@frontmcp/auth 1.10.16 → 1.11.0-rc.2

package/browser/cimd/cimd.validator.mjs

@@ -0,0 +1,217 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// libs/auth/src/cimd/cimd.validator.ts
+import { classifyIpAddress } from "@frontmcp/utils";
+import { CimdSecurityError, InvalidClientIdUrlError } from "./cimd.errors.mjs";
+function isCimdClientId(clientId, allowInsecure = false) {
+  if (!clientId || typeof clientId !== "string") {
+    return false;
+  }
+  try {
+    const url = new URL(clientId);
+    if (url.protocol === "https:") {
+    } else if (url.protocol === "http:" && allowInsecure && isLocalhostHost(url.hostname)) {
+    } else {
+      return false;
+    }
+    if (!url.pathname || url.pathname === "/") {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isLocalhostHost(hostname) {
+  const lower = hostname.toLowerCase();
+  return lower === "localhost" || lower === "127.0.0.1" || lower === "[::1]" || lower.endsWith(".localhost");
+}
+function validateClientIdUrl(clientId, securityConfig) {
+  if (!clientId || typeof clientId !== "string") {
+    throw new InvalidClientIdUrlError(clientId || "", "client_id must be a non-empty string");
+  }
+  let url;
+  try {
+    url = new URL(clientId);
+  } catch {
+    throw new InvalidClientIdUrlError(clientId, "Invalid URL format");
+  }
+  const allowInsecure = securityConfig?.allowInsecureForTesting ?? false;
+  if (url.protocol === "https:") {
+  } else if (url.protocol === "http:" && allowInsecure && isLocalhostHost(url.hostname)) {
+  } else {
+    throw new InvalidClientIdUrlError(clientId, `CIMD requires HTTPS, got ${url.protocol.replace(":", "")}`);
+  }
+  if (!url.pathname || url.pathname === "/") {
+    throw new InvalidClientIdUrlError(
+      clientId,
+      "CIMD client_id URL must have a path component (e.g., /oauth/client-metadata.json)"
+    );
+  }
+  const config = {
+    blockPrivateIPs: securityConfig?.blockPrivateIPs ?? true,
+    allowedDomains: securityConfig?.allowedDomains,
+    blockedDomains: securityConfig?.blockedDomains
+  };
+  if (config.allowedDomains?.length) {
+    if (!isDomainInList(url.hostname, config.allowedDomains)) {
+      throw new CimdSecurityError(clientId, `Domain "${url.hostname}" is not in the allowed domains list`);
+    }
+  }
+  if (config.blockedDomains?.length) {
+    if (isDomainInList(url.hostname, config.blockedDomains)) {
+      throw new CimdSecurityError(clientId, `Domain "${url.hostname}" is blocked`);
+    }
+  }
+  if (config.blockPrivateIPs && !allowInsecure) {
+    const ssrfCheck = checkSsrfProtection(url.hostname);
+    if (!ssrfCheck.allowed) {
+      throw new CimdSecurityError(clientId, ssrfCheck.reason);
+    }
+  }
+  return url;
+}
+function checkSsrfProtection(hostname) {
+  const lowercaseHostname = hostname.toLowerCase();
+  if (lowercaseHostname === "localhost" || lowercaseHostname === "localhost.localdomain" || lowercaseHostname.endsWith(".localhost")) {
+    return { allowed: false, reason: "Localhost addresses are not allowed" };
+  }
+  if (isIpAddress(hostname)) {
+    const ipCheck = checkIpAddress(hostname);
+    if (!ipCheck.allowed) {
+      return ipCheck;
+    }
+  }
+  return { allowed: true, reason: "" };
+}
+async function resolveAndCheckHostname(hostname) {
+  const literal = checkSsrfProtection(hostname);
+  if (!literal.allowed) return literal;
+  if (isIpAddress(hostname)) return { allowed: true, reason: "" };
+  let dns;
+  try {
+    dns = __require("node:dns");
+  } catch {
+    return { allowed: true, reason: "" };
+  }
+  let addresses;
+  try {
+    const result = await dns.promises.lookup(hostname, { all: true, verbatim: true });
+    addresses = Array.isArray(result) ? result : [result];
+  } catch {
+    return { allowed: false, reason: `DNS resolution failed for "${hostname}"; refusing to fetch an unvalidated host` };
