@frontmcp/auth 1.8.0 → 1.8.1

package/authorities/authorities.context.d.ts

@@ -4,8 +4,8 @@
  * Builds an AuthoritiesEvaluationContext from AuthInfo and claimsMapping.
  * Handles JWT shape differences across IdPs (Auth0, Keycloak, Okta, etc.).
  */
-import type { AuthoritiesEvaluationContext, RelationshipResolver } from './authorities.types';
 import type { AuthoritiesClaimsMapping } from './authorities.profiles';
+import type { AuthoritiesEvaluationContext, RelationshipResolver } from './authorities.types';
 /**
  * Resolve a dot-path value from a nested object.
  * First tries a direct key lookup (for keys containing dots, e.g., Auth0 namespaced claims),
@@ -39,6 +39,21 @@ export interface AuthInfoLike {
     extra?: Record<string, unknown>;
     [key: string]: unknown;
 }
+/**
+ * The caller's claims, wherever the entry point put them: top-level `user`, or
+ * `extra.user` (MCP 2026-07-28 and the HTTP flow's context).
+ */
+export declare function resolveAuthUser(authInfo: Partial<AuthInfoLike> | undefined): NonNullable<AuthInfoLike['user']>;
+/**
+ * Whether a subject names no signed-in caller: missing, not a string, empty, or an anonymous placeholder (`anon:…`).
+ */
+export declare function isAnonymousSubject(sub: unknown): boolean;
+/**
+ * The signed-in subject of a caller, or undefined for an anonymous one. A caller whose own
+ * subject is anonymous stays anonymous, whatever `claimsMapping.userId` resolves to; a mapped
+ * user id that is not a usable string falls back to the caller's own subject.
+ */
+export declare function signedInSubject(rawSub: unknown, mappedSub?: unknown): string | undefined;
 /**
  * Options for building an evaluation context.
  */

package/authorities/authorities.context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,4BAA4B;CAsEhC"}
+{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,4BAA4B;CAoEhC"}

package/authorities/authorities.evaluator.d.ts

@@ -3,7 +3,7 @@
  *
  * Pure functions for evaluating RBAC, ABAC, and ReBAC policies.
  */
-import type { RbacRolesPolicy, RbacPermissionsPolicy, AbacPolicy, RebacPolicy, ResourceIdRef, AuthoritiesResult, AuthoritiesEvaluationContext } from './authorities.types';
+import type { AbacPolicy, AuthoritiesEvaluationContext, AuthoritiesResult, RbacPermissionsPolicy, RbacRolesPolicy, RebacPolicy, ResourceIdRef } from './authorities.types';
 /**
  * Evaluate RBAC roles policy against user roles.
  */

package/authorities/authorities.evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,UAAU,EAEV,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAO7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AA6FD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAqCrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAuCD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}
+{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAEV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AA8FD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAqCrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAgDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}

package/authorities/authorities.types.d.ts

@@ -249,8 +249,8 @@ export interface RelationshipResolver {
 export interface AuthoritiesEvaluationContext {
     /** Resolved user information */
     user: {
-        /** User subject identifier */
-        sub: string;
+        /** User subject identifier; undefined for anonymous callers */
+        sub?: string;
         /** User roles (extracted via claimsMapping) */
         roles: string[];
         /** User permissions (extracted via claimsMapping) */

package/authorities/authorities.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.types.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,GACV,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,aAAa,CAAC;CAC3B;AAMD;;;;;GAKG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,4BAA4B,KAAK,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;AAEnH,MAAM,WAAW,yBAAyB;IACxC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,iCAAiC;IACjC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,uCAAuC;IACvC,aAAa,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACxB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,yBAAyB,CAAC;IAChC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,qDAAqD;IACrD,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAMD;;;;;;;;;;;;;;GAcG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,yBAAyB;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,yBAAyB,CAAC;AAM5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,EAAE,GAAG,yBAAyB,CAAC;AAM5G;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAClH,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,gCAAgC;IAChC,IAAI,EAAE;QACJ,8BAA8B;QAC9B,GAAG,EAAE,MAAM,CAAC;QACZ,+CAA+C;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,qDAAqD;QACrD,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,6CAA6C;IAC7C,aAAa,EAAE,oBAAoB,CAAC;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"authorities.types.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,UAAU,GACV,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,aAAa,CAAC;CAC3B;AAMD;;;;;GAKG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,4BAA4B,KAAK,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;AAEnH,MAAM,WAAW,yBAAyB;IACxC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,iCAAiC;IACjC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,uCAAuC;IACvC,aAAa,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACxB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,yBAAyB,CAAC;IAChC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;IACpC,qDAAqD;IACrD,KAAK,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAMD;;;;;;;;;;;;;;GAcG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,yBAAyB;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,yBAAyB,CAAC;AAM5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,EAAE,GAAG,yBAAyB,CAAC;AAM5G;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAClH,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,gCAAgC;IAChC,IAAI,EAAE;QACJ,+DAA+D;QAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+CAA+C;QAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,qDAAqD;QACrD,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,6CAA6C;IAC7C,aAAa,EAAE,oBAAoB,CAAC;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC1F"}

