@frontmcp/adapters 1.8.2 → 1.8.3

package/esm/index.mjs

@@ -183,13 +183,13 @@ var OpenApiSpecPoller = class {
 };
 
 // libs/adapters/src/openapi/openapi.security.ts
-import { SecurityResolver, createSecurityContext } from "mcp-from-openapi";
+import { createSecurityContext, SecurityResolver } from "mcp-from-openapi";
 async function createSecurityContextFromAuth(tool2, ctx, options) {
   if (options.securityResolver) {
     return await options.securityResolver(tool2, ctx);
   }
   if (options.authProviderMapper) {
-    const context = createSecurityContext({});
+    const context = {};
     const securitySchemes = /* @__PURE__ */ new Set();
     for (const mapper of tool2.mapper) {
       if (mapper.security?.scheme) {
@@ -242,22 +242,38 @@ async function createSecurityContextFromAuth(tool2, ctx, options) {
         }
       }
     }
+    if (hasStaticAuth(options)) {
+      return createSecurityContext({ ...options.staticAuth, ...context });
+    }
     const hasAnyAuth = context.jwt || context.apiKey || context.basic || context.oauth2Token;
-    const authToken = ctx.authInfo?.token;
-    if (!hasAnyAuth && authToken) {
-      if (typeof authToken !== "string") {
-        throw new Error(`authInfo.token must be a string, but got: ${typeof authToken}`);
+    if (!hasAnyAuth && options.passthroughCallerToken === true) {
+      const callerToken = getCallerToken(ctx);
+      if (callerToken) {
+        context.jwt = callerToken;
       }
-      context.jwt = authToken;
     }
-    return context;
+    return createSecurityContext(context);
   }
-  if (options.staticAuth) {
+  if (hasStaticAuth(options)) {
     return createSecurityContext(options.staticAuth);
   }
-  return createSecurityContext({
-    jwt: ctx.authInfo?.token
-  });
+  if (options.passthroughCallerToken === true) {
+    return createSecurityContext({ jwt: getCallerToken(ctx) });
+  }
+  return createSecurityContext({});
+}
+function hasStaticAuth(options) {
+  return !!options.staticAuth && Object.keys(options.staticAuth).length > 0;
+}
+function getCallerToken(ctx) {
+  const authToken = ctx.authInfo?.token;
+  if (authToken === void 0 || authToken === null || authToken === "") {
+    return void 0;
+  }
+  if (typeof authToken !== "string") {
+    throw new Error(`authInfo.token must be a string, but got: ${typeof authToken}`);
+  }
+  return authToken;
 }
 function extractSecuritySchemes(tools) {
   const schemes = /* @__PURE__ */ new Set();
@@ -293,12 +309,12 @@ function validateSecurityConfiguration(tools, options) {
     );
     return result;
   }
-  if (options.staticAuth && Object.keys(options.staticAuth).length > 0) {
+  if (hasStaticAuth(options)) {
     result.securityRiskScore = "medium";
     result.warnings.push(
       "SECURITY INFO: Using staticAuth with hardcoded credentials. Ensure credentials are stored securely (environment variables, secrets manager)."
     );
-    return result;
+    return withPassthroughRisk(result, securitySchemes, options);
   }
   const schemesInInput = new Set(options.securitySchemesInInput || []);
   if (options.authProviderMapper || schemesInInput.size > 0) {
@@ -308,13 +324,18 @@ function validateSecurityConfiguration(tools, options) {
         `INFO: Per-scheme security control enabled. Schemes in input: ${Array.from(schemesInInput).join(", ")}`
       );
     }
+    const passthroughFallback = [];
     for (const scheme of securitySchemes) {
       if (schemesInInput.has(scheme)) {
         continue;
       }
       if (!options.authProviderMapper?.[scheme]) {
-        result.valid = false;
-        result.missingMappings.push(scheme);
