@frontmcp/auth 1.0.4 → 1.1.0

package/consent/consent.types.d.ts

@@ -4,103 +4,103 @@
  * Defines types for the tool consent flow that allows users to select
  * which MCP tools they want to expose to the LLM.
  */
-import { z } from 'zod';
+import { z } from '@frontmcp/lazy-zod';
 import { consentConfigSchema } from '../options/shared.schemas';
 export { consentConfigSchema };
 /**
  * Tool consent item schema - represents a tool available for consent
  */
-export declare const consentToolItemSchema: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    appId: z.ZodString;
-    appName: z.ZodString;
-    defaultSelected: z.ZodDefault<z.ZodBoolean>;
-    requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    category: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+export declare const consentToolItemSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    id: import("@frontmcp/lazy-zod").ZodString;
+    name: import("@frontmcp/lazy-zod").ZodString;
+    description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    appId: import("@frontmcp/lazy-zod").ZodString;
+    appName: import("@frontmcp/lazy-zod").ZodString;
+    defaultSelected: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requiredScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    category: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 /**
  * Consent selection schema - user's tool selection
  */
-export declare const consentSelectionSchema: z.ZodObject<{
-    selectedTools: z.ZodArray<z.ZodString>;
-    allSelected: z.ZodBoolean;
-    consentedAt: z.ZodString;
-    consentVersion: z.ZodDefault<z.ZodString>;
-}, z.core.$strip>;
+export declare const consentSelectionSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    selectedTools: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    allSelected: import("@frontmcp/lazy-zod").ZodBoolean;
+    consentedAt: import("@frontmcp/lazy-zod").ZodString;
+    consentVersion: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 /**
  * Consent page state schema - stored in pending authorization
  */
-export declare const consentStateSchema: z.ZodObject<{
-    enabled: z.ZodBoolean;
-    availableTools: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        appId: z.ZodString;
-        appName: z.ZodString;
-        defaultSelected: z.ZodDefault<z.ZodBoolean>;
-        requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        category: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    preselectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    groupByApp: z.ZodDefault<z.ZodBoolean>;
-    customMessage: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+export declare const consentStateSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    enabled: import("@frontmcp/lazy-zod").ZodBoolean;
+    availableTools: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        id: import("@frontmcp/lazy-zod").ZodString;
+        name: import("@frontmcp/lazy-zod").ZodString;
+        description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        appId: import("@frontmcp/lazy-zod").ZodString;
+        appName: import("@frontmcp/lazy-zod").ZodString;
+        defaultSelected: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        requiredScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+        category: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    preselectedTools: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    groupByApp: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    customMessage: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 /**
  * Auth provider item for federated login UI
  */
-export declare const federatedProviderItemSchema: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    icon: z.ZodOptional<z.ZodString>;
-    type: z.ZodEnum<{
+export declare const federatedProviderItemSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    id: import("@frontmcp/lazy-zod").ZodString;
+    name: import("@frontmcp/lazy-zod").ZodString;
+    description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    icon: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    type: import("@frontmcp/lazy-zod").ZodEnum<{
         transparent: "transparent";
         local: "local";
         remote: "remote";
     }>;
-    providerUrl: z.ZodOptional<z.ZodString>;
-    appIds: z.ZodArray<z.ZodString>;
-    appNames: z.ZodArray<z.ZodString>;
-    scopes: z.ZodArray<z.ZodString>;
-    isPrimary: z.ZodBoolean;
-    isOptional: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
+    providerUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    appIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    appNames: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    scopes: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    isPrimary: import("@frontmcp/lazy-zod").ZodBoolean;
+    isOptional: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>;
 /**
  * Federated login state schema
  */
-export declare const federatedLoginStateSchema: z.ZodObject<{
-    providers: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        icon: z.ZodOptional<z.ZodString>;
-        type: z.ZodEnum<{
+export declare const federatedLoginStateSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    providers: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        id: import("@frontmcp/lazy-zod").ZodString;
+        name: import("@frontmcp/lazy-zod").ZodString;
+        description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        icon: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        type: import("@frontmcp/lazy-zod").ZodEnum<{
             transparent: "transparent";
             local: "local";
             remote: "remote";
         }>;
-        providerUrl: z.ZodOptional<z.ZodString>;
-        appIds: z.ZodArray<z.ZodString>;
-        appNames: z.ZodArray<z.ZodString>;
-        scopes: z.ZodArray<z.ZodString>;
-        isPrimary: z.ZodBoolean;
-        isOptional: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>>;
-    primaryProviderId: z.ZodOptional<z.ZodString>;
-    allowSkip: z.ZodDefault<z.ZodBoolean>;
-    preselectedProviders: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
+        providerUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        appIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        appNames: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        scopes: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        isPrimary: import("@frontmcp/lazy-zod").ZodBoolean;
+        isOptional: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    }, import("zod/v4/core").$strip>>;
+    primaryProviderId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    allowSkip: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    preselectedProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+}, import("zod/v4/core").$strip>;
 /**
  * Federated login selection schema
  */
-export declare const federatedSelectionSchema: z.ZodObject<{
-    selectedProviders: z.ZodArray<z.ZodString>;
-    skippedProviders: z.ZodArray<z.ZodString>;
-    providerMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strip>;
+export declare const federatedSelectionSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    selectedProviders: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    skippedProviders: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    providerMetadata: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
+}, import("zod/v4/core").$strip>;
 export type ConsentToolItem = z.infer<typeof consentToolItemSchema>;
 export type ConsentSelection = z.infer<typeof consentSelectionSchema>;
 export type ConsentState = z.infer<typeof consentStateSchema>;

