@frontmcp/auth 1.0.4 → 1.1.0-beta.1

package/index.js

@@ -237,6 +237,11 @@ __export(index_exports, {
   AuthProvidersNotConfiguredError: () => AuthProvidersNotConfiguredError,
   AuthProvidersRegistry: () => AuthProvidersRegistry,
   AuthProvidersVault: () => AuthProvidersVault,
+  AuthoritiesContextBuilder: () => AuthoritiesContextBuilder,
+  AuthoritiesEngine: () => AuthoritiesEngine,
+  AuthoritiesEvaluatorRegistry: () => AuthoritiesEvaluatorRegistry,
+  AuthoritiesProfileRegistry: () => AuthoritiesProfileRegistry,
+  AuthorityDeniedError: () => AuthorityDeniedError,
   AuthorizationBase: () => AuthorizationBase,
   CDN: () => CDN,
   CimdClientIdMismatchError: () => CimdClientIdMismatchError,
@@ -254,10 +259,12 @@ __export(index_exports, {
   EagerCredentialLoader: () => EagerCredentialLoader,
   ElicitationSecretRequiredError: () => ElicitationSecretRequiredError,
   EncryptedRedisVault: () => EncryptedRedisVault,
-  EncryptedStorageError: () => import_utils17.EncryptedStorageError,
-  EncryptedTypedStorage: () => import_utils17.EncryptedTypedStorage,
+  EncryptedStorageError: () => import_utils16.EncryptedStorageError,
+  EncryptedTypedStorage: () => import_utils16.EncryptedTypedStorage,
   EncryptionContextNotSetError: () => EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError: () => EncryptionKeyNotConfiguredError,
+  FetchCredentialMiddleware: () => FetchCredentialMiddleware,
+  FrontMcpAuthContextImpl: () => FrontMcpAuthContextImpl,
   InMemoryAuthorizationStore: () => InMemoryAuthorizationStore,
   InMemoryAuthorizationVault: () => InMemoryAuthorizationVault,
   InMemoryCimdCache: () => InMemoryCimdCache,
@@ -291,11 +298,14 @@ __export(index_exports, {
   TokenVault: () => TokenVault,
   TransparentAuthorization: () => TransparentAuthorization,
   TransportIdGenerator: () => TransportIdGenerator,
-  TypedStorage: () => import_utils16.TypedStorage,
+  TypedStorage: () => import_utils15.TypedStorage,
   VaultEncryption: () => VaultEncryption,
   VaultLoadError: () => VaultLoadError,
   VaultNotFoundError: () => VaultNotFoundError,
   VercelKvSessionStore: () => VercelKvSessionStore,
+  abacConditionSchema: () => abacConditionSchema,
+  abacOperatorSchema: () => abacOperatorSchema,
+  abacPolicySchema: () => abacPolicySchema,
   aiPlatformTypeSchema: () => aiPlatformTypeSchema,
   allowsPublicAccess: () => allowsPublicAccess,
   apiKeyCredentialSchema: () => apiKeyCredentialSchema,
@@ -311,13 +321,20 @@ __export(index_exports, {
   authProviderMappingSchema: () => authProviderMappingSchema,
   authProvidersVaultOptionsSchema: () => authProvidersVaultOptionsSchema,
   authUserSchema: () => authUserSchema,
+  authoritiesClaimsMappingSchema: () => authoritiesClaimsMappingSchema,
+  authoritiesConfigSchema: () => authoritiesConfigSchema,
+  authoritiesMetadataSchema: () => authoritiesMetadataSchema,
+  authoritiesPolicySchema: () => authoritiesPolicySchema,
   authorizationCodeRecordSchema: () => authorizationCodeRecordSchema,
   authorizationVaultEntrySchema: () => authorizationVaultEntrySchema,
   authorizedPromptSchema: () => authorizedPromptSchema,
   authorizedToolSchema: () => authorizedToolSchema,
   baseLayout: () => baseLayout,
+  basicApplier: () => basicApplier,
   basicAuthCredentialSchema: () => basicAuthCredentialSchema,
+  bearerApplier: () => bearerApplier,
   bearerCredentialSchema: () => bearerCredentialSchema,
+  buildAuthContext: () => buildAuthContext,
   buildConsentPage: () => buildConsentPage,
   buildErrorPage: () => buildErrorPage,
   buildFederatedLoginPage: () => buildFederatedLoginPage,
@@ -352,9 +369,9 @@ __export(index_exports, {
   credentialTypeSchema: () => credentialTypeSchema,
   customCredentialSchema: () => customCredentialSchema,
   decodeJwtPayloadSafe: () => decodeJwtPayloadSafe,
-  decryptAesGcm: () => import_utils25.decryptAesGcm,
+  decryptAesGcm: () => import_utils23.decryptAesGcm,
   decryptSessionJson: () => decryptSessionJson,
-  decryptValue: () => import_utils25.decryptValue,
+  decryptValue: () => import_utils23.decryptValue,