package/authorities/index.d.ts

@@ -10,7 +10,7 @@ export type { AuthoritiesClaimsMapping, AuthoritiesConfig, AuthoritiesScopeMappi
 export { resolveRequiredScopes } from './authorities.scope-mapping';
 export { rbacRolesPolicySchema, rbacPermissionsPolicySchema, abacOperatorSchema, abacConditionSchema, abacPolicySchema, resourceIdRefSchema, rebacPolicySchema, authoritiesPolicySchema, authoritiesMetadataSchema, authoritiesClaimsMappingSchema, authoritiesConfigSchema, } from './authorities.schema';
 export { AuthoritiesEngine } from './authorities.engine';
-export { AuthoritiesContextBuilder } from './authorities.context';
+export { AuthoritiesContextBuilder, isAnonymousSubject } from './authorities.context';
 export type { ClaimsResolverFn } from './authorities.context';
 export { AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry } from './authorities.registry';
 export { AuthorityDeniedError } from './authorities.errors';

package/authorities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,gCAAgC,CAAC;AAGxC,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGlG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,gCAAgC,CAAC;AAGxC,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGlG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/cimd/cimd.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.service.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAQL,KAAK,eAAe,EAEpB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAGtB;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IA4BlE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;;OAQG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoD5E;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUhF;;;;OAIG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAMhD;;;;OAIG;YACW,qBAAqB;IAoKnC;;OAEG;YACW,qBAAqB;IAyCnC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAiBzB"}
+{"version":3,"file":"cimd.service.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAQL,KAAK,eAAe,EAEpB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAGtB;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IA4BlE;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;;OAQG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoD5E;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUhF;;;;OAIG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAMhD;;;;OAIG;YACW,qBAAqB;IAoKnC;;OAEG;YACW,qBAAqB;IAyCnC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAiBzB"}

package/cimd/cimd.validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.validator.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.validator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,UAAQ,GAAG,OAAO,CA4B/E;AAUD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CA6DvG;AAED;;GAEG;AACH,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAqBrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgDxF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzF;AAyQD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB5E"}
+{"version":3,"file":"cimd.validator.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,UAAQ,GAAG,OAAO,CA4B/E;AAUD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CA6DvG;AAED;;GAEG;AACH,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAqBrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgDxF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzF;AAyGD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB5E"}

package/context/frontmcp-auth-context.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmcp-auth-context.impl.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yDAAyD;IACzD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE5B,MAAM,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,wBAAwB;IA0DnF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI9C,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAI1C,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI1D,gBAAgB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIzD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIhD,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAM/C;;;OAGG;IACH,OAAO,CAAC,cAAc;CASvB"}
+{"version":3,"file":"frontmcp-auth-context.impl.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yDAAyD;IACzD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE5B,MAAM,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,wBAAwB;IA4DnF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI9C,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAI1C,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI1D,gBAAgB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIzD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIhD,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAM/C;;;OAGG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/esm/index.mjs

@@ -225,10 +225,14 @@ import {
   bytesToHex,
   createKeyPersistence,
   isProduction,
+  isRedirectResponse,
   randomBytes,
   rsaVerify
 } from "@frontmcp/utils";
 
