@frontmcp/auth 1.9.1-rc.3 → 1.9.2

package/authorities/authorities.context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,4BAA4B;CAoEhC"}
+{"version":3,"file":"authorities.context.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE9F;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAelF;AA0BD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAI9G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxF;AAQD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;gBAEhD,OAAO,GAAE,gCAAqC;IAM1D;;OAEG;IACH,KAAK,CACH,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAC/B,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAc,GACxC,4BAA4B;CAoEhC"}

package/authorities/authorities.evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAEV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AA8FD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAqCrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAgDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}
+{"version":3,"file":"authorities.evaluator.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAEV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,qBAAqB,CAAC;AAM7B;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CA4B/G;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,GAAG,EAAE,4BAA4B,GAChC,iBAAiB,CA4BnB;AAqGD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,4BAA4B,GAAG,iBAAiB,CAsCrG;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,GAAG,MAAM,GAAG,SAAS,CAc3G;AAgDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,GAAG,WAAW,EAAE,EACnC,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAS5B"}

package/context/frontmcp-auth-context.factory.d.ts

@@ -4,9 +4,10 @@
  * This is the recommended entry point — prefer `buildAuthContext()` over
  * directly constructing `FrontMcpAuthContextImpl`.
  */
-import type { AuthoritiesClaimsMapping } from '../authorities/authorities.profiles';
-import type { FrontMcpAuthContext, AuthContextPipe } from './frontmcp-auth-context';
-import type { AuthContextSourceInfo } from './frontmcp-auth-context.impl';
+import { type ClaimsResolverFn } from '../authorities/authorities.context';
+import { type AuthoritiesClaimsMapping } from '../authorities/authorities.profiles';
+import { type AuthContextPipe, type FrontMcpAuthContext } from './frontmcp-auth-context';
+import { type AuthContextSourceInfo } from './frontmcp-auth-context.impl';
 /**
  * Build a {@link FrontMcpAuthContext} from raw auth information.
  *
@@ -17,6 +18,7 @@ import type { AuthContextSourceInfo } from './frontmcp-auth-context.impl';
  * @param authInfo - Raw auth info (e.g., from MCP SDK AuthInfo, JWT payload, etc.)
  * @param claimsMapping - Optional IdP-specific claims mapping (Keycloak, Auth0, Okta, etc.)
  * @param pipes - Optional pipe functions that extract custom fields from claims
+ * @param claimsResolver - Optional resolver that decides the roles, permissions and claims (it wins over claimsMapping)
  * @returns A frozen, immutable FrontMcpAuthContext instance (with custom extensions if pipes provided)
  *
  * @example
@@ -34,6 +36,6 @@ import type { AuthContextSourceInfo } from './frontmcp-auth-context.impl';
  * ]);
  * ```
  */
-export declare function buildAuthContext(authInfo: AuthContextSourceInfo, claimsMapping?: AuthoritiesClaimsMapping): FrontMcpAuthContext;
-export declare function buildAuthContext(authInfo: AuthContextSourceInfo, claimsMapping: AuthoritiesClaimsMapping | undefined, pipes: AuthContextPipe[]): Promise<FrontMcpAuthContext>;
+export declare function buildAuthContext(authInfo: AuthContextSourceInfo, claimsMapping?: AuthoritiesClaimsMapping, pipes?: undefined, claimsResolver?: ClaimsResolverFn): FrontMcpAuthContext;
+export declare function buildAuthContext(authInfo: AuthContextSourceInfo, claimsMapping: AuthoritiesClaimsMapping | undefined, pipes: AuthContextPipe[], claimsResolver?: ClaimsResolverFn): Promise<FrontMcpAuthContext>;
 //# sourceMappingURL=frontmcp-auth-context.factory.d.ts.map

package/context/frontmcp-auth-context.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmcp-auth-context.factory.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEpF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,CAAC,EAAE,wBAAwB,GACvC,mBAAmB,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,wBAAwB,GAAG,SAAS,EACnD,KAAK,EAAE,eAAe,EAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"frontmcp-auth-context.factory.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,CAAC,EAAE,wBAAwB,EACxC,KAAK,CAAC,EAAE,SAAS,EACjB,cAAc,CAAC,EAAE,gBAAgB,GAChC,mBAAmB,CAAC;AACvB,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,qBAAqB,EAC/B,aAAa,EAAE,wBAAwB,GAAG,SAAS,EACnD,KAAK,EAAE,eAAe,EAAE,EACxB,cAAc,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAAC"}

package/context/frontmcp-auth-context.impl.d.ts

@@ -5,6 +5,7 @@
  * roles/permissions using the same `resolveDotPath` utility used by the
  * authorities engine, and exposes convenience query methods.
  */
+import { type ClaimsResolverFn } from '../authorities/authorities.context';
 import type { AuthoritiesClaimsMapping } from '../authorities/authorities.profiles';
 import type { FrontMcpAuthContext, FrontMcpAuthUser } from './frontmcp-auth-context';
 /**
@@ -53,7 +54,7 @@ export declare class FrontMcpAuthContextImpl implements FrontMcpAuthContext {
     readonly claims: Readonly<Record<string, unknown>>;
     readonly roles: readonly string[];
     readonly permissions: readonly string[];
-    constructor(source: AuthContextSourceInfo, claimsMapping?: AuthoritiesClaimsMapping);
