@frontmcp/auth 1.12.0-rc.1 → 1.12.1

package/authorities/authorities.context.d.ts

@@ -17,6 +17,11 @@ import type { AuthoritiesEvaluationContext, RelationshipResolver } from './autho
  * resolveDotPath({ a: 1 }, 'a.b') // undefined
  */
 export declare function resolveDotPath(obj: Record<string, unknown>, path: string): unknown;
+/**
+ * The resolver of a context built without `relationshipResolver`. Its `check` answers false, and the
+ * engine reports a relationship rule checked against it as unresolved, so a `not` around it never grants.
+ */
+export declare const noopRelationshipResolver: RelationshipResolver;
 /**
  * Function signature for custom claims resolution.
  */
@@ -70,6 +75,8 @@ export declare class AuthoritiesContextBuilder {
     private readonly claimsResolver;
     private readonly relationshipResolver;
     constructor(options?: AuthoritiesContextBuilderOptions);
+    /** Whether a relationship resolver was configured; without one every relationship check denies as unresolved. */
+    get hasRelationshipResolver(): boolean;
     /**
      * Build an evaluation context from AuthInfo and tool input.
      */

package/authorities/authorities.context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAQD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAc,GACxC,4BAA4B;CAwEhC"}
+{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AAgBD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,oBAItC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAQD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D,iHAAiH;IACjH,IAAI,uBAAuB,IAAI,OAAO,CAErC;IAED;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAc,GACxC,4BAA4B;CAwEhC"}

package/authorities/authorities.engine.d.ts

@@ -24,15 +24,21 @@ export declare class AuthoritiesEngine {
     constructor(profiles: AuthoritiesProfileRegistry, evaluators: AuthoritiesEvaluatorRegistry);
     /**
      * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
-     * and each profile name it uses that no registered profile has. The server reports them when it
-     * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
+     * each profile name it uses that no registered profile has, and each custom evaluator it names that
+     * is not registered. The server reports them when it starts; {@link evaluate} denies such a value.
      */
     findRuleProblems(authorities: unknown): string[];
     /**
-     * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
-     * The server reports them when it starts.
+     * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}), and each
+     * custom evaluator a profile names that is not registered. The server reports them when it starts.
      */
     findProfileProblems(): string[];
+    /** The registered profiles whose rule checks relationships, at any depth. */
+    profilesCheckingRelationships(): string[];
+    /** Whether an entry's rule object checks relationships, at any depth (a profile it names is not looked into). */
+    ruleChecksRelationships(authorities: unknown): boolean;
+    /** A problem for each custom evaluator a rule names, at any depth, that is not registered. */
+    private unknownEvaluatorProblems;
     /**
      * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
      *

package/authorities/authorities.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA2C7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAIlC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;YACW,cAAc;IAkB5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAO3B;;OAEG;YACW,aAAa;IA4B3B;;OAEG;YACW,WAAW;IAiBzB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}
+{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAiE7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAYhD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAQ/B,6EAA6E;IAC7E,6BAA6B,IAAI,MAAM,EAAE;IAMzC,iHAAiH;IACjH,uBAAuB,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO;IAItD,8FAA8F;IAC9F,OAAO,CAAC,wBAAwB;IAMhC;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAIlC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;YACW,cAAc;IAmB5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAO3B;;OAEG;YACW,aAAa;IA4B3B;;OAEG;YACW,WAAW;IAiBzB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}

package/authorities/authorities.evaluator.d.ts

@@ -12,6 +12,8 @@ export declare function evaluateRbacRoles(policy: RbacRolesPolicy, ctx: Authorit
  * Evaluate RBAC permissions policy against user permissions.
  */
 export declare function evaluateRbacPermissions(policy: RbacPermissionsPolicy, ctx: AuthoritiesEvaluationContext): AuthoritiesResult;
+/** Why a `matches` check cannot run on these values in bounded time, or undefined when it can. */
+export declare function unmatchableReason(actual: unknown, pattern: unknown): string | undefined;
 /**
  * Evaluate ABAC policy.
  */