   defaultSessionRateLimiter: () => defaultSessionRateLimiter,
   deriveAuthorizationId: () => deriveAuthorizationId,
   deriveExpectedAudience: () => deriveExpectedAudience,
@@ -362,9 +379,9 @@ __export(index_exports, {
   deriveTypedUser: () => deriveTypedUser,
   detectAuthProviders: () => detectAuthProviders,
   detectedAuthProviderSchema: () => detectedAuthProviderSchema,
-  encryptAesGcm: () => import_utils25.encryptAesGcm,
+  encryptAesGcm: () => import_utils23.encryptAesGcm,
   encryptJson: () => encryptJson,
-  encryptValue: () => import_utils25.encryptValue,
+  encryptValue: () => import_utils23.encryptValue,
   encryptedBlobSchema: () => encryptedBlobSchema,
   encryptedDataSchema: () => encryptedDataSchema,
   encryptedVaultEntrySchema: () => encryptedVaultEntrySchema,
@@ -382,15 +399,16 @@ __export(index_exports, {
   generatePkceChallenge: () => generatePkceChallenge,
   getCredentialOptionsSchema: () => getCredentialOptionsSchema,
   getKey: () => getKey,
-  getMachineId: () => getMachineId,
   getNextProvider: () => getNextProvider,
   getProviderApps: () => getProviderApps,
   getProviderScopes: () => getProviderScopes,
   getTokenSignatureFingerprint: () => getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris: () => hasOnlyLocalhostRedirectUris,
-  hkdfSha256: () => import_utils25.hkdfSha256,
+  headerApplier: () => headerApplier,
+  hkdfSha256: () => import_utils23.hkdfSha256,
   incrementalAuthConfigSchema: () => incrementalAuthConfigSchema,
   isCimdClientId: () => isCimdClientId,
+  isFrontMcpCredentials: () => isFrontMcpCredentials,
   isJwt: () => isJwt,
   isLocalMode: () => isLocalMode,
   isOrchestratedLocal: () => isOrchestratedLocal,
@@ -428,17 +446,22 @@ __export(index_exports, {
   providerConfigSchema: () => providerConfigSchema,
   publicAccessConfigSchema: () => publicAccessConfigSchema,
   publicAuthOptionsSchema: () => publicAuthOptionsSchema,
+  queryApplier: () => queryApplier,
+  rbacPermissionsPolicySchema: () => rbacPermissionsPolicySchema,
+  rbacRolesPolicySchema: () => rbacRolesPolicySchema,
+  rebacPolicySchema: () => rebacPolicySchema,
   redisConfigSchema: () => redisConfigSchema,
   redisVaultEntrySchema: () => redisVaultEntrySchema,
   remoteAuthSchema: () => remoteAuthSchema,
   remoteProviderConfigSchema: () => remoteProviderConfigSchema,
   renderToHtml: () => renderToHtml,
   resetCachedKey: () => resetCachedKey,
+  resolveRequiredScopes: () => resolveRequiredScopes,
+  resourceIdRefSchema: () => resourceIdRefSchema,
   safeDecrypt: () => safeDecrypt,
   serviceAccountCredentialSchema: () => serviceAccountCredentialSchema,
   sessionIdPayloadSchema: () => sessionIdPayloadSchema,
   sessionJwtPayloadSchema: () => sessionJwtPayloadSchema,
-  setMachineIdOverride: () => setMachineIdOverride,
   signSession: () => signSession,
   skippedAppBehaviorSchema: () => skippedAppBehaviorSchema,
   sseTransportStateSchema: () => sseTransportStateSchema,
@@ -1401,33 +1424,33 @@ function renderToHtml(html, _options) {
 }
 
 // libs/auth/src/session/authorization.store.ts
+var import_lazy_zod = require("@frontmcp/lazy-zod");
 var import_utils4 = require("@frontmcp/utils");
-var import_zod = require("zod");
-var pkceChallengeSchema = import_zod.z.object({
-  challenge: import_zod.z.string().min(43).max(128),
-  method: import_zod.z.literal("S256")
+var pkceChallengeSchema = import_lazy_zod.z.object({
+  challenge: import_lazy_zod.z.string().min(43).max(128),
+  method: import_lazy_zod.z.literal("S256")
 });
-var authorizationCodeRecordSchema = import_zod.z.object({
-  code: import_zod.z.string().min(1),
-  clientId: import_zod.z.string().min(1),
-  redirectUri: import_zod.z.string().url(),
-  scopes: import_zod.z.array(import_zod.z.string()),
+var authorizationCodeRecordSchema = import_lazy_zod.z.object({
+  code: import_lazy_zod.z.string().min(1),
+  clientId: import_lazy_zod.z.string().min(1),
+  redirectUri: import_lazy_zod.z.string().url(),
+  scopes: import_lazy_zod.z.array(import_lazy_zod.z.string()),
   pkce: pkceChallengeSchema,
-  userSub: import_zod.z.string().min(1),