+  }
+  if (addresses.length === 0) {
+    return { allowed: false, reason: `Host "${hostname}" resolved to no addresses` };
+  }
+  for (const { address } of addresses) {
+    if (!address) continue;
+    const ipCheck = checkIpAddress(address);
+    if (!ipCheck.allowed) {
+      return {
+        allowed: false,
+        reason: `Host "${hostname}" resolves to a blocked address (${address}): ${ipCheck.reason}`
+      };
+    }
+  }
+  return { allowed: true, reason: "" };
+}
+async function assertHostNotSsrf(hostname, clientId) {
+  const check = await resolveAndCheckHostname(hostname);
+  if (!check.allowed) {
+    throw new CimdSecurityError(clientId, check.reason);
+  }
+}
+function isIpAddress(hostname) {
+  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
+  if (ipv4Pattern.test(hostname)) {
+    return true;
+  }
+  const cleanHostname = hostname.replace(/^\[|\]$/g, "");
+  if (cleanHostname.includes(":")) {
+    return true;
+  }
+  return false;
+}
+var BLOCKED_RANGE_REASONS = /* @__PURE__ */ new Map([
+  ["0.0.0.0/8", "Current network addresses (0.x.x.x) are not allowed"],
+  ["10.0.0.0/8", "Private IP addresses (10.x.x.x) are not allowed"],
+  ["100.64.0.0/10", "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed"],
+  ["127.0.0.0/8", "Loopback addresses (127.x.x.x) are not allowed"],
+  ["169.254.0.0/16", "Link-local addresses (169.254.x.x) are not allowed"],
+  ["172.16.0.0/12", "Private IP addresses (172.16-31.x.x) are not allowed"],
+  ["192.0.0.0/24", "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed"],
+  ["192.168.0.0/16", "Private IP addresses (192.168.x.x) are not allowed"],
+  ["224.0.0.0/4", "Multicast addresses are not allowed"],
+  ["255.255.255.255/32", "Broadcast address is not allowed"],
+  ["::/128", "IPv6 unspecified address (::) is not allowed"],
+  ["::1/128", "IPv6 loopback address (::1) is not allowed"],
+  ["fc00::/7", "IPv6 unique local addresses (fc00::/7) are not allowed"],
+  ["fe80::/10", "IPv6 link-local addresses (fe80::/10) are not allowed"]
+]);
+function checkIpAddress(ip) {
+  const classification = classifyIpAddress(ip);
+  if (!classification) {
+    const bareIp = ip.replace(/^\[|\]$/g, "");
+    return {
+      allowed: false,
+      reason: bareIp.includes(":") ? `Malformed IPv6 address: ${bareIp}` : "Invalid IPv4 address"
+    };
+  }
+  if (classification.range === "public") {
+    return { allowed: true, reason: "" };
+  }
+  return {
+    allowed: false,
+    reason: BLOCKED_RANGE_REASONS.get(classification.cidr) ?? `Addresses in the ${classification.range} range (${classification.cidr}) are not allowed`
+  };
+}
+function isDomainInList(hostname, domainList) {
+  const lowerHostname = hostname.toLowerCase();
+  for (const domain of domainList) {
+    const lowerDomain = domain.toLowerCase();
+    if (lowerHostname === lowerDomain) {
+      return true;
+    }
+    if (lowerHostname.endsWith("." + lowerDomain)) {
+      return true;
+    }
+    if (lowerDomain.startsWith("*.")) {
+      const baseDomain = lowerDomain.slice(2);
+      if (lowerHostname === baseDomain || lowerHostname.endsWith("." + baseDomain)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function hasOnlyLocalhostRedirectUris(redirectUris) {
+  if (!redirectUris.length) {
+    return false;
+  }
+  return redirectUris.every((uri) => {
+    try {
+      const url = new URL(uri);
+      const hostname = url.hostname.toLowerCase();
+      return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.endsWith(".localhost");
+    } catch {
+      return false;
+    }
+  });
+}
+export {
+  assertHostNotSsrf,
+  checkSsrfProtection,
+  hasOnlyLocalhostRedirectUris,
+  isCimdClientId,
+  resolveAndCheckHostname,
+  validateClientIdUrl
+};

