidSignatureError extends OAuthError {
+    constructor(message = "Token signature verification failed") {
+        super(message, ERROR_CODES.AUTH.SIGNATURE_INVALID.full, 401, undefined, 'Bearer error="invalid_token", error_description="Signature verification failed"');
+        this.name = "InvalidSignatureError";
+    }
+}
+// =============================================================================
+// Authorization Errors (403)
+// =============================================================================
+/**
+ * Token does not have required scope
+ */
+export class InsufficientScopeError extends OAuthError {
+    constructor(requiredScope, providedScopes) {
+        const required = Array.isArray(requiredScope)
+            ? requiredScope
+            : [requiredScope];
+        const scopeValue = required.join(" ");
+        super(`Insufficient scope. Required: ${scopeValue}`, ERROR_CODES.AUTH.SCOPE_DENIED.full, 403, { requiredScope: required, providedScopes }, `Bearer error="insufficient_scope", scope="${scopeValue}"`);
+        this.name = "InsufficientScopeError";
+    }
+}
+// =============================================================================
+// Server Errors (500)
+// =============================================================================
+/**
+ * Failed to discover authorization server metadata
+ */
+export class AuthServerDiscoveryError extends OAuthError {
+    constructor(serverUrl, cause) {
+        super(`Failed to discover authorization server metadata: ${serverUrl}`, ERROR_CODES.AUTH.DISCOVERY_FAILED.full, 500, {
+            serverUrl,
+            cause: cause?.message,
+        });
+        this.name = "AuthServerDiscoveryError";
+    }
+}
+/**
+ * Failed to fetch JWKS
+ */
+export class JwksFetchError extends OAuthError {
+    constructor(jwksUri, cause) {
+        super(`Failed to fetch JWKS: ${jwksUri}`, ERROR_CODES.AUTH.JWKS_FETCH_FAILED.full, 500, {
+            jwksUri,
+            cause: cause?.message,
+        });
+        this.name = "JwksFetchError";
+    }
+}
+/**
+ * Failed to register client
+ */
+export class ClientRegistrationError extends OAuthError {
+    constructor(message, details) {
+        super(message, ERROR_CODES.AUTH.REGISTRATION_FAILED.full, 500, details);
+        this.name = "ClientRegistrationError";
+    }
+}
+// =============================================================================
+// Utility Functions
+// =============================================================================
+/**
+ * Check if an error is an OAuth error
+ */
+export function isOAuthError(error) {
+    return error instanceof OAuthError;
+}
+/**
+ * Get WWW-Authenticate header for an OAuth error
+ */
+export function getWWWAuthenticateHeader(error, realm = "db-mcp") {
+    return error.wwwAuthenticate ?? `Bearer realm="${realm}"`;
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IACxC,sCAAsC;IAC7B,UAAU,CAAS;IAE5B,oCAAoC;IAC3B,eAAe,CAAsB;IAE9C,YACE,OAAe,EACf,IAAY,EACZ,UAAkB,EAClB,OAAiC,EACjC,eAAwB;QAExB,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;CACF;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,KAAK,GAAG,QAAQ;QAC1B,KAAK,CACH,0BAA0B,EAC1B,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EACnC,GAAG,EACH,SAAS,EACT,iBAAiB,KAAK,GAAG,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YACE,OAAO,GAAG,sBAAsB,EAChC,OAAiC;QAEjC,KAAK,CACH,OAAO,EACP,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EACnC,GAAG,EACH,OAAO,EACP,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,SAAgB;QAC1B,KAAK,CACH,0BAA0B,EAC1B,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EACnC,GAAG,EACH,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAC9D,qEAAqE,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACnD,YAAY,OAAO,GAAG,qCAAqC;QACzD,KAAK,CACH,OAAO,EACP,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EACvC,GAAG,EACH,SAAS,EACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IACpD,YAAY,aAAgC,EAAE,cAAyB;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtC,KAAK,CACH,iCAAiC,UAAU,EAAE,EAC7C,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAClC,GAAG,EACH,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,EAC3C,6CAA6C,UAAU,GAAG,CAC3D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,UAAU;IACtD,YAAY,SAAiB,EAAE,KAAa;QAC1C,KAAK,CACH,qDAAqD,SAAS,EAAE,EAChE,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EACtC,GAAG,EACH;YACE,SAAS;YACT,KAAK,EAAE,KAAK,EAAE,OAAO;SACtB,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAe,EAAE,KAAa;QACxC,KAAK,CACH,yBAAyB,OAAO,EAAE,EAClC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EACvC,GAAG,EACH;YACE,OAAO;YACP,KAAK,EAAE,KAAK,EAAE,OAAO;SACtB,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IACrD,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,UAAU,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAiB,EACjB,KAAK,GAAG,QAAQ;IAEhB,OAAO,KAAK,CAAC,eAAe,IAAI,iBAAiB,KAAK,GAAG,CAAC;AAC5D,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * db-mcp - Auth Module Public Exports
+ *
+ * OAuth 2.0 authentication and authorization components.
