@frontmcp/auth 1.11.1 → 1.11.3

package/README.md

@@ -98,9 +98,9 @@ export default class Server {}
 - **Auth modes**: `authOptionsSchema` and the option types of each mode. See [Auth modes](https://frontmcp.dev/reference/auth/modes).
 - **Local mode**: FrontMCP as an OAuth 2.1 authorization server, with PKCE (Proof Key for Code Exchange), dynamic client registration and refresh tokens. See [Local auth](https://frontmcp.dev/reference/auth/local).
 - **Remote mode**: users sign in at your identity provider, and FrontMCP issues the tokens. See [Remote and proxied auth](https://frontmcp.dev/reference/auth/remote).
-- **Upstream providers**: several OAuth providers linked in one sign-in. See [Upstream providers](https://frontmcp.dev/reference/auth/upstream-providers).
+- **Upstream providers**: several OAuth providers linked in one sign-in, on one picker page or one provider per page (`incrementalAuth.showAllAppsAtOnce: false`, `buildFederatedStepPage`). See [Upstream providers](https://frontmcp.dev/reference/auth/upstream-providers).
 - **Token checks**: JWT verification against a JSON Web Key Set (JWKS), and audience and scope checks (`JwksService`, `validateAudience`). See [Tokens and sessions](https://frontmcp.dev/reference/auth/tokens).
-- **CIMD (Client ID Metadata Documents)**: clients whose `client_id` is the URL of a metadata document (`CimdService`). See [Client ID metadata](https://frontmcp.dev/reference/auth/cimd).
+- **CIMD (Client ID Metadata Documents)**: clients whose `client_id` is the URL of a metadata document (`CimdService`). A public client declares `token_endpoint_auth_method: 'none'`; a confidential one declares `private_key_jwt` and authenticates at the token endpoint with a client assertion signed by a key from its `jwks` / `jwks_uri` (RFC 7523, `CimdService.verifyClientAssertion`). See [Client ID metadata](https://frontmcp.dev/reference/auth/cimd).
 - **Authorities**: rules on tools, resources, prompts, skills and agents, from roles, permissions, token claims, the call's arguments or your own code (`AuthorityDeniedError`). See [Authorities](https://frontmcp.dev/reference/auth/authorities).
 - **Credential vault**: per-user credentials that tools read with `this.credentials`, and that users can add to mid-session. See [Progressive auth](https://frontmcp.dev/reference/auth/progressive).
 - **Sign-in pages**: the built-in sign-in, consent and error pages, and `escapeHtml`, `buildLoginPage` and `baseLayout` for your own. See [Custom login UI](https://frontmcp.dev/reference/auth/login-ui).

package/authorities/authorities.context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAQD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAc,GACxC,4BAA4B;CAoEhC"}
+{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAQD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAc,GACxC,4BAA4B;CAwEhC"}

package/authorities/authorities.engine.d.ts

@@ -76,7 +76,7 @@ export declare class AuthoritiesEngine {
      */
     private evaluateAnyOf;
     /**
-     * not combinator — inverts the nested policy result.
+     * not combinator — inverts the nested policy result; an unresolved denial stays a denial.
      */
     private evaluateNot;
     /**

package/authorities/authorities.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAczB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}
+{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA2C7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAIlC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;YACW,cAAc;IAkB5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAO3B;;OAEG;YACW,aAAa;IA4B3B;;OAEG;YACW,WAAW;IAiBzB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}

package/authorities/authorities.evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAEV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AAqGD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAsCrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAgDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}
+{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AAgHD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAmDrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAiDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAY5B"}

package/authorities/authorities.profiles.d.ts

@@ -33,7 +33,7 @@ export interface AuthoritiesClaimsMapping {
     roles?: string;
     /** Dot-path to permissions array/string in JWT claims */
     permissions?: string;
-    /** Dot-path to tenant/org ID in JWT claims */
+    /** Dot-path to tenant/org ID in JWT claims; a string value becomes `user.tenantId` for rules and guards */
     tenantId?: string;
     /** Dot-path to user ID in JWT claims (default: 'sub') */
     userId?: string;

