@frontmcp/auth 1.0.4 → 1.1.0

package/esm/index.mjs

@@ -1149,8 +1149,8 @@ function renderToHtml(html, _options) {
 }
 
 // libs/auth/src/session/authorization.store.ts
+import { z } from "@frontmcp/lazy-zod";
 import { randomUUID, sha256Base64url } from "@frontmcp/utils";
-import { z } from "zod";
 var pkceChallengeSchema = z.object({
   challenge: z.string().min(43).max(128),
   method: z.literal("S256")
@@ -1428,7 +1428,7 @@ var RedisAuthorizationStore = class {
 };
 
 // libs/auth/src/session/authorization-vault.ts
-import { z as z2 } from "zod";
+import { z as z2 } from "@frontmcp/lazy-zod";
 var credentialTypeSchema = z2.enum([
   "oauth",
   // OAuth 2.0 tokens
@@ -1689,14 +1689,14 @@ var authorizationVaultEntrySchema = z2.object({
 });
 
 // libs/auth/src/session/vault-encryption.ts
-import { z as z3 } from "zod";
+import { z as z3 } from "@frontmcp/lazy-zod";
 import {
-  hkdfSha256,
-  encryptAesGcm,
-  decryptAesGcm,
-  randomBytes as randomBytes2,
+  base64urlDecode,
   base64urlEncode,
-  base64urlDecode
+  decryptAesGcm,
+  encryptAesGcm,
+  hkdfSha256,
+  randomBytes as randomBytes2
 } from "@frontmcp/utils";
 var encryptedDataSchema = z3.object({
   /** Version for future algorithm changes */
@@ -1940,7 +1940,7 @@ import {
 } from "@frontmcp/utils";
 
 // libs/auth/src/session/transport-session.types.ts
-import { z as z4 } from "zod";
+import { z as z4 } from "@frontmcp/lazy-zod";
 var transportProtocolSchema = z4.enum([
   "legacy-sse",
   "sse",
@@ -2426,84 +2426,13 @@ function extractBearerToken(header) {
 }
 
 // libs/auth/src/session/utils/session-crypto.utils.ts
-import { sha256, encryptValue, decryptValue, getEnv as getEnv3, isProduction as isProduction4 } from "@frontmcp/utils";
-
-// libs/auth/src/machine-id/machine-id.ts
-import { randomUUID as randomUUID3, mkdir, writeFile, readFileSync, getEnv as getEnv2, getCwd, isProduction as isProduction3, isBrowser } from "@frontmcp/utils";
-var DEFAULT_MACHINE_ID_PATH = ".frontmcp/machine-id";
-function isDevPersistenceEnabled() {
-  if (isBrowser()) return false;
-  return !isProduction3();
-}
-function resolveMachineIdPath() {
-  if (isBrowser()) return DEFAULT_MACHINE_ID_PATH;
-  const path = __require("path");
-  const machineIdPath = getEnv2("MACHINE_ID_PATH") ?? DEFAULT_MACHINE_ID_PATH;
-  return path.isAbsolute(machineIdPath) ? machineIdPath : path.resolve(getCwd(), machineIdPath);
-}
-function loadMachineIdSync() {
-  if (!isDevPersistenceEnabled()) {
-    return null;
-  }
-  const machineIdPath = resolveMachineIdPath();
-  try {
-    const content = readFileSync(machineIdPath, "utf8").trim();
-    if (/^[0-9a-f-]{32,36}$/i.test(content)) {
-      return content;
-    }
-    console.warn(`[MachineId] Invalid format at ${machineIdPath}, will regenerate`);
-    return null;
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      console.warn(`[MachineId] Failed to load from ${machineIdPath}: ${error.message}`);
-    }
-    return null;
-  }
-}
-function saveMachineIdAsync(machineId2) {
-  if (!isDevPersistenceEnabled()) {
-    return;
-  }
-  const machineIdPath = resolveMachineIdPath();
-  const path = __require("path");
-  const dir = path.dirname(machineIdPath);
-  (async () => {
-    try {
-      await mkdir(dir, { recursive: true, mode: 448 });
-      await writeFile(machineIdPath, machineId2, { mode: 384 });
-    } catch (error) {
-      console.warn(`[MachineId] Failed to save to ${machineIdPath}: ${error.message}`);
-    }
-  })();
-}
-var machineId = (() => {
-  const envMachineId = getEnv2("MACHINE_ID");
-  if (envMachineId) {
-    return envMachineId;
-  }
-  const loadedId = loadMachineIdSync();
-  if (loadedId) {
-    return loadedId;
-  }
-  const newId = randomUUID3();
-  saveMachineIdAsync(newId);
-  return newId;
-})();
-var machineIdOverride;
-function getMachineId() {
-  return machineIdOverride ?? machineId;
-}
-function setMachineIdOverride(id) {
-  machineIdOverride = id;
-}
-
-// libs/auth/src/session/utils/session-crypto.utils.ts
+import { decryptValue, encryptValue, getEnv as getEnv2, getMachineId, isProduction as isProduction3, sha256 } from "@frontmcp/utils";
 var cachedKey = null;
 function getKey() {
   if (cachedKey) return cachedKey;
-  const secret = getEnv3("MCP_SESSION_SECRET");
+  const secret = getEnv2("MCP_SESSION_SECRET");
   if (!secret) {
-    if (isProduction4()) {
+    if (isProduction3()) {
       throw new SessionSecretRequiredError("session ID encryption");
     }
     console.warn(
@@ -2543,7 +2472,7 @@ import { TypedStorage as TypedStorage3 } from "@frontmcp/utils";
 import { EncryptedTypedStorage, EncryptedStorageError } from "@frontmcp/utils";
 