+        if (options.passthroughCallerToken === true) {
+          passthroughFallback.push(scheme);
+        } else {
+          result.valid = false;
+          result.missingMappings.push(scheme);
+        }
       }
     }
     if (!result.valid) {
@@ -322,19 +343,36 @@ function validateSecurityConfiguration(tools, options) {
         `ERROR: Missing auth provider mappings for security schemes: ${result.missingMappings.join(", ")}`
       );
     }
+    withPassthroughRisk(result, securitySchemes, options);
+    if (passthroughFallback.length > 0) {
+      result.warnings.push(
+        `SECURITY WARNING: Security schemes with no authProviderMapper entry (${passthroughFallback.join(", ")}) get the MCP client's own token, because passthroughCallerToken is enabled.`
+      );
+    }
     return result;
   }
-  if (securitySchemes.size > 0) {
+  if (securitySchemes.size > 0 && options.passthroughCallerToken !== true) {
+    const schemesStr = Array.from(securitySchemes).join(", ");
     result.securityRiskScore = "medium";
     result.warnings.push(
-      `INFO: No auth configuration provided. Using default ctx.authInfo.token for all security schemes: ${Array.from(
-        securitySchemes
-      ).join(", ")}`
-    );
-    result.warnings.push(
-      "RECOMMENDATION: For multiple auth providers, use authProviderMapper or securityResolver to map each security scheme to the correct auth provider."
+      `SECURITY WARNING: No auth configuration provided, so the adapter has no credentials for the API (security schemes: ${schemesStr}). Operations that require authentication will fail. The MCP client's own token is not forwarded: configure authProviderMapper, securityResolver or staticAuth, or set passthroughCallerToken: true if the API is meant to receive the caller's MCP token.`
     );
   }
+  return withPassthroughRisk(result, securitySchemes, options);
+}
+function canPassThroughCallerToken(options) {
+  return options.passthroughCallerToken === true && !options.securityResolver && !hasStaticAuth(options);
+}
+function withPassthroughRisk(result, securitySchemes, options) {
+  if (securitySchemes.size === 0 || !canPassThroughCallerToken(options)) {
+    return result;
+  }
+  const schemesStr = Array.from(securitySchemes).join(", ");
+  const when = options.authProviderMapper ? " whenever no authProviderMapper function returns a credential" : "";
+  result.securityRiskScore = "high";
+  result.warnings.push(
+    `SECURITY WARNING: passthroughCallerToken is enabled. The MCP client's own token (ctx.authInfo.token) is sent to the API${when} for security schemes: ${schemesStr}. Only use this when the API accepts tokens issued for this MCP server.`
+  );
   return result;
 }
 async function resolveToolSecurity(tool2, ctx, options) {
@@ -352,9 +390,10 @@ async function resolveToolSecurity(tool2, ctx, options) {
 Required security schemes: ${schemesStr}
 Solutions:
   1. Add authProviderMapper: { '${firstScheme}': (ctx) => ctx.authInfo.user?.token }
-  2. Add securityResolver: (tool, ctx) => ({ jwt: ctx.authInfo.token })
+  2. Add securityResolver: async (tool, ctx) => ({ jwt: await getApiToken(ctx) })
   3. Add staticAuth: { jwt: process.env.API_TOKEN }
-  4. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
+  4. Set passthroughCallerToken: true, only if the API accepts the MCP client's own token
+  5. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
     );
   }
   return await securityResolver.resolve(tool2.mapper, securityContext);
@@ -1155,7 +1194,7 @@ Add one of the following to your adapter configuration:
    }
 