package/authorities/authorities.profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.profiles.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAMjH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC;;;OAGG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACrD;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClD,sDAAsD;IACtD,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,kCAAkC,EAAE,eAAe,EAAE,CAAC;CACtE"}
+{"version":3,"file":"authorities.profiles.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.profiles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAMjH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2GAA2G;IAC3G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC;;;OAGG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACrD;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClD,sDAAsD;IACtD,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,kCAAkC,EAAE,eAAe,EAAE,CAAC;CACtE"}

package/authorities/authorities.registry.d.ts

@@ -4,7 +4,7 @@
  * - AuthoritiesProfileRegistry: stores named authority profiles
  * - AuthoritiesEvaluatorRegistry: stores custom evaluators
  */
-import type { AuthoritiesPolicyMetadata, AuthoritiesEvaluator } from './authorities.types';
+import type { AuthoritiesEvaluator, AuthoritiesPolicyMetadata } from './authorities.types';
 /**
  * Registry for named authority profiles.
  * Profiles map a string name to a policy, allowing

package/authorities/authorities.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.registry.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAM7B;;;;GAIG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IAEzE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,IAAI;IAI/D;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,IAAI;IAMtE;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;IAI5D;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAQnD;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd;AAMD;;;GAGG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2C;IAEtE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,GAAG,IAAI;IAI7D;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,IAAI;IAMnE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAInD;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"authorities.registry.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAM3F;;;;GAIG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IAEzE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,GAAG,IAAI;IAI/D;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,IAAI;IAMtE;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;IAI5D;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAQnD;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd;AAMD;;;GAGG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2C;IAEtE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,GAAG,IAAI;IAI7D;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,IAAI;IAMnE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAInD;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/authorities/authorities.scope-mapping.d.ts

@@ -4,8 +4,8 @@
  * Resolves required OAuth scopes from a structured authority denial
  * using explicit scopeMapping configuration.
  */
-import type { AuthoritiesDenial, AuthoritiesMetadata } from './authorities.types';
 import type { AuthoritiesScopeMapping } from './authorities.profiles';
+import type { AuthoritiesDenial, AuthoritiesMetadata } from './authorities.types';
 /**
  * Resolve required OAuth scopes from a structured denial and scopeMapping.
  * Returns undefined if no mapping matches the denial.

package/authorities/authorities.scope-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.scope-mapping.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.scope-mapping.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,uBAAuB,EAChC,WAAW,EAAE,mBAAmB,GAC/B,MAAM,EAAE,GAAG,SAAS,CAkCtB"}
+{"version":3,"file":"authorities.scope-mapping.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.scope-mapping.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAElF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,uBAAuB,EAChC,WAAW,EAAE,mBAAmB,GAC/B,MAAM,EAAE,GAAG,SAAS,CAkCtB"}

package/authorities/authorities.types.d.ts

@@ -216,6 +216,8 @@ export interface AuthoritiesDenial {
 export interface AuthoritiesResult {
     /** Whether access was granted */
     granted: boolean;
+    /** With `granted: false`: the check couldn't be decided (e.g. a missing `{ fromInput }` value), so `not` keeps the denial */
+    unresolved?: boolean;
     /** Human-readable reason for denial (kept for backward compatibility) */
     deniedBy?: string;
     /** Structured denial data (machine-parsable) */
@@ -257,6 +259,8 @@ export interface AuthoritiesEvaluationContext {
         permissions: string[];
         /** Raw JWT claims */
         claims: Record<string, unknown>;
+        /** Tenant or organization id, read from the claim `claimsMapping.tenantId` names; undefined without one */
+        tenantId?: string;
     };
     /** Tool/prompt input arguments */
     input: Record<string, unknown>;