 // libs/auth/src/session/storage/storage-token-store.ts
-import { randomUUID as randomUUID4, TypedStorage } from "@frontmcp/utils";
+import { randomUUID as randomUUID3, TypedStorage } from "@frontmcp/utils";
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -2561,7 +2490,7 @@ var StorageTokenStore = class {
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return randomUUID4();
+    return randomUUID3();
   }
   /**
    * Store an encrypted token blob.
@@ -2624,7 +2553,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-import { randomUUID as randomUUID5, TypedStorage as TypedStorage2 } from "@frontmcp/utils";
+import { randomUUID as randomUUID4, TypedStorage as TypedStorage2 } from "@frontmcp/utils";
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -2644,7 +2573,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: randomUUID5(),
+      id: randomUUID4(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -2718,7 +2647,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: randomUUID5(),
+      id: randomUUID4(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -2947,7 +2876,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-import { randomUUID as randomUUID6, RedisStorageAdapter } from "@frontmcp/utils";
+import { randomUUID as randomUUID5, RedisStorageAdapter } from "@frontmcp/utils";
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -3158,7 +3087,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return randomUUID6();
+    return randomUUID5();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -3194,7 +3123,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-import { randomUUID as randomUUID7, VercelKvStorageAdapter } from "@frontmcp/utils";
+import { randomUUID as randomUUID6, VercelKvStorageAdapter } from "@frontmcp/utils";
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -3388,7 +3317,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return randomUUID7();
+    return randomUUID6();
   }
   /**
    * Disconnect from Vercel KV
@@ -3688,7 +3617,7 @@ var InMemoryOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/federated-auth.session.ts
-import { randomUUID as randomUUID8 } from "@frontmcp/utils";
+import { randomUUID as randomUUID7 } from "@frontmcp/utils";
 function toSessionRecord(session) {
   return {
     ...session,
@@ -3763,7 +3692,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: randomUUID8(),
+      id: randomUUID7(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -3795,7 +3724,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: randomUUID8(),
+    id: randomUUID7(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -3852,9 +3781,8 @@ function startNextProvider(session, pkce, state) {
 }
 
 // libs/auth/src/session/encrypted-authorization-vault.ts
-import { z as z5 } from "zod";
-import { randomUUID as randomUUID9 } from "@frontmcp/utils";
-import { AsyncLocalStorage } from "@frontmcp/utils";
+import { z as z5 } from "@frontmcp/lazy-zod";
+import { AsyncLocalStorage, randomUUID as randomUUID8 } from "@frontmcp/utils";
 var redisVaultEntrySchema = z5.object({
   /** Vault ID */
   id: z5.string(),
@@ -4012,7 +3940,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: randomUUID9(),
+      id: randomUUID8(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -4071,7 +3999,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: randomUUID9(),
+      id: randomUUID8(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4280,7 +4208,7 @@ function tryJwtExp(token) {
 }
 
 // libs/auth/src/authorization/authorization.types.ts
-import { z as z6 } from "zod";
+import { z as z6 } from "@frontmcp/lazy-zod";
 var authModeSchema = z6.enum(["public", "transparent", "orchestrated"]);
 var authUserSchema = z6.object({
   sub: z6.string(),
@@ -4334,7 +4262,7 @@ var progressiveAuthStateSchema = z6.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-import { randomUUID as randomUUID10, base64urlDecode as base64urlDecode4 } from "@frontmcp/utils";
+import { base64urlDecode as base64urlDecode4, getMachineId as getMachineId2, randomUUID as randomUUID9 } from "@frontmcp/utils";
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -4382,14 +4310,14 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = randomUUID10();
+    const sessionId = randomUUID9();
     const session = {
       id: sessionId,
       authorizationId: this.id,
       protocol,
       createdAt: Date.now(),
       expiresAt: this.expiresAt,
-      nodeId: getMachineId(),
+      nodeId: getMachineId2(),
       clientFingerprint: fingerprint
     };
     this.#sessions.set(session.id, session);
@@ -4571,7 +4499,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-import { randomUUID as randomUUID11 } from "@frontmcp/utils";
+import { randomUUID as randomUUID10 } from "@frontmcp/utils";
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -4607,7 +4535,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = randomUUID11();
+    const uuid = randomUUID10();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -5189,7 +5117,7 @@ var OrchestratedAuthAccessorAdapter = class {
 };
 
 // libs/auth/src/common/jwt.types.ts
-import { z as z7 } from "zod";
+import { z as z7 } from "@frontmcp/lazy-zod";
 var jwkParametersSchema = z7.object({
   kty: z7.string().optional(),
   alg: z7.string().optional(),
@@ -5223,7 +5151,7 @@ var jsonWebKeySetSchema = z7.object({
 });
 
 // libs/auth/src/common/session.types.ts
-import { z as z8 } from "zod";
+import { z as z8 } from "@frontmcp/lazy-zod";
 var aiPlatformTypeSchema = z8.enum([
   "openai",
   "claude",
@@ -5273,7 +5201,7 @@ var authorizationSchema = z8.object({
 });
 
 // libs/auth/src/options/shared.schemas.ts
-import { z as z10 } from "zod";
+import { z as z10 } from "@frontmcp/lazy-zod";
 
 // libs/auth/src/cimd/cimd.logger.ts
 var noopLogger = {
@@ -5289,7 +5217,7 @@ var noopLogger = {
 };
 
 // libs/auth/src/cimd/cimd.types.ts
-import { z as z9 } from "zod";
+import { z as z9 } from "@frontmcp/lazy-zod";
 var clientMetadataDocumentSchema = z9.object({
   // REQUIRED per CIMD spec
   /**
@@ -6381,7 +6309,7 @@ var incrementalAuthConfigSchema = z10.object({
 });
 
 // libs/auth/src/options/public.schema.ts
-import { z as z11 } from "zod";
+import { z as z11 } from "@frontmcp/lazy-zod";
 var publicAuthOptionsSchema = z11.object({
   mode: z11.literal("public"),
   /**
@@ -6416,7 +6344,7 @@ var publicAuthOptionsSchema = z11.object({
 });
 
 // libs/auth/src/options/transparent.schema.ts
-import { z as z12 } from "zod";
+import { z as z12 } from "@frontmcp/lazy-zod";
 var transparentAuthOptionsSchema = z12.object({
   mode: z12.literal("transparent"),
   /**
@@ -6451,7 +6379,7 @@ var transparentAuthOptionsSchema = z12.object({
 });
 
 // libs/auth/src/options/orchestrated.schema.ts
-import { z as z13 } from "zod";
+import { z as z13 } from "@frontmcp/lazy-zod";
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
@@ -6478,7 +6406,7 @@ var orchestratedLocalSchema = localAuthSchema;
 var orchestratedRemoteSchema = remoteAuthSchema;
 