+ */
+export type * from "./types.js";
+export * from "./errors.js";
+export * from "./scopes.js";
+export { OAuthResourceServer, createOAuthResourceServer, } from "./OAuthResourceServer.js";
+export { AuthorizationServerDiscovery, createAuthServerDiscovery, } from "./AuthorizationServerDiscovery.js";
+export { TokenValidator, createTokenValidator } from "./TokenValidator.js";
+export { createAuthMiddleware, extractBearerToken, requireScope, requireAnyScope, requireToolScope, oauthErrorHandler, type AuthMiddlewareConfig, } from "./middleware.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,mBAAmB,YAAY,CAAC;AAChC,cAAc,aAAa,CAAC;AAG5B,cAAc,aAAa,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,15 @@
+/**
+ * db-mcp - Auth Module Public Exports
+ *
+ * OAuth 2.0 authentication and authorization components.
+ */
+export * from "./errors.js";
+// Scopes
+export * from "./scopes.js";
+// Core classes
+export { OAuthResourceServer, createOAuthResourceServer, } from "./OAuthResourceServer.js";
+export { AuthorizationServerDiscovery, createAuthServerDiscovery, } from "./AuthorizationServerDiscovery.js";
+export { TokenValidator, createTokenValidator } from "./TokenValidator.js";
+// Middleware
+export { createAuthMiddleware, extractBearerToken, requireScope, requireAnyScope, requireToolScope, oauthErrorHandler, } from "./middleware.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,cAAc,aAAa,CAAC;AAE5B,SAAS;AACT,cAAc,aAAa,CAAC;AAE5B,eAAe;AACf,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3E,aAAa;AACb,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,iBAAiB,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,81 @@
+/**
+ * db-mcp - OAuth Middleware
+ *
+ * Express middleware for OAuth 2.0 authentication and authorization.
+ * Extracts Bearer tokens, validates them, and enforces scope requirements.
+ */
+import type { Request, Response, NextFunction, RequestHandler } from "express";
+import type { TokenClaims } from "./types.js";
+import type { TokenValidator } from "./TokenValidator.js";
+import type { OAuthResourceServer } from "./OAuthResourceServer.js";
+/**
+ * Extended Express Request with auth context
+ * Uses module augmentation to extend Express.Request interface
+ */
+declare module "express-serve-static-core" {
+    interface Request {
+        /** Authenticated user claims */
+        auth?: TokenClaims;
+        /** Raw access token */
+        accessToken?: string;
+        /** Request ID for tracing */
+        requestId?: string;
+    }
+}
+/**
+ * Auth middleware configuration
+ */
+export interface AuthMiddlewareConfig {
+    /** Token validator instance */
+    tokenValidator: TokenValidator;
+    /** Resource server instance (for WWW-Authenticate header) */
+    resourceServer: OAuthResourceServer;
+    /** Paths that bypass authentication (e.g., '/.well-known/*', '/health') */
+    publicPaths?: string[];
+}
+/**
+ * Extract Bearer token from Authorization header
+ *
+ * @param authHeader - Authorization header value
+ * @returns The token or null if not present/invalid
+ */
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+/**
+ * Create the main authentication middleware
+ *
+ * This middleware:
+ * 1. Skips authentication for public paths (e.g., /.well-known/*)
+ * 2. Extracts Bearer token from Authorization header
+ * 3. Validates the token using the TokenValidator
+ * 4. Attaches validated claims to req.auth
+ * 5. Returns 401 with WWW-Authenticate header on failure
+ */
+export declare function createAuthMiddleware(config: AuthMiddlewareConfig): RequestHandler;
+/**
+ * Middleware factory that requires a specific scope
+ *
+ * @param scope - Required scope
+ * @returns Express middleware
+ */
+export declare function requireScope(scope: string): RequestHandler;
+/**
+ * Middleware factory that requires any of the specified scopes
+ *
+ * @param scopes - Array of acceptable scopes (user must have at least one)
+ * @returns Express middleware
+ */
+export declare function requireAnyScope(scopes: string[]): RequestHandler;
+/**
+ * Middleware factory that requires scope for a specific tool
+ *
+ * @param toolName - Name of the tool being accessed
+ * @returns Express middleware
+ */
+export declare function requireToolScope(toolName: string): RequestHandler;
+/**
+ * Error handler middleware for OAuth errors
+ *
+ * Should be added after all routes to catch OAuth-related errors
+ */
+export declare function oauthErrorHandler(error: Error, _req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAgBpE;;;GAGG;AACH,OAAO,QAAQ,2BAA2B,CAAC;IACzC,UAAU,OAAO;QACf,gCAAgC;QAChC,IAAI,CAAC,EAAE,WAAW,CAAC;QACnB,uBAAuB;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,6BAA6B;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;CACF;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,cAAc,EAAE,cAAc,CAAC;IAE/B,6DAA6D;IAC7D,cAAc,EAAE,mBAAmB,CAAC;IAEpC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAmBf;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CA4FhB;AAMD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAoC1D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CA6ChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAqCjE;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAiBN"}