package/browser/cimd/index.mjs

@@ -0,0 +1,63 @@
+// libs/auth/src/cimd/index.ts
+import { noopLogger } from "./cimd.logger.mjs";
+import {
+  clientMetadataDocumentSchema,
+  cimdCacheConfigSchema,
+  cimdRedisCacheConfigSchema,
+  cimdSecurityConfigSchema,
+  cimdNetworkConfigSchema,
+  cimdConfigSchema
+} from "./cimd.types.mjs";
+import {
+  CimdError,
+  InvalidClientIdUrlError,
+  CimdFetchError,
+  CimdValidationError,
+  CimdClientIdMismatchError,
+  CimdSecurityError,
+  RedirectUriMismatchError,
+  CimdResponseTooLargeError,
+  CimdDisabledError
+} from "./cimd.errors.mjs";
+import {
+  isCimdClientId,
+  validateClientIdUrl,
+  checkSsrfProtection,
+  hasOnlyLocalhostRedirectUris
+} from "./cimd.validator.mjs";
+import {
+  InMemoryCimdCache,
+  createCimdCache,
+  extractCacheHeaders,
+  parseCacheHeaders
+} from "./cimd.cache.mjs";
+import { RedisCimdCache } from "./cimd-redis.cache.mjs";
+import { CimdService } from "./cimd.service.mjs";
+export {
+  CimdClientIdMismatchError,
+  CimdDisabledError,
+  CimdError,
+  CimdFetchError,
+  CimdResponseTooLargeError,
+  CimdSecurityError,
+  CimdService,
+  CimdValidationError,
+  InMemoryCimdCache,
+  InvalidClientIdUrlError,
+  RedirectUriMismatchError,
+  RedisCimdCache,
+  checkSsrfProtection,
+  cimdCacheConfigSchema,
+  cimdConfigSchema,
+  cimdNetworkConfigSchema,
+  cimdRedisCacheConfigSchema,
+  cimdSecurityConfigSchema,
+  clientMetadataDocumentSchema,
+  createCimdCache,
+  extractCacheHeaders,
+  hasOnlyLocalhostRedirectUris,
+  isCimdClientId,
+  noopLogger,
+  parseCacheHeaders,
+  validateClientIdUrl
+};

package/browser/common/auth-logger.interface.mjs

@@ -0,0 +1,14 @@
+// libs/auth/src/common/auth-logger.interface.ts
+var noopAuthLogger = {
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  },
+  debug() {
+  }
+};
+export {
+  noopAuthLogger
+};

package/browser/common/index.mjs

@@ -0,0 +1,6 @@
+// libs/auth/src/common/index.ts
+export { noopAuthLogger } from "./auth-logger.interface.mjs";
+import "./zod-utils.mjs";
+import "./session-user.types.mjs";
+export { jsonWebKeySetSchema, jwkParametersSchema, jwkSchema } from "./jwt.types.mjs";
+export { aiPlatformTypeSchema, authorizationSchema, sessionIdPayloadSchema, sessionIdSchema, userClaimSchema } from "./session.types.mjs";

package/browser/common/jwt.types.mjs

@@ -0,0 +1,38 @@
+// libs/auth/src/common/jwt.types.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var jwkParametersSchema = z.object({
+  kty: z.string().optional(),
+  alg: z.string().optional(),
+  key_ops: z.array(z.string()).optional(),
+  ext: z.boolean().optional(),
+  use: z.string().optional(),
+  x5c: z.array(z.string()).optional(),
+  x5t: z.string().optional(),
+  "x5t#S256": z.string().optional(),
+  x5u: z.string().optional(),
+  kid: z.string().optional()
+});
+var jwkSchema = jwkParametersSchema.extend({
+  crv: z.string().optional(),
+  d: z.string().optional(),
+  dp: z.string().optional(),
+  dq: z.string().optional(),
+  e: z.string().optional(),
+  k: z.string().optional(),
+  n: z.string().optional(),
+  p: z.string().optional(),
+  q: z.string().optional(),
+  qi: z.string().optional(),
+  x: z.string().optional(),
+  y: z.string().optional(),
+  pub: z.string().optional(),
+  priv: z.string().optional()
+});
+var jsonWebKeySetSchema = z.object({
+  keys: z.array(jwkSchema)
+});
+export {
+  jsonWebKeySetSchema,
+  jwkParametersSchema,
+  jwkSchema
+};

