@frontmcp/auth 1.0.4 → 1.1.0-beta.1

package/authorities/authorities.context.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Authorities Evaluation Context Builder
+ *
+ * Builds an AuthoritiesEvaluationContext from AuthInfo and claimsMapping.
+ * Handles JWT shape differences across IdPs (Auth0, Keycloak, Okta, etc.).
+ */
+import type { AuthoritiesEvaluationContext, RelationshipResolver } from './authorities.types';
+import type { AuthoritiesClaimsMapping } from './authorities.profiles';
+/**
+ * Resolve a dot-path value from a nested object.
+ * First tries a direct key lookup (for keys containing dots, e.g., Auth0 namespaced claims),
+ * then falls back to dot-separated path traversal.
+ *
+ * @example
+ * resolveDotPath({ a: { b: { c: 42 } } }, 'a.b.c') // 42
+ * resolveDotPath({ 'https://myapp.com/roles': ['admin'] }, 'https://myapp.com/roles') // ['admin']
+ * resolveDotPath({ a: 1 }, 'a.b') // undefined
+ */
+export declare function resolveDotPath(obj: Record<string, unknown>, path: string): unknown;
+/**
+ * Function signature for custom claims resolution.
+ */
+export type ClaimsResolverFn = (authInfo: Partial<AuthInfoLike>) => {
+    roles: string[];
+    permissions: string[];
+    claims: Record<string, unknown>;
+};
+/**
+ * Minimal shape of AuthInfo that the context builder needs.
+ * Avoids hard dependency on @frontmcp/protocol.
+ */
+export interface AuthInfoLike {
+    user?: {
+        sub?: string;
+        roles?: string[];
+        permissions?: string[];
+        [key: string]: unknown;
+    };
+    extra?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * Options for building an evaluation context.
+ */
+export interface AuthoritiesContextBuilderOptions {
+    claimsMapping?: AuthoritiesClaimsMapping;
+    claimsResolver?: ClaimsResolverFn;
+    relationshipResolver?: RelationshipResolver;
+}
+/**
+ * Builds AuthoritiesEvaluationContext from request-time AuthInfo.
+ */
+export declare class AuthoritiesContextBuilder {
+    private readonly claimsMapping;
+    private readonly claimsResolver;
+    private readonly relationshipResolver;
+    constructor(options?: AuthoritiesContextBuilderOptions);
+    /**
+     * Build an evaluation context from AuthInfo and tool input.
+     */
+    build(authInfo: Partial<AuthInfoLike>, input?: Record<string, unknown>, env?: Record<string, unknown>): AuthoritiesEvaluationContext;
+}
+//# sourceMappingURL=authorities.context.d.ts.map

package/authorities/authorities.context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,4BAA4B;CAsEhC"}

package/authorities/authorities.engine.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Authorities Evaluation Engine
+ *
+ * Orchestrates policy evaluation with profile resolution,
+ * built-in evaluators, custom evaluators, and combinators.
+ */
+import type { AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry } from './authorities.registry';
+import type { AuthoritiesEvaluationContext, AuthoritiesMetadata, AuthoritiesResult } from './authorities.types';
+/**
+ * The main evaluation engine.
+ *
+ * Usage:
+ * ```typescript
+ * const engine = new AuthoritiesEngine(profileRegistry, evaluatorRegistry);
+ * const result = await engine.evaluate(authorities, ctx);
+ * if (!result.granted) throw new AuthorityDeniedError({ ... });
+ * ```
+ */
+export declare class AuthoritiesEngine {
+    private readonly profiles;
+    private readonly evaluators;
+    constructor(profiles: AuthoritiesProfileRegistry, evaluators: AuthoritiesEvaluatorRegistry);
+    /**
+     * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
+     */
+    evaluate(authorities: AuthoritiesMetadata, ctx: AuthoritiesEvaluationContext): Promise<AuthoritiesResult>;
+    /**
+     * Resolve and evaluate a single named profile.
+     */
+    private evaluateProfile;
+    /**
+     * Evaluate an array of profile names (AND semantics).
+     */
+    private evaluateProfileArray;
+    /**
+     * Evaluate an inline policy object.
+     */
+    private evaluatePolicy;
+    /**
+     * Combine results with AND or OR semantics.
+     */
+    private combineResults;
+    /**
+     * Evaluate custom evaluators.
+     */
+    private evaluateCustom;
+    /**
+     * Evaluate async guard functions in sequence.
+     * Each guard returns true (granted) or a string (denial message).
+     */
+    private evaluateGuards;
+    /**
+     * allOf combinator — all nested policies must pass.
+     */
+    private evaluateAllOf;
+    /**
+     * anyOf combinator — at least one nested policy must pass.
+     */
+    private evaluateAnyOf;
+    /**
+     * not combinator — inverts the nested policy result.
+     */
+    private evaluateNot;
+}
+//# sourceMappingURL=authorities.engine.d.ts.map