-  userEmail: import_zod.z.string().email().optional(),
-  userName: import_zod.z.string().optional(),
-  state: import_zod.z.string().optional(),
-  createdAt: import_zod.z.number(),
-  expiresAt: import_zod.z.number(),
-  used: import_zod.z.boolean(),
-  resource: import_zod.z.string().url().optional(),
+  userSub: import_lazy_zod.z.string().min(1),
+  userEmail: import_lazy_zod.z.string().email().optional(),
+  userName: import_lazy_zod.z.string().optional(),
+  state: import_lazy_zod.z.string().optional(),
+  createdAt: import_lazy_zod.z.number(),
+  expiresAt: import_lazy_zod.z.number(),
+  used: import_lazy_zod.z.boolean(),
+  resource: import_lazy_zod.z.string().url().optional(),
   // Consent and federated login fields
-  selectedToolIds: import_zod.z.array(import_zod.z.string()).optional(),
-  selectedProviderIds: import_zod.z.array(import_zod.z.string()).optional(),
-  skippedProviderIds: import_zod.z.array(import_zod.z.string()).optional(),
-  consentEnabled: import_zod.z.boolean().optional(),
-  federatedLoginUsed: import_zod.z.boolean().optional(),
-  pendingAuthId: import_zod.z.string().optional()
+  selectedToolIds: import_lazy_zod.z.array(import_lazy_zod.z.string()).optional(),
+  selectedProviderIds: import_lazy_zod.z.array(import_lazy_zod.z.string()).optional(),
+  skippedProviderIds: import_lazy_zod.z.array(import_lazy_zod.z.string()).optional(),
+  consentEnabled: import_lazy_zod.z.boolean().optional(),
+  federatedLoginUsed: import_lazy_zod.z.boolean().optional(),
+  pendingAuthId: import_lazy_zod.z.string().optional()
 });
 function verifyPkce(codeVerifier, challenge) {
   if (challenge.method !== "S256") {
@@ -1680,8 +1703,8 @@ var RedisAuthorizationStore = class {
 };
 
 // libs/auth/src/session/authorization-vault.ts
-var import_zod2 = require("zod");
-var credentialTypeSchema = import_zod2.z.enum([
+var import_lazy_zod2 = require("@frontmcp/lazy-zod");
+var credentialTypeSchema = import_lazy_zod2.z.enum([
   "oauth",
   // OAuth 2.0 tokens
   "api_key",
@@ -1703,135 +1726,135 @@ var credentialTypeSchema = import_zod2.z.enum([
   "oauth_pkce"
   // OAuth 2.0 with PKCE for public clients
 ]);
-var oauthCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("oauth"),
+var oauthCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("oauth"),
   /** Access token */
-  accessToken: import_zod2.z.string(),
+  accessToken: import_lazy_zod2.z.string(),
   /** Refresh token (optional) */
-  refreshToken: import_zod2.z.string().optional(),
+  refreshToken: import_lazy_zod2.z.string().optional(),
   /** Token type (usually 'Bearer') */
-  tokenType: import_zod2.z.string().default("Bearer"),
+  tokenType: import_lazy_zod2.z.string().default("Bearer"),
   /** Token expiration timestamp (epoch ms) */
-  expiresAt: import_zod2.z.number().optional(),
+  expiresAt: import_lazy_zod2.z.number().optional(),
   /** Granted scopes */
-  scopes: import_zod2.z.array(import_zod2.z.string()).default([]),
+  scopes: import_lazy_zod2.z.array(import_lazy_zod2.z.string()).default([]),
   /** ID token for OIDC (optional) */
-  idToken: import_zod2.z.string().optional()
+  idToken: import_lazy_zod2.z.string().optional()
 });
-var apiKeyCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("api_key"),
+var apiKeyCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("api_key"),
   /** The API key value */
-  key: import_zod2.z.string().min(1),
+  key: import_lazy_zod2.z.string().min(1),
   /** Header name to use (e.g., 'X-API-Key', 'Authorization') */
-  headerName: import_zod2.z.string().default("X-API-Key"),
+  headerName: import_lazy_zod2.z.string().default("X-API-Key"),
   /** Prefix for the header value (e.g., 'Bearer ', 'Api-Key ') */
-  headerPrefix: import_zod2.z.string().optional(),
+  headerPrefix: import_lazy_zod2.z.string().optional(),
   /** Alternative: send as query parameter */
-  queryParam: import_zod2.z.string().optional()
+  queryParam: import_lazy_zod2.z.string().optional()
 });
-var basicAuthCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("basic"),