package/authorities/authorities.evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AAgHD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAmDrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAiDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAY5B"}
+{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AA8DD,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUvF;AA+CD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4DrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AA4DD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAY5B"}

package/authorities/authorities.validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.validation.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgPH;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE,CAY1E;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAEtF"}
+{"version":3,"file":"authorities.validation.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkPH;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE,CAY1E;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAEtF"}

package/authorization/dcr-client.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dcr-client.registry.d.ts","sourceRoot":"","sources":["../../src/authorization/dcr-client.registry.ts"],"names":[],"mappings":"AAgBA,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,EACtB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAChF,UAAU,CAAC,EAAE,KAAK,CAAC,oBAAoB,GAAG,eAAe,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAyBjE;AA0ED;;;GAGG;AACH,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAExB,MAAM,GAAE,iBAAsB;IAK3D,+EAA+E;IAC/E,OAAO,CAAC,wBAAwB;IAoBhC,yEAAyE;IACzE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAInD;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS;IAcvG,oDAAoD;IACpD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO;IAY3C,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,mBAAmB;IAM3B,sDAAsD;IACtD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAOlD,mDAAmD;IACnD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQ5C,wEAAwE;IACxE,0BAA0B,IAAI,OAAO;IAIrC;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;CAajE"}
+{"version":3,"file":"dcr-client.registry.d.ts","sourceRoot":"","sources":["../../src/authorization/dcr-client.registry.ts"],"names":[],"mappings":"AAgBA,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B,EACtB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,GAAG,EAAE,OAAO,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAChF,UAAU,CAAC,EAAE,KAAK,CAAC,oBAAoB,GAAG,eAAe,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAyBjE;AAoFD;;;GAGG;AACH,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAExB,MAAM,GAAE,iBAAsB;IAK3D,+EAA+E;IAC/E,OAAO,CAAC,wBAAwB;IAoBhC,yEAAyE;IACzE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAInD;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS;IAcvG,oDAAoD;IACpD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO;IAY3C,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,mBAAmB;IAM3B,sDAAsD;IACtD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAOlD,mDAAmD;IACnD,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQ5C,wEAAwE;IACxE,0BAA0B,IAAI,OAAO;IAIrC;;;;OAIG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;CAajE"}

package/authorization/public.authorization.d.ts

@@ -44,6 +44,7 @@ export interface PublicAuthorizationCreateCtx {
  * - Ideal for development, docs, public wikis, and read-only resources
  */
 export declare class PublicAuthorization extends AuthorizationBase {
+    #private;
     readonly mode: AuthMode;
     /**
      * Issuer identifier for the anonymous authorization
@@ -73,11 +74,11 @@ export declare class PublicAuthorization extends AuthorizationBase {
      */
     getToken(_providerId?: string): Promise<string>;
     /**
-     * Check if all tools are allowed (public access)
+     * Check if all tools are allowed (`allowedTools: 'all'`); an empty list allows none
      */
     get allowsAllTools(): boolean;
     /**
-     * Check if all prompts are allowed (public access)
+     * Check if all prompts are allowed (`allowedPrompts: 'all'`); an empty list allows none
      */
     get allowsAllPrompts(): boolean;
     /**

package/authorization/public.authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.authorization.d.ts","sourceRoot":"","sources":["../../src/authorization/public.authorization.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAoC,MAAM,uBAAuB,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAY;IAEnC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,OAAO;IAKP;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,GAAE,4BAAiC,GAAG,mBAAmB;IA6D1E;;;;OAIG;IACG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED;;OAEG;IACM,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAQ/C;;OAEG;IACM,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAOpD"}
+{"version":3,"file":"public.authorization.d.ts","sourceRoot":"","sources":["../../src/authorization/public.authorization.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAoC,MAAM,uBAAuB,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAY;IAEnC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAKzB,OAAO;IAOP;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,GAAE,4BAAiC,GAAG,mBAAmB;IA+D1E;;;;OAIG;IACG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD;;OAEG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED;;OAEG;IACM,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAO/C;;OAEG;IACM,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAMpD"}