 2. securityResolver:
-   securityResolver: (tool, authInfo) => ({ jwt: authInfo.token })
+   securityResolver: async (tool, ctx) => ({ jwt: await getApiToken(ctx) })
 
 3. staticAuth:
    staticAuth: { jwt: process.env.API_TOKEN }

package/esm/openapi/index.mjs

@@ -183,13 +183,13 @@ var OpenApiSpecPoller = class {
 };
 
 // libs/adapters/src/openapi/openapi.security.ts
-import { SecurityResolver, createSecurityContext } from "mcp-from-openapi";
+import { createSecurityContext, SecurityResolver } from "mcp-from-openapi";
 async function createSecurityContextFromAuth(tool2, ctx, options) {
   if (options.securityResolver) {
     return await options.securityResolver(tool2, ctx);
   }
   if (options.authProviderMapper) {
-    const context = createSecurityContext({});
+    const context = {};
     const securitySchemes = /* @__PURE__ */ new Set();
     for (const mapper of tool2.mapper) {
       if (mapper.security?.scheme) {
@@ -242,22 +242,38 @@ async function createSecurityContextFromAuth(tool2, ctx, options) {
         }
       }
     }
+    if (hasStaticAuth(options)) {
+      return createSecurityContext({ ...options.staticAuth, ...context });
+    }
     const hasAnyAuth = context.jwt || context.apiKey || context.basic || context.oauth2Token;
-    const authToken = ctx.authInfo?.token;
-    if (!hasAnyAuth && authToken) {
-      if (typeof authToken !== "string") {
-        throw new Error(`authInfo.token must be a string, but got: ${typeof authToken}`);
+    if (!hasAnyAuth && options.passthroughCallerToken === true) {
+      const callerToken = getCallerToken(ctx);
+      if (callerToken) {
+        context.jwt = callerToken;
       }
-      context.jwt = authToken;
     }
-    return context;
+    return createSecurityContext(context);
   }
-  if (options.staticAuth) {
+  if (hasStaticAuth(options)) {
     return createSecurityContext(options.staticAuth);
   }
-  return createSecurityContext({
-    jwt: ctx.authInfo?.token
-  });
+  if (options.passthroughCallerToken === true) {
+    return createSecurityContext({ jwt: getCallerToken(ctx) });
+  }
+  return createSecurityContext({});
+}
+function hasStaticAuth(options) {
+  return !!options.staticAuth && Object.keys(options.staticAuth).length > 0;
+}
+function getCallerToken(ctx) {
+  const authToken = ctx.authInfo?.token;
+  if (authToken === void 0 || authToken === null || authToken === "") {
+    return void 0;
+  }
+  if (typeof authToken !== "string") {
+    throw new Error(`authInfo.token must be a string, but got: ${typeof authToken}`);
+  }
+  return authToken;
 }
 function extractSecuritySchemes(tools) {
   const schemes = /* @__PURE__ */ new Set();
@@ -293,12 +309,12 @@ function validateSecurityConfiguration(tools, options) {
     );
     return result;
   }
-  if (options.staticAuth && Object.keys(options.staticAuth).length > 0) {
+  if (hasStaticAuth(options)) {
     result.securityRiskScore = "medium";
     result.warnings.push(
       "SECURITY INFO: Using staticAuth with hardcoded credentials. Ensure credentials are stored securely (environment variables, secrets manager)."
     );
-    return result;
+    return withPassthroughRisk(result, securitySchemes, options);
   }
   const schemesInInput = new Set(options.securitySchemesInInput || []);
   if (options.authProviderMapper || schemesInInput.size > 0) {
@@ -308,13 +324,18 @@ function validateSecurityConfiguration(tools, options) {
         `INFO: Per-scheme security control enabled. Schemes in input: ${Array.from(schemesInInput).join(", ")}`
       );
     }
+    const passthroughFallback = [];
     for (const scheme of securitySchemes) {
       if (schemesInInput.has(scheme)) {
         continue;
       }