package/consent/consent.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent.types.d.ts","sourceRoot":"","sources":["../../src/consent/consent.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAM/B;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;iBAiBhC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;iBASjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;iBAW7B,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;iBAuBtC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;iBASpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;iBAOnC,CAAC;AAMH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"consent.types.d.ts","sourceRoot":"","sources":["../../src/consent/consent.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAM/B;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;gCAiBhC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;gCASjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;gCAW7B,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;gCAuBtC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;gCASpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;gCAOnC,CAAC;AAMH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/context/frontmcp-auth-context.d.ts

@@ -0,0 +1,113 @@
+/**
+ * FrontMcpAuthContext — FrontMCP's own auth identity interface.
+ *
+ * Extensible via `declare global { interface ExtendFrontMcpAuthContext { ... } }`.
+ * Custom fields are populated by auth context pipes registered in
+ * `@FrontMcp({ authorities: { pipes: [...] } })`.
+ */
+/**
+ * Global extension interface for FrontMcpAuthContext.
+ * Developers augment this to add custom typed fields extracted from JWT claims.
+ *
+ * @example
+ * ```typescript
+ * declare global {
+ *   interface ExtendFrontMcpAuthContext {
+ *     tenantId: string;
+ *     orgName: string;
+ *     subscription: { plan: string; active: boolean };
+ *   }
+ * }
+ * ```
+ */
+declare global {
+    interface ExtendFrontMcpAuthContext {
+    }
+}
+/**
+ * Pipe function that extracts custom fields from JWT claims during context construction.
+ * Can be sync or async (for DB/Redis lookups).
+ *
+ * @example
+ * ```typescript
+ * const extractTenant: AuthContextPipe = (claims) => ({
+ *   tenantId: claims['tenantId'] as string ?? '',
+ * });
+ *
+ * const lookupSubscription: AuthContextPipe = async (claims) => {
+ *   const plan = await db.query('SELECT plan FROM orgs WHERE id=$1', [claims['org_id']]);
+ *   return { subscription: { plan: plan?.name ?? 'free', active: !!plan?.active } };
+ * };
+ * ```
+ */
+export type AuthContextPipe = (claims: Readonly<Record<string, unknown>>) => Partial<ExtendFrontMcpAuthContext> | Promise<Partial<ExtendFrontMcpAuthContext>>;
+/**
+ * User identity attached to a FrontMcpAuthContext.
+ */
+export interface FrontMcpAuthUser {
+    /** Subject identifier (e.g., JWT `sub` claim) */
+    readonly sub: string;
+    /** Display name */
+    readonly name?: string;
+    /** Email address */
+    readonly email?: string;
+    /** Avatar URL */
+    readonly picture?: string;
+}
+/**
+ * Rich authentication context for FrontMCP request processing.
+ *
+ * Built from raw auth info (e.g., AuthInfo from MCP SDK) plus an optional
+ * {@link AuthoritiesClaimsMapping} that tells the builder where to find
+ * roles and permissions in IdP-specific JWT shapes.
+ *
+ * @example
+ * ```typescript
+ * if (ctx.isAnonymous) {
+ *   throw new Error('Authentication required');
+ * }
+ * if (!ctx.hasRole('admin')) {
+ *   throw new Error('Admin role required');
+ * }
+ * if (!ctx.hasAllScopes(['read', 'write'])) {
+ *   throw new Error('Insufficient scopes');
+ * }
+ * ```
+ */
+export interface FrontMcpAuthContext extends ExtendFrontMcpAuthContext {
+    /** Resolved user identity */
+    readonly user: FrontMcpAuthUser;
+    /** True when the user is anonymous (sub starts with `anon:` or is empty) */
+    readonly isAnonymous: boolean;
+    /** Authentication mode (e.g., 'public', 'transparent', 'orchestrated') */
+    readonly mode: string;
+    /** Session identifier (empty string if no session) */
+    readonly sessionId: string;
+    /** OAuth scopes granted to this session */
+    readonly scopes: readonly string[];
+    /** Raw JWT claims (merged from user + extra.authorization.claims) */
+    readonly claims: Readonly<Record<string, unknown>>;
+    /** Resolved roles (via claimsMapping or direct extraction) */
+    readonly roles: readonly string[];
+    /** Resolved permissions (via claimsMapping or direct extraction) */
+    readonly permissions: readonly string[];
+    /** Check whether the user has a specific role */
+    hasRole(role: string): boolean;
+    /** Check whether the user has ALL of the specified roles */
+    hasAllRoles(roles: readonly string[]): boolean;
+    /** Check whether the user has at least one of the specified roles */
+    hasAnyRole(roles: readonly string[]): boolean;
+    /** Check whether the user has a specific permission */
+    hasPermission(permission: string): boolean;
+    /** Check whether the user has ALL of the specified permissions */
+    hasAllPermissions(permissions: readonly string[]): boolean;
+    /** Check whether the user has at least one of the specified permissions */
+    hasAnyPermission(permissions: readonly string[]): boolean;
+    /** Check whether the session has a specific OAuth scope */
+    hasScope(scope: string): boolean;
+    /** Check whether the session has ALL of the specified OAuth scopes */
+    hasAllScopes(scopes: readonly string[]): boolean;
+    /** Check whether the session has at least one of the specified OAuth scopes */
+    hasAnyScope(scopes: readonly string[]): boolean;
+}
+//# sourceMappingURL=frontmcp-auth-context.d.ts.map