 // libs/auth/src/options/schema.ts
-import { z as z14 } from "zod";
+import { z as z14 } from "@frontmcp/lazy-zod";
 var authOptionsSchema = z14.union([
   publicAuthOptionsSchema,
   transparentAuthOptionsSchema,
@@ -6487,7 +6415,7 @@ var authOptionsSchema = z14.union([
 ]);
 
 // libs/auth/src/options/app-auth.schema.ts
-import { z as z15 } from "zod";
+import { z as z15 } from "@frontmcp/lazy-zod";
 var standaloneOptionSchema = {
   standalone: z15.boolean().optional(),
   excludeFromParent: z15.boolean().optional()
@@ -6532,7 +6460,7 @@ function allowsPublicAccess(options) {
 }
 
 // libs/auth/src/consent/consent.types.ts
-import { z as z16 } from "zod";
+import { z as z16 } from "@frontmcp/lazy-zod";
 var consentToolItemSchema = z16.object({
   /** Tool ID (e.g., 'slack:send_message') */
   id: z16.string().min(1),
@@ -6617,7 +6545,7 @@ var federatedSelectionSchema = z16.object({
 });
 
 // libs/auth/src/detection/auth-provider-detection.ts
-import { z as z17 } from "zod";
+import { z as z17 } from "@frontmcp/lazy-zod";
 var detectedAuthProviderSchema = z17.object({
   id: z17.string(),
   providerUrl: z17.string().optional(),
@@ -7023,7 +6951,7 @@ var AudienceValidator = class _AudienceValidator {
 };
 