package/authorities/authorities.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.types.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,GACV,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,aAAa,CAAC;CAC3B;AAMD;;;;;GAKG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,4BAA4B,KAAK,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;AAEnH,MAAM,WAAW,yBAAyB;IACxC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,iCAAiC;IACjC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,uCAAuC;IACvC,aAAa,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACxB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,yBAAyB,CAAC;IAChC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,qDAAqD;IACrD,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAMD;;;;;;;;;;;;;;GAcG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,yBAAyB;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,yBAAyB,CAAC;AAM5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,EAAE,GAAG,yBAAyB,CAAC;AAM5G;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAClH,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,gCAAgC;IAChC,IAAI,EAAE;QACJ,+DAA+D;QAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+CAA+C;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,qDAAqD;QACrD,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,6CAA6C;IAC7C,aAAa,EAAE,oBAAoB,CAAC;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"authorities.types.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,GACV,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,aAAa,CAAC;CAC3B;AAMD;;;;;GAKG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,4BAA4B,KAAK,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;AAEnH,MAAM,WAAW,yBAAyB;IACxC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,iCAAiC;IACjC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,uCAAuC;IACvC,aAAa,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACxB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,yBAAyB,CAAC;IAChC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,qDAAqD;IACrD,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAMD;;;;;;;;;;;;;;GAcG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,yBAAyB;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,yBAAyB,CAAC;AAM5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,EAAE,GAAG,yBAAyB,CAAC;AAM5G;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAClH,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,6HAA6H;IAC7H,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,gCAAgC;IAChC,IAAI,EAAE;QACJ,+DAA+D;QAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+CAA+C;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,qDAAqD;QACrD,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,2GAA2G;QAC3G,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,6CAA6C;IAC7C,aAAa,EAAE,oBAAoB,CAAC;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC1F"}

package/authorization/orchestrated.accessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrated.accessor.d.ts","sourceRoot":"","sources":["../../src/authorization/orchestrated.accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C;;;;;OAKG;IACH,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAEzC;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAExC;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnD;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAElC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAErC;;GAEG;AACH,qBAAa,4BAA6B,YAAW,wBAAwB;IAC3E,QAAQ,CAAC,iBAAiB,YAAa;IACvC,QAAQ,CAAC,MAAM,YAAa;IAC5B,QAAQ,CAAC,eAAe,UAAU;IAClC,QAAQ,CAAC,eAAe,SAAS;IAE3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD;AAED;;GAEG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IAE5E,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE;QAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,cAAc,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACnD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,sBAAsB,IAAI,MAAM,EAAE,CAAC;QACnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;KACpD;IAGH,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD"}
+{"version":3,"file":"orchestrated.accessor.d.ts","sourceRoot":"","sources":["../../src/authorization/orchestrated.accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAIrC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C;;;;;OAKG;IACH,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAEzC;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAExC;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnD;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAElC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAErC;;GAEG;AACH,qBAAa,4BAA6B,YAAW,wBAAwB;IAC3E,QAAQ,CAAC,iBAAiB,YAAa;IACvC,QAAQ,CAAC,MAAM,YAAa;IAC5B,QAAQ,CAAC,eAAe,UAAU;IAClC,QAAQ,CAAC,eAAe,SAAS;IAE3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD;AAED;;GAEG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IAE5E,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE;QAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,cAAc,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACnD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,sBAAsB,IAAI,MAAM,EAAE,CAAC;QACnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;KACpD;IAGH,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD"}

package/authorization/public.authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.authorization.d.ts","sourceRoot":"","sources":["../../src/authorization/public.authorization.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAoC,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGxF;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAY;IAEnC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,OAAO;IAKP;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,GAAE,4BAAiC,GAAG,mBAAmB;IA6D1E;;;;OAIG;IACG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED;;OAEG;IACM,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAQ/C;;OAEG;IACM,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAOpD"}
+{"version":3,"file":"public.authorization.d.ts","sourceRoot":"","sources":["../../src/authorization/public.authorization.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAoC,MAAM,uBAAuB,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAY;IAEnC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,OAAO;IAKP;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,GAAE,4BAAiC,GAAG,mBAAmB;IA6D1E;;;;OAIG;IACG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED;;OAEG;IACM,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAQ/C;;OAEG;IACM,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAOpD"}