package/authorities/authorities.engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EAEnB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAoB7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;OAEG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAe/G;;OAEG;YACW,eAAe;IAsB7B;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;OAGG;YACW,cAAc;IAoB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;CAa1B"}

package/authorities/authorities.errors.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Authority Denied Error
+ *
+ * Thrown when an entry's authorities policy denies access.
+ * Uses MCP FORBIDDEN error code (-32003) for JSON-RPC responses.
+ */
+import type { AuthoritiesDenial } from './authorities.types';
+/**
+ * Parameters for creating an AuthorityDeniedError.
+ */
+export interface AuthorityDeniedErrorParams {
+    /** Entry type: 'Tool', 'Resource', 'Prompt', 'Skill', 'Agent' */
+    entryType: string;
+    /** Entry name (e.g., 'delete-user') */
+    entryName: string;
+    /** Policy that denied access (e.g., "roles.all: missing 'admin'") */
+    deniedBy: string;
+    /** Optional custom message */
+    message?: string;
+    /** Structured denial data (machine-parsable) */
+    denial?: AuthoritiesDenial;
+    /** Required scopes for scope challenges */
+    requiredScopes?: string[];
+}
+/**
+ * Error thrown when an authorities policy denies access.
+ *
+ * Extends the standard Error class. When used within the FrontMCP SDK,
+ * the enforcement plugin maps this to the appropriate MCP error response
+ * with code -32003 (FORBIDDEN).
+ */
+export declare class AuthorityDeniedError extends Error {
+    /** MCP error code for JSON-RPC responses */
+    readonly mcpErrorCode = -32003;
+    /** HTTP status code equivalent */
+    readonly statusCode = 403;
+    /** Error classification code */
+    readonly code = "AUTHORITY_DENIED";
+    /** Entry type that was denied */
+    readonly entryType: string;
+    /** Entry name that was denied */
+    readonly entryName: string;
+    /** Policy that caused the denial */
+    readonly deniedBy: string;
+    /** Structured denial data (machine-parsable) */
+    readonly denial?: AuthoritiesDenial;
+    /** Required scopes for scope challenges */
+    readonly requiredScopes?: string[];
+    constructor(params: AuthorityDeniedErrorParams);
+    /**
+     * Convert to JSON-RPC error format.
+     */
+    toJsonRpcError(): {
+        code: number;
+        message: string;
+        data?: Record<string, unknown>;
+    };
+}
+//# sourceMappingURL=authorities.errors.d.ts.map

package/authorities/authorities.errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.errors.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAQ7D;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,UAAkB;IACvC,kCAAkC;IAClC,QAAQ,CAAC,UAAU,OAAO;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,IAAI,sBAAsB;IACnC,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,2CAA2C;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;gBAEvB,MAAM,EAAE,0BAA0B;IAW9C;;OAEG;IACH,cAAc,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;CAcpF"}