+var basicAuthCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("basic"),
   /** Username */
-  username: import_zod2.z.string().min(1),
+  username: import_lazy_zod2.z.string().min(1),
   /** Password */
-  password: import_zod2.z.string(),
+  password: import_lazy_zod2.z.string(),
   /** Pre-computed base64 encoded value (optional, for caching) */
-  encodedValue: import_zod2.z.string().optional()
+  encodedValue: import_lazy_zod2.z.string().optional()
 });
-var bearerCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("bearer"),
+var bearerCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("bearer"),
   /** The bearer token value */
-  token: import_zod2.z.string().min(1),
+  token: import_lazy_zod2.z.string().min(1),
   /** Token expiration (optional, for static tokens that expire) */
-  expiresAt: import_zod2.z.number().optional()
+  expiresAt: import_lazy_zod2.z.number().optional()
 });
-var privateKeyCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("private_key"),
+var privateKeyCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("private_key"),
   /** Key format */
-  format: import_zod2.z.enum(["pem", "jwk", "pkcs8", "pkcs12"]),
+  format: import_lazy_zod2.z.enum(["pem", "jwk", "pkcs8", "pkcs12"]),
   /** The key data (PEM string or JWK JSON) */
-  keyData: import_zod2.z.string(),
+  keyData: import_lazy_zod2.z.string(),
   /** Key ID (for JWK) */
-  keyId: import_zod2.z.string().optional(),
+  keyId: import_lazy_zod2.z.string().optional(),
   /** Algorithm to use for signing */
-  algorithm: import_zod2.z.string().optional(),
+  algorithm: import_lazy_zod2.z.string().optional(),
   /** Passphrase if key is encrypted */
-  passphrase: import_zod2.z.string().optional(),
+  passphrase: import_lazy_zod2.z.string().optional(),
   /** Associated certificate (for mTLS) */
-  certificate: import_zod2.z.string().optional()
+  certificate: import_lazy_zod2.z.string().optional()
 });
-var mtlsCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("mtls"),
+var mtlsCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("mtls"),
   /** Client certificate (PEM format) */
-  certificate: import_zod2.z.string(),
+  certificate: import_lazy_zod2.z.string(),
   /** Private key (PEM format) */
-  privateKey: import_zod2.z.string(),
+  privateKey: import_lazy_zod2.z.string(),
   /** Passphrase if private key is encrypted */
-  passphrase: import_zod2.z.string().optional(),
+  passphrase: import_lazy_zod2.z.string().optional(),
   /** CA certificate chain (optional) */
-  caCertificate: import_zod2.z.string().optional()
+  caCertificate: import_lazy_zod2.z.string().optional()
 });
-var customCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("custom"),
+var customCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("custom"),
   /** Custom type identifier */
-  customType: import_zod2.z.string().min(1),
+  customType: import_lazy_zod2.z.string().min(1),
   /** Arbitrary credential data */
-  data: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
+  data: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.unknown()),
   /** Headers to include in requests */
-  headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).optional()
+  headers: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.string()).optional()
 });
-var sshKeyCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("ssh_key"),
+var sshKeyCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("ssh_key"),
   /** Private key (PEM format) */
-  privateKey: import_zod2.z.string().min(1),
+  privateKey: import_lazy_zod2.z.string().min(1),
   /** Public key (optional, can be derived from private key) */
-  publicKey: import_zod2.z.string().optional(),
+  publicKey: import_lazy_zod2.z.string().optional(),
   /** Passphrase if private key is encrypted */
-  passphrase: import_zod2.z.string().optional(),
+  passphrase: import_lazy_zod2.z.string().optional(),
   /** Key type */
-  keyType: import_zod2.z.enum(["rsa", "ed25519", "ecdsa", "dsa"]).default("ed25519"),
+  keyType: import_lazy_zod2.z.enum(["rsa", "ed25519", "ecdsa", "dsa"]).default("ed25519"),