package/authorization/transparent.authorization.d.ts

@@ -1,5 +1,5 @@
 import { AuthorizationBase } from './authorization.class';
-import type { AuthorizationCreateCtx, AuthMode } from './authorization.types';
+import type { AuthMode, AuthorizationCreateCtx } from './authorization.types';
 /**
  * Verified JWT payload from transparent auth provider
  */

package/authorization/transparent.authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transparent.authorization.d.ts","sourceRoot":"","sources":["../../src/authorization/transparent.authorization.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAY,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAIxF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,EAAE,0BAA0B,CAAC;IAEpC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAChE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAiB;IAExC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,OAAO;IAWP;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,iCAAiC,GAAG,wBAAwB;IA8C1F;;;;;;;;OAQG;IACG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAM1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAMtC;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAE5C;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAMlC"}
+{"version":3,"file":"transparent.authorization.d.ts","sourceRoot":"","sources":["../../src/authorization/transparent.authorization.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAY,MAAM,uBAAuB,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,EAAE,0BAA0B,CAAC;IAEpC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAChE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAiB;IAExC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,OAAO;IAWP;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,iCAAiC,GAAG,wBAAwB;IA8C1F;;;;;;;;OAQG;IACG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAM1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAMtC;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAE5C;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAMlC"}

package/browser/authorities/authorities.context.mjs

@@ -93,12 +93,14 @@ var AuthoritiesContextBuilder = class {
       permissions = toStringArray(user["permissions"] ?? []);
     }
     const mappedSub = this.claimsMapping?.userId ? resolveDotPath(rawClaims, this.claimsMapping.userId) : void 0;
+    const mappedTenantId = this.claimsMapping?.tenantId ? resolveDotPath(rawClaims, this.claimsMapping.tenantId) : void 0;
     return {
       user: {
         sub: signedInSubject(user.sub, mappedSub),
         roles,
         permissions,
-        claims: rawClaims
+        claims: rawClaims,
+        tenantId: typeof mappedTenantId === "string" && mappedTenantId !== "" ? mappedTenantId : void 0
       },
       input,
       env,