 // libs/auth/src/vault/auth-providers.types.ts
-import { z as z18 } from "zod";
+import { z as z18 } from "@frontmcp/lazy-zod";
 var credentialScopeSchema = z18.enum(["global", "user", "session"]);
 var loadingStrategySchema = z18.enum(["eager", "lazy"]);
 var getCredentialOptionsSchema = z18.object({
@@ -8024,6 +7952,971 @@ var LazyCredentialLoader = class {
     this.loading.clear();
   }
 };
+
+// libs/auth/src/authorities/authorities.context.ts
+function resolveDotPath(obj, path) {
+  if (path in obj) {
+    return obj[path];
+  }
+  const segments = path.split(".");
+  let current = obj;
+  for (const segment of segments) {
+    if (current === null || current === void 0 || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  if (typeof value === "string") {
+    return value.split(/\s+/).filter(Boolean);
+  }
+  return [];
+}
+var noopRelationshipResolver = {
+  async check() {
+    return false;
+  }
+};
+var AuthoritiesContextBuilder = class {
+  claimsMapping;
+  claimsResolver;
+  relationshipResolver;
+  constructor(options = {}) {
+    this.claimsMapping = options.claimsMapping;
+    this.claimsResolver = options.claimsResolver;
+    this.relationshipResolver = options.relationshipResolver ?? noopRelationshipResolver;
+  }
+  /**
+   * Build an evaluation context from AuthInfo and tool input.
+   */
+  build(authInfo, input = {}, env = {}) {
+    if (this.claimsResolver) {
+      const resolved = this.claimsResolver(authInfo);
+      return {
+        user: {
+          sub: authInfo?.user?.sub ?? "",
+          roles: resolved.roles,
+          permissions: resolved.permissions,
+          claims: resolved.claims
+        },
+        input,
+        env,
+        relationships: this.relationshipResolver
+      };
+    }
+    const user = authInfo?.user ?? {};
+    const authorization = authInfo?.extra?.["authorization"];
+    const authorizationClaims = authorization?.["claims"] ?? {};
+    const rawClaims = {
+      ...authorizationClaims,
+      ...user
+    };
+    let roles;
+    if (this.claimsMapping?.roles) {
+      roles = toStringArray(resolveDotPath(rawClaims, this.claimsMapping.roles));
+    } else {
+      roles = toStringArray(
+        user["roles"] ?? authorization?.["scopes"] ?? []
+      );
+    }
+    let permissions;
+    if (this.claimsMapping?.permissions) {
+      permissions = toStringArray(resolveDotPath(rawClaims, this.claimsMapping.permissions));
+    } else {
+      permissions = toStringArray(user["permissions"] ?? []);
+    }
+    const sub = this.claimsMapping?.userId ? String(resolveDotPath(rawClaims, this.claimsMapping.userId) ?? "") : user.sub ?? "";
+    return {
+      user: {
+        sub,
+        roles,
+        permissions,
+        claims: rawClaims
+      },
+      input,
+      env,
+      relationships: this.relationshipResolver
+    };
+  }
+};
+
+// libs/auth/src/context/frontmcp-auth-context.impl.ts
+function toStringArray2(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  if (typeof value === "string") {
+    return value.split(/\s+/).filter(Boolean);
+  }
+  return [];
+}
+var FrontMcpAuthContextImpl = class {
+  user;
+  isAnonymous;
+  mode;
+  sessionId;
+  scopes;
+  claims;
+  roles;
+  permissions;
+  constructor(source, claimsMapping) {
+    const rawUser = source.user ?? {};
+    const sub = claimsMapping?.userId ? String(resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) ?? rawUser.sub ?? "") : String(rawUser.sub ?? "");
+    this.user = Object.freeze({
+      sub,
+      name: rawUser.name,
+      email: rawUser.email,
+      picture: rawUser.picture
+    });
+    this.isAnonymous = sub === "" || sub.startsWith("anon:");
+    const extraAuth = source.extra?.["authorization"];
+    this.mode = String(
+      source.extra?.["authMode"] ?? extraAuth?.["mode"] ?? (source.extra?.["isPublic"] === true || rawUser["anonymous"] === true ? "public" : "authenticated")
+    );
+    this.sessionId = typeof source.sessionId === "string" ? source.sessionId : "";
+    this.scopes = Object.freeze(
+      Array.isArray(source.scopes) ? source.scopes.filter((s) => typeof s === "string") : []
+    );
+    const rawClaims = this.buildRawClaims(source);
+    this.claims = Object.freeze({ ...rawClaims });
+    if (claimsMapping?.roles) {
+      this.roles = Object.freeze([...toStringArray2(resolveDotPath(rawClaims, claimsMapping.roles))]);
+    } else {
+      this.roles = Object.freeze([
+        ...toStringArray2(rawUser["roles"] ?? extraAuth?.["scopes"] ?? [])
+      ]);
+    }
+    if (claimsMapping?.permissions) {
+      this.permissions = Object.freeze([...toStringArray2(resolveDotPath(rawClaims, claimsMapping.permissions))]);
+    } else {
+      this.permissions = Object.freeze([...toStringArray2(rawUser["permissions"] ?? [])]);
+    }
+  }
+  // -- Query methods -------------------------------------------------
+  hasRole(role) {
+    return this.roles.includes(role);
+  }
+  hasAllRoles(roles) {
+    return roles.every((r) => this.roles.includes(r));
+  }
+  hasAnyRole(roles) {
+    return roles.some((r) => this.roles.includes(r));
+  }
+  hasPermission(permission) {
+    return this.permissions.includes(permission);
+  }
+  hasAllPermissions(permissions) {
+    return permissions.every((p) => this.permissions.includes(p));
+  }
+  hasAnyPermission(permissions) {
+    return permissions.some((p) => this.permissions.includes(p));
+  }
+  hasScope(scope) {
+    return this.scopes.includes(scope);
+  }
+  hasAllScopes(scopes) {
+    return scopes.every((s) => this.scopes.includes(s));
+  }
+  hasAnyScope(scopes) {
+    return scopes.some((s) => this.scopes.includes(s));
+  }
+  // -- Internal helpers ----------------------------------------------
+  /**
+   * Build the merged raw claims map from user fields + extra.authorization.claims.
+   * Mirrors the logic in AuthoritiesContextBuilder.build().
+   */
+  buildRawClaims(source) {
+    const rawUser = source.user ?? {};
+    const extraAuth = source.extra?.["authorization"];
+    const authorizationClaims = extraAuth?.["claims"] ?? {};
+    return {
+      ...authorizationClaims,
+      ...rawUser
+    };
+  }
+};
+
+// libs/auth/src/context/frontmcp-auth-context.factory.ts
+function buildAuthContext(authInfo, claimsMapping, pipes) {
+  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping);
+  if (!pipes || pipes.length === 0) {
+    return base;
+  }
+  return runPipes(base, pipes);
+}
+async function runPipes(base, pipes) {
+  const extensions = {};
+  for (const pipe of pipes) {
+    try {
+      const result = await pipe(base.claims);
+      if (result && typeof result === "object") {