package/browser/authorities/authorities.context.mjs

@@ -53,6 +53,10 @@ var AuthoritiesContextBuilder = class {
     this.claimsResolver = options.claimsResolver;
     this.relationshipResolver = options.relationshipResolver ?? noopRelationshipResolver;
   }
+  /** Whether a relationship resolver was configured; without one every relationship check denies as unresolved. */
+  get hasRelationshipResolver() {
+    return this.relationshipResolver !== noopRelationshipResolver;
+  }
   /**
    * Build an evaluation context from AuthInfo and tool input.
    */
@@ -111,6 +115,7 @@ var AuthoritiesContextBuilder = class {
 export {
   AuthoritiesContextBuilder,
   isAnonymousSubject,
+  noopRelationshipResolver,
   resolveAuthUser,
   resolveDotPath,
   signedInSubject

package/browser/authorities/authorities.engine.mjs

@@ -15,6 +15,24 @@ function invalidRule(problems, policies = []) {
     evaluatedPolicies: policies
   };
 }
+function customEvaluatorNames(rule, seen = /* @__PURE__ */ new Set()) {
+  if (typeof rule !== "object" || rule === null || Array.isArray(rule) || seen.has(rule)) return [];
+  seen.add(rule);
+  const { custom, allOf, anyOf, not } = rule;
+  const nested = [...Array.isArray(allOf) ? allOf : [], ...Array.isArray(anyOf) ? anyOf : [], not];
+  return [
+    ...typeof custom === "object" && custom !== null ? Object.keys(custom) : [],
+    ...nested.flatMap((inner) => customEvaluatorNames(inner, seen))
+  ];
+}
+function checksRelationships(rule, seen = /* @__PURE__ */ new Set()) {
+  if (typeof rule !== "object" || rule === null || Array.isArray(rule) || seen.has(rule)) return false;
+  seen.add(rule);
+  const { relationships, allOf, anyOf, not } = rule;
+  if (relationships !== void 0) return true;
+  const nested = [...Array.isArray(allOf) ? allOf : [], ...Array.isArray(anyOf) ? anyOf : [], not];
+  return nested.some((inner) => checksRelationships(inner, seen));
+}
 async function evaluateEvery(items, evaluateItem, evaluatedPolicies = []) {
   let unresolved;
   for (const item of items) {
@@ -37,23 +55,40 @@ var AuthoritiesEngine = class {
   ruleProblems = /* @__PURE__ */ new WeakMap();
   /**
    * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
-   * and each profile name it uses that no registered profile has. The server reports them when it
-   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '\u2026' is not registered`).
+   * each profile name it uses that no registered profile has, and each custom evaluator it names that
+   * is not registered. The server reports them when it starts; {@link evaluate} denies such a value.
    */
   findRuleProblems(authorities) {
     const problems = findAuthoritiesRuleProblems(authorities);
     if (problems.length > 0) return problems;
     const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
-    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
+    return [
+      ...names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`),
+      ...this.unknownEvaluatorProblems(authorities)
+    ];
   }
   /**
-   * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
-   * The server reports them when it starts.
+   * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}), and each
+   * custom evaluator a profile names that is not registered. The server reports them when it starts.
    */
   findProfileProblems() {
-    return Object.entries(this.profiles.getAll()).flatMap(
-      ([name, policy]) => findAuthoritiesProfileProblems(name, policy)
-    );
+    return Object.entries(this.profiles.getAll()).flatMap(([name, policy]) => {
+      const problems = findAuthoritiesProfileProblems(name, policy);
+      if (problems.length > 0) return problems;
+      return this.unknownEvaluatorProblems(policy).map((problem) => `profile "${name}": ${problem}`);
+    });
+  }
+  /** The registered profiles whose rule checks relationships, at any depth. */
+  profilesCheckingRelationships() {
+    return Object.entries(this.profiles.getAll()).filter(([, policy]) => checksRelationships(policy)).map(([name]) => name);
+  }
+  /** Whether an entry's rule object checks relationships, at any depth (a profile it names is not looked into). */
+  ruleChecksRelationships(authorities) {
+    return checksRelationships(authorities);
+  }
+  /** A problem for each custom evaluator a rule names, at any depth, that is not registered. */
+  unknownEvaluatorProblems(rule) {
+    return [...new Set(customEvaluatorNames(rule))].filter((name) => !this.evaluators.has(name)).map((name) => `names an unknown custom evaluator "${name}" (register it in authorities.evaluators)`);
   }
   /**
    * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
@@ -183,7 +218,8 @@ var AuthoritiesEngine = class {
       if (!evaluator) {
         return {
           granted: false,
-          deniedBy: `custom evaluator '${name}' is not registered`,
+          unresolved: true,
+          deniedBy: `custom evaluator '${name}' is not registered (add it to authorities.evaluators)`,
           evaluatedPolicies: [`custom.${name}`]
         };
       }