package/authorities/authorities.evaluator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Built-in Authority Evaluators
+ *
+ * Pure functions for evaluating RBAC, ABAC, and ReBAC policies.
+ */
+import type { RbacRolesPolicy, RbacPermissionsPolicy, AbacPolicy, RebacPolicy, ResourceIdRef, AuthoritiesResult, AuthoritiesEvaluationContext } from './authorities.types';
+/**
+ * Evaluate RBAC roles policy against user roles.
+ */
+export declare function evaluateRbacRoles(policy: RbacRolesPolicy, ctx: AuthoritiesEvaluationContext): AuthoritiesResult;
+/**
+ * Evaluate RBAC permissions policy against user permissions.
+ */
+export declare function evaluateRbacPermissions(policy: RbacPermissionsPolicy, ctx: AuthoritiesEvaluationContext): AuthoritiesResult;
+/**
+ * Evaluate ABAC policy.
+ */
+export declare function evaluateAbac(policy: AbacPolicy, ctx: AuthoritiesEvaluationContext): AuthoritiesResult;
+/**
+ * Resolve a ResourceIdRef to a concrete string.
+ */
+export declare function resolveResourceId(ref: ResourceIdRef, ctx: AuthoritiesEvaluationContext): string | undefined;
+/**
+ * Evaluate ReBAC policy (single or array).
+ * Multiple policies are AND-ed (all relationships must hold).
+ */
+export declare function evaluateRebac(policy: RebacPolicy | RebacPolicy[], ctx: AuthoritiesEvaluationContext): Promise<AuthoritiesResult>;
+//# sourceMappingURL=authorities.evaluator.d.ts.map

package/authorities/authorities.evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,UAAU,EAEV,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAO7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AA6FD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAqCrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAuCD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}

package/authorities/authorities.metadata-augment.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Global interface augmentation for authorities metadata.
+ *
+ * Adds the `authorities` field to all entry type metadata interfaces.
+ * Entry-level Zod schemas use `.passthrough()` so the field is accepted at runtime.
+ *
+ * Server/app-level configuration (claimsMapping, profiles) is passed via
+ * `AuthoritiesPlugin.init({ claimsMapping, profiles })`.
+ *
+ * Import this file (or anything from '@frontmcp/auth/authorities') to
+ * activate the augmentation.
+ */
+import type { AuthoritiesMetadata } from './authorities.types';
+declare global {
+    interface ExtendFrontMcpToolMetadata {
+        authorities?: AuthoritiesMetadata;
+    }
+    interface ExtendFrontMcpResourceMetadata {
+        authorities?: AuthoritiesMetadata;
+    }
+    interface ExtendFrontMcpResourceTemplateMetadata {
+        authorities?: AuthoritiesMetadata;
+    }
+    interface ExtendFrontMcpPromptMetadata {
+        authorities?: AuthoritiesMetadata;
+    }
+    interface ExtendFrontMcpSkillMetadata {
+        authorities?: AuthoritiesMetadata;
+    }
+}
+//# sourceMappingURL=authorities.metadata-augment.d.ts.map

package/authorities/authorities.metadata-augment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.metadata-augment.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.metadata-augment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,0BAA0B;QAClC,WAAW,CAAC,EAAE,mBAAmB,CAAC;KACnC;IAED,UAAU,8BAA8B;QACtC,WAAW,CAAC,EAAE,mBAAmB,CAAC;KACnC;IAED,UAAU,sCAAsC;QAC9C,WAAW,CAAC,EAAE,mBAAmB,CAAC;KACnC;IAED,UAAU,4BAA4B;QACpC,WAAW,CAAC,EAAE,mBAAmB,CAAC;KACnC;IAED,UAAU,2BAA2B;QACnC,WAAW,CAAC,EAAE,mBAAmB,CAAC;KACnC;CACF"}