+    constructor(source: AuthContextSourceInfo, claimsMapping?: AuthoritiesClaimsMapping, claimsResolver?: ClaimsResolverFn);
     hasRole(role: string): boolean;
     hasAllRoles(roles: readonly string[]): boolean;
     hasAnyRole(roles: readonly string[]): boolean;

package/context/frontmcp-auth-context.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmcp-auth-context.impl.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yDAAyD;IACzD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE5B,MAAM,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,wBAAwB;IA4DnF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI9C,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAI1C,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI1D,gBAAgB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIzD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIhD,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAM/C;;;OAGG;IACH,OAAO,CAAC,cAAc;CASvB"}
+{"version":3,"file":"frontmcp-auth-context.impl.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-auth-context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yDAAyD;IACzD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgBD;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;gBAGtC,MAAM,EAAE,qBAAqB,EAC7B,aAAa,CAAC,EAAE,wBAAwB,EACxC,cAAc,CAAC,EAAE,gBAAgB;IAsEnC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI9C,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI7C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAI1C,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAI1D,gBAAgB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIzD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAIhD,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO;IAM/C;;;OAGG;IACH,OAAO,CAAC,cAAc;CASvB"}

package/detection/auth-provider-detection.d.ts

@@ -48,6 +48,8 @@ export interface AppAuthInfo {
     id: string;
     name: string;
     auth?: AuthOptions;
+    /** A remote app's `remoteAuth.mode`. */
+    remoteAuthMode?: string;
 }
 export declare function deriveProviderId(options: AuthOptions): string;
 export declare function detectAuthProviders(parentAuth: AuthOptions | undefined, apps: AppAuthInfo[]): AuthProviderDetectionResult;

package/detection/auth-provider-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider-detection.d.ts","sourceRoot":"","sources":["../../src/detection/auth-provider-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;gCAOrC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;gCAQ5C,CAAC;AAMH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiB7D;AAyBD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,WAAW,GAAG,SAAS,EACnC,IAAI,EAAE,WAAW,EAAE,GAClB,2BAA2B,CA4E7B;AAcD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,EAAE,WAAW,GAAG,SAAS,GAClC,OAAO,CAaT;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtG;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpG"}
+{"version":3,"file":"auth-provider-detection.d.ts","sourceRoot":"","sources":["../../src/detection/auth-provider-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAcrD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;gCAOrC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;gCAQ5C,CAAC;AAMH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiB7D;AAyBD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,WAAW,GAAG,SAAS,EACnC,IAAI,EAAE,WAAW,EAAE,GAClB,2BAA2B,CA+F7B;AA6BD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,EAAE,WAAW,GAAG,SAAS,GAClC,OAAO,CAaT;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtG;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpG"}

package/esm/index.mjs

@@ -867,7 +867,8 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *   4) `<issuer>/.well-known/jwks.json` → fetch, cache, return
+   *   5) discover jwks_uri         → the issuer's OAuth authorization server
    *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
    *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
    *      then fetch jwks_uri, cache, return
@@ -886,6 +887,8 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
+    const fromWellKnown = await this.tryFetchJwks(ref.id, `${issuer}/.well-known/jwks.json`);
+    if (fromWellKnown?.keys?.length) return fromWellKnown;
     for (const document of ["oauth-authorization-server", "openid-configuration"]) {
       const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
       const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
@@ -3935,7 +3938,8 @@ function deriveTypedUser(claims) {
     ...claims,
     iss: extractClaimValue(claims, "iss", isString) ?? "",
     sid: extractClaimValue(claims, "sid", isString),
-    sub: extractClaimValue(claims, "sub", isString) ?? "",
+    // RFC 9068 §2.2: a client-credentials token names the client as its subject; some IdPs only put it in client_id / azp
+    sub: extractClaimValue(claims, "sub", isString) ?? extractClaimValue(claims, "client_id", isString) ?? extractClaimValue(claims, "azp", isString) ?? "",
     exp: extractClaimValue(claims, "exp", isNumber),
     iat: extractClaimValue(claims, "iat", isNumber),
     aud: extractClaimValue(claims, "aud", isStringOrStringArray),
@@ -8760,9 +8764,17 @@ function detectAuthProviders(parentAuth, apps) {
       `Invalid auth configuration: Parent uses transparent mode but apps have their own auth providers. Transparent mode passes tokens through without modification, which is incompatible with multi-provider setups. Change parent auth to local or remote mode to properly manage tokens for each provider. Detected providers: ${[...providers.keys()].join(", ")}`