package/browser/authorities/authorities.engine.mjs

@@ -15,6 +15,17 @@ function invalidRule(problems, policies = []) {
     evaluatedPolicies: policies
   };
 }
+async function evaluateEvery(items, evaluateItem, evaluatedPolicies = []) {
+  let unresolved;
+  for (const item of items) {
+    const result = await evaluateItem(item);
+    evaluatedPolicies.push(...result.evaluatedPolicies);
+    if (result.granted) continue;
+    if (!result.unresolved) return { ...result, evaluatedPolicies };
+    unresolved ??= result;
+  }
+  return unresolved ? { ...unresolved, evaluatedPolicies } : { granted: true, evaluatedPolicies };
+}
 var AuthoritiesEngine = class {
   constructor(profiles, evaluators) {
     this.profiles = profiles;
@@ -98,15 +109,7 @@ var AuthoritiesEngine = class {
    * Evaluate an array of profile names (AND semantics).
    */
   async evaluateProfileArray(names, ctx) {
-    const allPolicies = [];
-    for (const name of names) {
-      const result = await this.evaluateProfile(name, ctx);
-      allPolicies.push(...result.evaluatedPolicies);
-      if (!result.granted) {
-        return { ...result, evaluatedPolicies: allPolicies };
-      }
-    }
-    return { granted: true, evaluatedPolicies: allPolicies };
+    return evaluateEvery(names, (name) => this.evaluateProfile(name, ctx));
   }
   /**
    * Evaluate an inline policy object.
@@ -152,7 +155,7 @@ var AuthoritiesEngine = class {
   combineResults(results, operator) {
     const allPolicies = results.flatMap((r) => r.evaluatedPolicies);
     if (operator === "AND") {
-      const denied = results.find((r) => !r.granted);
+      const denied = results.find((r) => !r.granted && !r.unresolved) ?? results.find((r) => !r.granted);
       if (denied) {
         return { ...denied, evaluatedPolicies: allPolicies };
       }
@@ -162,10 +165,12 @@ var AuthoritiesEngine = class {
     if (anyGranted) {
       return { granted: true, evaluatedPolicies: allPolicies };
     }
-    const firstDenied = results.find((r) => !r.granted);
+    const unresolved = results.find((r) => r.unresolved);
+    const reported = unresolved ?? results.find((r) => !r.granted);
     return {
       granted: false,
-      deniedBy: firstDenied?.deniedBy ?? "all policies denied (OR)",
+      ...unresolved && { unresolved: true },
+      deniedBy: reported?.deniedBy ?? "all policies denied (OR)",
       evaluatedPolicies: allPolicies
     };
   }
@@ -173,23 +178,18 @@ var AuthoritiesEngine = class {
    * Evaluate custom evaluators.
    */
   async evaluateCustom(custom, ctx) {
-    const allPolicies = [];
-    for (const [name, config] of Object.entries(custom)) {
+    return evaluateEvery(Object.entries(custom), async ([name, config]) => {
       const evaluator = this.evaluators.get(name);
       if (!evaluator) {
         return {
           granted: false,
           deniedBy: `custom evaluator '${name}' is not registered`,
-          evaluatedPolicies: [...allPolicies, `custom.${name}`]
+          evaluatedPolicies: [`custom.${name}`]
         };
       }
       const result = await evaluator.evaluate(config, ctx);
-      allPolicies.push(`custom.${name}`, ...result.evaluatedPolicies);
-      if (!result.granted) {
-        return { ...result, evaluatedPolicies: allPolicies };
-      }
-    }
-    return { granted: true, evaluatedPolicies: allPolicies };
+      return { ...result, evaluatedPolicies: [`custom.${name}`, ...result.evaluatedPolicies] };
+    });
   }
   /**
    * Evaluate async guard functions in sequence.
@@ -216,15 +216,7 @@ var AuthoritiesEngine = class {
    * allOf combinator \u2014 all nested policies must pass.
    */
   async evaluateAllOf(policies, ctx) {
-    const allPolicies = ["allOf"];
-    for (const policy of policies) {
-      const result = await this.evaluatePolicy(policy, ctx);
-      allPolicies.push(...result.evaluatedPolicies);
-      if (!result.granted) {
-        return { ...result, evaluatedPolicies: allPolicies };
-      }
-    }
-    return { granted: true, evaluatedPolicies: allPolicies };
+    return evaluateEvery(policies, (policy) => this.evaluatePolicy(policy, ctx), ["allOf"]);
   }
   /**
    * anyOf combinator \u2014 at least one nested policy must pass.
@@ -232,6 +224,7 @@ var AuthoritiesEngine = class {
   async evaluateAnyOf(policies, ctx) {
     const allPolicies = ["anyOf"];
     let lastDenied;
+    let unresolved;
     for (const policy of policies) {
       const result = await this.evaluatePolicy(policy, ctx);
       allPolicies.push(...result.evaluatedPolicies);
@@ -239,19 +232,25 @@ var AuthoritiesEngine = class {
         return { granted: true, evaluatedPolicies: allPolicies };
       }
       lastDenied = result;
+      if (result.unresolved) unresolved ??= result;
     }
+    const reported = unresolved ?? lastDenied;
     return {
       granted: false,
-      deniedBy: lastDenied?.deniedBy ?? "no policies in anyOf",
-      denial: lastDenied?.denial ?? { kind: "anyOf", path: "anyOf" },
+      ...unresolved && { unresolved: true },
+      deniedBy: reported?.deniedBy ?? "no policies in anyOf",
+      denial: reported?.denial ?? { kind: "anyOf", path: "anyOf" },
       evaluatedPolicies: allPolicies
     };
   }
   /**
-   * not combinator \u2014 inverts the nested policy result.
+   * not combinator \u2014 inverts the nested policy result; an unresolved denial stays a denial.
    */
   async evaluateNot(policy, ctx) {
     const result = await this.evaluatePolicy(policy, ctx);
+    if (!result.granted && result.unresolved) {
+      return { ...result, evaluatedPolicies: ["not", ...result.evaluatedPolicies] };
+    }
     return {
       granted: !result.granted,
       deniedBy: result.granted ? "not: inner policy was granted (negated to denied)" : void 0,