+// libs/auth/src/cimd/cimd.validator.ts
+import { classifyIpAddress } from "@frontmcp/utils";
+
 // libs/auth/src/cimd/cimd.errors.ts
 var CimdError = class extends Error {
   /**
@@ -492,122 +496,38 @@ function isIpAddress(hostname) {
   }
   return false;
 }
+var BLOCKED_RANGE_REASONS = /* @__PURE__ */ new Map([
+  ["0.0.0.0/8", "Current network addresses (0.x.x.x) are not allowed"],
+  ["10.0.0.0/8", "Private IP addresses (10.x.x.x) are not allowed"],
+  ["100.64.0.0/10", "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed"],
+  ["127.0.0.0/8", "Loopback addresses (127.x.x.x) are not allowed"],
+  ["169.254.0.0/16", "Link-local addresses (169.254.x.x) are not allowed"],
+  ["172.16.0.0/12", "Private IP addresses (172.16-31.x.x) are not allowed"],
+  ["192.0.0.0/24", "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed"],
+  ["192.168.0.0/16", "Private IP addresses (192.168.x.x) are not allowed"],
+  ["224.0.0.0/4", "Multicast addresses are not allowed"],
+  ["255.255.255.255/32", "Broadcast address is not allowed"],
+  ["::/128", "IPv6 unspecified address (::) is not allowed"],
+  ["::1/128", "IPv6 loopback address (::1) is not allowed"],
+  ["fc00::/7", "IPv6 unique local addresses (fc00::/7) are not allowed"],
+  ["fe80::/10", "IPv6 link-local addresses (fe80::/10) are not allowed"]
+]);
 function checkIpAddress(ip) {
-  const cleanIp = ip.replace(/^\[|\]$/g, "");
-  if (cleanIp.includes(".") && !cleanIp.includes(":")) {
-    return checkIpv4(cleanIp);
-  }
-  return checkIpv6(cleanIp);
-}
-function checkIpv4(ip) {
-  const parts = ip.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((p) => isNaN(p) || p < 0 || p > 255)) {
-    return { allowed: false, reason: "Invalid IPv4 address" };
-  }
-  const [a, b, c, d] = parts;
-  if (a === 127) {
-    return { allowed: false, reason: "Loopback addresses (127.x.x.x) are not allowed" };
-  }
-  if (a === 10) {
-    return { allowed: false, reason: "Private IP addresses (10.x.x.x) are not allowed" };
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return { allowed: false, reason: "Private IP addresses (172.16-31.x.x) are not allowed" };
-  }
-  if (a === 192 && b === 168) {
-    return { allowed: false, reason: "Private IP addresses (192.168.x.x) are not allowed" };
-  }
-  if (a === 169 && b === 254) {
-    return { allowed: false, reason: "Link-local addresses (169.254.x.x) are not allowed" };
-  }
-  if (a === 100 && b >= 64 && b <= 127) {
-    return { allowed: false, reason: "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed" };
-  }
-  if (a === 192 && b === 0 && c === 0) {
-    return { allowed: false, reason: "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed" };
-  }
-  if (a === 0) {
-    return { allowed: false, reason: "Current network addresses (0.x.x.x) are not allowed" };
-  }
-  if (a === 255 && b === 255 && c === 255 && d === 255) {
-    return { allowed: false, reason: "Broadcast address is not allowed" };
-  }
-  if (a >= 224 && a <= 239) {
-    return { allowed: false, reason: "Multicast addresses are not allowed" };
-  }
-  return { allowed: true, reason: "" };
-}
-function expandIpv6(ip) {
-  let text = ip.toLowerCase();
-  if (text.includes("%")) {
-    text = text.slice(0, text.indexOf("%"));
-  }
-  const dottedQuad = text.match(/^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-  if (dottedQuad) {
-    const octets = dottedQuad[2].split(".").map(Number);
-    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;
-    const high = (octets[0] << 8 | octets[1]).toString(16);
-    const low = (octets[2] << 8 | octets[3]).toString(16);