       if (!options.authProviderMapper?.[scheme]) {
-        result.valid = false;
-        result.missingMappings.push(scheme);
+        if (options.passthroughCallerToken === true) {
+          passthroughFallback.push(scheme);
+        } else {
+          result.valid = false;
+          result.missingMappings.push(scheme);
+        }
       }
     }
     if (!result.valid) {
@@ -322,19 +343,36 @@ function validateSecurityConfiguration(tools, options) {
         `ERROR: Missing auth provider mappings for security schemes: ${result.missingMappings.join(", ")}`
       );
     }
+    withPassthroughRisk(result, securitySchemes, options);
+    if (passthroughFallback.length > 0) {
+      result.warnings.push(
+        `SECURITY WARNING: Security schemes with no authProviderMapper entry (${passthroughFallback.join(", ")}) get the MCP client's own token, because passthroughCallerToken is enabled.`
+      );
+    }
     return result;
   }
-  if (securitySchemes.size > 0) {
+  if (securitySchemes.size > 0 && options.passthroughCallerToken !== true) {
+    const schemesStr = Array.from(securitySchemes).join(", ");
     result.securityRiskScore = "medium";
     result.warnings.push(
-      `INFO: No auth configuration provided. Using default ctx.authInfo.token for all security schemes: ${Array.from(
-        securitySchemes
-      ).join(", ")}`
-    );
-    result.warnings.push(
-      "RECOMMENDATION: For multiple auth providers, use authProviderMapper or securityResolver to map each security scheme to the correct auth provider."
+      `SECURITY WARNING: No auth configuration provided, so the adapter has no credentials for the API (security schemes: ${schemesStr}). Operations that require authentication will fail. The MCP client's own token is not forwarded: configure authProviderMapper, securityResolver or staticAuth, or set passthroughCallerToken: true if the API is meant to receive the caller's MCP token.`
     );
   }
+  return withPassthroughRisk(result, securitySchemes, options);
+}
+function canPassThroughCallerToken(options) {
+  return options.passthroughCallerToken === true && !options.securityResolver && !hasStaticAuth(options);
+}
+function withPassthroughRisk(result, securitySchemes, options) {
+  if (securitySchemes.size === 0 || !canPassThroughCallerToken(options)) {
+    return result;
+  }
+  const schemesStr = Array.from(securitySchemes).join(", ");
+  const when = options.authProviderMapper ? " whenever no authProviderMapper function returns a credential" : "";
+  result.securityRiskScore = "high";
+  result.warnings.push(
+    `SECURITY WARNING: passthroughCallerToken is enabled. The MCP client's own token (ctx.authInfo.token) is sent to the API${when} for security schemes: ${schemesStr}. Only use this when the API accepts tokens issued for this MCP server.`
+  );
   return result;
 }
 async function resolveToolSecurity(tool2, ctx, options) {
@@ -352,9 +390,10 @@ async function resolveToolSecurity(tool2, ctx, options) {
 Required security schemes: ${schemesStr}
 Solutions:
   1. Add authProviderMapper: { '${firstScheme}': (ctx) => ctx.authInfo.user?.token }
-  2. Add securityResolver: (tool, ctx) => ({ jwt: ctx.authInfo.token })
+  2. Add securityResolver: async (tool, ctx) => ({ jwt: await getApiToken(ctx) })
   3. Add staticAuth: { jwt: process.env.API_TOKEN }
-  4. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
+  4. Set passthroughCallerToken: true, only if the API accepts the MCP client's own token
+  5. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
     );
   }
   return await securityResolver.resolve(tool2.mapper, securityContext);
@@ -1155,7 +1194,7 @@ Add one of the following to your adapter configuration:
    }
 