     );
   }
-  if (uniqueProviderCount > 1 && parentAuth && isPublicMode(parentAuth)) {
-    warnings.push(
-      `Parent uses public mode but apps have auth providers configured. App-level auth will be used, but consider using local or remote mode at parent for unified auth management.`
+  const sharedEndpointUnenforced = !parentAuth || isPublicMode(parentAuth) || isStaticMode(parentAuth);
+  const unenforcedAppIds = apps.filter((app) => app.auth && !isPublicMode(app.auth) && !staticParentEnforces(parentAuth, app.auth)).map((app) => app.id);
+  if (sharedEndpointUnenforced && unenforcedAppIds.length > 0) {
+    validationErrors.push(
+      `App-level auth is not enforced on the shared endpoint of a server in ${parentAuth?.mode ?? "public"} mode, so the tools of ${unenforcedAppIds.join(", ")} would be served without it. Serve the app on its own endpoint with standalone: true or splitByApp: true, or run the server in local or remote mode with incrementalAuth enabled, which checks each tool call against the apps the caller has authorized (without incrementalAuth, local and remote mode do not check app grants per tool call).`
+    );
+  }
+  const tokenMintingAppIds = apps.filter((app) => app.remoteAuthMode === "forward" && !(parentAuth && isTransparentMode(parentAuth))).map((app) => app.id);
+  if (tokenMintingAppIds.length > 0) {
+    validationErrors.push(
+      `remoteAuth: { mode: 'forward' } on ${tokenMintingAppIds.join(", ")} would send the remote a token this server minted or holds itself: only a server in transparent mode receives its callers' tokens from the identity provider. Use remoteAuth: { mode: 'static', credentials } (or transportOptions.headers) for the remote, or run the server in transparent mode.`
     );
   }
   return {
@@ -8775,6 +8787,14 @@ function detectAuthProviders(parentAuth, apps) {
     warnings
   };
 }
+function staticParentEnforces(parentAuth, appAuth) {
+  if (!parentAuth || !isStaticMode(parentAuth) || !isStaticMode(appAuth)) return false;
+  const parent = staticAuthOptionsSchema.safeParse(parentAuth);
+  const app = staticAuthOptionsSchema.safeParse(appAuth);
+  if (!parent.success || !app.success) return false;
+  const sameChallenge = parent.data.header.toLowerCase() === app.data.header.toLowerCase() && parent.data.scheme === app.data.scheme;
+  return sameChallenge && parent.data.tokens.every((token) => app.data.tokens.includes(token));
+}
 function getProviderUrl(options) {
   if (isTransparentMode(options)) {
     return options.provider;
@@ -9115,6 +9135,16 @@ function isLoopbackRedirectUri(uri) {
   return false;
 }
 
+// libs/auth/src/utils/token-scopes.utils.ts
+function scopesFromClaims(claims) {
+  const scopes = [claims?.scope, claims?.scp].flatMap((claim) => {
+    if (typeof claim === "string") return claim.split(/\s+/).filter(Boolean);
+    if (Array.isArray(claim)) return claim.filter((scope) => typeof scope === "string");
+    return [];
+  });
+  return [...new Set(scopes)];
+}
+
 // libs/auth/src/vault/auth-providers.types.ts
 import { z as z19 } from "@frontmcp/lazy-zod";
 var credentialScopeSchema = z19.enum(["global", "user", "session"]);
@@ -10132,6 +10162,7 @@ var LazyCredentialLoader = class {
 };
 
 // libs/auth/src/authorities/authorities.context.ts
+import { getEnv as getEnv4 } from "@frontmcp/utils";
 function resolveDotPath(obj, path) {
   if (path in obj) {
     return obj[path];
@@ -10172,6 +10203,10 @@ function signedInSubject(rawSub, mappedSub) {
   if (rawSub !== void 0 && isAnonymousSubject(rawSub)) return void 0;
   return [mappedSub, rawSub].find((candidate) => !isAnonymousSubject(candidate));
 }
+var runtimeEnv = new Proxy(
+  {},
+  { get: (_target, name) => typeof name === "string" ? getEnv4(name) : void 0 }
+);
 var AuthoritiesContextBuilder = class {
   claimsMapping;
   claimsResolver;
@@ -10184,7 +10219,7 @@ var AuthoritiesContextBuilder = class {
   /**
    * Build an evaluation context from AuthInfo and tool input.
    */
-  build(authInfo, input = {}, env = {}) {
+  build(authInfo, input = {}, env = runtimeEnv) {
     if (this.claimsResolver) {
       const resolved = this.claimsResolver(authInfo);
       return {
@@ -10254,9 +10289,9 @@ var FrontMcpAuthContextImpl = class {
   claims;
   roles;
   permissions;
-  constructor(source, claimsMapping) {
+  constructor(source, claimsMapping, claimsResolver) {
     const rawUser = resolveAuthUser(source);
-    const mappedSub = claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
+    const mappedSub = !claimsResolver && claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
     const signedInSub = signedInSubject(rawUser.sub, mappedSub);
     const sub = signedInSub ?? (typeof rawUser.sub === "string" ? rawUser.sub : "");
     this.user = Object.freeze({
@@ -10274,6 +10309,13 @@ var FrontMcpAuthContextImpl = class {
     this.scopes = Object.freeze(
       Array.isArray(source.scopes) ? source.scopes.filter((s) => typeof s === "string") : []
     );
+    if (claimsResolver) {
+      const resolved = claimsResolver(source);
+      this.claims = Object.freeze({ ...resolved.claims });
+      this.roles = Object.freeze([...toStringArray2(resolved.roles)]);
+      this.permissions = Object.freeze([...toStringArray2(resolved.permissions)]);
+      return;
+    }
     const rawClaims = this.buildRawClaims(source);
     this.claims = Object.freeze({ ...rawClaims });
     if (claimsMapping?.roles) {
@@ -10334,8 +10376,8 @@ var FrontMcpAuthContextImpl = class {