package/browser/common/session.types.mjs

@@ -0,0 +1,58 @@
+// libs/auth/src/common/session.types.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+var aiPlatformTypeSchema = z.enum([
+  "openai",
+  "claude",
+  "claude-code",
+  "codex",
+  "gemini",
+  "cursor",
+  "continue",
+  "cody",
+  "generic-mcp",
+  "ext-apps",
+  "unknown"
+]);
+var userClaimSchema = z.object({
+  iss: z.string(),
+  sid: z.string().optional(),
+  sub: z.string(),
+  exp: z.number().optional(),
+  iat: z.number().optional(),
+  aud: z.union([z.string(), z.array(z.string())]).optional(),
+  email: z.string().optional(),
+  username: z.string().optional(),
+  preferred_username: z.string().optional(),
+  name: z.string().optional(),
+  picture: z.string().optional()
+}).passthrough();
+var sessionIdPayloadSchema = z.object({
+  nodeId: z.string(),
+  authSig: z.string(),
+  uuid: z.string().uuid(),
+  iat: z.number(),
+  protocol: z.enum(["legacy-sse", "sse", "streamable-http", "stateful-http", "stateless-http"]).optional(),
+  isPublic: z.boolean().optional(),
+  platformType: aiPlatformTypeSchema.optional(),
+  clientName: z.string().optional(),
+  clientVersion: z.string().optional(),
+  supportsElicitation: z.boolean().optional(),
+  skillsOnlyMode: z.boolean().optional()
+});
+var sessionIdSchema = z.object({
+  id: z.string(),
+  /** Payload is optional - may be undefined when session validation failed but ID is passed for transport lookup */
+  payload: sessionIdPayloadSchema.optional()
+});
+var authorizationSchema = z.object({
+  token: z.string(),
+  session: sessionIdSchema.optional(),
+  user: userClaimSchema
+});
+export {
+  aiPlatformTypeSchema,
+  authorizationSchema,
+  sessionIdPayloadSchema,
+  sessionIdSchema,
+  userClaimSchema
+};