+        Object.assign(extensions, result);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[FrontMcpAuth] pipe failed: ${message}`);
+    }
+  }
+  const merged = Object.create(Object.getPrototypeOf(base));
+  Object.assign(merged, base, extensions);
+  return Object.freeze(merged);
+}
+
+// libs/auth/src/authorities/authorities.scope-mapping.ts
+function resolveRequiredScopes(denial, mapping, authorities) {
+  const scopes = /* @__PURE__ */ new Set();
+  if (typeof authorities === "string" && mapping.profiles?.[authorities]) {
+    mapping.profiles[authorities].forEach((s) => scopes.add(s));
+  }
+  if (Array.isArray(authorities)) {
+    for (const profileName of authorities) {
+      if (typeof profileName === "string" && mapping.profiles?.[profileName]) {
+        mapping.profiles[profileName].forEach((s) => scopes.add(s));
+      }
+    }
+  }
+  if (denial.kind === "roles" && denial.missing && mapping.roles) {
+    for (const role of denial.missing) {
+      const mapped = mapping.roles[role];
+      if (mapped) mapped.forEach((s) => scopes.add(s));
+    }
+  }
+  if (denial.kind === "permissions" && denial.missing && mapping.permissions) {
+    for (const perm of denial.missing) {
+      const mapped = mapping.permissions[perm];
+      if (mapped) mapped.forEach((s) => scopes.add(s));
+    }
+  }
+  return scopes.size > 0 ? [...scopes].sort() : void 0;
+}
+
+// libs/auth/src/authorities/authorities.schema.ts
+import { z as z19 } from "@frontmcp/lazy-zod";
+var rbacRolesPolicySchema = z19.object({
+  all: z19.array(z19.string().min(1)).optional(),
+  any: z19.array(z19.string().min(1)).optional()
+}).refine((data) => data.all !== void 0 || data.any !== void 0, {
+  message: 'Roles policy must have at least "all" or "any"'
+});
+var rbacPermissionsPolicySchema = z19.object({
+  all: z19.array(z19.string().min(1)).optional(),
+  any: z19.array(z19.string().min(1)).optional()
+}).refine((data) => data.all !== void 0 || data.any !== void 0, {
+  message: 'Permissions policy must have at least "all" or "any"'
+});
+var abacOperatorSchema = z19.enum([
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "exists",
+  "matches"
+]);
+var abacConditionSchema = z19.object({
+  path: z19.string().min(1),
+  op: abacOperatorSchema,
+  value: z19.unknown()
+});
+var abacPolicySchema = z19.object({
+  match: z19.record(z19.string(), z19.unknown()).optional(),
+  conditions: z19.array(abacConditionSchema).optional()
+}).refine((data) => data.match !== void 0 || data.conditions !== void 0, {
+  message: 'Attributes policy must have at least "match" or "conditions"'
+});
+var resourceIdRefSchema = z19.union([
+  z19.string().min(1),
+  z19.object({ fromInput: z19.string().min(1) }).strict(),
+  z19.object({ fromClaims: z19.string().min(1) }).strict()
+]);
+var rebacPolicySchema = z19.object({
+  type: z19.string().min(1),
+  resource: z19.string().min(1),
+  resourceId: resourceIdRefSchema
+});
+var basePolicyShape = {
+  roles: rbacRolesPolicySchema.optional(),
+  permissions: rbacPermissionsPolicySchema.optional(),
+  attributes: abacPolicySchema.optional(),
+  relationships: z19.union([rebacPolicySchema, z19.array(rebacPolicySchema)]).optional(),
+  custom: z19.record(z19.string(), z19.unknown()).optional(),
+  guards: z19.array(z19.instanceof(Function)).optional(),
+  operator: z19.enum(["AND", "OR"]).optional()
+};
+var authoritiesPolicySchema = z19.lazy(
+  () => z19.object({
+    ...basePolicyShape,
+    not: authoritiesPolicySchema.optional(),
+    anyOf: z19.array(authoritiesPolicySchema).optional(),
+    allOf: z19.array(authoritiesPolicySchema).optional()
+  })
+);
+var authoritiesMetadataSchema = z19.union([
+  z19.string().min(1),
+  z19.array(z19.string().min(1)).min(1),
+  authoritiesPolicySchema
+]);
+var authoritiesClaimsMappingSchema = z19.record(z19.string(), z19.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
+  message: "Claims mapping must have at least one mapping"
+});
+var authoritiesConfigSchema = z19.object({
+  claimsMapping: authoritiesClaimsMappingSchema.optional(),
+  profiles: z19.record(z19.string().min(1), authoritiesPolicySchema).optional()
+});
+
+// libs/auth/src/authorities/authorities.evaluator.ts
+function evaluateRbacRoles(policy, ctx) {
+  const userRoles = ctx.user.roles;
+  if (policy.all) {
+    const missing = policy.all.filter((r) => !userRoles.includes(r));
+    if (missing.length > 0) {
+      return {
+        granted: false,
+        deniedBy: `roles.all: missing ${missing.map((r) => `'${r}'`).join(", ")}`,
+        denial: { kind: "roles", path: "roles.all", missing },
+        evaluatedPolicies: ["roles.all"]
+      };
+    }
+  }
+  if (policy.any) {
+    const hasAny = policy.any.some((r) => userRoles.includes(r));
+    if (!hasAny) {
+      return {
+        granted: false,
+        deniedBy: `roles.any: user has none of ${policy.any.map((r) => `'${r}'`).join(", ")}`,
+        denial: { kind: "roles", path: "roles.any", missing: policy.any },
+        evaluatedPolicies: ["roles.any"]
+      };
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["roles"] };
+}
+function evaluateRbacPermissions(policy, ctx) {
+  const userPerms = ctx.user.permissions;
+  if (policy.all) {
+    const missing = policy.all.filter((p) => !userPerms.includes(p));
+    if (missing.length > 0) {
+      return {
+        granted: false,
+        deniedBy: `permissions.all: missing ${missing.map((p) => `'${p}'`).join(", ")}`,
+        denial: { kind: "permissions", path: "permissions.all", missing },
+        evaluatedPolicies: ["permissions.all"]
+      };
+    }
+  }
+  if (policy.any) {
+    const hasAny = policy.any.some((p) => userPerms.includes(p));
+    if (!hasAny) {
+      return {
+        granted: false,
+        deniedBy: `permissions.any: user has none of ${policy.any.map((p) => `'${p}'`).join(", ")}`,
+        denial: { kind: "permissions", path: "permissions.any", missing: policy.any },
+        evaluatedPolicies: ["permissions.any"]
+      };
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["permissions"] };
+}
+function buildContextEnvelope(ctx) {
+  return {
+    user: ctx.user,
+    claims: ctx.user.claims,
+    input: ctx.input,
+    env: ctx.env
+  };
+}
+function resolveValue(value, ctx) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    if ("fromInput" in obj && typeof obj["fromInput"] === "string") {
+      return ctx.input[obj["fromInput"]];
+    }
+    if ("fromClaims" in obj && typeof obj["fromClaims"] === "string") {
+      return resolveDotPath(ctx.user.claims, obj["fromClaims"]);
+    }
+  }
+  return value;
+}
+function applyOperator(actual, op, expected) {
+  switch (op) {
+    case "eq":
+      return actual === expected;