package/browser/authorities/authorities.evaluator.mjs

@@ -1,5 +1,6 @@
 // libs/auth/src/authorities/authorities.evaluator.ts
-import { isAnonymousSubject, resolveDotPath } from "./authorities.context.mjs";
+import { isPatternSafe } from "@frontmcp/utils";
+import { isAnonymousSubject, noopRelationshipResolver, resolveDotPath } from "./authorities.context.mjs";
 function evaluateRbacRoles(policy, ctx) {
   const userRoles = ctx.user.roles;
   if (policy.all) {
@@ -87,6 +88,19 @@ function unresolvedAttribute(policyPath, denialPath, path, value, actual) {
     evaluatedPolicies: [policyPath]
   };
 }
+var MAX_PATTERN_LENGTH = 256;
+var MAX_MATCHED_LENGTH = 1e4;
+function unmatchableReason(actual, pattern) {
+  if (typeof pattern !== "string") return void 0;
+  if (pattern.length > MAX_PATTERN_LENGTH) return `the pattern is longer than ${MAX_PATTERN_LENGTH} characters`;
+  if (!isPatternSafe(pattern)) {
+    return "the pattern is not a valid regular expression, or its matching time can grow very fast with the value";
+  }
+  if (typeof actual === "string" && actual.length > MAX_MATCHED_LENGTH) {
+    return `the value is longer than ${MAX_MATCHED_LENGTH} characters`;
+  }
+  return void 0;
+}
 function applyOperator(actual, op, expected) {
   switch (op) {
     case "eq":
@@ -116,14 +130,7 @@ function applyOperator(actual, op, expected) {
     case "exists":
       return expected ? actual !== void 0 && actual !== null : actual === void 0 || actual === null;
     case "matches":
-      if (typeof actual !== "string" || typeof expected !== "string") return false;
-      if (expected.length > 256) return false;
-      if (/(\+\+|\*\*|\{\d+,\d*\}\{)/.test(expected)) return false;
-      try {
-        return new RegExp(expected).test(actual);
-      } catch {
-        return false;
-      }
+      return typeof actual === "string" && typeof expected === "string" && new RegExp(expected).test(actual);
     default:
       return false;
   }
@@ -159,6 +166,7 @@ function evaluateAbac(policy, ctx) {
       const actual = resolveDotPath(envelope, condition.path);
       const expected = resolveValue(condition.value, ctx);
       const reported = reportableActual(condition.path, actual);
+      const unmatchable = condition.op === "matches" ? unmatchableReason(actual, expected) : void 0;
       if (expected === void 0) {
         unresolved ??= unresolvedAttribute(
           "attributes.conditions",
@@ -167,6 +175,14 @@ function evaluateAbac(policy, ctx) {
           condition.value,
           reported
         );
+      } else if (unmatchable !== void 0) {
+        unresolved ??= {
+          granted: false,
+          unresolved: true,
+          deniedBy: `attributes.conditions: '${condition.path}' could not be checked: ${unmatchable}`,
+          denial: { kind: "attributes", path: denialPath, actual: reported },
+          evaluatedPolicies: ["attributes.conditions"]
+        };
       } else if (!applyOperator(actual, condition.op, expected)) {
         return {
           granted: false,
@@ -201,6 +217,15 @@ async function evaluateSingleRebac(policy, ctx) {
       evaluatedPolicies: ["relationships"]
     };
   }
+  if (ctx.relationships === noopRelationshipResolver) {
+    return {
+      granted: false,
+      unresolved: true,
+      deniedBy: `relationships: '${policy.type}' of ${policy.resource} could not be checked: no relationship resolver is configured (set authorities.relationshipResolver)`,
+      denial: { kind: "relationships", path: "relationships", expected: `${policy.type}:${policy.resource}` },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
   const resourceId = resolveResourceId(policy.resourceId, ctx);
   if (resourceId === void 0) {
     return {
@@ -247,5 +272,6 @@ export {
   evaluateRbacPermissions,
   evaluateRbacRoles,
   evaluateRebac,
-  resolveResourceId
+  resolveResourceId,
+  unmatchableReason
 };