package/context/frontmcp-auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmcp-auth-context.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;;;;;;;;GAcG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,yBAAyB;KAAG;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACtC,OAAO,CAAC,yBAAyB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAMtF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mBAAmB;IACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB;IACjB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,yBAAyB;IACpE,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAEhC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAE9B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAEnC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,iDAAiD;IACjD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B,4DAA4D;IAC5D,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAE/C,qEAAqE;IACrE,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAE9C,uDAAuD;IACvD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAE3C,kEAAkE;IAClE,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3D,2EAA2E;IAC3E,gBAAgB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAE1D,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAEjC,sEAAsE;IACtE,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAEjD,+EAA+E;IAC/E,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;CACjD"}

package/context/frontmcp-auth-context.factory.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Factory function for building FrontMcpAuthContext instances.
+ *
+ * This is the recommended entry point — prefer `buildAuthContext()` over
+ * directly constructing `FrontMcpAuthContextImpl`.
+ */
+import type { AuthoritiesClaimsMapping } from '../authorities/authorities.profiles';
+import type { FrontMcpAuthContext, AuthContextPipe } from './frontmcp-auth-context';
+import type { AuthContextSourceInfo } from './frontmcp-auth-context.impl';
+/**
+ * Build a {@link FrontMcpAuthContext} from raw auth information.
+ *
+ * When `pipes` are provided, they run in sequence after the base context is built.
+ * Each pipe receives the merged JWT claims and returns custom fields that are
+ * merged into the final context. Pipes can be async (for DB/Redis lookups).
+ *
+ * @param authInfo - Raw auth info (e.g., from MCP SDK AuthInfo, JWT payload, etc.)
+ * @param claimsMapping - Optional IdP-specific claims mapping (Keycloak, Auth0, Okta, etc.)
+ * @param pipes - Optional pipe functions that extract custom fields from claims
+ * @returns A frozen, immutable FrontMcpAuthContext instance (with custom extensions if pipes provided)
+ *
+ * @example
+ * ```typescript
+ * // Without pipes
+ * const ctx = buildAuthContext({ user: { sub: 'user-123' } });
+ *
+ * // With pipes
+ * const ctx = await buildAuthContext(authInfo, claimsMapping, [
+ *   (claims) => ({ tenantId: claims['tenantId'] as string }),
+ *   async (claims) => {
+ *     const plan = await db.query('SELECT plan FROM orgs WHERE id=$1', [claims['org_id']]);
+ *     return { subscription: { plan: plan?.name ?? 'free', active: !!plan?.active } };
+ *   },
+ * ]);
+ * ```
+ */
+export declare function buildAuthContext(authInfo: AuthContextSourceInfo, claimsMapping?: AuthoritiesClaimsMapping): FrontMcpAuthContext;
+export declare function buildAuthContext(authInfo: AuthContextSourceInfo, claimsMapping: AuthoritiesClaimsMapping | undefined, pipes: AuthContextPipe[]): Promise<FrontMcpAuthContext>;
+//# sourceMappingURL=frontmcp-auth-context.factory.d.ts.map