+    case "neq":
+      return actual !== expected;
+    case "in":
+      return Array.isArray(expected) && expected.includes(actual);
+    case "notIn":
+      return Array.isArray(expected) && !expected.includes(actual);
+    case "gt":
+      return typeof actual === "number" && typeof expected === "number" && actual > expected;
+    case "gte":
+      return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+    case "lt":
+      return typeof actual === "number" && typeof expected === "number" && actual < expected;
+    case "lte":
+      return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+    case "contains":
+      if (typeof actual === "string" && typeof expected === "string") return actual.includes(expected);
+      if (Array.isArray(actual)) return actual.includes(expected);
+      return false;
+    case "startsWith":
+      return typeof actual === "string" && typeof expected === "string" && actual.startsWith(expected);
+    case "endsWith":
+      return typeof actual === "string" && typeof expected === "string" && actual.endsWith(expected);
+    case "exists":
+      return expected ? actual !== void 0 && actual !== null : actual === void 0 || actual === null;
+    case "matches":
+      if (typeof actual !== "string" || typeof expected !== "string") return false;
+      if (expected.length > 256) return false;
+      if (/(\+\+|\*\*|\{\d+,\d*\}\{)/.test(expected)) return false;
+      try {
+        return new RegExp(expected).test(actual);
+      } catch {
+        return false;
+      }
+    default:
+      return false;
+  }
+}
+function evaluateCondition(condition, envelope, ctx) {
+  const actual = resolveDotPath(envelope, condition.path);
+  const expected = resolveValue(condition.value, ctx);
+  return applyOperator(actual, condition.op, expected);
+}
+function evaluateAbac(policy, ctx) {
+  const envelope = buildContextEnvelope(ctx);
+  if (policy.match) {
+    for (const [path, expectedRaw] of Object.entries(policy.match)) {
+      const actual = resolveDotPath(envelope, path);
+      const expected = resolveValue(expectedRaw, ctx);
+      if (actual !== expected) {
+        return {
+          granted: false,
+          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
+          denial: { kind: "attributes", path: "attributes.match", expected, actual },
+          evaluatedPolicies: ["attributes.match"]
+        };
+      }
+    }
+  }
+  if (policy.conditions) {
+    for (let i = 0; i < policy.conditions.length; i++) {
+      const condition = policy.conditions[i];
+      if (!evaluateCondition(condition, envelope, ctx)) {
+        const expected = resolveValue(condition.value, ctx);
+        const actual = resolveDotPath(envelope, condition.path);
+        return {
+          granted: false,
+          deniedBy: `attributes.conditions: '${condition.path}' failed '${condition.op}' check against '${String(expected)}'`,
+          denial: { kind: "attributes", path: `attributes.conditions[${i}]`, expected, actual },
+          evaluatedPolicies: ["attributes.conditions"]
+        };
+      }
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["attributes"] };
+}
+function resolveResourceId(ref, ctx) {
+  if (typeof ref === "string") return ref;
+  if ("fromInput" in ref) {
+    const val = ctx.input[ref.fromInput];
+    return typeof val === "string" ? val : void 0;
+  }
+  if ("fromClaims" in ref) {
+    const val = resolveDotPath(ctx.user.claims, ref.fromClaims);
+    return typeof val === "string" ? val : void 0;
+  }
+  return void 0;
+}
+async function evaluateSingleRebac(policy, ctx) {
+  const resourceId = resolveResourceId(policy.resourceId, ctx);
+  if (resourceId === void 0) {
+    return {
+      granted: false,
+      deniedBy: `relationships: could not resolve resourceId for ${policy.resource}`,
+      denial: {
+        kind: "relationships",
+        path: "relationships",
+        expected: `${policy.resource}:resourceId`,
+        actual: void 0
+      },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, ctx.user.sub, ctx);
+  if (!hasRelationship) {
+    return {
+      granted: false,
+      deniedBy: `relationships: user '${ctx.user.sub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
+      denial: {
+        kind: "relationships",
+        path: "relationships",
+        expected: `${policy.type}:${policy.resource}:${resourceId}`
+      },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  return { granted: true, evaluatedPolicies: ["relationships"] };
+}
+async function evaluateRebac(policy, ctx) {
+  const policies = Array.isArray(policy) ? policy : [policy];
+  for (const p of policies) {
+    const result = await evaluateSingleRebac(p, ctx);
+    if (!result.granted) return result;
+  }
+  return { granted: true, evaluatedPolicies: ["relationships"] };
+}
+
+// libs/auth/src/authorities/authorities.engine.ts
+function mergeResult(base, ...others) {
+  const evaluatedPolicies = [...base.evaluatedPolicies];
+  for (const other of others) {
+    evaluatedPolicies.push(...other.evaluatedPolicies);
+  }
+  return { ...base, evaluatedPolicies };
+}
+function granted(policies) {
+  return { granted: true, evaluatedPolicies: policies };
+}
+var AuthoritiesEngine = class {
+  constructor(profiles, evaluators) {
+    this.profiles = profiles;
+    this.evaluators = evaluators;
+  }
+  /**
+   * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
+   */
+  async evaluate(authorities, ctx) {
+    if (typeof authorities === "string") {
+      return this.evaluateProfile(authorities, ctx);
+    }
+    if (Array.isArray(authorities)) {
+      return this.evaluateProfileArray(authorities, ctx);
+    }
+    return this.evaluatePolicy(authorities, ctx);
+  }
+  /**
+   * Resolve and evaluate a single named profile.
+   */
+  async evaluateProfile(name, ctx) {
+    const policy = this.profiles.resolve(name);
+    if (!policy) {
+      return {
+        granted: false,
+        deniedBy: `profile '${name}' is not registered`,
+        evaluatedPolicies: [`profile:${name}`]
+      };
+    }
+    const result = await this.evaluatePolicy(policy, ctx);
+    if (!result.granted) {
+      return {
+        ...result,
+        deniedBy: `profile:${name}: ${result.deniedBy}`,
+        evaluatedPolicies: [`profile:${name}`, ...result.evaluatedPolicies]
+      };
+    }
+    return mergeResult(result, { granted: true, evaluatedPolicies: [`profile:${name}`] });
+  }
+  /**
+   * Evaluate an array of profile names (AND semantics).
+   */
+  async evaluateProfileArray(names, ctx) {
+    const allPolicies = [];
+    for (const name of names) {
