@frontmcp/auth 1.8.3 → 1.8.5

package/authorities/authorities.engine.d.ts

@@ -23,8 +23,9 @@ export declare class AuthoritiesEngine {
     private readonly ruleProblems;
     constructor(profiles: AuthoritiesProfileRegistry, evaluators: AuthoritiesEvaluatorRegistry);
     /**
-     * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}).
-     * The server reports them when it starts; {@link evaluate} denies such a value.
+     * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+     * and each profile name it uses that no registered profile has. The server reports them when it
+     * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
      */
     findRuleProblems(authorities: unknown): string[];
     /**

package/authorities/authorities.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;OAGG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAIhD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAczB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}
+{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAczB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}

package/esm/index.mjs

@@ -619,6 +619,12 @@ var TRANSPARENT_JWT_ALGS = [
 ];
 var MAX_JWKS_FETCH_BYTES = 1048576;
 var MAX_JWKS_FETCH_HOPS = 3;
+var MISSING_EXP_ERROR = 'missing required "exp" claim';
+function isMissingExpError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { code, claim, reason } = error;
+  return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -688,6 +694,7 @@ var JwksService = class {
       kid = typeof header?.kid === "string" ? header.kid : void 0;
     } catch {
     }
+    let missingExp = false;
     for (const p of candidates) {
       let jwks;
       try {
@@ -719,11 +726,14 @@ var JwksService = class {
             if (fallbackResult.ok) {
               return fallbackResult;
             }
+            if (fallbackResult.error === "missing_exp") missingExp = true;
           }
         }
+        if (isMissingExpError(e)) missingExp = true;
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
     return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
   }
   /**
@@ -856,7 +866,10 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+   *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+   *      then fetch jwks_uri, cache, return
    */
   async getJwksForProvider(ref) {
     if (ref.jwks?.keys?.length) {
@@ -872,11 +885,13 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
-    const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/oauth-authorization-server`);
-    const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
-    if (uri) {
-      const fromMeta = await this.tryFetchJwks(ref.id, uri);
-      if (fromMeta?.keys?.length) return fromMeta;
+    for (const document of ["oauth-authorization-server", "openid-configuration"]) {
+      const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
+      const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
+      if (uri) {
+        const fromMeta = await this.tryFetchJwks(ref.id, uri);
+        if (fromMeta?.keys?.length) return fromMeta;
+      }
     }
     const maxStaleMs = Math.max(this.opts.providerJwksTtlMs * 4, 6e4);
     if (cached && Date.now() - cached.fetchedAt < maxStaleMs) {
@@ -3927,6 +3942,15 @@ function deriveTypedUser(claims) {
     picture: extractClaimValue(claims, "picture", isString)
   };
 }
+function anonymousCallerClaims(options, anonymousId) {
+  const { issuer, scopes = ["anonymous"], subject } = options;
+  return {
+    sub: subject ?? `anon:${anonymousId}`,
+    iss: issuer,
+    name: subject ? "Static token" : "Anonymous",
+    scope: scopes.join(" ")
+  };
+}
 function extractBearerToken(header) {
   if (!header) return void 0;
   const m = header.match(/^\s*Bearer\s+(\S+)\s*$/i);
@@ -9048,6 +9072,19 @@ function grantScopes(requested, allowed) {
   }
   return granted;
 }
+function advertisedScopes(allowed) {
+  const scopes = [];
+  for (const scope of allowed ?? DEFAULT_ALLOWED_SCOPES) {
+    if (scope && !scope.includes("*") && !scopes.includes(scope)) scopes.push(scope);
+  }
+  return scopes;
+}
+function resourceScopesFor(options) {
+  const mode = options?.mode ?? "public";
+  if (mode === "local" || mode === "remote") return advertisedScopes(options?.allowedScopes);
+  const listed = mode === "public" ? options?.anonymousScopes ?? ["anonymous"] : mode === "static" ? options?.scopes ?? ["static"] : mode === "transparent" ? [...options?.requiredScopes ?? [], ...options?.scopes ?? []] : [];
+  return advertisedScopes(listed);
+}
 
 // libs/auth/src/utils/redirect-uri.utils.ts
 function isLoopbackRedirectUri(uri) {
@@ -10864,11 +10901,15 @@ var AuthoritiesEngine = class {
   /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
   ruleProblems = /* @__PURE__ */ new WeakMap();
   /**
-   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}).
-   * The server reports them when it starts; {@link evaluate} denies such a value.
+   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+   * and each profile name it uses that no registered profile has. The server reports them when it
+   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
    */
   findRuleProblems(authorities) {
-    return findAuthoritiesRuleProblems(authorities);
+    const problems = findAuthoritiesRuleProblems(authorities);
+    if (problems.length > 0) return problems;
+    const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
+    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
   }
   /**
    * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
@@ -11429,8 +11470,10 @@ export {
   abacConditionSchema,
   abacOperatorSchema,
   abacPolicySchema,
+  advertisedScopes,
   aiPlatformTypeSchema,
   allowsPublicAccess,
+  anonymousCallerClaims,
   apiKeyCredentialSchema,
   appAuthOptionsSchema,
   appAuthStateSchema,
@@ -11610,6 +11653,7 @@ export {
   resetCachedKey,
   resolveRequiredScopes,
   resourceIdRefSchema,
+  resourceScopesFor,
   safeDecrypt,
   sealPendingLogin,
   secureStoreConfigSchema,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.3",
-    "@frontmcp/storage-sqlite": "1.8.3",
+    "@frontmcp/lazy-zod": "1.8.5",
+    "@frontmcp/storage-sqlite": "1.8.5",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.8.3",
-    "@frontmcp/utils": "1.8.3",
+    "@frontmcp/di": "1.8.5",
+    "@frontmcp/utils": "1.8.5",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/index.d.ts