package/authorities/authorities.profiles.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Authority Profiles Configuration
+ *
+ * Types for JWT claims mapping and pre-registered authority profiles.
+ * Configured at server/app level via @FrontMcp({ authorities: { ... } })
+ */
+import type { AuthoritiesPolicyMetadata } from './authorities.types';
+/**
+ * Maps IdP-specific JWT claim paths to standard authority fields.
+ * Each value is a dot-path into the JWT claims object.
+ *
+ * @example
+ * ```typescript
+ * // Auth0
+ * { roles: 'https://myapp.com/roles', permissions: 'permissions', tenantId: 'org_id' }
+ *
+ * // Keycloak
+ * { roles: 'realm_access.roles', permissions: 'resource_access.account.roles' }
+ *
+ * // Okta
+ * { roles: 'groups', permissions: 'scp' }
+ *
+ * // Cognito
+ * { roles: 'cognito:groups', permissions: 'scope' }
+ *
+ * // Frontegg
+ * { roles: 'roles', permissions: 'permissions', tenantId: 'tenantId' }
+ * ```
+ */
+export interface AuthoritiesClaimsMapping {
+    /** Dot-path to roles array in JWT claims */
+    roles?: string;
+    /** Dot-path to permissions array/string in JWT claims */
+    permissions?: string;
+    /** Dot-path to tenant/org ID in JWT claims */
+    tenantId?: string;
+    /** Dot-path to user ID in JWT claims (default: 'sub') */
+    userId?: string;
+    /** Extensible: additional custom claim mappings */
+    [key: string]: string | undefined;
+}
+/**
+ * Maps authority denials to OAuth scope challenges.
+ * When an authority check fails and the denial matches a scopeMapping key,
+ * the required scopes are included in the 403 insufficient_scope response.
+ * Explicit only — no automatic permission-to-scope inference.
+ */
+export interface AuthoritiesScopeMapping {
+    /** Map role names to required OAuth scopes: `{ admin: ['admin:all'] }` */
+    roles?: Record<string, string[]>;
+    /** Map permission names to required OAuth scopes: `{ 'repo:write': ['repo'] }` */
+    permissions?: Record<string, string[]>;
+    /** Map profile names to required OAuth scopes: `{ admin: ['admin:all'] }` */
+    profiles?: Record<string, string[]>;
+}
+/**
+ * Server/app-level authorities configuration.
+ * Registered in `@FrontMcp({ authorities: { ... } })`.
+ */
+export interface AuthoritiesConfig {
+    /** JWT claims mapping for your IdP */
+    claimsMapping?: AuthoritiesClaimsMapping;
+    /** Pre-registered named authority profiles */
+    profiles?: Record<string, AuthoritiesPolicyMetadata>;
+    /** Map authority denials to OAuth scope challenges */
+    scopeMapping?: AuthoritiesScopeMapping;
+    /**
+     * Auth context pipes — extract custom typed fields from JWT claims.
+     * Pipes run during context construction and their results are merged
+     * into the FrontMcpAuthContext. Declare custom fields via
+     * `declare global { interface ExtendFrontMcpAuthContext { ... } }`.
+     */
+    pipes?: import('../context/frontmcp-auth-context').AuthContextPipe[];
+}
+//# sourceMappingURL=authorities.profiles.d.ts.map

package/authorities/authorities.profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.profiles.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAMrE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACrD,sDAAsD;IACtD,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,kCAAkC,EAAE,eAAe,EAAE,CAAC;CACtE"}

package/authorities/authorities.registry.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Authority Registries
+ *
+ * - AuthoritiesProfileRegistry: stores named authority profiles
+ * - AuthoritiesEvaluatorRegistry: stores custom evaluators
+ */
+import type { AuthoritiesPolicyMetadata, AuthoritiesEvaluator } from './authorities.types';
+/**
+ * Registry for named authority profiles.
+ * Profiles map a string name to a policy, allowing
+ * `authorities: 'admin'` shorthand in decorators.
+ */
+export declare class AuthoritiesProfileRegistry {
+    private readonly profiles;
+    /**
+     * Register a named profile.
+     * Overwrites any existing profile with the same name.
+     */
+    register(name: string, policy: AuthoritiesPolicyMetadata): void;
+    /**
+     * Register multiple profiles at once.
+     */
+    registerAll(profiles: Record<string, AuthoritiesPolicyMetadata>): void;
+    /**
+     * Resolve a profile name to its policy.
+     * Returns `undefined` if the profile is not registered.
+     */
+    resolve(name: string): AuthoritiesPolicyMetadata | undefined;
+    /**
+     * Check if a profile is registered.
+     */
+    has(name: string): boolean;
+    /**
+     * Get all registered profiles.
+     */
+    getAll(): Record<string, AuthoritiesPolicyMetadata>;
+    /**
+     * Get the number of registered profiles.
+     */
+    get size(): number;
+    /**
+     * Remove a profile by name.
+     */
+    remove(name: string): boolean;
+    /**
+     * Clear all profiles.
+     */
+    clear(): void;
+}
+/**
+ * Registry for custom authority evaluators.
+ * Custom evaluators handle the `custom.*` field in policies.
+ */
+export declare class AuthoritiesEvaluatorRegistry {
+    private readonly evaluators;
+    /**
+     * Register a custom evaluator.
+     * The evaluator's name must match the key used in `custom.*`.
+     */
+    register(name: string, evaluator: AuthoritiesEvaluator): void;
+    /**
+     * Register multiple evaluators at once.
+     */
+    registerAll(evaluators: Record<string, AuthoritiesEvaluator>): void;
+    /**
+     * Get an evaluator by name.
+     */
+    get(name: string): AuthoritiesEvaluator | undefined;
+    /**
+     * Check if an evaluator is registered.
+     */
+    has(name: string): boolean;
+    /**
+     * Get the number of registered evaluators.
+     */
+    get size(): number;
+    /**
+     * Remove an evaluator by name.
+     */
+    remove(name: string): boolean;
+    /**
+     * Clear all evaluators.
+     */
+    clear(): void;
+}
+//# sourceMappingURL=authorities.registry.d.ts.map