+      const result = await this.evaluateProfile(name, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * Evaluate an inline policy object.
+   */
+  async evaluatePolicy(policy, ctx) {
+    const operator = policy.operator ?? "AND";
+    const results = [];
+    if (policy.roles) {
+      results.push(evaluateRbacRoles(policy.roles, ctx));
+    }
+    if (policy.permissions) {
+      results.push(evaluateRbacPermissions(policy.permissions, ctx));
+    }
+    if (policy.attributes) {
+      results.push(evaluateAbac(policy.attributes, ctx));
+    }
+    if (policy.relationships) {
+      results.push(await evaluateRebac(policy.relationships, ctx));
+    }
+    if (policy.custom) {
+      results.push(await this.evaluateCustom(policy.custom, ctx));
+    }
+    if (policy.guards && policy.guards.length > 0) {
+      results.push(await this.evaluateGuards(policy.guards, ctx));
+    }
+    if (policy.allOf) {
+      results.push(await this.evaluateAllOf(policy.allOf, ctx));
+    }
+    if (policy.anyOf) {
+      results.push(await this.evaluateAnyOf(policy.anyOf, ctx));
+    }
+    if (policy.not) {
+      results.push(await this.evaluateNot(policy.not, ctx));
+    }
+    if (results.length === 0) {
+      return granted([]);
+    }
+    return this.combineResults(results, operator);
+  }
+  /**
+   * Combine results with AND or OR semantics.
+   */
+  combineResults(results, operator) {
+    const allPolicies = results.flatMap((r) => r.evaluatedPolicies);
+    if (operator === "AND") {
+      const denied = results.find((r) => !r.granted);
+      if (denied) {
+        return { ...denied, evaluatedPolicies: allPolicies };
+      }
+      return { granted: true, evaluatedPolicies: allPolicies };
+    }
+    const anyGranted = results.some((r) => r.granted);
+    if (anyGranted) {
+      return { granted: true, evaluatedPolicies: allPolicies };
+    }
+    const firstDenied = results.find((r) => !r.granted);
+    return {
+      granted: false,
+      deniedBy: firstDenied?.deniedBy ?? "all policies denied (OR)",
+      evaluatedPolicies: allPolicies
+    };
+  }
+  /**
+   * Evaluate custom evaluators.
+   */
+  async evaluateCustom(custom, ctx) {
+    const allPolicies = [];
+    for (const [name, config] of Object.entries(custom)) {
+      const evaluator = this.evaluators.get(name);
+      if (!evaluator) {
+        return {
+          granted: false,
+          deniedBy: `custom evaluator '${name}' is not registered`,
+          evaluatedPolicies: [...allPolicies, `custom.${name}`]
+        };
+      }
+      const result = await evaluator.evaluate(config, ctx);
+      allPolicies.push(`custom.${name}`, ...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * Evaluate async guard functions in sequence.
+   * Each guard returns true (granted) or a string (denial message).
+   */
+  async evaluateGuards(guards, ctx) {
+    for (let i = 0; i < guards.length; i++) {
+      const guard = guards[i];
+      const result = await guard(ctx);
+      if (result === false || typeof result === "string") {
+        const denialMessage = typeof result === "string" ? result : `guard[${i}] denied`;
+        return {
+          granted: false,
+          deniedBy: `guards[${i}]: ${denialMessage}`,
+          denial: { kind: "custom", path: `guards[${i}]` },
+          evaluatedPolicies: ["guards"]
+        };
+      }
+    }
+    return { granted: true, evaluatedPolicies: ["guards"] };
+  }
+  /**
+   * allOf combinator — all nested policies must pass.
+   */
+  async evaluateAllOf(policies, ctx) {
+    const allPolicies = ["allOf"];
+    for (const policy of policies) {
+      const result = await this.evaluatePolicy(policy, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * anyOf combinator — at least one nested policy must pass.
+   */
+  async evaluateAnyOf(policies, ctx) {
+    const allPolicies = ["anyOf"];
+    let lastDenied;
+    for (const policy of policies) {
+      const result = await this.evaluatePolicy(policy, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (result.granted) {
+        return { granted: true, evaluatedPolicies: allPolicies };
+      }
+      lastDenied = result;
+    }
+    return {
+      granted: false,
+      deniedBy: lastDenied?.deniedBy ?? "no policies in anyOf",
+      denial: lastDenied?.denial ?? { kind: "anyOf", path: "anyOf" },
+      evaluatedPolicies: allPolicies
+    };
+  }
+  /**
+   * not combinator — inverts the nested policy result.
+   */
+  async evaluateNot(policy, ctx) {
+    const result = await this.evaluatePolicy(policy, ctx);
+    return {
+      granted: !result.granted,
+      deniedBy: result.granted ? "not: inner policy was granted (negated to denied)" : void 0,
+      denial: result.granted ? { kind: "not", path: "not" } : void 0,
+      evaluatedPolicies: ["not", ...result.evaluatedPolicies]
+    };
+  }
+};
+
+// libs/auth/src/authorities/authorities.registry.ts
+var AuthoritiesProfileRegistry = class {
+  profiles = /* @__PURE__ */ new Map();
+  /**
+   * Register a named profile.
+   * Overwrites any existing profile with the same name.
+   */
+  register(name, policy) {
+    this.profiles.set(name, policy);
+  }
+  /**
+   * Register multiple profiles at once.
+   */
+  registerAll(profiles) {
+    for (const [name, policy] of Object.entries(profiles)) {
+      this.profiles.set(name, policy);
+    }
+  }
+  /**
+   * Resolve a profile name to its policy.
+   * Returns `undefined` if the profile is not registered.
+   */
+  resolve(name) {
+    return this.profiles.get(name);
+  }
+  /**
+   * Check if a profile is registered.
+   */
+  has(name) {
+    return this.profiles.has(name);
+  }
+  /**
+   * Get all registered profiles.
+   */
+  getAll() {
+    const result = {};
+    for (const [name, policy] of this.profiles) {
+      result[name] = policy;
+    }
+    return result;
+  }
+  /**
+   * Get the number of registered profiles.
+   */
+  get size() {
+    return this.profiles.size;
+  }
+  /**
+   * Remove a profile by name.
+   */
+  remove(name) {
+    return this.profiles.delete(name);
+  }
+  /**
+   * Clear all profiles.
+   */
+  clear() {
+    this.profiles.clear();
+  }
+};
+var AuthoritiesEvaluatorRegistry = class {
+  evaluators = /* @__PURE__ */ new Map();
+  /**
+   * Register a custom evaluator.
+   * The evaluator's name must match the key used in `custom.*`.
+   */
+  register(name, evaluator) {
+    this.evaluators.set(name, evaluator);
+  }
+  /**
+   * Register multiple evaluators at once.
+   */
+  registerAll(evaluators) {
+    for (const [name, evaluator] of Object.entries(evaluators)) {
+      this.evaluators.set(name, evaluator);
+    }
+  }
+  /**
+   * Get an evaluator by name.
+   */
+  get(name) {