package/context/frontmcp-auth-context.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmcp-auth-context.factory.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEpF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,CAAC,EAAE,wBAAwB,GACvC,mBAAmB,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,wBAAwB,GAAG,SAAS,EACnD,KAAK,EAAE,eAAe,EAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC"}

package/context/frontmcp-auth-context.impl.d.ts

@@ -0,0 +1,72 @@
+/**
+ * FrontMcpAuthContextImpl — Concrete implementation of FrontMcpAuthContext.
+ *
+ * Takes raw auth info and an optional AuthoritiesClaimsMapping, resolves
+ * roles/permissions using the same `resolveDotPath` utility used by the
+ * authorities engine, and exposes convenience query methods.
+ */
+import type { AuthoritiesClaimsMapping } from '../authorities/authorities.profiles';
+import type { FrontMcpAuthContext, FrontMcpAuthUser } from './frontmcp-auth-context';
+/**
+ * Minimal shape of incoming auth info that FrontMcpAuthContextImpl accepts.
+ * Intentionally loose so it can accept both MCP SDK AuthInfo shapes and
+ * FrontMCP's own future FrontMcpAuthInfo.
+ */
+export interface AuthContextSourceInfo {
+    /** OAuth token (if present) */
+    token?: string;
+    /** Client ID */
+    clientId?: string;
+    /** OAuth scopes */
+    scopes?: string[];
+    /** Token expiry (epoch seconds) */
+    expiresAt?: number;
+    /** User object — shape varies by IdP */
+    user?: {
+        sub?: string;
+        name?: string;
+        email?: string;
+        picture?: string;
+        roles?: string[];
+        permissions?: string[];
+        [key: string]: unknown;
+    };
+    /** Session ID (string or nested object with `id` field) */
+    sessionId?: string;
+    /** Extended claims / metadata */
+    extra?: Record<string, unknown>;
+    /** Allow additional top-level keys for forward-compat */
+    [key: string]: unknown;
+}
+/**
+ * Concrete implementation of {@link FrontMcpAuthContext}.
+ *
+ * Constructed via {@link buildAuthContext} factory — not intended for direct instantiation
+ * by application code (though it is exported for testing purposes).
+ */
+export declare class FrontMcpAuthContextImpl implements FrontMcpAuthContext {
+    readonly user: FrontMcpAuthUser;
+    readonly isAnonymous: boolean;
+    readonly mode: string;
+    readonly sessionId: string;
+    readonly scopes: readonly string[];
+    readonly claims: Readonly<Record<string, unknown>>;
+    readonly roles: readonly string[];
+    readonly permissions: readonly string[];
+    constructor(source: AuthContextSourceInfo, claimsMapping?: AuthoritiesClaimsMapping);
+    hasRole(role: string): boolean;
+    hasAllRoles(roles: readonly string[]): boolean;
+    hasAnyRole(roles: readonly string[]): boolean;
+    hasPermission(permission: string): boolean;
+    hasAllPermissions(permissions: readonly string[]): boolean;
+    hasAnyPermission(permissions: readonly string[]): boolean;
+    hasScope(scope: string): boolean;
+    hasAllScopes(scopes: readonly string[]): boolean;
+    hasAnyScope(scopes: readonly string[]): boolean;
+    /**
+     * Build the merged raw claims map from user fields + extra.authorization.claims.
+     * Mirrors the logic in AuthoritiesContextBuilder.build().
+     */
+    private buildRawClaims;
+}
+//# sourceMappingURL=frontmcp-auth-context.impl.d.ts.map