package/browser/consent/consent.types.mjs

@@ -0,0 +1,94 @@
+// libs/auth/src/consent/consent.types.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { consentConfigSchema } from "../options/shared.schemas.mjs";
+var consentToolItemSchema = z.object({
+  /** Tool ID (e.g., 'slack:send_message') */
+  id: z.string().min(1),
+  /** Tool name for display */
+  name: z.string().min(1),
+  /** Tool description */
+  description: z.string().optional(),
+  /** App ID this tool belongs to */
+  appId: z.string().min(1),
+  /** App name for display */
+  appName: z.string().min(1),
+  /** Whether the tool is selected by default */
+  defaultSelected: z.boolean().default(true),
+  /** Whether this tool requires specific scopes */
+  requiredScopes: z.array(z.string()).optional(),
+  /** Category for grouping (e.g., 'read', 'write', 'admin') */
+  category: z.string().optional()
+});
+var consentSelectionSchema = z.object({
+  /** Selected tool IDs */
+  selectedTools: z.array(z.string()),
+  /** Whether all tools were selected */
+  allSelected: z.boolean(),
+  /** Timestamp when consent was given */
+  consentedAt: z.string().datetime(),
+  /** Consent version for tracking changes */
+  consentVersion: z.string().default("1.0")
+});
+var consentStateSchema = z.object({
+  /** Whether consent flow is enabled */
+  enabled: z.boolean(),
+  /** Available tools for consent */
+  availableTools: z.array(consentToolItemSchema),
+  /** Pre-selected tools (from previous consent or defaults) */
+  preselectedTools: z.array(z.string()).optional(),
+  /** Whether to show all tools or group by app */
+  groupByApp: z.boolean().default(true),
+  /** Custom consent message */
+  customMessage: z.string().optional()
+});
+var federatedProviderItemSchema = z.object({
+  /** Provider ID (derived or explicit) */
+  id: z.string().min(1),
+  /** Provider display name */
+  name: z.string().min(1),
+  /** Provider description */
+  description: z.string().optional(),
+  /** Provider icon URL or emoji */
+  icon: z.string().optional(),
+  /** Provider type */
+  type: z.enum(["local", "remote", "transparent"]),
+  /** OAuth provider URL (for remote providers) */
+  providerUrl: z.string().url().optional(),
+  /** Apps using this provider */
+  appIds: z.array(z.string()),
+  /** App names using this provider */
+  appNames: z.array(z.string()),
+  /** Scopes required by this provider */
+  scopes: z.array(z.string()),
+  /** Whether this is the primary/parent provider */
+  isPrimary: z.boolean(),
+  /** Whether this provider is optional (can be skipped) */
+  isOptional: z.boolean().default(false)
+});
+var federatedLoginStateSchema = z.object({
+  /** All available providers */
+  providers: z.array(federatedProviderItemSchema),
+  /** Primary provider ID (if any) */
+  primaryProviderId: z.string().optional(),
+  /** Whether user can skip optional providers */
+  allowSkip: z.boolean().default(true),
+  /** Pre-selected provider IDs (from previous session) */
+  preselectedProviders: z.array(z.string()).optional()
+});
+var federatedSelectionSchema = z.object({
+  /** Selected provider IDs */
+  selectedProviders: z.array(z.string()),
+  /** Skipped provider IDs */
+  skippedProviders: z.array(z.string()),
+  /** Provider-specific metadata */
+  providerMetadata: z.record(z.string(), z.unknown()).optional()
+});
+export {
+  consentConfigSchema,
+  consentSelectionSchema,
+  consentStateSchema,
+  consentToolItemSchema,
+  federatedLoginStateSchema,
+  federatedProviderItemSchema,
+  federatedSelectionSchema
+};

package/browser/consent/index.mjs

@@ -0,0 +1,17 @@
+// libs/auth/src/consent/index.ts
+import {
+  consentToolItemSchema,
+  consentSelectionSchema,
+  consentStateSchema,
+  federatedProviderItemSchema,
+  federatedLoginStateSchema,
+  federatedSelectionSchema
+} from "./consent.types.mjs";
+export {
+  consentSelectionSchema,
+  consentStateSchema,
+  consentToolItemSchema,
+  federatedLoginStateSchema,
+  federatedProviderItemSchema,
+  federatedSelectionSchema
+};

package/browser/context/frontmcp-auth-context.factory.mjs

@@ -0,0 +1,29 @@
+// libs/auth/src/context/frontmcp-auth-context.factory.ts
+import { FrontMcpAuthContextImpl } from "./frontmcp-auth-context.impl.mjs";
+function buildAuthContext(authInfo, claimsMapping, pipes, claimsResolver) {
+  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping, claimsResolver);
+  if (!pipes || pipes.length === 0) {
+    return base;
+  }
+  return runPipes(base, pipes);
+}
+async function runPipes(base, pipes) {
+  const extensions = {};
+  for (const pipe of pipes) {
+    try {
+      const result = await pipe(base.claims);
+      if (result && typeof result === "object") {
+        Object.assign(extensions, result);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[FrontMcpAuth] pipe failed: ${message}`);
+    }
+  }
+  const merged = Object.create(Object.getPrototypeOf(base));
+  Object.assign(merged, base, extensions);
+  return Object.freeze(merged);
+}
+export {
+  buildAuthContext
+};