   /** Key fingerprint (SHA256 hash) */
-  fingerprint: import_zod2.z.string().optional(),
+  fingerprint: import_lazy_zod2.z.string().optional(),
   /** Username for SSH connections */
-  username: import_zod2.z.string().optional()
+  username: import_lazy_zod2.z.string().optional()
 });
-var serviceAccountCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("service_account"),
+var serviceAccountCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("service_account"),
   /** Cloud provider */
-  provider: import_zod2.z.enum(["gcp", "aws", "azure", "custom"]),
+  provider: import_lazy_zod2.z.enum(["gcp", "aws", "azure", "custom"]),
   /** Raw credentials (JSON key file content, access keys, etc.) */
-  credentials: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
+  credentials: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.unknown()),
   /** Project/Account ID */
-  projectId: import_zod2.z.string().optional(),
+  projectId: import_lazy_zod2.z.string().optional(),
   /** Region for regional services */
-  region: import_zod2.z.string().optional(),
+  region: import_lazy_zod2.z.string().optional(),
   /** AWS: Role ARN to assume */
-  assumeRoleArn: import_zod2.z.string().optional(),
+  assumeRoleArn: import_lazy_zod2.z.string().optional(),
   /** AWS: External ID for cross-account access */
-  externalId: import_zod2.z.string().optional(),
+  externalId: import_lazy_zod2.z.string().optional(),
   /** Service account email (GCP) or ARN (AWS) */
-  serviceAccountId: import_zod2.z.string().optional(),
+  serviceAccountId: import_lazy_zod2.z.string().optional(),
   /** Expiration timestamp for temporary credentials */
-  expiresAt: import_zod2.z.number().optional()
+  expiresAt: import_lazy_zod2.z.number().optional()
 });
-var pkceOAuthCredentialSchema = import_zod2.z.object({
-  type: import_zod2.z.literal("oauth_pkce"),
+var pkceOAuthCredentialSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("oauth_pkce"),
   /** Access token */
-  accessToken: import_zod2.z.string(),
+  accessToken: import_lazy_zod2.z.string(),
   /** Refresh token (optional) */
-  refreshToken: import_zod2.z.string().optional(),
+  refreshToken: import_lazy_zod2.z.string().optional(),
   /** Token type (usually 'Bearer') */
-  tokenType: import_zod2.z.string().default("Bearer"),
+  tokenType: import_lazy_zod2.z.string().default("Bearer"),
   /** Token expiration timestamp (epoch ms) */
-  expiresAt: import_zod2.z.number().optional(),
+  expiresAt: import_lazy_zod2.z.number().optional(),
   /** Granted scopes */
-  scopes: import_zod2.z.array(import_zod2.z.string()).default([]),
+  scopes: import_lazy_zod2.z.array(import_lazy_zod2.z.string()).default([]),
   /** ID token for OIDC (optional) */
-  idToken: import_zod2.z.string().optional(),
+  idToken: import_lazy_zod2.z.string().optional(),
   /** Authorization server issuer */
-  issuer: import_zod2.z.string().optional()
+  issuer: import_lazy_zod2.z.string().optional()
 });
-var credentialSchema = import_zod2.z.discriminatedUnion("type", [
+var credentialSchema = import_lazy_zod2.z.discriminatedUnion("type", [
   oauthCredentialSchema,
   apiKeyCredentialSchema,
   basicAuthCredentialSchema,
@@ -1843,117 +1866,117 @@ var credentialSchema = import_zod2.z.discriminatedUnion("type", [
   serviceAccountCredentialSchema,
   pkceOAuthCredentialSchema
 ]);
-var appCredentialSchema = import_zod2.z.object({
+var appCredentialSchema = import_lazy_zod2.z.object({
   /** App ID this credential belongs to */
-  appId: import_zod2.z.string().min(1),
+  appId: import_lazy_zod2.z.string().min(1),
   /** Provider ID within the app (for apps with multiple auth providers) */
-  providerId: import_zod2.z.string().min(1),
+  providerId: import_lazy_zod2.z.string().min(1),
   /** The credential data */
   credential: credentialSchema,
   /** Timestamp when credential was acquired */
-  acquiredAt: import_zod2.z.number(),
+  acquiredAt: import_lazy_zod2.z.number(),
   /** Timestamp when credential was last used */
-  lastUsedAt: import_zod2.z.number().optional(),