@@ -34,8 +34,8 @@ export { JwksService, trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from '.
 export type { JwksServiceOptions, ProviderVerifyRef, VerifyResult } from './jwks';
 export { CDN, DEFAULT_THEME, baseLayout, createLayout, authLayout, centeredCardLayout, wideLayout, extraWideLayout, escapeHtml, BUILT_IN_AUTH_PAGE_CSP, builtInAuthPageHeaders, buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildConnectPage, buildConnectSuccessPage, buildErrorPage, renderToHtml, renderLocalLoginPage, toLoginExtraFields, withoutSecretFieldValues, } from './ui';
 export type { ThemeColors, ThemeFonts, ThemeConfig, BaseLayoutOptions, AppAuthCard, ProviderCard, ToolCard, LoginExtraField, ConsentHiddenField, } from './ui';
-export { InMemoryAuthorizationStore, RedisAuthorizationStore, StorageAuthorizationStore, sealPendingLogin, openPendingLogin, SIGNIN_BINDING_COOKIE_PREFIX, SIGNIN_BINDING_SECURE_COOKIE_PREFIX, SIGNIN_BINDING_MAX_AGE_SECONDS, createSigninBinding, signinBindingCookieName, signinBindingMatches, verifyPkce, generatePkceChallenge, generateAuthorizationCode, generateRefreshTokenValue, buildCodeRecord, buildPendingRecord, buildRefreshTokenRecord, pkceChallengeSchema, authorizationCodeRecordSchema, credentialTypeSchema, oauthCredentialSchema, apiKeyCredentialSchema, basicAuthCredentialSchema, bearerCredentialSchema, privateKeyCredentialSchema, mtlsCredentialSchema, customCredentialSchema, sshKeyCredentialSchema, serviceAccountCredentialSchema, pkceOAuthCredentialSchema, credentialSchema, appCredentialSchema, vaultConsentRecordSchema, vaultFederatedRecordSchema, pendingIncrementalAuthSchema, authorizationVaultEntrySchema, InMemoryAuthorizationVault, StorageAuthorizationVault, EncryptedTypedStorage, EncryptedStorageError, encryptedDataSchema, encryptedVaultEntrySchema, VaultEncryption, TokenVault, StorageTokenStore, TypedStorage, hkdfSha256, encryptValue, decryptValue, encryptAesGcm, decryptAesGcm, TinyTtlCache, transportProtocolSchema, sseTransportStateSchema, streamableHttpTransportStateSchema, statefulHttpTransportStateSchema, statelessHttpTransportStateSchema, legacySseTransportStateSchema, transportStateSchema, transportSessionSchema, sessionJwtPayloadSchema, encryptedBlobSchema, storedSessionSchema, redisConfigSchema, signSession, verifySession, isSignedSession, verifyOrParseSession, SessionRateLimiter, defaultSessionRateLimiter, TransportIdGenerator, isJwt, getTokenSignatureFingerprint, deriveTypedUser, extractBearerToken, getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey, RedisSessionStore, VercelKvSessionStore, InMemoryOrchestratedTokenStore, StorageOrchestratedTokenStore, InMemoryFederatedAuthSessionStore, StorageFederatedAuthSessionStore, toSessionRecord, fromSessionRecord, createFederatedAuthSession, isSessionComplete, getNextProvider, completeCurrentProvider, startNextProvider, InMemoryConsentStore, StorageConsentStore, consentRecordKey, createTokenStorageAdapter, isRedisTokenStorage, isSqliteTokenStorage, isPersistentTokenStorage, redisVaultEntrySchema, EncryptedRedisVault, createEncryptedVault, toEpochSeconds, isSoonExpiring, isSoonExpiringProvider, tryJwtExp, SessionCredentialVault, createSessionCredentialVault, signCredentialResumeToken, verifyCredentialResumeToken, buildCredentialResumeUrl, DEFAULT_RESUME_TTL_MS, signIncrementalAuthTicket, verifyIncrementalAuthTicket, DEFAULT_INCREMENTAL_TICKET_TTL_MS, CREDENTIALS_ACCESSOR, CredentialsAccessorImpl, EncryptedStorageSecureStoreBackend, SECURE_STORE_ACCESSOR, SecureStoreAccessorImpl, createSecureStore, } from './session';