 };
 
 // libs/auth/src/context/frontmcp-auth-context.factory.ts
-function buildAuthContext(authInfo, claimsMapping, pipes) {
-  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping);
+function buildAuthContext(authInfo, claimsMapping, pipes, claimsResolver) {
+  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping, claimsResolver);
   if (!pipes || pipes.length === 0) {
     return base;
   }
@@ -10587,6 +10629,10 @@ function evaluateCondition(condition, envelope, ctx) {
   const expected = resolveValue(condition.value, ctx);
   return applyOperator(actual, condition.op, expected);
 }
+var REDACTED_ENV_VALUE = "[redacted]";
+function reportableActual(path, actual) {
+  return path === "env" || path.startsWith("env.") ? REDACTED_ENV_VALUE : actual;
+}
 function evaluateAbac(policy, ctx) {
   const envelope = buildContextEnvelope(ctx);
   if (policy.match) {
@@ -10594,10 +10640,11 @@ function evaluateAbac(policy, ctx) {
       const actual = resolveDotPath(envelope, path);
       const expected = resolveValue(expectedRaw, ctx);
       if (expected === void 0 || actual !== expected) {
+        const reported = reportableActual(path, actual);
         return {
           granted: false,
-          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
-          denial: { kind: "attributes", path: "attributes.match", expected, actual },
+          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(reported)}'`,
+          denial: { kind: "attributes", path: "attributes.match", expected, actual: reported },
           evaluatedPolicies: ["attributes.match"]
         };
       }
@@ -10608,7 +10655,7 @@ function evaluateAbac(policy, ctx) {
       const condition = policy.conditions[i];
       if (!evaluateCondition(condition, envelope, ctx)) {
         const expected = resolveValue(condition.value, ctx);
-        const actual = resolveDotPath(envelope, condition.path);
+        const actual = reportableActual(condition.path, resolveDotPath(envelope, condition.path));
         return {
           granted: false,
           deniedBy: `attributes.conditions: '${condition.path}' failed '${condition.op}' check against '${String(expected)}'`,
@@ -11347,6 +11394,21 @@ var basicApplier = {
 function isFrontMcpCredentials(creds) {
   return typeof creds === "object" && creds !== null && "provider" in creds && typeof creds.provider === "string" && creds.provider.length > 0;
 }
+function providerHeadersCredentials(resolveHeaders) {
+  return {
+    async applyCredentials(_url, init) {
+      const { credentials, ...cleanInit } = init;
+      if (!isFrontMcpCredentials(credentials)) {
+        return { init: typeof credentials === "string" ? init : cleanInit };
+      }
+      const headers = new Headers(cleanInit.headers);
+      for (const [name, value] of Object.entries(await resolveHeaders(credentials.provider))) {
+        headers.set(name, value);
+      }
+      return { init: { ...cleanInit, headers } };
+    }
+  };
+}
 var FetchCredentialMiddleware = class {
   constructor(tokenAccessor, appliers) {
     this.tokenAccessor = tokenAccessor;
@@ -11647,6 +11709,7 @@ export {
   privateKeyCredentialSchema,
   progressiveAuthStateSchema,
   providerConfigSchema,
+  providerHeadersCredentials,
   publicAccessConfigSchema,
   publicAuthOptionsSchema,
   queryApplier,
@@ -11664,6 +11727,7 @@ export {
   resourceIdRefSchema,
   resourceScopesFor,
   safeDecrypt,
+  scopesFromClaims,
   sealPendingLogin,
   secureStoreConfigSchema,
   secureStoreCustomBackendSchema,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.9.1-rc.3",
+  "version": "1.9.2",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1-rc.3",
-    "@frontmcp/storage-sqlite": "1.9.1-rc.3",
+    "@frontmcp/lazy-zod": "1.9.2",
+    "@frontmcp/storage-sqlite": "1.9.2",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.9.1-rc.3",
-    "@frontmcp/utils": "1.9.1-rc.3",
+    "@frontmcp/di": "1.9.2",
+    "@frontmcp/utils": "1.9.2",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/fetch/fetch-credential-middleware.d.ts

@@ -70,6 +70,16 @@ export type FrontMcpFetchInit = Omit<RequestInit, 'credentials'> & {
     credentials?: FrontMcpCredentials | RequestCredentials;
 };
 export declare function isFrontMcpCredentials(creds: unknown): creds is FrontMcpCredentials;
+/** What applies `credentials: { provider }` to an outgoing request. */
+export interface FetchCredentialApplier {
+    applyCredentials(url: string, init: FrontMcpFetchInit): Promise<CredentialApplyResult>;
+}
+/**
+ * Applies the headers a provider's credential resolves to (what `this.authProviders.headers(provider)`
+ * returns), so each provider decides how its credential is sent. A provider without a credential adds
+ * none. The `credentials` object itself is never passed on to `fetch`.
+ */
+export declare function providerHeadersCredentials(resolveHeaders: (providerName: string) => Promise<Record<string, string>>): FetchCredentialApplier;
 /**
  * Middleware that resolves upstream provider tokens and delegates to
  * the provider's CredentialApplier to inject them into outgoing requests.
@@ -86,7 +96,7 @@ export declare function isFrontMcpCredentials(creds: unknown): creds is FrontMcp
  * });
  * ```
  */
-export declare class FetchCredentialMiddleware {
+export declare class FetchCredentialMiddleware implements FetchCredentialApplier {
     private readonly tokenAccessor;
     private readonly appliers;
     constructor(tokenAccessor: TokenAccessor, appliers?: Record<string, CredentialApplier>);