package/browser/authorities/authorities.validation.mjs

@@ -1,4 +1,5 @@
 // libs/auth/src/authorities/authorities.validation.ts
+import { unmatchableReason } from "./authorities.evaluator.mjs";
 var ABAC_OPERATORS = /* @__PURE__ */ new Set([
   "eq",
   "neq",
@@ -82,7 +83,8 @@ function checkConditionValue(op, condition, path) {
   const expected = OPERATOR_VALUES[op];
   if (expected && !expected.accepts(value)) return [`${path} must be ${expected.needs} for "${op}"`];
   if (Array.isArray(value) && value.length === 0 && (op === "in" || op === "notIn")) return [`${path} is empty`];
-  return [];
+  const unmatchable = op === "matches" ? unmatchableReason(void 0, value) : void 0;
+  return unmatchable === void 0 ? [] : [`${path} cannot be used: ${unmatchable}`];
 }
 function checkAttributes(value, path) {
   if (!isPlainObject(value)) return [`${path} must be an object with "match" or "conditions"`];

package/browser/authorization/authorization.class.mjs

@@ -108,13 +108,13 @@ var AuthorizationBase = class _AuthorizationBase {
    * Check if a tool is authorized
    */
   canAccessTool(toolId) {
-    return toolId in this.authorizedTools || this.authorizedToolIds.includes(toolId);
+    return Object.hasOwn(this.authorizedTools, toolId) || this.authorizedToolIds.includes(toolId);
   }
   /**
    * Check if a prompt is authorized
    */
   canAccessPrompt(promptId) {
-    return promptId in this.authorizedPrompts || this.authorizedPromptIds.includes(promptId);
+    return Object.hasOwn(this.authorizedPrompts, promptId) || this.authorizedPromptIds.includes(promptId);
   }
   /**
    * Check if an app is authorized.
@@ -122,7 +122,7 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param appId - App ID to check
    */
   isAppAuthorized(appId) {
-    return appId in this.authorizedApps || this.authorizedAppIds.includes(appId);
+    return Object.hasOwn(this.authorizedApps, appId) || this.authorizedAppIds.includes(appId);
   }
   /**
    * Build URL for progressive/incremental authorization.