-export type { AuthorizationStore, PkceChallenge, AuthorizationCodeRecord, PendingAuthorizationRecord, PendingLoginState, SigninBinding, SigninBindingCookieOptions, RefreshTokenRecord, ConsentStateRecord, FederatedLoginStateRecord, CreateCodeRecordParams, CreatePendingRecordParams, CreateRefreshTokenRecordParams, StorageAuthorizationStoreOptions, CredentialType, OAuthCredential, ApiKeyCredential, BasicAuthCredential, BearerCredential, PrivateKeyCredential, MtlsCredential, CustomCredential, SshKeyCredential, ServiceAccountCredential, PkceOAuthCredential, Credential, AppCredential, VaultConsentRecord, VaultFederatedRecord, PendingIncrementalAuth, AuthorizationVaultEntry, AuthorizationVault, InMemoryAuthorizationVaultOptions, EncryptedData, VaultKeyDerivationClaims, VaultEncryptionConfig, EncryptedVaultEntry, VaultSensitiveData, EncBlob, VaultKey, SecretRecord, TokenStore, TypedStorageOptions, TypedSetOptions, TypedSetEntry, EncryptedTypedStorageOptions, EncryptedSetOptions, EncryptedSetEntry, EncryptionKey, StoredEncryptedBlob, ClientKeyBinding, StorageTokenStoreOptions, StorageAuthorizationVaultOptions, EncryptedBlob, TransportProtocol, SessionStorageMode, TransportSession, TransportState, SseTransportState, StreamableHttpTransportState, StatefulHttpTransportState, StatelessHttpTransportState, LegacySseTransportState, SessionJwtPayload, StatelessSessionJwtPayload, StoredSession, TransportEncryptedBlob, SessionStore, SessionStorageConfig, RedisConfig, SessionSecurityConfig, SessionMode, ProviderEmbedMode, SessionEncBlob, ProviderSnapshot, CreateSessionArgs, SignedSession, SessionSigningConfig, SessionRateLimiterConfig, RateLimitResult, RedisSessionStoreConfig, VercelKvSessionConfig, InMemoryOrchestratedTokenStoreOptions, StorageOrchestratedTokenStoreOptions, StorageFederatedAuthSessionStoreOptions, ProviderPkce, ProviderTokens, ProviderUserInfo, CompletedProvider, FederatedAuthSession, FederatedAuthSessionRecord, FederatedAuthSessionStore, FederatedAuthSessionCreateParams, ConsentStore, RememberedConsentRecord, StorageConsentStoreOptions, RedisVaultEntry, EncryptionContext, TokenRefreshCtx, TokenRefreshResult, TokenRefresher, StoredCredential, SessionCredentialVaultOptions, CreateSessionCredentialVaultOptions, CredentialResumePayload, IncrementalAuthTicketPayload, CredentialsAccessor, CredentialValue, CredentialNotConnected, CredentialConnected, RequireConnectResult, RequireConnectOptions, CredentialsAccessorDeps, SecureStoreBackend, SecureStoreScope, SecureStoreScopeRef, EncryptedStorageSecureStoreBackendOptions, SecureStoreAccessor, SecureStoreSetOptions, SecureStoreAccessorDeps, CreateSecureStoreOptions, ResolvedSecureStore, SecureStoreBackendKind, } from './session';
+export { InMemoryAuthorizationStore, RedisAuthorizationStore, StorageAuthorizationStore, sealPendingLogin, openPendingLogin, SIGNIN_BINDING_COOKIE_PREFIX, SIGNIN_BINDING_SECURE_COOKIE_PREFIX, SIGNIN_BINDING_MAX_AGE_SECONDS, createSigninBinding, signinBindingCookieName, signinBindingMatches, verifyPkce, generatePkceChallenge, generateAuthorizationCode, generateRefreshTokenValue, buildCodeRecord, buildPendingRecord, buildRefreshTokenRecord, pkceChallengeSchema, authorizationCodeRecordSchema, credentialTypeSchema, oauthCredentialSchema, apiKeyCredentialSchema, basicAuthCredentialSchema, bearerCredentialSchema, privateKeyCredentialSchema, mtlsCredentialSchema, customCredentialSchema, sshKeyCredentialSchema, serviceAccountCredentialSchema, pkceOAuthCredentialSchema, credentialSchema, appCredentialSchema, vaultConsentRecordSchema, vaultFederatedRecordSchema, pendingIncrementalAuthSchema, authorizationVaultEntrySchema, InMemoryAuthorizationVault, StorageAuthorizationVault, EncryptedTypedStorage, EncryptedStorageError, encryptedDataSchema, encryptedVaultEntrySchema, VaultEncryption, TokenVault, StorageTokenStore, TypedStorage, hkdfSha256, encryptValue, decryptValue, encryptAesGcm, decryptAesGcm, TinyTtlCache, transportProtocolSchema, sseTransportStateSchema, streamableHttpTransportStateSchema, statefulHttpTransportStateSchema, statelessHttpTransportStateSchema, legacySseTransportStateSchema, transportStateSchema, transportSessionSchema, sessionJwtPayloadSchema, encryptedBlobSchema, storedSessionSchema, redisConfigSchema, signSession, verifySession, isSignedSession, verifyOrParseSession, SessionRateLimiter, defaultSessionRateLimiter, TransportIdGenerator, isJwt, getTokenSignatureFingerprint, deriveTypedUser, anonymousCallerClaims, extractBearerToken, getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey, RedisSessionStore, VercelKvSessionStore, InMemoryOrchestratedTokenStore, StorageOrchestratedTokenStore, InMemoryFederatedAuthSessionStore, StorageFederatedAuthSessionStore, toSessionRecord, fromSessionRecord, createFederatedAuthSession, isSessionComplete, getNextProvider, completeCurrentProvider, startNextProvider, InMemoryConsentStore, StorageConsentStore, consentRecordKey, createTokenStorageAdapter, isRedisTokenStorage, isSqliteTokenStorage, isPersistentTokenStorage, redisVaultEntrySchema, EncryptedRedisVault, createEncryptedVault, toEpochSeconds, isSoonExpiring, isSoonExpiringProvider, tryJwtExp, SessionCredentialVault, createSessionCredentialVault, signCredentialResumeToken, verifyCredentialResumeToken, buildCredentialResumeUrl, DEFAULT_RESUME_TTL_MS, signIncrementalAuthTicket, verifyIncrementalAuthTicket, DEFAULT_INCREMENTAL_TICKET_TTL_MS, CREDENTIALS_ACCESSOR, CredentialsAccessorImpl, EncryptedStorageSecureStoreBackend, SECURE_STORE_ACCESSOR, SecureStoreAccessorImpl, createSecureStore, } from './session';
+export type { AnonymousCallerClaimsOptions, AuthorizationStore, PkceChallenge, AuthorizationCodeRecord, PendingAuthorizationRecord, PendingLoginState, SigninBinding, SigninBindingCookieOptions, RefreshTokenRecord, ConsentStateRecord, FederatedLoginStateRecord, CreateCodeRecordParams, CreatePendingRecordParams, CreateRefreshTokenRecordParams, StorageAuthorizationStoreOptions, CredentialType, OAuthCredential, ApiKeyCredential, BasicAuthCredential, BearerCredential, PrivateKeyCredential, MtlsCredential, CustomCredential, SshKeyCredential, ServiceAccountCredential, PkceOAuthCredential, Credential, AppCredential, VaultConsentRecord, VaultFederatedRecord, PendingIncrementalAuth, AuthorizationVaultEntry, AuthorizationVault, InMemoryAuthorizationVaultOptions, EncryptedData, VaultKeyDerivationClaims, VaultEncryptionConfig, EncryptedVaultEntry, VaultSensitiveData, EncBlob, VaultKey, SecretRecord, TokenStore, TypedStorageOptions, TypedSetOptions, TypedSetEntry, EncryptedTypedStorageOptions, EncryptedSetOptions, EncryptedSetEntry, EncryptionKey, StoredEncryptedBlob, ClientKeyBinding, StorageTokenStoreOptions, StorageAuthorizationVaultOptions, EncryptedBlob, TransportProtocol, SessionStorageMode, TransportSession, TransportState, SseTransportState, StreamableHttpTransportState, StatefulHttpTransportState, StatelessHttpTransportState, LegacySseTransportState, SessionJwtPayload, StatelessSessionJwtPayload, StoredSession, TransportEncryptedBlob, SessionStore, SessionStorageConfig, RedisConfig, SessionSecurityConfig, SessionMode, ProviderEmbedMode, SessionEncBlob, ProviderSnapshot, CreateSessionArgs, SignedSession, SessionSigningConfig, SessionRateLimiterConfig, RateLimitResult, RedisSessionStoreConfig, VercelKvSessionConfig, InMemoryOrchestratedTokenStoreOptions, StorageOrchestratedTokenStoreOptions, StorageFederatedAuthSessionStoreOptions, ProviderPkce, ProviderTokens, ProviderUserInfo, CompletedProvider, FederatedAuthSession, FederatedAuthSessionRecord, FederatedAuthSessionStore, FederatedAuthSessionCreateParams, ConsentStore, RememberedConsentRecord, StorageConsentStoreOptions, RedisVaultEntry, EncryptionContext, TokenRefreshCtx, TokenRefreshResult, TokenRefresher, StoredCredential, SessionCredentialVaultOptions, CreateSessionCredentialVaultOptions, CredentialResumePayload, IncrementalAuthTicketPayload, CredentialsAccessor, CredentialValue, CredentialNotConnected, CredentialConnected, RequireConnectResult, RequireConnectOptions, CredentialsAccessorDeps, SecureStoreBackend, SecureStoreScope, SecureStoreScopeRef, EncryptedStorageSecureStoreBackendOptions, SecureStoreAccessor, SecureStoreSetOptions, SecureStoreAccessorDeps, CreateSecureStoreOptions, ResolvedSecureStore, SecureStoreBackendKind, } from './session';