package/authorities/authorities.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.registry.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAM7B;;;;GAIG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IAEzE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,IAAI;IAI/D;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,IAAI;IAMtE;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;IAI5D;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAQnD;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd;AAMD;;;GAGG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2C;IAEtE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,GAAG,IAAI;IAI7D;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,IAAI;IAMnE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAInD;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/authorities/authorities.schema.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Zod Validation Schemas for Authorities
+ *
+ * Runtime validation for authorities metadata, profiles, and claims mapping.
+ */
+import { z } from '@frontmcp/lazy-zod';
+import type { AuthoritiesClaimsMapping, AuthoritiesConfig } from './authorities.profiles';
+import type { AbacCondition, AbacOperator, AbacPolicy, AuthoritiesMetadata, AuthoritiesPolicyMetadata, RbacPermissionsPolicy, RbacRolesPolicy, RebacPolicy, ResourceIdRef } from './authorities.types';
+export declare const rbacRolesPolicySchema: z.ZodType<RbacRolesPolicy>;
+export declare const rbacPermissionsPolicySchema: z.ZodType<RbacPermissionsPolicy>;
+export declare const abacOperatorSchema: z.ZodType<AbacOperator>;
+export declare const abacConditionSchema: z.ZodType<AbacCondition>;
+export declare const abacPolicySchema: z.ZodType<AbacPolicy>;
+export declare const resourceIdRefSchema: z.ZodType<ResourceIdRef>;
+export declare const rebacPolicySchema: z.ZodType<RebacPolicy>;
+export declare const authoritiesPolicySchema: z.ZodType<AuthoritiesPolicyMetadata>;
+/**
+ * Validates the `authorities` field on any entry decorator.
+ * Accepts: string (profile), string[] (profiles), or policy object.
+ */
+export declare const authoritiesMetadataSchema: z.ZodType<AuthoritiesMetadata>;
+export declare const authoritiesClaimsMappingSchema: z.ZodType<AuthoritiesClaimsMapping>;
+export declare const authoritiesConfigSchema: z.ZodType<AuthoritiesConfig>;
+//# sourceMappingURL=authorities.schema.d.ts.map

package/authorities/authorities.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.schema.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,yBAAyB,EAEzB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAOzD,CAAC;AAEL,eAAO,MAAM,2BAA2B,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAOrE,CAAC;AAML,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAcrD,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAIvD,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAO/C,CAAC;AAML,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAIvD,CAAC;AAEH,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAInD,CAAC;AAgBH,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAOxE,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAInE,CAAC;AAMH,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAI3E,CAAC;AAML,eAAO,MAAM,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAG/D,CAAC"}

package/authorities/authorities.scope-mapping.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Scope Mapping Resolver
+ *
+ * Resolves required OAuth scopes from a structured authority denial
+ * using explicit scopeMapping configuration.
+ */
+import type { AuthoritiesDenial, AuthoritiesMetadata } from './authorities.types';
+import type { AuthoritiesScopeMapping } from './authorities.profiles';
+/**
+ * Resolve required OAuth scopes from a structured denial and scopeMapping.
+ * Returns undefined if no mapping matches the denial.
+ *
+ * Uses explicit mapping only — no automatic permission-to-scope inference.
+ */
+export declare function resolveRequiredScopes(denial: AuthoritiesDenial, mapping: AuthoritiesScopeMapping, authorities: AuthoritiesMetadata): string[] | undefined;
+//# sourceMappingURL=authorities.scope-mapping.d.ts.map

package/authorities/authorities.scope-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorities.scope-mapping.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.scope-mapping.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,uBAAuB,EAChC,WAAW,EAAE,mBAAmB,GAC/B,MAAM,EAAE,GAAG,SAAS,CAkCtB"}