package/browser/authorization/dcr-client.registry.mjs

@@ -60,9 +60,17 @@ function splitRedirectUri(s) {
   }
   return { scheme, userinfo, host, port, rest };
 }
+function hasAmbiguousCharacter(uri) {
+  for (let index = 0; index < uri.length; index++) {
+    const code = uri.charCodeAt(index);
+    if (code <= 32 || code === 92 || code === 127) return true;
+  }
+  return false;
+}
 function globMatchRedirectUri(pattern, input) {
   const p = splitRedirectUri(pattern);
   if (!p) return globMatch(pattern, input);
+  if (hasAmbiguousCharacter(input)) return false;
   const u = splitRedirectUri(input);
   if (!u) return false;
   return globMatch(p.scheme, u.scheme) && globMatch(p.userinfo, u.userinfo) && globMatch(p.host, u.host) && globMatch(p.port, u.port) && globMatch(p.rest, u.rest);

package/browser/authorization/public.authorization.mjs

@@ -8,9 +8,13 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
    * Issuer identifier for the anonymous authorization
    */
   issuer;
+  #allTools;
+  #allPrompts;
   constructor(ctx) {
     super(ctx);
     this.issuer = ctx.issuer;
+    this.#allTools = ctx.allTools;
+    this.#allPrompts = ctx.allPrompts;
   }
   /**
    * Create a new PublicAuthorization for anonymous access
@@ -72,6 +76,8 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       scopes,
       expiresAt,
       issuer,
+      allTools: allowedTools === "all",
+      allPrompts: allowedPrompts === "all",
       authorizedTools: allowedTools === "all" ? void 0 : authorizedTools,
       authorizedToolIds: allowedTools === "all" ? void 0 : authorizedToolIds,
       authorizedPrompts: allowedPrompts === "all" ? void 0 : authorizedPrompts,
@@ -89,16 +95,16 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
     );
   }
   /**
-   * Check if all tools are allowed (public access)
+   * Check if all tools are allowed (`allowedTools: 'all'`); an empty list allows none
    */
   get allowsAllTools() {
-    return this.authorizedToolIds.length === 0 && Object.keys(this.authorizedTools).length === 0;
+    return this.#allTools;
   }
   /**
-   * Check if all prompts are allowed (public access)
+   * Check if all prompts are allowed (`allowedPrompts: 'all'`); an empty list allows none
    */
   get allowsAllPrompts() {
-    return this.authorizedPromptIds.length === 0 && Object.keys(this.authorizedPrompts).length === 0;
+    return this.#allPrompts;
   }
   /**
    * Override canAccessTool to support 'all' mode

package/browser/cimd/cimd-redis.cache.mjs

@@ -20,7 +20,9 @@ var RedisCimdCache = class {
     this.keyPrefix = config.redis.keyPrefix ?? "cimd:";
     const redisOptions = {};
     if (config.redis.url) {
+      const { port, password, db, tls } = config.redis;
       redisOptions.url = config.redis.url;
+      redisOptions.config = { port, password, db, tls };
     } else if (config.redis.host) {
       redisOptions.config = {
         host: config.redis.host,