 export { type AuthMode, type AuthUser, type AuthorizedTool, type AuthorizedPrompt, type LLMSafeAuthContext, type AppAuthorizationRecord, type ProgressiveAuthState, type AuthorizationCreateCtx, type Authorization, AppAuthState, authModeSchema, authUserSchema, authorizedToolSchema, authorizedPromptSchema, llmSafeAuthContextSchema, appAuthStateSchema, appAuthorizationRecordSchema, progressiveAuthStateSchema, AuthorizationBase, PublicAuthorization, type PublicAuthorizationCreateCtx, TransparentAuthorization, type TransparentAuthorizationCreateCtx, type TransparentVerifiedPayload, OrchestratedAuthorization, type OrchestratedAuthorizationCreateCtx, type OrchestratedProviderState, type OrchestratedTokenStore, type TokenRefreshCallback, type OrchestratedAuthAccessor, OrchestratedAuthAccessorAdapter, NullOrchestratedAuthAccessor, ORCHESTRATED_AUTH_ACCESSOR, DcrClientRegistry, type RegisteredClient, type PreRegisteredClientInput, type DcrRegistryConfig, } from './authorization';
 export type { AuthLogger } from './common';
 export type { RawZodShape } from './common';
@@ -49,8 +49,8 @@ export * from './options';
 export { consentToolItemSchema, consentSelectionSchema, consentStateSchema, federatedProviderItemSchema, federatedLoginStateSchema, federatedSelectionSchema, } from './consent';
 export type { ConsentToolItem, ConsentSelection, ConsentState, FederatedProviderItem, FederatedLoginState, FederatedSelection, } from './consent';
 export * from './detection';
-export { buildWwwAuthenticate, buildPrmUrl, buildUnauthorizedHeader, buildInvalidTokenHeader, buildInsufficientScopeHeader, buildInvalidRequestHeader, parseWwwAuthenticate, validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, deriveAuthorizationId, DEFAULT_ALLOWED_SCOPES, grantScopes, isLoopbackRedirectUri, } from './utils';
-export type { BearerErrorCode, WwwAuthenticateOptions, AudienceValidationResult, AudienceValidatorOptions, } from './utils';
+export { buildWwwAuthenticate, buildPrmUrl, buildUnauthorizedHeader, buildInvalidTokenHeader, buildInsufficientScopeHeader, buildInvalidRequestHeader, parseWwwAuthenticate, validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, deriveAuthorizationId, advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, resourceScopesFor, isLoopbackRedirectUri, } from './utils';
+export type { BearerErrorCode, ResourceScopeOptions, WwwAuthenticateOptions, AudienceValidationResult, AudienceValidatorOptions, } from './utils';
 export { type CredentialScope, type LoadingStrategy, type GetCredentialOptions, type ResolvedCredential, type CredentialFactoryContext, type CredentialFactory, type CredentialRefreshFn, type CredentialHeadersFn, type CredentialProviderConfig, type AuthProviderMapping, type CredentialCacheEntry, type VaultStorageKey, type AuthProvidersVaultOptions, type CredentialEventType, type CredentialEvent, type CacheStats, credentialScopeSchema, loadingStrategySchema, getCredentialOptionsSchema, credentialProviderConfigSchema, authProviderMappingSchema, authProvidersVaultOptionsSchema, extractCredentialExpiry, CredentialCache, type AuthProvidersAccessor, AUTH_PROVIDERS_ACCESSOR, AuthProvidersAccessorImpl, AuthProvidersRegistry, AUTH_PROVIDERS_REGISTRY, type NormalizedProviderConfig, AuthProvidersVault, AUTH_PROVIDERS_VAULT, EagerCredentialLoader, type EagerLoadResult, LazyCredentialLoader, } from './vault';
 export { type CimdLogger, noopLogger, clientMetadataDocumentSchema, cimdCacheConfigSchema, cimdSecurityConfigSchema, cimdNetworkConfigSchema, cimdConfigSchema, type ClientMetadataDocument, type ClientMetadataDocumentInput, type CimdCacheConfig, type CimdSecurityConfig, type CimdNetworkConfig, type CimdConfig, type CimdConfigInput, type CimdResolutionResult, CimdError, InvalidClientIdUrlError, CimdFetchError, CimdValidationError, CimdClientIdMismatchError, CimdSecurityError, RedirectUriMismatchError, CimdResponseTooLargeError, CimdDisabledError, isCimdClientId, validateClientIdUrl, checkSsrfProtection, hasOnlyLocalhostRedirectUris, InMemoryCimdCache, extractCacheHeaders, parseCacheHeaders, type CimdCacheEntry, type CacheableHeaders, CimdService, } from './cimd';
 export { FrontMcpAuthContextImpl, buildAuthContext } from './context';