package/context/frontmcp-auth-context.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmcp-auth-context.impl.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yDAAyD;IACzD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE5B,MAAM,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,wBAAwB;IA0DnF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI9C,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAI1C,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI1D,gBAAgB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIzD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIhD,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAM/C;;;OAGG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/context/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * FrontMcpAuthContext module — FrontMCP's own auth identity type system.
+ *
+ * @example
+ * ```typescript
+ * import { buildAuthContext } from '@frontmcp/auth';
+ *
+ * const ctx = buildAuthContext(authInfo, { roles: 'realm_access.roles' });
+ * if (ctx.hasRole('admin')) { ... }
+ * ```
+ */
+export type { FrontMcpAuthContext, FrontMcpAuthUser, AuthContextPipe } from './frontmcp-auth-context';
+export { FrontMcpAuthContextImpl } from './frontmcp-auth-context.impl';
+export type { AuthContextSourceInfo } from './frontmcp-auth-context.impl';
+export { buildAuthContext } from './frontmcp-auth-context.factory';
+//# sourceMappingURL=index.d.ts.map

package/context/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC"}

package/detection/auth-provider-detection.d.ts

@@ -4,42 +4,42 @@
  * Detects unique auth providers across nested apps and determines
  * if orchestrated mode is required at the parent scope level.
  */
-import { z } from 'zod';
+import { z } from '@frontmcp/lazy-zod';
 import type { AuthOptions } from '../options/schema';
-export declare const detectedAuthProviderSchema: z.ZodObject<{
-    id: z.ZodString;
-    providerUrl: z.ZodOptional<z.ZodString>;
-    mode: z.ZodEnum<{
+export declare const detectedAuthProviderSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    id: import("@frontmcp/lazy-zod").ZodString;
+    providerUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    mode: import("@frontmcp/lazy-zod").ZodEnum<{
         public: "public";
         transparent: "transparent";
         local: "local";
         remote: "remote";
     }>;
-    appIds: z.ZodArray<z.ZodString>;
-    scopes: z.ZodArray<z.ZodString>;
-    isParentProvider: z.ZodBoolean;
-}, z.core.$strip>;
-export declare const authProviderDetectionResultSchema: z.ZodObject<{
-    providers: z.ZodMap<z.ZodString, z.ZodObject<{
-        id: z.ZodString;
-        providerUrl: z.ZodOptional<z.ZodString>;
-        mode: z.ZodEnum<{
+    appIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    scopes: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    isParentProvider: import("@frontmcp/lazy-zod").ZodBoolean;
+}, import("zod/v4/core").$strip>;
+export declare const authProviderDetectionResultSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    providers: import("zod").ZodMap<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodObject<{
+        id: import("@frontmcp/lazy-zod").ZodString;
+        providerUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        mode: import("@frontmcp/lazy-zod").ZodEnum<{
             public: "public";
             transparent: "transparent";
             local: "local";
             remote: "remote";
         }>;
-        appIds: z.ZodArray<z.ZodString>;
-        scopes: z.ZodArray<z.ZodString>;
-        isParentProvider: z.ZodBoolean;
-    }, z.core.$strip>>;
-    requiresOrchestration: z.ZodBoolean;
-    parentProviderId: z.ZodOptional<z.ZodString>;
-    childProviderIds: z.ZodArray<z.ZodString>;
-    uniqueProviderCount: z.ZodNumber;
-    validationErrors: z.ZodArray<z.ZodString>;
-    warnings: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
+        appIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        scopes: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        isParentProvider: import("@frontmcp/lazy-zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>>;
+    requiresOrchestration: import("@frontmcp/lazy-zod").ZodBoolean;
+    parentProviderId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    childProviderIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    uniqueProviderCount: import("@frontmcp/lazy-zod").ZodNumber;
+    validationErrors: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    warnings: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 export type DetectedAuthProvider = z.infer<typeof detectedAuthProviderSchema>;
 export type AuthProviderDetectionResult = z.infer<typeof authProviderDetectionResultSchema>;
 export interface AppAuthInfo {

package/detection/auth-provider-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider-detection.d.ts","sourceRoot":"","sources":["../../src/detection/auth-provider-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMrD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAOrC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;iBAQ5C,CAAC;AAMH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiB7D;AAyBD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,WAAW,GAAG,SAAS,EACnC,IAAI,EAAE,WAAW,EAAE,GAClB,2BAA2B,CA4E7B;AAcD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,EAAE,WAAW,GAAG,SAAS,GAClC,OAAO,CAaT;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtG;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpG"}
+{"version":3,"file":"auth-provider-detection.d.ts","sourceRoot":"","sources":["../../src/detection/auth-provider-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;gCAOrC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;gCAQ5C,CAAC;AAMH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiB7D;AAyBD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,WAAW,GAAG,SAAS,EACnC,IAAI,EAAE,WAAW,EAAE,GAClB,2BAA2B,CA4E7B;AAcD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,EAAE,WAAW,GAAG,SAAS,GAClC,OAAO,CAaT;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtG;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpG"}