 2. securityResolver:
-   securityResolver: (tool, authInfo) => ({ jwt: authInfo.token })
+   securityResolver: async (tool, ctx) => ({ jwt: await getApiToken(ctx) })
 
 3. staticAuth:
    staticAuth: { jwt: process.env.API_TOKEN }

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.8.2",
-    "@frontmcp/di": "1.8.2",
-    "@frontmcp/sdk": "1.8.2",
-    "@frontmcp/utils": "1.8.2",
+    "@frontmcp/auth": "1.8.3",
+    "@frontmcp/di": "1.8.3",
+    "@frontmcp/sdk": "1.8.3",
+    "@frontmcp/utils": "1.8.3",
     "js-yaml": "^4.1.0",
     "mcp-from-openapi": "2.8.0",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.2"
+    "@frontmcp/lazy-zod": "1.8.3"
   }
 }

package/esm/skills/index.mjs

@@ -611,7 +611,13 @@ var npmSourceSchema = z2.object({
   exportName: z2.string().optional(),
   /**
    * Verify GitHub artifact attestation / npm provenance for the package before loading.
-   * Defaults to true. Set false (with warning) only for local development packages.
+   * Defaults to true. Provenance verification is not implemented yet, so `true` refuses
+   * to load the package; set `false` to load it without a provenance check.
+   *
+   * With `false`, the package is imported (its code runs) before the bundle is parsed, so
+   * bundle signing (`requireSignature` + `trustedKeys`) cannot protect the import itself.
+   * Only use it for a package you trust: pin its exact version in `package.json` and
+   * install from a lockfile with integrity hashes.
    */
   verifyProvenance: z2.boolean().default(true)
 });
@@ -619,11 +625,15 @@ var saasSourceSchema = z2.object({
   type: z2.literal("saas"),
   /** SaaS pull endpoint, e.g. `https://cloud.frontmcp.dev/v1/bundles/<bundleId>`. */
   endpoint: httpsUrl,
-  /** Pinned JWT issued by the SaaS for the customer's FrontMCP server. */
+  /**
+   * Pinned JWT issued by the SaaS for the customer's FrontMCP server. Verified
+   * before every pull: signed by a key in `jwksUrl`, `iss` = `expectedIssuer`,
+   * `aud` includes `expectedAudience`, not expired. A rejected token stops the pull.
+   */
   authToken: z2.string().min(1),
   /**
-   * RFC 8707 resource indicator the JWT must encode. The plugin verifies
-   * `resource` AND `aud` claims match this on every push/pull.
+   * RFC 8707 resource indicator the JWT must encode: its `aud` claim must include
+   * this value (and its `resource` claim too, when it has one).
    */
   expectedAudience: z2.string().min(1),
   /** Polling interval in ms (boot pull is always immediate). Default 300000 (5 min). */
@@ -633,9 +643,9 @@ var saasSourceSchema = z2.object({
    * updates synchronously. Default false in v1.2 (interval polling only).
    */
   enableWebhook: z2.boolean().default(false),
-  /** JWKS URL for verifying SaaS-issued tokens. */
+  /** JWKS URL for verifying SaaS-issued tokens (fetched without credentials, redirects refused). */
   jwksUrl: httpsUrl,
-  /** Expected issuer (`iss`) claim. */
+  /** Expected issuer (`iss`) claim of `authToken`. */
   expectedIssuer: z2.string().min(1)
 });
 var inlineSourceSchema = z2.object({
@@ -733,8 +743,8 @@ var NpmSource = class {
   }
   async loadBundleFromPackage() {
     if (this.options.verifyProvenance) {
-      this.logger.warn(
-        `[npm-source] verifyProvenance=true requested but provenance verification is not yet implemented in OSS (planned v1.2.x). Loading "${this.options.packageName}" without provenance check.`
+      throw new Error(
+        `npm source "${this.options.packageName}": verifyProvenance is true, but npm provenance verification is not implemented, so the package was not loaded. Set verifyProvenance: false to load it without a provenance check, only for a package you trust: importing it runs its code before any bundle signature is checked, so pin its exact version and install it from a lockfile with integrity hashes.`
       );
     }
     const mod = await this.dynamicImport(this.options.packageName);
@@ -769,9 +779,33 @@ var NpmSource = class {
 };
 