package/fetch/fetch-credential-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-credential-middleware.d.ts","sourceRoot":"","sources":["../../src/fetch/fetch-credential-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,qBAAqB,CAAC;CAC7E;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,iBAM3B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAQpF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAQjE;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,iBAQ1B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;IACjE,WAAW,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAAC;CACxD,CAAC;AAMF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAQlF;AAMD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAAyB;IAIlC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAHhC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;gBAGvC,aAAa,EAAE,aAAa,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAK9C;;;OAGG;IACG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA8B7F"}
+{"version":3,"file":"fetch-credential-middleware.d.ts","sourceRoot":"","sources":["../../src/fetch/fetch-credential-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,qBAAqB,CAAC;CAC7E;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,iBAM3B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAQpF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAQjE;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,iBAQ1B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;IACjE,WAAW,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAAC;CACxD,CAAC;AAMF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAQlF;AAMD,uEAAuE;AACvE,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACxF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACxE,sBAAsB,CAcxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAA0B,YAAW,sBAAsB;IAIpE,OAAO,CAAC,QAAQ,CAAC,aAAa;IAHhC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;gBAGvC,aAAa,EAAE,aAAa,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAK9C;;;OAGG;IACG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA8B7F"}

package/fetch/index.d.ts

@@ -5,6 +5,6 @@
  * fetch requests via the `credentials: { provider: '...' }` pattern.
  * Auth providers decide HOW to apply credentials (Bearer, API key, query param, basic).
  */
-export { FetchCredentialMiddleware, isFrontMcpCredentials, bearerApplier, basicApplier, headerApplier, queryApplier, } from './fetch-credential-middleware';
-export type { TokenAccessor, CredentialApplier, CredentialApplyResult, FrontMcpCredentials, FrontMcpFetchInit, } from './fetch-credential-middleware';
+export { FetchCredentialMiddleware, providerHeadersCredentials, isFrontMcpCredentials, bearerApplier, basicApplier, headerApplier, queryApplier, } from './fetch-credential-middleware';
+export type { FetchCredentialApplier, TokenAccessor, CredentialApplier, CredentialApplyResult, FrontMcpCredentials, FrontMcpFetchInit, } from './fetch-credential-middleware';
 //# sourceMappingURL=index.d.ts.map

package/fetch/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fetch/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/fetch/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC"}

package/index.d.ts

@@ -49,13 +49,13 @@ export * from './options';
 export { consentToolItemSchema, consentSelectionSchema, consentStateSchema, federatedProviderItemSchema, federatedLoginStateSchema, federatedSelectionSchema, } from './consent';
 export type { ConsentToolItem, ConsentSelection, ConsentState, FederatedProviderItem, FederatedLoginState, FederatedSelection, } from './consent';
 export * from './detection';
-export { buildWwwAuthenticate, buildPrmUrl, buildUnauthorizedHeader, buildInvalidTokenHeader, buildInsufficientScopeHeader, buildInvalidRequestHeader, parseWwwAuthenticate, validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, deriveAuthorizationId, advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, resourceScopesFor, isLoopbackRedirectUri, } from './utils';
+export { buildWwwAuthenticate, buildPrmUrl, buildUnauthorizedHeader, buildInvalidTokenHeader, buildInsufficientScopeHeader, buildInvalidRequestHeader, parseWwwAuthenticate, validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, deriveAuthorizationId, advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, resourceScopesFor, scopesFromClaims, isLoopbackRedirectUri, } from './utils';
 export type { BearerErrorCode, ResourceScopeOptions, WwwAuthenticateOptions, AudienceValidationResult, AudienceValidatorOptions, } from './utils';
 export { type CredentialScope, type LoadingStrategy, type GetCredentialOptions, type ResolvedCredential, type CredentialFactoryContext, type CredentialFactory, type CredentialRefreshFn, type CredentialHeadersFn, type CredentialProviderConfig, type AuthProviderMapping, type CredentialCacheEntry, type VaultStorageKey, type AuthProvidersVaultOptions, type CredentialEventType, type CredentialEvent, type CacheStats, credentialScopeSchema, loadingStrategySchema, getCredentialOptionsSchema, credentialProviderConfigSchema, authProviderMappingSchema, authProvidersVaultOptionsSchema, extractCredentialExpiry, CredentialCache, type AuthProvidersAccessor, AUTH_PROVIDERS_ACCESSOR, AuthProvidersAccessorImpl, AuthProvidersRegistry, AUTH_PROVIDERS_REGISTRY, type NormalizedProviderConfig, AuthProvidersVault, AUTH_PROVIDERS_VAULT, EagerCredentialLoader, type EagerLoadResult, LazyCredentialLoader, } from './vault';
 export { type CimdLogger, noopLogger, clientMetadataDocumentSchema, cimdCacheConfigSchema, cimdSecurityConfigSchema, cimdNetworkConfigSchema, cimdConfigSchema, type ClientMetadataDocument, type ClientMetadataDocumentInput, type CimdCacheConfig, type CimdSecurityConfig, type CimdNetworkConfig, type CimdConfig, type CimdConfigInput, type CimdResolutionResult, CimdError, InvalidClientIdUrlError, CimdFetchError, CimdValidationError, CimdClientIdMismatchError, CimdSecurityError, RedirectUriMismatchError, CimdResponseTooLargeError, CimdDisabledError, isCimdClientId, validateClientIdUrl, checkSsrfProtection, hasOnlyLocalhostRedirectUris, InMemoryCimdCache, extractCacheHeaders, parseCacheHeaders, type CimdCacheEntry, type CacheableHeaders, CimdService, } from './cimd';
 export { FrontMcpAuthContextImpl, buildAuthContext } from './context';
 export type { FrontMcpAuthContext, FrontMcpAuthUser, AuthContextSourceInfo } from './context';
 export * from './authorities';
-export { FetchCredentialMiddleware, isFrontMcpCredentials, bearerApplier, basicApplier, headerApplier, queryApplier, } from './fetch';
-export type { TokenAccessor, CredentialApplier, FrontMcpCredentials, FrontMcpFetchInit } from './fetch';
+export { FetchCredentialMiddleware, providerHeadersCredentials, isFrontMcpCredentials, bearerApplier, basicApplier, headerApplier, queryApplier, } from './fetch';
+export type { FetchCredentialApplier, TokenAccessor, CredentialApplier, FrontMcpCredentials, FrontMcpFetchInit, } from './fetch';
 //# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,4BAA4B,EAE5B,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,EAErB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EAEjB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,4BAA4B,EAE5B,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,EAErB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAEhB,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,SAAS,CAAC"}