package/browser/cimd/cimd.service.mjs

@@ -21,7 +21,13 @@ import {
   clientJwksSchema,
   clientMetadataDocumentSchema
 } from "./cimd.types.mjs";
-import { assertHostNotSsrf, hasOnlyLocalhostRedirectUris, isCimdClientId, validateClientIdUrl } from "./cimd.validator.mjs";
+import {
+  assertHostNotSsrf,
+  blocksPrivateAddressesFor,
+  hasOnlyLocalhostRedirectUris,
+  isCimdClientId,
+  validateClientIdUrl
+} from "./cimd.validator.mjs";
 var MAX_CACHED_KEY_SETS = 500;
 var KEY_SET_REFRESH_COOLDOWN_MS = 3e4;
 var CimdService = class {
@@ -130,15 +136,15 @@ var CimdService = class {
     }
     this.logger.info(`Fetching CIMD document: ${clientId}`);
     const { document, headers } = await this.fetchMetadataDocument(clientId);
-    this.validateDocument(clientId, document);
-    if (this.securityConfig.warnOnLocalhostRedirects && hasOnlyLocalhostRedirectUris(document.redirect_uris)) {
+    const metadata = this.validateDocument(clientId, document);
+    if (this.securityConfig.warnOnLocalhostRedirects && hasOnlyLocalhostRedirectUris(metadata.redirect_uris)) {
       this.logger.warn(`CIMD client "${clientId}" has only localhost redirect URIs - this may be a development client`);
     }
-    await cache.set(clientId, document, headers);
+    await cache.set(clientId, metadata, headers);
     const entry = await cache.get(clientId);
     return {
       isCimdClient: true,
-      metadata: document,
+      metadata,
       fromCache: false,
       expiresAt: entry?.expiresAt,
       etag: entry?.etag,
@@ -300,8 +306,9 @@ var CimdService = class {
       let redirectCount = 0;
       let isFirstRequest = true;
       while (true) {
-        if (this.securityConfig.blockPrivateIPs && !this.securityConfig.allowInsecureForTesting) {
-          await assertHostNotSsrf(new URL(currentUrl).hostname, url);
+        const hostname = new URL(currentUrl).hostname;
+        if (blocksPrivateAddressesFor(hostname, this.securityConfig)) {
+          await assertHostNotSsrf(hostname, url);
         }
         const headers = {
           Accept: "application/json"
@@ -436,6 +443,7 @@ var CimdService = class {
    *
    * @param clientId - The URL from which the document was fetched
    * @param document - The document to validate
+   * @returns The parsed document, with the schema's defaults for the fields it leaves out
    */
   validateDocument(clientId, document) {
     const result = clientMetadataDocumentSchema.safeParse(document);
@@ -449,6 +457,7 @@ var CimdService = class {
     if (result.data.client_id !== clientId) {
       throw new CimdClientIdMismatchError(clientId, result.data.client_id);
     }
+    return result.data;
   }
 };
 var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "[::1]", "localhost"]);

package/browser/cimd/cimd.validator.mjs

@@ -34,6 +34,10 @@ function isLocalhostHost(hostname) {
   const lower = hostname.toLowerCase();
   return lower === "localhost" || lower === "127.0.0.1" || lower === "[::1]" || lower.endsWith(".localhost");
 }
+function blocksPrivateAddressesFor(hostname, securityConfig) {
+  if (!(securityConfig?.blockPrivateIPs ?? true)) return false;
+  return !(securityConfig?.allowInsecureForTesting && isLocalhostHost(hostname));
+}
 function validateClientIdUrl(clientId, securityConfig) {
   if (!clientId || typeof clientId !== "string") {
     throw new InvalidClientIdUrlError(clientId || "", "client_id must be a non-empty string");
@@ -57,7 +61,6 @@ function validateClientIdUrl(clientId, securityConfig) {
     );
   }
   const config = {
-    blockPrivateIPs: securityConfig?.blockPrivateIPs ?? true,
     allowedDomains: securityConfig?.allowedDomains,
     blockedDomains: securityConfig?.blockedDomains
   };
@@ -71,7 +74,7 @@ function validateClientIdUrl(clientId, securityConfig) {
       throw new CimdSecurityError(clientId, `Domain "${url.hostname}" is blocked`);
     }
   }
-  if (config.blockPrivateIPs && !allowInsecure) {
+  if (blocksPrivateAddressesFor(url.hostname, securityConfig)) {
     const ssrfCheck = checkSsrfProtection(url.hostname);
     if (!ssrfCheck.allowed) {
       throw new CimdSecurityError(clientId, ssrfCheck.reason);
@@ -209,6 +212,7 @@ function hasOnlyLocalhostRedirectUris(redirectUris) {
 }
 export {
   assertHostNotSsrf,
+  blocksPrivateAddressesFor,
   checkSsrfProtection,
   hasOnlyLocalhostRedirectUris,
   isCimdClientId,