package/browser/authorities/authorities.evaluator.mjs

@@ -72,11 +72,25 @@ function resolveValue(value, ctx) {
   }
   return value;
 }
+function describeMissingValue(value) {
+  const reference = value ?? {};
+  if (typeof reference["fromInput"] === "string") return `input '${reference["fromInput"]}'`;
+  if (typeof reference["fromClaims"] === "string") return `claim '${reference["fromClaims"]}'`;
+  return "the value";
+}
+function unresolvedAttribute(policyPath, denialPath, path, value, actual) {
+  return {
+    granted: false,
+    unresolved: true,
+    deniedBy: `${policyPath}: '${path}' could not be checked: ${describeMissingValue(value)} is missing`,
+    denial: { kind: "attributes", path: denialPath, actual },
+    evaluatedPolicies: [policyPath]
+  };
+}
 function applyOperator(actual, op, expected) {
   switch (op) {
-    // A missing expected value (e.g. an absent fromInput) never matches, even an absent actual value
     case "eq":
-      return expected !== void 0 && actual === expected;
+      return actual === expected;
     case "neq":
       return actual !== expected;
     case "in":
@@ -114,23 +128,21 @@ function applyOperator(actual, op, expected) {
       return false;
   }
 }
-function evaluateCondition(condition, envelope, ctx) {
-  const actual = resolveDotPath(envelope, condition.path);
-  const expected = resolveValue(condition.value, ctx);
-  return applyOperator(actual, condition.op, expected);
-}
 var REDACTED_ENV_VALUE = "[redacted]";
 function reportableActual(path, actual) {
   return path === "env" || path.startsWith("env.") ? REDACTED_ENV_VALUE : actual;
 }
 function evaluateAbac(policy, ctx) {
   const envelope = buildContextEnvelope(ctx);
+  let unresolved;
   if (policy.match) {
     for (const [path, expectedRaw] of Object.entries(policy.match)) {
       const actual = resolveDotPath(envelope, path);
       const expected = resolveValue(expectedRaw, ctx);
-      if (expected === void 0 || actual !== expected) {
-        const reported = reportableActual(path, actual);
+      const reported = reportableActual(path, actual);
+      if (expected === void 0) {
+        unresolved ??= unresolvedAttribute("attributes.match", "attributes.match", path, expectedRaw, reported);
+      } else if (actual !== expected) {
         return {
           granted: false,
           deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(reported)}'`,
@@ -143,19 +155,29 @@ function evaluateAbac(policy, ctx) {
   if (policy.conditions) {
     for (let i = 0; i < policy.conditions.length; i++) {
       const condition = policy.conditions[i];
-      if (!evaluateCondition(condition, envelope, ctx)) {
-        const expected = resolveValue(condition.value, ctx);
-        const actual = reportableActual(condition.path, resolveDotPath(envelope, condition.path));
+      const denialPath = `attributes.conditions[${i}]`;
+      const actual = resolveDotPath(envelope, condition.path);
+      const expected = resolveValue(condition.value, ctx);
+      const reported = reportableActual(condition.path, actual);
+      if (expected === void 0) {
+        unresolved ??= unresolvedAttribute(
+          "attributes.conditions",
+          denialPath,
+          condition.path,
+          condition.value,
+          reported
+        );
+      } else if (!applyOperator(actual, condition.op, expected)) {
         return {
           granted: false,
           deniedBy: `attributes.conditions: '${condition.path}' failed '${condition.op}' check against '${String(expected)}'`,
-          denial: { kind: "attributes", path: `attributes.conditions[${i}]`, expected, actual },
+          denial: { kind: "attributes", path: denialPath, expected, actual: reported },
           evaluatedPolicies: ["attributes.conditions"]
         };
       }
     }
   }
-  return { granted: true, evaluatedPolicies: ["attributes"] };
+  return unresolved ?? { granted: true, evaluatedPolicies: ["attributes"] };
 }
 function resolveResourceId(ref, ctx) {
   if (typeof ref === "string") return ref;
@@ -183,6 +205,7 @@ async function evaluateSingleRebac(policy, ctx) {
   if (resourceId === void 0) {
     return {
       granted: false,
+      unresolved: true,
       deniedBy: `relationships: could not resolve resourceId for ${policy.resource}`,
       denial: {
         kind: "relationships",
@@ -210,11 +233,14 @@ async function evaluateSingleRebac(policy, ctx) {
 }
 async function evaluateRebac(policy, ctx) {
   const policies = Array.isArray(policy) ? policy : [policy];
+  let unresolved;
   for (const p of policies) {
     const result = await evaluateSingleRebac(p, ctx);
-    if (!result.granted) return result;
+    if (result.granted) continue;
+    if (!result.unresolved) return result;
+    unresolved ??= result;
   }
-  return { granted: true, evaluatedPolicies: ["relationships"] };
+  return unresolved ?? { granted: true, evaluatedPolicies: ["relationships"] };
 }
 export {
   evaluateAbac,