+    return this.evaluators.get(name);
+  }
+  /**
+   * Check if an evaluator is registered.
+   */
+  has(name) {
+    return this.evaluators.has(name);
+  }
+  /**
+   * Get the number of registered evaluators.
+   */
+  get size() {
+    return this.evaluators.size;
+  }
+  /**
+   * Remove an evaluator by name.
+   */
+  remove(name) {
+    return this.evaluators.delete(name);
+  }
+  /**
+   * Clear all evaluators.
+   */
+  clear() {
+    this.evaluators.clear();
+  }
+};
+
+// libs/auth/src/authorities/authorities.errors.ts
+var FORBIDDEN_CODE = -32003;
+var AuthorityDeniedError = class extends Error {
+  /** MCP error code for JSON-RPC responses */
+  mcpErrorCode = FORBIDDEN_CODE;
+  /** HTTP status code equivalent */
+  statusCode = 403;
+  /** Error classification code */
+  code = "AUTHORITY_DENIED";
+  /** Entry type that was denied */
+  entryType;
+  /** Entry name that was denied */
+  entryName;
+  /** Policy that caused the denial */
+  deniedBy;
+  /** Structured denial data (machine-parsable) */
+  denial;
+  /** Required scopes for scope challenges */
+  requiredScopes;
+  constructor(params) {
+    const msg = params.message ?? `Access denied to ${params.entryType} "${params.entryName}": ${params.deniedBy}`;
+    super(msg);
+    this.name = "AuthorityDeniedError";
+    this.entryType = params.entryType;
+    this.entryName = params.entryName;
+    this.deniedBy = params.deniedBy;
+    this.denial = params.denial;
+    this.requiredScopes = params.requiredScopes;
+  }
+  /**
+   * Convert to JSON-RPC error format.
+   */
+  toJsonRpcError() {
+    const data = {
+      entryType: this.entryType,
+      entryName: this.entryName,
+      deniedBy: this.deniedBy
+    };
+    if (this.denial !== void 0) data["denial"] = this.denial;
+    if (this.requiredScopes !== void 0) data["requiredScopes"] = this.requiredScopes;
+    return {
+      code: this.mcpErrorCode,
+      message: this.message,
+      data
+    };
+  }
+};
+
+// libs/auth/src/fetch/fetch-credential-middleware.ts
+var bearerApplier = {
+  apply(token, _url, init) {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return { init: { ...init, headers } };
+  }
+};
+function headerApplier(headerName, prefix) {
+  return {
+    apply(token, _url, init) {
+      const headers = new Headers(init.headers);
+      headers.set(headerName, prefix ? `${prefix} ${token}` : token);
+      return { init: { ...init, headers } };
+    }
+  };
+}
+function queryApplier(paramName) {
+  return {
+    apply(token, url, init) {
+      const urlObj = new URL(url);
+      urlObj.searchParams.set(paramName, token);
+      return { init, url: urlObj.toString() };
+    }
+  };
+}
+var basicApplier = {
+  apply(token, _url, init) {
+    const headers = new Headers(init.headers);
+    const encoded = typeof btoa === "function" ? btoa(token) : Buffer.from(token).toString("base64");
+    headers.set("Authorization", `Basic ${encoded}`);
+    return { init: { ...init, headers } };
+  }
+};
+function isFrontMcpCredentials(creds) {
+  return typeof creds === "object" && creds !== null && "provider" in creds && typeof creds.provider === "string" && creds.provider.length > 0;
+}
+var FetchCredentialMiddleware = class {
+  constructor(tokenAccessor, appliers) {
+    this.tokenAccessor = tokenAccessor;
+    this.appliers = new Map(Object.entries(appliers ?? {}));
+  }
+  appliers;
+  /**
+   * Inspect the `credentials` field. If it references a named provider,
+   * resolve the token and delegate to the provider's applier.
+   */
+  async applyCredentials(url, init) {
+    const creds = init.credentials;
+    if (!creds || typeof creds === "string") {
+      return { init };
+    }
+    if (!isFrontMcpCredentials(creds)) {
+      const { credentials: _removed2, ...rest } = init;
+      return { init: rest };
+    }
+    const token = await this.tokenAccessor.getToken(creds.provider);
+    if (!token) {
+      const { credentials: _removed2, ...rest } = init;
+      return { init: rest };
+    }
+    const applier = this.appliers.get(creds.provider) ?? bearerApplier;
+    const { credentials: _removed, ...cleanInit } = init;
+    return applier.apply(token, url, cleanInit);
+  }
+};
 export {
   AUTH_PROVIDERS_ACCESSOR,
   AUTH_PROVIDERS_REGISTRY,
@@ -8036,6 +8929,11 @@ export {
   AuthProvidersNotConfiguredError,
   AuthProvidersRegistry,
   AuthProvidersVault,
+  AuthoritiesContextBuilder,
+  AuthoritiesEngine,
+  AuthoritiesEvaluatorRegistry,
+  AuthoritiesProfileRegistry,
+  AuthorityDeniedError,
   AuthorizationBase,
   CDN,
   CimdClientIdMismatchError,
@@ -8057,6 +8955,8 @@ export {
   EncryptedTypedStorage,
   EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError,
+  FetchCredentialMiddleware,
+  FrontMcpAuthContextImpl,
   InMemoryAuthorizationStore,
   InMemoryAuthorizationVault,
   InMemoryCimdCache,
@@ -8095,6 +8995,9 @@ export {
   VaultLoadError,
   VaultNotFoundError,
   VercelKvSessionStore,
+  abacConditionSchema,
+  abacOperatorSchema,
+  abacPolicySchema,
   aiPlatformTypeSchema,
   allowsPublicAccess,
   apiKeyCredentialSchema,
@@ -8110,13 +9013,20 @@ export {
   authProviderMappingSchema,
   authProvidersVaultOptionsSchema,
   authUserSchema,
+  authoritiesClaimsMappingSchema,
+  authoritiesConfigSchema,
+  authoritiesMetadataSchema,
+  authoritiesPolicySchema,
   authorizationCodeRecordSchema,
   authorizationVaultEntrySchema,
   authorizedPromptSchema,
   authorizedToolSchema,
   baseLayout,
+  basicApplier,
   basicAuthCredentialSchema,
+  bearerApplier,
   bearerCredentialSchema,
+  buildAuthContext,
   buildConsentPage,
   buildErrorPage,
   buildFederatedLoginPage,
@@ -8181,15 +9091,16 @@ export {
   generatePkceChallenge,
   getCredentialOptionsSchema,
   getKey,
-  getMachineId,
   getNextProvider,
   getProviderApps,
   getProviderScopes,
   getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris,
+  headerApplier,
   hkdfSha2563 as hkdfSha256,
   incrementalAuthConfigSchema,
   isCimdClientId,
+  isFrontMcpCredentials,
   isJwt,
   isLocalMode,
   isOrchestratedLocal,
@@ -8227,17 +9138,22 @@ export {
   providerConfigSchema,
   publicAccessConfigSchema,
   publicAuthOptionsSchema,
+  queryApplier,
+  rbacPermissionsPolicySchema,
+  rbacRolesPolicySchema,
+  rebacPolicySchema,
   redisConfigSchema,
   redisVaultEntrySchema,
   remoteAuthSchema,
   remoteProviderConfigSchema,
   renderToHtml,
   resetCachedKey,
+  resolveRequiredScopes,
+  resourceIdRefSchema,
   safeDecrypt,
   serviceAccountCredentialSchema,
   sessionIdPayloadSchema,
   sessionJwtPayloadSchema,
-  setMachineIdOverride,
   signSession,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,