package/browser/detection/auth-provider-detection.mjs

@@ -81,6 +81,13 @@ function detectAuthProviders(parentAuth, apps) {
     }
     const providerId = deriveProviderId(app.auth);
     const existing = providers.get(providerId);
+    const providerUrl = getProviderUrl(app.auth);
+    if (existing && providerUrl && existing.providerUrl && !sameIssuer(providerUrl, existing.providerUrl)) {
+      const owner = existing.isParentProvider ? "the server" : `app "${existing.appIds[0]}"`;
+      validationErrors.push(
+        `App "${app.id}" names the identity provider ${providerUrl} and ${owner} names ${existing.providerUrl}, but both get the provider id "${providerId}", so a token from one would be accepted for the other. Set a distinct providerConfig.id on each.`
+      );
+    }
     if (existing) {
       existing.appIds.push(app.id);
       const newScopes = extractScopes(app.auth);
@@ -137,6 +144,14 @@ function staticParentEnforces(parentAuth, appAuth) {
   const sameChallenge = parent.data.header.toLowerCase() === app.data.header.toLowerCase() && parent.data.scheme === app.data.scheme;
   return sameChallenge && parent.data.tokens.every((token) => app.data.tokens.includes(token));
 }
+function sameIssuer(first, second) {
+  return issuerIdentity(first) === issuerIdentity(second);
+}
+function issuerIdentity(url) {
+  let identity = URL.canParse(url) ? new URL(url).href : url;
+  while (identity.endsWith("/")) identity = identity.slice(0, -1);
+  return identity;
+}
 function getProviderUrl(options) {
   if (isTransparentMode(options)) {
     return options.provider;

package/browser/jwks/jwks.service.mjs

@@ -9,7 +9,14 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // libs/auth/src/jwks/jwks.service.ts
-import { bytesToHex, isProduction, isRedirectResponse, randomBytes, rsaVerify } from "@frontmcp/utils";
+import {
+  bytesToHex,
+  isProduction,
+  isRedirectResponse,
+  randomBytes,
+  readTextWithLimit,
+  rsaVerify
+} from "@frontmcp/utils";
 import { resolveAndCheckHostname } from "../cimd/cimd.validator.mjs";
 import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
 import { loadJose } from "./jose.loader.mjs";
@@ -438,14 +445,7 @@ var JwksService = class {
           continue;
         }
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        const contentLength = res.headers.get("content-length");
-        if (contentLength && Number(contentLength) > MAX_JWKS_FETCH_BYTES) {
-          throw new Error("response too large");
-        }
-        const text = await res.text();
-        if (text.length > MAX_JWKS_FETCH_BYTES) {
-          throw new Error("response too large");
-        }
+        const text = await readTextWithLimit(res, MAX_JWKS_FETCH_BYTES);
         return JSON.parse(text);
       }
     } finally {

package/browser/people/loopback-token.auth.mjs

@@ -87,13 +87,20 @@ var LoopbackTokenAuth = class {
     const previous = this.failures.get(client);
     const count = previous && now - previous.lastAt <= lockoutMs ? previous.count + 1 : 1;
     const locked = count >= maxFailedAttempts;
-    if (!previous && this.failures.size >= MAX_TRACKED_CLIENTS) this.forgetIdleClients(now);
+    this.failures.delete(client);
+    if (this.failures.size >= MAX_TRACKED_CLIENTS) this.forgetOldestClients(now);
     this.failures.set(client, { count: locked ? 0 : count, lastAt: now, lockedUntil: locked ? now + lockoutMs : 0 });
     return locked ? LOCKED : INVALID;
   }
-  forgetIdleClients(now) {
+  /**
+   * Clients are kept in the order of their last failure, so the idle ones come first: drop them, and stop at the
+   * first active one, unless the map is still full, when that oldest active one goes too.
+   */
+  forgetOldestClients(now) {
     for (const [client, failures] of this.failures) {
-      if (failures.lockedUntil <= now && now - failures.lastAt > this.options.lockoutMs) this.failures.delete(client);
+      const idle = failures.lockedUntil <= now && now - failures.lastAt > this.options.lockoutMs;
+      if (!idle && this.failures.size < MAX_TRACKED_CLIENTS) return;
+      this.failures.delete(client);
     }
   }
 };