package/browser/authorization/dcr-client.registry.mjs

@@ -86,7 +86,7 @@ var DcrClientRegistry = class {
         client_id: c.clientId,
         client_secret: c.clientSecret,
         token_endpoint_auth_method: c.tokenEndpointAuthMethod ?? "none",
-        grant_types: c.grantTypes ?? ["authorization_code"],
+        grant_types: c.grantTypes ?? ["authorization_code", "refresh_token"],
         response_types: c.responseTypes ?? ["code"],
         redirect_uris: c.redirectUris,
         client_name: c.clientName,

package/browser/authorization/public.authorization.mjs

@@ -1,7 +1,7 @@
 // libs/auth/src/authorization/public.authorization.ts
 import { randomUUID } from "@frontmcp/utils";
-import { AuthorizationBase } from "./authorization.class.mjs";
 import { TokenNotAvailableError } from "../errors/auth-internal.errors.mjs";
+import { AuthorizationBase } from "./authorization.class.mjs";
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**

package/browser/authorization/transparent.authorization.mjs

@@ -1,7 +1,7 @@
 // libs/auth/src/authorization/transparent.authorization.ts
 import { sha256Hex } from "@frontmcp/utils";
-import { AuthorizationBase } from "./authorization.class.mjs";
 import { TokenNotAvailableError } from "../errors/auth-internal.errors.mjs";
+import { AuthorizationBase } from "./authorization.class.mjs";
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**