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,EAErB,sBAAsB,EACtB,WAAW,EAEX,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,4BAA4B,EAE5B,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,EAErB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EAEjB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}

package/index.js

@@ -332,8 +332,10 @@ __export(index_exports, {
   abacConditionSchema: () => abacConditionSchema,
   abacOperatorSchema: () => abacOperatorSchema,
   abacPolicySchema: () => abacPolicySchema,
+  advertisedScopes: () => advertisedScopes,
   aiPlatformTypeSchema: () => aiPlatformTypeSchema,
   allowsPublicAccess: () => allowsPublicAccess,
+  anonymousCallerClaims: () => anonymousCallerClaims,
   apiKeyCredentialSchema: () => apiKeyCredentialSchema,
   appAuthOptionsSchema: () => appAuthOptionsSchema,
   appAuthStateSchema: () => appAuthStateSchema,
@@ -513,6 +515,7 @@ __export(index_exports, {
   resetCachedKey: () => resetCachedKey,
   resolveRequiredScopes: () => resolveRequiredScopes,
   resourceIdRefSchema: () => resourceIdRefSchema,
+  resourceScopesFor: () => resourceScopesFor,
   safeDecrypt: () => safeDecrypt,
   sealPendingLogin: () => sealPendingLogin,
   secureStoreConfigSchema: () => secureStoreConfigSchema,
@@ -957,6 +960,12 @@ var TRANSPARENT_JWT_ALGS = [
 ];
 var MAX_JWKS_FETCH_BYTES = 1048576;
 var MAX_JWKS_FETCH_HOPS = 3;
+var MISSING_EXP_ERROR = 'missing required "exp" claim';
+function isMissingExpError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { code, claim, reason } = error;
+  return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -1026,6 +1035,7 @@ var JwksService = class {
       kid = typeof header?.kid === "string" ? header.kid : void 0;
     } catch {
     }
+    let missingExp = false;
     for (const p of candidates) {
       let jwks;
       try {
@@ -1057,11 +1067,14 @@ var JwksService = class {
             if (fallbackResult.ok) {
               return fallbackResult;
             }
+            if (fallbackResult.error === "missing_exp") missingExp = true;
           }
         }
+        if (isMissingExpError(e)) missingExp = true;
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
     return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
   }
   /**
@@ -1194,7 +1207,10 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+   *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+   *      then fetch jwks_uri, cache, return
    */
   async getJwksForProvider(ref) {
     if (ref.jwks?.keys?.length) {
@@ -1210,11 +1226,13 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
-    const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/oauth-authorization-server`);
-    const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
-    if (uri) {
-      const fromMeta = await this.tryFetchJwks(ref.id, uri);
-      if (fromMeta?.keys?.length) return fromMeta;
+    for (const document of ["oauth-authorization-server", "openid-configuration"]) {
+      const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
+      const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
+      if (uri) {
+        const fromMeta = await this.tryFetchJwks(ref.id, uri);
+        if (fromMeta?.keys?.length) return fromMeta;
+      }
     }
     const maxStaleMs = Math.max(this.opts.providerJwksTtlMs * 4, 6e4);
     if (cached && Date.now() - cached.fetchedAt < maxStaleMs) {
@@ -4238,6 +4256,15 @@ function deriveTypedUser(claims) {
     picture: extractClaimValue(claims, "picture", isString)
   };
 }
+function anonymousCallerClaims(options, anonymousId) {
+  const { issuer, scopes = ["anonymous"], subject } = options;
+  return {
+    sub: subject ?? `anon:${anonymousId}`,
+    iss: issuer,
+    name: subject ? "Static token" : "Anonymous",
+    scope: scopes.join(" ")
+  };
+}
 function extractBearerToken(header) {
   if (!header) return void 0;
   const m = header.match(/^\s*Bearer\s+(\S+)\s*$/i);
@@ -9359,6 +9386,19 @@ function grantScopes(requested, allowed) {
   }
   return granted;
 }
+function advertisedScopes(allowed) {
+  const scopes = [];
+  for (const scope of allowed ?? DEFAULT_ALLOWED_SCOPES) {
+    if (scope && !scope.includes("*") && !scopes.includes(scope)) scopes.push(scope);
+  }
+  return scopes;
+}
+function resourceScopesFor(options) {
+  const mode = options?.mode ?? "public";
+  if (mode === "local" || mode === "remote") return advertisedScopes(options?.allowedScopes);
+  const listed = mode === "public" ? options?.anonymousScopes ?? ["anonymous"] : mode === "static" ? options?.scopes ?? ["static"] : mode === "transparent" ? [...options?.requiredScopes ?? [], ...options?.scopes ?? []] : [];
+  return advertisedScopes(listed);
+}
 
 // libs/auth/src/utils/redirect-uri.utils.ts
 function isLoopbackRedirectUri(uri) {
@@ -11175,11 +11215,15 @@ var AuthoritiesEngine = class {
   /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
   ruleProblems = /* @__PURE__ */ new WeakMap();
   /**
-   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}).
-   * The server reports them when it starts; {@link evaluate} denies such a value.
+   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+   * and each profile name it uses that no registered profile has. The server reports them when it
+   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
    */
   findRuleProblems(authorities) {
-    return findAuthoritiesRuleProblems(authorities);
+    const problems = findAuthoritiesRuleProblems(authorities);
+    if (problems.length > 0) return problems;
+    const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
+    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
   }
   /**
    * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
@@ -11741,8 +11785,10 @@ var FetchCredentialMiddleware = class {
   abacConditionSchema,
   abacOperatorSchema,
   abacPolicySchema,
+  advertisedScopes,
   aiPlatformTypeSchema,
   allowsPublicAccess,
+  anonymousCallerClaims,
   apiKeyCredentialSchema,
   appAuthOptionsSchema,
   appAuthStateSchema,
@@ -11922,6 +11968,7 @@ var FetchCredentialMiddleware = class {
   resetCachedKey,
   resolveRequiredScopes,
   resourceIdRefSchema,
+  resourceScopesFor,
   safeDecrypt,
   sealPendingLogin,
   secureStoreConfigSchema,