package/index.js

@@ -500,6 +500,7 @@ __export(index_exports, {
   privateKeyCredentialSchema: () => privateKeyCredentialSchema,
   progressiveAuthStateSchema: () => progressiveAuthStateSchema,
   providerConfigSchema: () => providerConfigSchema,
+  providerHeadersCredentials: () => providerHeadersCredentials,
   publicAccessConfigSchema: () => publicAccessConfigSchema,
   publicAuthOptionsSchema: () => publicAuthOptionsSchema,
   queryApplier: () => queryApplier,
@@ -517,6 +518,7 @@ __export(index_exports, {
   resourceIdRefSchema: () => resourceIdRefSchema,
   resourceScopesFor: () => resourceScopesFor,
   safeDecrypt: () => safeDecrypt,
+  scopesFromClaims: () => scopesFromClaims,
   sealPendingLogin: () => sealPendingLogin,
   secureStoreConfigSchema: () => secureStoreConfigSchema,
   secureStoreCustomBackendSchema: () => secureStoreCustomBackendSchema,
@@ -1207,7 +1209,8 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *   4) `<issuer>/.well-known/jwks.json` → fetch, cache, return
+   *   5) discover jwks_uri         → the issuer's OAuth authorization server
    *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
    *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
    *      then fetch jwks_uri, cache, return
@@ -1226,6 +1229,8 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
+    const fromWellKnown = await this.tryFetchJwks(ref.id, `${issuer}/.well-known/jwks.json`);
+    if (fromWellKnown?.keys?.length) return fromWellKnown;
     for (const document of ["oauth-authorization-server", "openid-configuration"]) {
       const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
       const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
@@ -4248,7 +4253,8 @@ function deriveTypedUser(claims) {
     ...claims,
     iss: extractClaimValue(claims, "iss", isString) ?? "",
     sid: extractClaimValue(claims, "sid", isString),
-    sub: extractClaimValue(claims, "sub", isString) ?? "",
+    // RFC 9068 §2.2: a client-credentials token names the client as its subject; some IdPs only put it in client_id / azp
+    sub: extractClaimValue(claims, "sub", isString) ?? extractClaimValue(claims, "client_id", isString) ?? extractClaimValue(claims, "azp", isString) ?? "",
     exp: extractClaimValue(claims, "exp", isNumber),
     iat: extractClaimValue(claims, "iat", isNumber),
     aud: extractClaimValue(claims, "aud", isStringOrStringArray),
@@ -9073,9 +9079,17 @@ function detectAuthProviders(parentAuth, apps) {
       `Invalid auth configuration: Parent uses transparent mode but apps have their own auth providers. Transparent mode passes tokens through without modification, which is incompatible with multi-provider setups. Change parent auth to local or remote mode to properly manage tokens for each provider. Detected providers: ${[...providers.keys()].join(", ")}`
     );
   }
-  if (uniqueProviderCount > 1 && parentAuth && isPublicMode(parentAuth)) {
-    warnings.push(
-      `Parent uses public mode but apps have auth providers configured. App-level auth will be used, but consider using local or remote mode at parent for unified auth management.`
+  const sharedEndpointUnenforced = !parentAuth || isPublicMode(parentAuth) || isStaticMode(parentAuth);
+  const unenforcedAppIds = apps.filter((app) => app.auth && !isPublicMode(app.auth) && !staticParentEnforces(parentAuth, app.auth)).map((app) => app.id);
+  if (sharedEndpointUnenforced && unenforcedAppIds.length > 0) {
+    validationErrors.push(
+      `App-level auth is not enforced on the shared endpoint of a server in ${parentAuth?.mode ?? "public"} mode, so the tools of ${unenforcedAppIds.join(", ")} would be served without it. Serve the app on its own endpoint with standalone: true or splitByApp: true, or run the server in local or remote mode with incrementalAuth enabled, which checks each tool call against the apps the caller has authorized (without incrementalAuth, local and remote mode do not check app grants per tool call).`
+    );
+  }
+  const tokenMintingAppIds = apps.filter((app) => app.remoteAuthMode === "forward" && !(parentAuth && isTransparentMode(parentAuth))).map((app) => app.id);
+  if (tokenMintingAppIds.length > 0) {
+    validationErrors.push(
+      `remoteAuth: { mode: 'forward' } on ${tokenMintingAppIds.join(", ")} would send the remote a token this server minted or holds itself: only a server in transparent mode receives its callers' tokens from the identity provider. Use remoteAuth: { mode: 'static', credentials } (or transportOptions.headers) for the remote, or run the server in transparent mode.`
     );
   }
   return {
@@ -9088,6 +9102,14 @@ function detectAuthProviders(parentAuth, apps) {
     warnings
   };
 }
+function staticParentEnforces(parentAuth, appAuth) {
+  if (!parentAuth || !isStaticMode(parentAuth) || !isStaticMode(appAuth)) return false;
+  const parent = staticAuthOptionsSchema.safeParse(parentAuth);
+  const app = staticAuthOptionsSchema.safeParse(appAuth);
+  if (!parent.success || !app.success) return false;
+  const sameChallenge = parent.data.header.toLowerCase() === app.data.header.toLowerCase() && parent.data.scheme === app.data.scheme;
+  return sameChallenge && parent.data.tokens.every((token) => app.data.tokens.includes(token));
+}
 function getProviderUrl(options) {
   if (isTransparentMode(options)) {
     return options.provider;
@@ -9428,6 +9450,16 @@ function isLoopbackRedirectUri(uri) {
   return false;
 }
 