+  lastUsedAt: import_lazy_zod2.z.number().optional(),
   /** Credential expiration (if applicable) */
-  expiresAt: import_zod2.z.number().optional(),
+  expiresAt: import_lazy_zod2.z.number().optional(),
   /** Whether this credential is currently valid */
-  isValid: import_zod2.z.boolean().default(true),
+  isValid: import_lazy_zod2.z.boolean().default(true),
   /** Error message if credential is invalid */
-  invalidReason: import_zod2.z.string().optional(),
+  invalidReason: import_lazy_zod2.z.string().optional(),
   /** User info associated with this credential */
-  userInfo: import_zod2.z.object({
-    sub: import_zod2.z.string().optional(),
-    email: import_zod2.z.string().optional(),
-    name: import_zod2.z.string().optional()
+  userInfo: import_lazy_zod2.z.object({
+    sub: import_lazy_zod2.z.string().optional(),
+    email: import_lazy_zod2.z.string().optional(),
+    name: import_lazy_zod2.z.string().optional()
   }).optional(),
   /** Metadata for tracking/debugging */
-  metadata: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional()
+  metadata: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.unknown()).optional()
 });
-var vaultConsentRecordSchema = import_zod2.z.object({
+var vaultConsentRecordSchema = import_lazy_zod2.z.object({
   /** Whether consent was enabled */
-  enabled: import_zod2.z.boolean(),
+  enabled: import_lazy_zod2.z.boolean(),
   /** Selected tool IDs (user approved these) */
-  selectedToolIds: import_zod2.z.array(import_zod2.z.string()),
+  selectedToolIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string()),
   /** Available tool IDs at time of consent */
-  availableToolIds: import_zod2.z.array(import_zod2.z.string()),
+  availableToolIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string()),
   /** Timestamp when consent was given */
-  consentedAt: import_zod2.z.number(),
+  consentedAt: import_lazy_zod2.z.number(),
   /** Consent version for tracking changes */
-  version: import_zod2.z.string().default("1.0")
+  version: import_lazy_zod2.z.string().default("1.0")
 });
-var vaultFederatedRecordSchema = import_zod2.z.object({
+var vaultFederatedRecordSchema = import_lazy_zod2.z.object({
   /** Provider IDs that were selected */
-  selectedProviderIds: import_zod2.z.array(import_zod2.z.string()),
+  selectedProviderIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string()),
   /** Provider IDs that were skipped (can be authorized later) */
-  skippedProviderIds: import_zod2.z.array(import_zod2.z.string()),
+  skippedProviderIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string()),
   /** Primary provider ID */
-  primaryProviderId: import_zod2.z.string().optional(),
+  primaryProviderId: import_lazy_zod2.z.string().optional(),
   /** Timestamp when federated login was completed */
-  completedAt: import_zod2.z.number()
+  completedAt: import_lazy_zod2.z.number()
 });
-var pendingIncrementalAuthSchema = import_zod2.z.object({
+var pendingIncrementalAuthSchema = import_lazy_zod2.z.object({
   /** Unique ID for this request */
-  id: import_zod2.z.string(),
+  id: import_lazy_zod2.z.string(),
   /** App ID being authorized */
-  appId: import_zod2.z.string(),
+  appId: import_lazy_zod2.z.string(),
   /** Tool ID that triggered the auth request */
-  toolId: import_zod2.z.string().optional(),
+  toolId: import_lazy_zod2.z.string().optional(),
   /** Authorization URL */
-  authUrl: import_zod2.z.string(),
+  authUrl: import_lazy_zod2.z.string(),
   /** Required scopes */
-  requiredScopes: import_zod2.z.array(import_zod2.z.string()).optional(),
+  requiredScopes: import_lazy_zod2.z.array(import_lazy_zod2.z.string()).optional(),
   /** Whether elicit is being used */
-  elicitId: import_zod2.z.string().optional(),
+  elicitId: import_lazy_zod2.z.string().optional(),
   /** Timestamp when request was created */
-  createdAt: import_zod2.z.number(),
+  createdAt: import_lazy_zod2.z.number(),
   /** Expiration timestamp */
-  expiresAt: import_zod2.z.number(),
+  expiresAt: import_lazy_zod2.z.number(),
   /** Status of the request */