 // libs/adapters/src/skills/sources/saas-pull.source.ts
+import { JwksService } from "@frontmcp/auth";
 import { dirname, ensureDir, isRedirectResponse, pathResolve, readFile, writeFile } from "@frontmcp/utils";
 var DEFAULT_CACHE_DIR = ".frontmcp/skilled-openapi";
 var DEFAULT_PULL_TIMEOUT_MS = 3e4;
+var USER_AGENT = "frontmcp-skilled-openapi";
+var SaasPullTokenRejectedError = class extends Error {
+  constructor(reason) {
+    super(`[saas-source] pull token rejected: ${reason}`);
+    this.name = "SaasPullTokenRejectedError";
+  }
+};
+function claimValues(claim) {
+  if (Array.isArray(claim)) return claim;
+  return claim === void 0 ? [] : [claim];
+}
+var PUBLIC_KEY_MEMBERS = /* @__PURE__ */ new Map([
+  ["RSA", ["n", "e"]],
+  ["EC", ["crv", "x", "y"]],
+  ["OKP", ["crv", "x"]]
+]);
+function isUsableSigningKey(key) {
+  if (typeof key !== "object" || key === null) return false;
+  const jwk = key;
+  const members = typeof jwk["kty"] === "string" ? PUBLIC_KEY_MEMBERS.get(jwk["kty"]) : void 0;
+  if (!members || jwk["use"] !== void 0 && jwk["use"] !== "sig") return false;
+  return members.every((m) => typeof jwk[m] === "string" && jwk[m] !== "");
+}
 var SaasPullSource = class {
   constructor(options, cacheDir, logger, deps = {}) {
     this.options = options;
@@ -789,6 +823,7 @@ var SaasPullSource = class {
   pollHandle;
   inFlight = false;
   stopped = false;
+  jwksService = new JwksService({});
   async start() {
     if (this.stopped || this.inFlight) {
       this.schedulePoll();
@@ -801,6 +836,7 @@ var SaasPullSource = class {
         bundle = await this.fetchOnce();
         await this.persistCache(bundle);
       } catch (e) {
+        if (e instanceof SaasPullTokenRejectedError) throw e;
         this.logger.warn(
           `[saas-source] initial pull failed (${e.message}); attempting cached bundle fallback`
         );
@@ -872,7 +908,11 @@ var SaasPullSource = class {
       await this.persistCache(bundle);
       this.notify(bundle);
     } catch (e) {
-      this.logger.warn(`[saas-source] poll failed: ${e.message}`);
+      if (e instanceof SaasPullTokenRejectedError) {
+        this.logger.error(`[saas-source] poll refused: ${e.message}; keeping the current bundle`);
+      } else {
+        this.logger.warn(`[saas-source] poll failed: ${e.message}`);
+      }
     } finally {
       this.inFlight = false;
       this.schedulePoll();
@@ -893,11 +933,53 @@ var SaasPullSource = class {
       clearTimeout(timer);
     }
   }
+  /**
+   * Verify the pinned pull token against the issuer's JWKS, issuer and audience.
+   * Throws {@link SaasPullTokenRejectedError} when the token is refused, and a
+   * plain Error when the JWKS can't be fetched (an outage).
+   */
+  async verifyPullToken() {
+    const { jwksUrl, expectedIssuer, expectedAudience, authToken } = this.options;
+    const { status, body } = await this.httpGet(jwksUrl, { Accept: "application/json", "User-Agent": USER_AGENT });
+    if (status < 200 || status >= 300) {
+      throw new Error(`JWKS ${jwksUrl} responded ${status}`);
+    }
+    let jwks;
+    try {
+      jwks = JSON.parse(body);
+    } catch {
+      throw new Error(`JWKS ${jwksUrl} is not valid JSON`);
+    }
+    if (!jwks || !Array.isArray(jwks.keys) || jwks.keys.length === 0) {
+      throw new Error(`JWKS ${jwksUrl} has no keys`);
+    }
+    const signingKeys = jwks.keys.filter(isUsableSigningKey);
+    if (signingKeys.length === 0) {
+      throw new Error(`JWKS ${jwksUrl} has no usable signing keys`);
+    }
+    const verified = await this.jwksService.verifyTransparentToken(authToken, [
+      { id: "skilled-openapi-saas", issuerUrl: expectedIssuer, jwks: { keys: signingKeys } }
+    ]);
+    if (!verified.ok || !verified.payload) {
+      throw new SaasPullTokenRejectedError(
+        `not a valid token from issuer "${expectedIssuer}" signed by a key in ${jwksUrl} (${verified.error ?? "verification failed"})`
+      );
+    }
+    const payload = verified.payload;
+    if (!claimValues(payload["aud"]).includes(expectedAudience)) {
+      throw new SaasPullTokenRejectedError(`its "aud" claim does not include "${expectedAudience}"`);
+    }
+    const resource = claimValues(payload["resource"]);
+    if (resource.length > 0 && !resource.includes(expectedAudience)) {
+      throw new SaasPullTokenRejectedError(`its "resource" claim does not include "${expectedAudience}"`);
+    }
+  }
   async fetchOnce() {
+    await this.verifyPullToken();
     const { status, body } = await this.httpGet(this.options.endpoint, {
       Authorization: `Bearer ${this.options.authToken}`,
       Accept: "application/json, application/yaml",
-      "User-Agent": "frontmcp-skilled-openapi"
+      "User-Agent": USER_AGENT
     });
     if (status < 200 || status >= 300) {
       throw new Error(`pull responded ${status}`);
@@ -1521,13 +1603,13 @@ function verifyBundleSignature(bundle, trustedKeys, telemetry) {
 }
 
 // libs/adapters/src/skills/security/jwt-verifier.ts
-import { JwksService } from "@frontmcp/auth";
+import { JwksService as JwksService2 } from "@frontmcp/auth";
 var DEFAULT_REQUIRED_ROLES = ["frontmcp:cloud:push"];
 var BundlePushJwtVerifier = class {
   constructor(options, logger, jwks) {
     this.options = options;
     this.logger = logger;
-    this.jwks = jwks ?? new JwksService({});
+    this.jwks = jwks ?? new JwksService2({});
     this.providerRef = {
       id: "skilled-openapi-cloud-push",
       issuerUrl: options.expectedIssuer,