+// libs/auth/src/utils/token-scopes.utils.ts
+function scopesFromClaims(claims) {
+  const scopes = [claims?.scope, claims?.scp].flatMap((claim) => {
+    if (typeof claim === "string") return claim.split(/\s+/).filter(Boolean);
+    if (Array.isArray(claim)) return claim.filter((scope) => typeof scope === "string");
+    return [];
+  });
+  return [...new Set(scopes)];
+}
+
 // libs/auth/src/vault/auth-providers.types.ts
 var import_lazy_zod19 = require("@frontmcp/lazy-zod");
 var credentialScopeSchema = import_lazy_zod19.z.enum(["global", "user", "session"]);
@@ -10445,6 +10477,7 @@ var LazyCredentialLoader = class {
 };
 
 // libs/auth/src/authorities/authorities.context.ts
+var import_utils47 = require("@frontmcp/utils");
 function resolveDotPath(obj, path) {
   if (path in obj) {
     return obj[path];
@@ -10485,6 +10518,10 @@ function signedInSubject(rawSub, mappedSub) {
   if (rawSub !== void 0 && isAnonymousSubject(rawSub)) return void 0;
   return [mappedSub, rawSub].find((candidate) => !isAnonymousSubject(candidate));
 }
+var runtimeEnv = new Proxy(
+  {},
+  { get: (_target, name) => typeof name === "string" ? (0, import_utils47.getEnv)(name) : void 0 }
+);
 var AuthoritiesContextBuilder = class {
   claimsMapping;
   claimsResolver;
@@ -10497,7 +10534,7 @@ var AuthoritiesContextBuilder = class {
   /**
    * Build an evaluation context from AuthInfo and tool input.
    */
-  build(authInfo, input = {}, env = {}) {
+  build(authInfo, input = {}, env = runtimeEnv) {
     if (this.claimsResolver) {
       const resolved = this.claimsResolver(authInfo);
       return {
@@ -10567,9 +10604,9 @@ var FrontMcpAuthContextImpl = class {
   claims;
   roles;
   permissions;
-  constructor(source, claimsMapping) {
+  constructor(source, claimsMapping, claimsResolver) {
     const rawUser = resolveAuthUser(source);
-    const mappedSub = claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
+    const mappedSub = !claimsResolver && claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
     const signedInSub = signedInSubject(rawUser.sub, mappedSub);
     const sub = signedInSub ?? (typeof rawUser.sub === "string" ? rawUser.sub : "");
     this.user = Object.freeze({
@@ -10587,6 +10624,13 @@ var FrontMcpAuthContextImpl = class {
     this.scopes = Object.freeze(
       Array.isArray(source.scopes) ? source.scopes.filter((s) => typeof s === "string") : []
     );
+    if (claimsResolver) {
+      const resolved = claimsResolver(source);
+      this.claims = Object.freeze({ ...resolved.claims });
+      this.roles = Object.freeze([...toStringArray2(resolved.roles)]);
+      this.permissions = Object.freeze([...toStringArray2(resolved.permissions)]);
+      return;
+    }
     const rawClaims = this.buildRawClaims(source);
     this.claims = Object.freeze({ ...rawClaims });
     if (claimsMapping?.roles) {
@@ -10647,8 +10691,8 @@ var FrontMcpAuthContextImpl = class {
 };
 