package/jwks/jwks.service.d.ts

@@ -57,7 +57,10 @@ export declare class JwksService {
      *   1) inline jwks (if provided) → cache & return
      *   2) cached & fresh (TTL)      → return
      *   3) explicit jwksUri          → fetch, cache, return
-     *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+     *   4) discover jwks_uri         → the issuer's OAuth authorization server
+     *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+     *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+     *      then fetch jwks_uri, cache, return
      */
     getJwksForProvider(ref: ProviderVerifyRef): Promise<JSONWebKeySet | undefined>;
     /** Return the orchestrator public JWKS (generates/rotates as needed). */

package/jwks/jwks.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAmClG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IA2DnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;OAMG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2CpF,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}
+{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAgDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAmEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA8CpF,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.3",
-    "@frontmcp/storage-sqlite": "1.8.3",
+    "@frontmcp/lazy-zod": "1.8.5",
+    "@frontmcp/storage-sqlite": "1.8.5",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.8.3",
-    "@frontmcp/utils": "1.8.3",
+    "@frontmcp/di": "1.8.5",
+    "@frontmcp/utils": "1.8.5",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/session/index.d.ts

@@ -48,7 +48,8 @@ export type { SignedSession, SessionSigningConfig } from './session-crypto';
 export { SessionRateLimiter, defaultSessionRateLimiter } from './session-rate-limiter';
 export type { SessionRateLimiterConfig, RateLimitResult } from './session-rate-limiter';
 export { TransportIdGenerator } from './session.transport';
-export { isJwt, getTokenSignatureFingerprint, deriveTypedUser, extractBearerToken, getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey, TinyTtlCache, } from './utils';
+export { isJwt, getTokenSignatureFingerprint, deriveTypedUser, anonymousCallerClaims, extractBearerToken, getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey, TinyTtlCache, } from './utils';
+export type { AnonymousCallerClaimsOptions } from './utils';
 export { TypedStorage, EncryptedTypedStorage, EncryptedStorageError, StorageTokenStore, StorageAuthorizationVault, InMemoryAuthorizationVault, } from './storage';
 export type { TypedStorageOptions, TypedSetOptions, TypedSetEntry, EncryptedTypedStorageOptions, EncryptedSetOptions, EncryptedSetEntry, EncryptionKey, StoredEncryptedBlob, ClientKeyBinding, StorageTokenStoreOptions, StorageAuthorizationVaultOptions, InMemoryAuthorizationVaultOptions, } from './storage';
 export { RedisSessionStore } from './redis-session.store';

package/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EAEvB,UAAU,EACV,qBAAqB,EAErB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EAEpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EACL,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGlF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,YAAY,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAGtF,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,YAAY,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AAG9F,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGxE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAG9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAC7E,YAAY,EAAE,yCAAyC,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGpH,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrG,YAAY,EACV,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGvD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,aAAa,IAAI,sBAAsB,EACvC,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,OAAO,IAAI,cAAc,EACzB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACrG,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACvF,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,YAAY,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAGxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,YAAY,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAG/F,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,YAAY,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAGhG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAG1F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EAEvB,UAAU,EACV,qBAAqB,EAErB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EAEpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EACL,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGlF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,YAAY,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAGtF,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,YAAY,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AAG9F,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGxE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAG9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAC7E,YAAY,EAAE,yCAAyC,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGpH,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrG,YAAY,EACV,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGvD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,aAAa,IAAI,sBAAsB,EACvC,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,OAAO,IAAI,cAAc,EACzB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACrG,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACvF,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAG5D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,YAAY,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAGxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,YAAY,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAG/F,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,YAAY,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAGhG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAG1F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/session/utils/auth-token.utils.d.ts

@@ -1,4 +1,4 @@
-import { UserClaim } from '../../common/session.types';
+import { type UserClaim } from '../../common/session.types';
 export declare function isJwt(token: string | undefined): boolean;
 /**
  * If the token is a JWT, returns the raw signature segment (3rd part) as base64url.
@@ -8,5 +8,27 @@ export declare function isJwt(token: string | undefined): boolean;
 export declare function getTokenSignatureFingerprint(token: string): string;
 /** Best-effort typed user derivation from claims */
 export declare function deriveTypedUser(claims: Record<string, unknown>): UserClaim;
+/** What identifies an anonymous or static-key caller in its claims. */
+export interface AnonymousCallerClaimsOptions {
+    /** Issuer of the claims (the server that identifies the caller). */
+    issuer: string;
+    /** Scopes granted to the caller. Default: `['anonymous']`. */
+    scopes?: string[];
+    /**
+     * Explicit subject. Static mode names the configured token that was presented; without it the
+     * caller is anonymous and gets `anon:<anonymousId>`.
+     */
+    subject?: string;
+}
+/**
+ * The claims of an anonymous or static-key caller (public mode, transparent anonymous access, a
+ * static key): `sub` is the given subject or `anon:<anonymousId>`, and `scope` the granted scopes.
+ */
+export declare function anonymousCallerClaims(options: AnonymousCallerClaimsOptions, anonymousId: string): {
+    sub: string;
+    iss: string;
+    name: string;
+    scope: string;
+};
 export declare function extractBearerToken(header?: string): string | undefined;
 //# sourceMappingURL=auth-token.utils.d.ts.map