-  status: import_zod2.z.enum(["pending", "completed", "cancelled", "expired"])
+  status: import_lazy_zod2.z.enum(["pending", "completed", "cancelled", "expired"])
 });
-var authorizationVaultEntrySchema = import_zod2.z.object({
+var authorizationVaultEntrySchema = import_lazy_zod2.z.object({
   /** Vault ID (maps to access token jti claim) */
-  id: import_zod2.z.string(),
+  id: import_lazy_zod2.z.string(),
   /** User subject identifier */
-  userSub: import_zod2.z.string(),
+  userSub: import_lazy_zod2.z.string(),
   /** User email */
-  userEmail: import_zod2.z.string().optional(),
+  userEmail: import_lazy_zod2.z.string().optional(),
   /** User name */
-  userName: import_zod2.z.string().optional(),
+  userName: import_lazy_zod2.z.string().optional(),
   /** Client ID that created this session */
-  clientId: import_zod2.z.string(),
+  clientId: import_lazy_zod2.z.string(),
   /** Creation timestamp */
-  createdAt: import_zod2.z.number(),
+  createdAt: import_lazy_zod2.z.number(),
   /** Last access timestamp */
-  lastAccessAt: import_zod2.z.number(),
+  lastAccessAt: import_lazy_zod2.z.number(),
   /** App credentials (keyed by `${appId}:${providerId}`) */
-  appCredentials: import_zod2.z.record(import_zod2.z.string(), appCredentialSchema).default({}),
+  appCredentials: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), appCredentialSchema).default({}),
   /** Consent record */
   consent: vaultConsentRecordSchema.optional(),
   /** Federated login record */
   federated: vaultFederatedRecordSchema.optional(),
   /** Pending incremental authorization requests */
-  pendingAuths: import_zod2.z.array(pendingIncrementalAuthSchema),
+  pendingAuths: import_lazy_zod2.z.array(pendingIncrementalAuthSchema),
   /** Apps that are fully authorized */
-  authorizedAppIds: import_zod2.z.array(import_zod2.z.string()),
+  authorizedAppIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string()),
   /** Apps that were skipped (not yet authorized) */
-  skippedAppIds: import_zod2.z.array(import_zod2.z.string())
+  skippedAppIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string())
 });
 
 // libs/auth/src/session/vault-encryption.ts
-var import_zod3 = require("zod");
+var import_lazy_zod3 = require("@frontmcp/lazy-zod");
 var import_utils5 = require("@frontmcp/utils");
-var encryptedDataSchema = import_zod3.z.object({
+var encryptedDataSchema = import_lazy_zod3.z.object({
   /** Version for future algorithm changes */
-  v: import_zod3.z.literal(1),
+  v: import_lazy_zod3.z.literal(1),
   /** Algorithm identifier */
-  alg: import_zod3.z.literal("aes-256-gcm"),
+  alg: import_lazy_zod3.z.literal("aes-256-gcm"),
   /** Initialization vector (base64) */
-  iv: import_zod3.z.string(),
+  iv: import_lazy_zod3.z.string(),
   /** Ciphertext (base64) */
-  ct: import_zod3.z.string(),
+  ct: import_lazy_zod3.z.string(),
   /** Authentication tag (base64) */
-  tag: import_zod3.z.string()
+  tag: import_lazy_zod3.z.string()
 });
 var VaultEncryption = class {
   pepper;
@@ -2091,29 +2114,29 @@ var VaultEncryption = class {
     return encryptedDataSchema.safeParse(data).success;
   }
 };
-var encryptedVaultEntrySchema = import_zod3.z.object({
+var encryptedVaultEntrySchema = import_lazy_zod3.z.object({
   /** Vault ID (maps to JWT jti claim) */
-  id: import_zod3.z.string(),
+  id: import_lazy_zod3.z.string(),
   /** User subject identifier */
-  userSub: import_zod3.z.string(),
+  userSub: import_lazy_zod3.z.string(),
   /** User email (unencrypted for display) */
-  userEmail: import_zod3.z.string().optional(),
+  userEmail: import_lazy_zod3.z.string().optional(),
   /** User name (unencrypted for display) */
-  userName: import_zod3.z.string().optional(),
+  userName: import_lazy_zod3.z.string().optional(),
   /** Client ID that created this session */
-  clientId: import_zod3.z.string(),
+  clientId: import_lazy_zod3.z.string(),
   /** Creation timestamp */
-  createdAt: import_zod3.z.number(),
+  createdAt: import_lazy_zod3.z.number(),
   /** Last access timestamp */
-  lastAccessAt: import_zod3.z.number(),