-    text = `${dottedQuad[1]}${high}:${low}`;
-  }
-  const halves = text.split("::");
-  if (halves.length > 2) return null;
-  const parseGroups = (part) => {
-    if (part === "") return [];
-    const groups = [];
-    for (const group of part.split(":")) {
-      if (!/^[0-9a-f]{1,4}$/.test(group)) return null;
-      groups.push(parseInt(group, 16));
-    }
-    return groups;
-  };
-  const head = parseGroups(halves[0]);
-  if (head === null) return null;
-  if (halves.length === 1) {
-    return head.length === 8 ? head : null;
-  }
-  const tail = parseGroups(halves[1]);
-  if (tail === null) return null;
-  if (head.length + tail.length > 7) return null;
-  return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail];
-}
-function checkIpv6(ip) {
-  const groups = expandIpv6(ip);
-  if (!groups) {
-    return { allowed: false, reason: `Malformed IPv6 address: ${ip}` };
-  }
-  const isZeroPrefix = groups.slice(0, 7).every((group) => group === 0);
-  if (isZeroPrefix && groups[7] === 1) {
-    return { allowed: false, reason: "IPv6 loopback address (::1) is not allowed" };
-  }
-  if (isZeroPrefix && groups[7] === 0) {
-    return { allowed: false, reason: "IPv6 unspecified address (::) is not allowed" };
-  }
-  if ((groups[0] & 65472) === 65152) {
-    return { allowed: false, reason: "IPv6 link-local addresses (fe80::/10) are not allowed" };
-  }
-  if ((groups[0] & 65024) === 64512) {
-    return { allowed: false, reason: "IPv6 unique local addresses (fc00::/7) are not allowed" };
+  const classification = classifyIpAddress(ip);
+  if (!classification) {
+    const bareIp = ip.replace(/^\[|\]$/g, "");
+    return {
+      allowed: false,
+      reason: bareIp.includes(":") ? `Malformed IPv6 address: ${bareIp}` : "Invalid IPv4 address"
+    };
   }
-  const embedded = extractEmbeddedIpv4(groups);
-  if (embedded) {
-    return checkIpv4(embedded);
+  if (classification.range === "public") {
+    return { allowed: true, reason: "" };
   }
-  return { allowed: true, reason: "" };
-}
-function extractEmbeddedIpv4(groups) {
-  const toDotted = () => {
-    const high = groups[6];
-    const low = groups[7];
-    return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+  return {
+    allowed: false,
+    reason: BLOCKED_RANGE_REASONS.get(classification.cidr) ?? `Addresses in the ${classification.range} range (${classification.cidr}) are not allowed`
   };
-  const firstFive = groups.slice(0, 5).every((group) => group === 0);
-  if (firstFive && groups[5] === 65535) return toDotted();
-  if (firstFive && groups[5] === 0) return toDotted();
-  if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((group) => group === 0)) {
-    return toDotted();
-  }
-  return null;
 }
 function isDomainInList(hostname, domainList) {
   const lowerHostname = hostname.toLowerCase();
@@ -1016,11 +936,10 @@ var JwksService = class {
           // Follow redirects manually so each hop is re-validated (scheme + SSRF).
           redirect: "manual"
         });
-        if (res.status >= 300 && res.status < 400) {
+        if (isRedirectResponse(res)) {
           const location = res.headers.get("location");
-          if (!location || hop >= MAX_JWKS_FETCH_HOPS) {
-            throw new Error("too many redirects");
-          }
+          if (!location) throw new Error("redirect without a readable Location header");
+          if (hop >= MAX_JWKS_FETCH_HOPS) throw new Error("too many redirects");
           currentUrl = new URL(location, currentUrl).toString();
           continue;
         }
@@ -7488,6 +7407,7 @@ init_cimd_cache();
 