package/browser/context/frontmcp-auth-context.impl.mjs

@@ -0,0 +1,112 @@
+// libs/auth/src/context/frontmcp-auth-context.impl.ts
+import {
+  resolveAuthUser,
+  resolveDotPath,
+  signedInSubject
+} from "../authorities/authorities.context.mjs";
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  if (typeof value === "string") {
+    return value.split(/\s+/).filter(Boolean);
+  }
+  return [];
+}
+var FrontMcpAuthContextImpl = class {
+  user;
+  isAnonymous;
+  mode;
+  sessionId;
+  scopes;
+  claims;
+  roles;
+  permissions;
+  constructor(source, claimsMapping, claimsResolver) {
+    const rawUser = resolveAuthUser(source);
+    const mappedSub = !claimsResolver && claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
+    const signedInSub = signedInSubject(rawUser.sub, mappedSub);
+    const sub = signedInSub ?? (typeof rawUser.sub === "string" ? rawUser.sub : "");
+    this.user = Object.freeze({
+      sub,
+      name: rawUser.name,
+      email: rawUser.email,
+      picture: rawUser.picture
+    });
+    this.isAnonymous = signedInSub === void 0;
+    const extraAuth = source.extra?.["authorization"];
+    this.mode = String(
+      source.extra?.["authMode"] ?? extraAuth?.["mode"] ?? (source.extra?.["isPublic"] === true || rawUser["anonymous"] === true ? "public" : "authenticated")
+    );
+    this.sessionId = typeof source.sessionId === "string" ? source.sessionId : "";
+    this.scopes = Object.freeze(
+      Array.isArray(source.scopes) ? source.scopes.filter((s) => typeof s === "string") : []
+    );
+    if (claimsResolver) {
+      const resolved = claimsResolver(source);
+      this.claims = Object.freeze({ ...resolved.claims });
+      this.roles = Object.freeze([...toStringArray(resolved.roles)]);
+      this.permissions = Object.freeze([...toStringArray(resolved.permissions)]);
+      return;
+    }
+    const rawClaims = this.buildRawClaims(source);
+    this.claims = Object.freeze({ ...rawClaims });
+    if (claimsMapping?.roles) {
+      this.roles = Object.freeze([...toStringArray(resolveDotPath(rawClaims, claimsMapping.roles))]);
+    } else {
+      this.roles = Object.freeze([
+        ...toStringArray(rawUser["roles"] ?? extraAuth?.["scopes"] ?? [])
+      ]);
+    }
+    if (claimsMapping?.permissions) {
+      this.permissions = Object.freeze([...toStringArray(resolveDotPath(rawClaims, claimsMapping.permissions))]);
+    } else {
+      this.permissions = Object.freeze([...toStringArray(rawUser["permissions"] ?? [])]);
+    }
+  }
+  // -- Query methods -------------------------------------------------
+  hasRole(role) {
+    return this.roles.includes(role);
+  }
+  hasAllRoles(roles) {
+    return roles.every((r) => this.roles.includes(r));
+  }
+  hasAnyRole(roles) {
+    return roles.some((r) => this.roles.includes(r));
+  }
+  hasPermission(permission) {
+    return this.permissions.includes(permission);
+  }
+  hasAllPermissions(permissions) {
+    return permissions.every((p) => this.permissions.includes(p));
+  }
+  hasAnyPermission(permissions) {
+    return permissions.some((p) => this.permissions.includes(p));
+  }
+  hasScope(scope) {
+    return this.scopes.includes(scope);
+  }
+  hasAllScopes(scopes) {
+    return scopes.every((s) => this.scopes.includes(s));
+  }
+  hasAnyScope(scopes) {
+    return scopes.some((s) => this.scopes.includes(s));
+  }
+  // -- Internal helpers ----------------------------------------------
+  /**
+   * Build the merged raw claims map from user fields + extra.authorization.claims.
+   * Mirrors the logic in AuthoritiesContextBuilder.build().
+   */
+  buildRawClaims(source) {
+    const rawUser = resolveAuthUser(source);
+    const extraAuth = source.extra?.["authorization"];
+    const authorizationClaims = extraAuth?.["claims"] ?? {};
+    return {
+      ...authorizationClaims,
+      ...rawUser
+    };
+  }
+};
+export {
+  FrontMcpAuthContextImpl
+};

package/browser/context/index.mjs

@@ -0,0 +1,7 @@
+// libs/auth/src/context/index.ts
+import { FrontMcpAuthContextImpl } from "./frontmcp-auth-context.impl.mjs";
+import { buildAuthContext } from "./frontmcp-auth-context.factory.mjs";
+export {
+  FrontMcpAuthContextImpl,
+  buildAuthContext
+};