 // libs/auth/src/context/frontmcp-auth-context.factory.ts
-function buildAuthContext(authInfo, claimsMapping, pipes) {
-  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping);
+function buildAuthContext(authInfo, claimsMapping, pipes, claimsResolver) {
+  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping, claimsResolver);
   if (!pipes || pipes.length === 0) {
     return base;
   }
@@ -10900,6 +10944,10 @@ function evaluateCondition(condition, envelope, ctx) {
   const expected = resolveValue(condition.value, ctx);
   return applyOperator(actual, condition.op, expected);
 }
+var REDACTED_ENV_VALUE = "[redacted]";
+function reportableActual(path, actual) {
+  return path === "env" || path.startsWith("env.") ? REDACTED_ENV_VALUE : actual;
+}
 function evaluateAbac(policy, ctx) {
   const envelope = buildContextEnvelope(ctx);
   if (policy.match) {
@@ -10907,10 +10955,11 @@ function evaluateAbac(policy, ctx) {
       const actual = resolveDotPath(envelope, path);
       const expected = resolveValue(expectedRaw, ctx);
       if (expected === void 0 || actual !== expected) {
+        const reported = reportableActual(path, actual);
         return {
           granted: false,
-          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
-          denial: { kind: "attributes", path: "attributes.match", expected, actual },
+          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(reported)}'`,
+          denial: { kind: "attributes", path: "attributes.match", expected, actual: reported },
           evaluatedPolicies: ["attributes.match"]
         };
       }
@@ -10921,7 +10970,7 @@ function evaluateAbac(policy, ctx) {
       const condition = policy.conditions[i];
       if (!evaluateCondition(condition, envelope, ctx)) {
         const expected = resolveValue(condition.value, ctx);
-        const actual = resolveDotPath(envelope, condition.path);
+        const actual = reportableActual(condition.path, resolveDotPath(envelope, condition.path));
         return {
           granted: false,
           deniedBy: `attributes.conditions: '${condition.path}' failed '${condition.op}' check against '${String(expected)}'`,
@@ -11660,6 +11709,21 @@ var basicApplier = {
 function isFrontMcpCredentials(creds) {
   return typeof creds === "object" && creds !== null && "provider" in creds && typeof creds.provider === "string" && creds.provider.length > 0;
 }
+function providerHeadersCredentials(resolveHeaders) {
+  return {
+    async applyCredentials(_url, init) {
+      const { credentials, ...cleanInit } = init;
+      if (!isFrontMcpCredentials(credentials)) {
+        return { init: typeof credentials === "string" ? init : cleanInit };
+      }
+      const headers = new Headers(cleanInit.headers);
+      for (const [name, value] of Object.entries(await resolveHeaders(credentials.provider))) {
+        headers.set(name, value);
+      }
+      return { init: { ...cleanInit, headers } };
+    }
+  };
+}
 var FetchCredentialMiddleware = class {
   constructor(tokenAccessor, appliers) {
     this.tokenAccessor = tokenAccessor;
@@ -11961,6 +12025,7 @@ var FetchCredentialMiddleware = class {
   privateKeyCredentialSchema,
   progressiveAuthStateSchema,
   providerConfigSchema,
+  providerHeadersCredentials,
   publicAccessConfigSchema,
   publicAuthOptionsSchema,
   queryApplier,
@@ -11978,6 +12043,7 @@ var FetchCredentialMiddleware = class {
   resourceIdRefSchema,
   resourceScopesFor,
   safeDecrypt,
+  scopesFromClaims,
   sealPendingLogin,
   secureStoreConfigSchema,
   secureStoreCustomBackendSchema,

package/jwks/jwks.service.d.ts

@@ -57,7 +57,8 @@ export declare class JwksService {
      *   1) inline jwks (if provided) → cache & return
      *   2) cached & fresh (TTL)      → return
      *   3) explicit jwksUri          → fetch, cache, return
-     *   4) discover jwks_uri         → the issuer's OAuth authorization server
+     *   4) `<issuer>/.well-known/jwks.json` → fetch, cache, return
+     *   5) discover jwks_uri         → the issuer's OAuth authorization server
      *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
      *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
      *      then fetch jwks_uri, cache, return

package/jwks/jwks.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAgDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAmEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA8CpF,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}
+{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAgDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAmEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAgDpF,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.9.1-rc.3",
+  "version": "1.9.2",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1-rc.3",
-    "@frontmcp/storage-sqlite": "1.9.1-rc.3",
+    "@frontmcp/lazy-zod": "1.9.2",
+    "@frontmcp/storage-sqlite": "1.9.2",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.9.1-rc.3",
-    "@frontmcp/utils": "1.9.1-rc.3",
+    "@frontmcp/di": "1.9.2",
+    "@frontmcp/utils": "1.9.2",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/session/utils/auth-token.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token.utils.d.ts","sourceRoot":"","sources":["../../../src/session/utils/auth-token.utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE;AAkBD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAe1E;AAED,uEAAuE;AACvE,MAAM,WAAW,4BAA4B;IAC3C,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,EACrC,WAAW,EAAE,MAAM,GAClB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQ3D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE"}
+{"version":3,"file":"auth-token.utils.d.ts","sourceRoot":"","sources":["../../../src/session/utils/auth-token.utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE;AAkBD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAoB1E;AAED,uEAAuE;AACvE,MAAM,WAAW,4BAA4B;IAC3C,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,EACrC,WAAW,EAAE,MAAM,GAClB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQ3D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE"}

package/utils/index.d.ts

@@ -8,4 +8,5 @@ export type { AudienceValidationResult, AudienceValidatorOptions } from './audie
 export { deriveAuthorizationId } from './authorization-id.utils';
 export { advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, resourceScopesFor, type ResourceScopeOptions, } from './scope-grant.utils';
 export { isLoopbackRedirectUri } from './redirect-uri.utils';
+export { scopesFromClaims } from './token-scopes.utils';
 //# sourceMappingURL=index.d.ts.map

package/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/utils/token-scopes.utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The scopes a token's claims grant: `scope` (RFC 9068 §2.2.3) and `scp` (Entra ID, Okta), each as
+ * a space-delimited string or an array, merged without duplicates.
+ *
+ * @param claims The token's claims (a JWT payload, or the verified user claim built from it).
+ */
+export declare function scopesFromClaims(claims: {
+    scope?: unknown;
+    scp?: unknown;
+} | undefined): string[];
+//# sourceMappingURL=token-scopes.utils.d.ts.map

package/utils/token-scopes.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-scopes.utils.d.ts","sourceRoot":"","sources":["../../src/utils/token-scopes.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAOjG"}