package/browser/cimd/cimd-client-assertion.mjs

@@ -0,0 +1,108 @@
+// libs/auth/src/cimd/cimd-client-assertion.ts
+import { sha256Hex } from "@frontmcp/utils";
+import { loadJose } from "../jwks/jose.loader.mjs";
+import { CimdClientAssertionError, CimdError } from "./cimd.errors.mjs";
+var CLIENT_ASSERTION_TYPE_JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var CLIENT_ASSERTION_SIGNING_ALGORITHMS = [
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512",
+  "EdDSA",
+  "Ed25519"
+];
+var MAX_CLIENT_ASSERTION_LIFETIME_SECONDS = 600;
+var CLOCK_TOLERANCE_SECONDS = 30;
+var MAX_CLIENT_ASSERTION_LENGTH = 16384;
+async function verifyClientAssertion(context) {
+  const { clientId, assertion } = context;
+  const refuse = (reason) => new CimdClientAssertionError(clientId, reason);
+  if (!assertion) throw refuse("missing_assertion");
+  if (context.type !== CLIENT_ASSERTION_TYPE_JWT_BEARER) throw refuse("unsupported_assertion_type");
+  if (assertion.length > MAX_CLIENT_ASSERTION_LENGTH) throw refuse("malformed");
+  const jose = await loadJose();
+  let algorithm;
+  try {
+    algorithm = jose.decodeProtectedHeader(assertion).alg;
+  } catch {
+    throw refuse("malformed");
+  }
+  if (typeof algorithm !== "string" || !CLIENT_ASSERTION_SIGNING_ALGORITHMS.includes(algorithm)) {
+    throw refuse("unsupported_algorithm");
+  }
+  let payload;
+  try {
+    payload = await verifySignedClaims(jose, context);
+  } catch (error) {
+    if (error instanceof CimdError) throw error;
+    throw refuse(refusalFor(error));
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  const expiresAt = payload.exp ?? now;
+  if (expiresAt - now > MAX_CLIENT_ASSERTION_LIFETIME_SECONDS) throw refuse("lifetime_too_long");
+  if (typeof payload.iat === "number" && payload.iat > now + CLOCK_TOLERANCE_SECONDS) throw refuse("not_yet_valid");
+  if (typeof payload.jti !== "string" || payload.jti.length === 0) throw refuse("missing_claim");
+  const ttlMs = (expiresAt - now + CLOCK_TOLERANCE_SECONDS) * 1e3;
+  const claimed = await context.claimOnce(`client-assertion:${sha256Hex(`${clientId}
+${payload.jti}`)}`, ttlMs);
+  if (!claimed) throw refuse("replayed");
+}
+async function verifySignedClaims(jose, context) {
+  const options = {
+    algorithms: CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+    issuer: context.clientId,
+    subject: context.clientId,
+    audience: [...context.audiences],
+    requiredClaims: ["exp", "jti"],
+    clockTolerance: CLOCK_TOLERANCE_SECONDS
+  };
+  const verifyWith = async (refresh) => {
+    const keys = jose.createLocalJWKSet(await context.keys(refresh));
+    return (await jose.jwtVerify(context.assertion ?? "", keys, options)).payload;
+  };
+  try {
+    return await verifyWith(false);
+  } catch (error) {
+    if (errorCode(error) !== "ERR_JWKS_NO_MATCHING_KEY") throw error;
+    return verifyWith(true);
+  }
+}
+function refusalFor(error) {
+  const { claim, reason } = error;
+  switch (errorCode(error)) {
+    case "ERR_JOSE_ALG_NOT_ALLOWED":
+      return "unsupported_algorithm";
+    case "ERR_JWKS_NO_MATCHING_KEY":
+    case "ERR_JWKS_MULTIPLE_MATCHING_KEYS":
+    case "ERR_JWKS_INVALID":
+    case "ERR_JWK_INVALID":
+      return "unknown_key";
+    case "ERR_JWS_SIGNATURE_VERIFICATION_FAILED":
+      return "bad_signature";
+    case "ERR_JWT_EXPIRED":
+      return "expired";
+    case "ERR_JWT_CLAIM_VALIDATION_FAILED":
+      if (reason === "missing") return "missing_claim";
+      if (claim === "iss") return "wrong_issuer";
+      if (claim === "sub") return "wrong_subject";
+      if (claim === "aud") return "wrong_audience";
+      if (claim === "nbf") return "not_yet_valid";
+      return "malformed";
+    default:
+      return "malformed";
+  }
+}
+function errorCode(error) {
+  return typeof error === "object" && error !== null ? error.code : void 0;
+}
+export {
+  CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+  CLIENT_ASSERTION_TYPE_JWT_BEARER,
+  MAX_CLIENT_ASSERTION_LIFETIME_SECONDS,
+  verifyClientAssertion
+};

package/browser/cimd/cimd-redis.cache.mjs

@@ -1,7 +1,9 @@
 // libs/auth/src/cimd/cimd-redis.cache.ts
-import { RedisStorageAdapter } from "@frontmcp/utils";
-import { sha256Hex } from "@frontmcp/utils";
-import { extractCacheHeaders, parseCacheHeaders } from "./cimd.cache.mjs";
+import { RedisStorageAdapter, sha256Hex } from "@frontmcp/utils";
+import {
+  extractCacheHeaders,
+  parseCacheHeaders
+} from "./cimd.cache.mjs";
 var RedisCimdCache = class {
   redis;
   keyPrefix;