 // libs/auth/src/cimd/cimd.service.ts
 init_cimd_cache();
+import { isRedirectResponse as isRedirectResponse2 } from "@frontmcp/utils";
 var CimdService = class {
   config;
   cacheConfig;
@@ -7661,7 +7581,7 @@ var CimdService = class {
             httpStatus: 304
           });
         }
-        if (response.status >= 300 && response.status < 400) {
+        if (isRedirectResponse2(response)) {
           const location = response.headers.get("location");
           if (!location) {
             throw new CimdFetchError(clientId, "Redirect response missing Location header", {
@@ -10049,6 +9969,18 @@ var noopRelationshipResolver = {
     return false;
   }
 };
+function resolveAuthUser(authInfo) {
+  const extraUser = authInfo?.extra?.["user"];
+  if (authInfo?.user) return authInfo.user;
+  return typeof extraUser === "object" && extraUser !== null ? extraUser : {};
+}
+function isAnonymousSubject(sub) {
+  return typeof sub !== "string" || sub === "" || sub.startsWith("anon:");
+}
+function signedInSubject(rawSub, mappedSub) {
+  if (rawSub !== void 0 && isAnonymousSubject(rawSub)) return void 0;
+  return [mappedSub, rawSub].find((candidate) => !isAnonymousSubject(candidate));
+}
 var AuthoritiesContextBuilder = class {
   claimsMapping;
   claimsResolver;
@@ -10066,7 +9998,7 @@ var AuthoritiesContextBuilder = class {
       const resolved = this.claimsResolver(authInfo);
       return {
         user: {
-          sub: authInfo?.user?.sub ?? "",
+          sub: signedInSubject(resolveAuthUser(authInfo).sub),
           roles: resolved.roles,
           permissions: resolved.permissions,
           claims: resolved.claims
@@ -10076,7 +10008,7 @@ var AuthoritiesContextBuilder = class {
         relationships: this.relationshipResolver
       };
     }
-    const user = authInfo?.user ?? {};
+    const user = resolveAuthUser(authInfo);
     const authorization = authInfo?.extra?.["authorization"];
     const authorizationClaims = authorization?.["claims"] ?? {};
     const rawClaims = {
@@ -10097,10 +10029,10 @@ var AuthoritiesContextBuilder = class {
     } else {
       permissions = toStringArray(user["permissions"] ?? []);
     }
-    const sub = this.claimsMapping?.userId ? String(resolveDotPath(rawClaims, this.claimsMapping.userId) ?? "") : user.sub ?? "";
+    const mappedSub = this.claimsMapping?.userId ? resolveDotPath(rawClaims, this.claimsMapping.userId) : void 0;
     return {
       user: {
-        sub,
+        sub: signedInSubject(user.sub, mappedSub),
         roles,
         permissions,
         claims: rawClaims
@@ -10132,15 +10064,17 @@ var FrontMcpAuthContextImpl = class {
   roles;
   permissions;
   constructor(source, claimsMapping) {
-    const rawUser = source.user ?? {};
-    const sub = claimsMapping?.userId ? String(resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) ?? rawUser.sub ?? "") : String(rawUser.sub ?? "");
+    const rawUser = resolveAuthUser(source);
+    const mappedSub = claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
+    const signedInSub = signedInSubject(rawUser.sub, mappedSub);
+    const sub = signedInSub ?? (typeof rawUser.sub === "string" ? rawUser.sub : "");
     this.user = Object.freeze({
       sub,
       name: rawUser.name,
       email: rawUser.email,
       picture: rawUser.picture
     });
-    this.isAnonymous = sub === "" || sub.startsWith("anon:");
+    this.isAnonymous = signedInSub === void 0;
     const extraAuth = source.extra?.["authorization"];
     this.mode = String(
       source.extra?.["authMode"] ?? extraAuth?.["mode"] ?? (source.extra?.["isPublic"] === true || rawUser["anonymous"] === true ? "public" : "authenticated")
@@ -10198,7 +10132,7 @@ var FrontMcpAuthContextImpl = class {
    * Mirrors the logic in AuthoritiesContextBuilder.build().
    */
   buildRawClaims(source) {
-    const rawUser = source.user ?? {};
+    const rawUser = resolveAuthUser(source);
     const extraAuth = source.extra?.["authorization"];
     const authorizationClaims = extraAuth?.["claims"] ?? {};
     return {
@@ -10417,8 +10351,9 @@ function resolveValue(value, ctx) {
 }
 function applyOperator(actual, op, expected) {
   switch (op) {
+    // A missing expected value (e.g. an absent fromInput) never matches, even an absent actual value
     case "eq":
-      return actual === expected;
+      return expected !== void 0 && actual === expected;
     case "neq":
       return actual !== expected;
     case "in":
@@ -10467,7 +10402,7 @@ function evaluateAbac(policy, ctx) {
     for (const [path, expectedRaw] of Object.entries(policy.match)) {
       const actual = resolveDotPath(envelope, path);
       const expected = resolveValue(expectedRaw, ctx);
-      if (actual !== expected) {
+      if (expected === void 0 || actual !== expected) {
         return {
           granted: false,
           deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
@@ -10507,6 +10442,15 @@ function resolveResourceId(ref, ctx) {
   return void 0;
 }
 async function evaluateSingleRebac(policy, ctx) {
+  const userSub = ctx.user.sub;
+  if (userSub === void 0 || isAnonymousSubject(userSub)) {
+    return {
+      granted: false,
+      deniedBy: `relationships: an anonymous caller cannot be '${policy.type}' of ${policy.resource}`,
+      denial: { kind: "relationships", path: "user.sub", expected: "a signed-in caller", actual: void 0 },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
   const resourceId = resolveResourceId(policy.resourceId, ctx);
   if (resourceId === void 0) {
     return {
@@ -10521,11 +10465,11 @@ async function evaluateSingleRebac(policy, ctx) {
       evaluatedPolicies: ["relationships"]
     };
   }
-  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, ctx.user.sub, ctx);
+  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, userSub, ctx);
   if (!hasRelationship) {
     return {
       granted: false,
-      deniedBy: `relationships: user '${ctx.user.sub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
+      deniedBy: `relationships: user '${userSub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
       denial: {
         kind: "relationships",
         path: "relationships",
@@ -11198,6 +11142,7 @@ export {
   headerApplier,
   hkdfSha2564 as hkdfSha256,
   incrementalAuthConfigSchema,
+  isAnonymousSubject,
   isCimdClientId,
   isFrontMcpCredentials,
   isJwt,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.0",
-    "@frontmcp/storage-sqlite": "1.8.0",
+    "@frontmcp/lazy-zod": "1.8.1",
+    "@frontmcp/storage-sqlite": "1.8.1",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.8.0",
-    "@frontmcp/utils": "1.8.0",
+    "@frontmcp/di": "1.8.1",
+    "@frontmcp/utils": "1.8.1",
     "jose": "^6.0.0"
   },
   "devDependencies": {