package/session/utils/auth-token.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token.utils.d.ts","sourceRoot":"","sources":["../../../src/session/utils/auth-token.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAGvD,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE;AAkBD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAe1E;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE"}
+{"version":3,"file":"auth-token.utils.d.ts","sourceRoot":"","sources":["../../../src/session/utils/auth-token.utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE;AAkBD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAe1E;AAED,uEAAuE;AACvE,MAAM,WAAW,4BAA4B;IAC3C,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,EACrC,WAAW,EAAE,MAAM,GAClB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQ3D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE"}

package/session/utils/index.d.ts

@@ -2,6 +2,6 @@
  * Session utilities
  */
 export { TinyTtlCache } from './tiny-ttl-cache';
-export { isJwt, getTokenSignatureFingerprint, deriveTypedUser, extractBearerToken } from './auth-token.utils';
+export { isJwt, getTokenSignatureFingerprint, deriveTypedUser, anonymousCallerClaims, extractBearerToken, type AnonymousCallerClaimsOptions, } from './auth-token.utils';
 export { getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey } from './session-crypto.utils';
 //# sourceMappingURL=index.d.ts.map

package/session/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/session/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/session/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,4BAA4B,GAClC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC"}

package/utils/index.d.ts

@@ -6,6 +6,6 @@ export type { BearerErrorCode, WwwAuthenticateOptions } from './www-authenticate
 export { validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, } from './audience.validator';
 export type { AudienceValidationResult, AudienceValidatorOptions } from './audience.validator';
 export { deriveAuthorizationId } from './authorization-id.utils';
-export { DEFAULT_ALLOWED_SCOPES, grantScopes } from './scope-grant.utils';
+export { advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, resourceScopesFor, type ResourceScopeOptions, } from './scope-grant.utils';
 export { isLoopbackRedirectUri } from './redirect-uri.utils';
 //# sourceMappingURL=index.d.ts.map

package/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}

package/utils/scope-grant.utils.d.ts

@@ -8,4 +8,38 @@ export declare const DEFAULT_ALLOWED_SCOPES: readonly string[];
  * @param allowed   The configured allowlist; `undefined` means {@link DEFAULT_ALLOWED_SCOPES}.
  */
 export declare function grantScopes(requested: readonly string[], allowed: readonly string[] | undefined): string[];
+/**
+ * The scope values to advertise as `scopes_supported` (RFC 8414 §2, RFC 9728 §2)
+ * for a server that grants `allowed`: the literal entries, in order, without
+ * duplicates. A `*` glob such as `'tickets:*'` names no single scope a client
+ * could ask for, so it isn't advertised (RFC 8414 lets a server leave supported
+ * scopes out); list a scope literally to advertise it.
+ *
+ * @param allowed The configured allowlist; `undefined` means {@link DEFAULT_ALLOWED_SCOPES}.
+ */
+export declare function advertisedScopes(allowed: readonly string[] | undefined): string[];
+/** The auth option fields {@link resourceScopesFor} reads, whichever mode they belong to. */
+export interface ResourceScopeOptions {
+    mode?: string;
+    allowedScopes?: readonly string[];
+    anonymousScopes?: readonly string[];
+    scopes?: readonly string[];
+    requiredScopes?: readonly string[];
+}
+/**
+ * The scope values a protected resource advertises as `scopes_supported`
+ * (RFC 9728 §2) for its auth mode: the scopes a client can actually be given
+ * for it, not a fixed OpenID Connect list (#629).
+ *
+ * - `local` / `remote`: the literal entries of `allowedScopes` ({@link advertisedScopes});
+ * - `public` (and no auth at all): `anonymousScopes`, what the anonymous grant gives;
+ * - `static`: `scopes`, what the static credential carries;
+ * - `transparent`: `requiredScopes`, then `scopes` (what the upstream provider is
+ *   asked for), the scopes a token for this resource needs.
+ *
+ * An empty result means the server names no scopes; leave `scopes_supported` out then.
+ *
+ * @param options The scope's auth options (parsed or as configured); `undefined` means public mode.
+ */
+export declare function resourceScopesFor(options: ResourceScopeOptions | undefined): string[];
 //# sourceMappingURL=scope-grant.utils.d.ts.map

package/utils/scope-grant.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-grant.utils.d.ts","sourceRoot":"","sources":["../../src/utils/scope-grant.utils.ts"],"names":[],"mappings":"AASA,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAQ1G"}
+{"version":3,"file":"scope-grant.utils.d.ts","sourceRoot":"","sources":["../../src/utils/scope-grant.utils.ts"],"names":[],"mappings":"AASA,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAQ1G;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAMjF;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GAAG,MAAM,EAAE,CAYrF"}