+  lastAccessAt: import_lazy_zod3.z.number(),
   /** Encrypted sensitive data (provider tokens, credentials, consent) */
   encryptedData: encryptedDataSchema,
   /** Apps that are fully authorized (unencrypted for quick lookup) */
-  authorizedAppIds: import_zod3.z.array(import_zod3.z.string()),
+  authorizedAppIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()),
   /** Apps that were skipped (unencrypted for quick lookup) */
-  skippedAppIds: import_zod3.z.array(import_zod3.z.string()),
+  skippedAppIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()),
   /** Pending auth IDs (unencrypted for lookup, actual URLs encrypted) */
-  pendingAuthIds: import_zod3.z.array(import_zod3.z.string()).default([])
+  pendingAuthIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).default([])
 });
 
 // libs/auth/src/session/token.vault.ts
@@ -2176,98 +2199,98 @@ var TokenVault = class {
 };
 
 // libs/auth/src/session/index.ts
-var import_utils25 = require("@frontmcp/utils");
+var import_utils23 = require("@frontmcp/utils");
 
 // libs/auth/src/session/transport-session.types.ts
-var import_zod4 = require("zod");
-var transportProtocolSchema = import_zod4.z.enum([
+var import_lazy_zod4 = require("@frontmcp/lazy-zod");
+var transportProtocolSchema = import_lazy_zod4.z.enum([
   "legacy-sse",
   "sse",
   "streamable-http",
   "stateful-http",
   "stateless-http"
 ]);
-var sseTransportStateSchema = import_zod4.z.object({
-  type: import_zod4.z.literal("sse"),
-  lastEventId: import_zod4.z.string().optional(),
-  lastPing: import_zod4.z.number().optional(),
-  connectionState: import_zod4.z.enum(["connecting", "open", "closed"]).optional()
+var sseTransportStateSchema = import_lazy_zod4.z.object({
+  type: import_lazy_zod4.z.literal("sse"),
+  lastEventId: import_lazy_zod4.z.string().optional(),
+  lastPing: import_lazy_zod4.z.number().optional(),
+  connectionState: import_lazy_zod4.z.enum(["connecting", "open", "closed"]).optional()
 });
-var streamableHttpTransportStateSchema = import_zod4.z.object({
-  type: import_zod4.z.literal("streamable-http"),
-  requestSeq: import_zod4.z.number(),
-  activeStreamId: import_zod4.z.string().optional(),
-  pendingRequests: import_zod4.z.array(import_zod4.z.string()).optional()
+var streamableHttpTransportStateSchema = import_lazy_zod4.z.object({
+  type: import_lazy_zod4.z.literal("streamable-http"),
+  requestSeq: import_lazy_zod4.z.number(),
+  activeStreamId: import_lazy_zod4.z.string().optional(),
+  pendingRequests: import_lazy_zod4.z.array(import_lazy_zod4.z.string()).optional()
 });
-var statefulHttpTransportStateSchema = import_zod4.z.object({
-  type: import_zod4.z.literal("stateful-http"),
-  requestSeq: import_zod4.z.number(),
-  pendingResponses: import_zod4.z.array(import_zod4.z.string()).optional(),
-  lastActivity: import_zod4.z.number().optional()
+var statefulHttpTransportStateSchema = import_lazy_zod4.z.object({
+  type: import_lazy_zod4.z.literal("stateful-http"),
+  requestSeq: import_lazy_zod4.z.number(),
+  pendingResponses: import_lazy_zod4.z.array(import_lazy_zod4.z.string()).optional(),
+  lastActivity: import_lazy_zod4.z.number().optional()
 });
-var statelessHttpTransportStateSchema = import_zod4.z.object({
-  type: import_zod4.z.literal("stateless-http"),
-  requestCount: import_zod4.z.number(),
-  windowStart: import_zod4.z.number().optional()
+var statelessHttpTransportStateSchema = import_lazy_zod4.z.object({
+  type: import_lazy_zod4.z.literal("stateless-http"),
+  requestCount: import_lazy_zod4.z.number(),
+  windowStart: import_lazy_zod4.z.number().optional()
 });
-var legacySseTransportStateSchema = import_zod4.z.object({
-  type: import_zod4.z.literal("legacy-sse"),
-  messagePath: import_zod4.z.string(),
-  lastEventId: import_zod4.z.string().optional(),
-  connectionState: import_zod4.z.enum(["connecting", "open", "closed"]).optional()
+var legacySseTransportStateSchema = import_lazy_zod4.z.object({
+  type: import_lazy_zod4.z.literal("legacy-sse"),
+  messagePath: import_lazy_zod4.z.string(),
+  lastEventId: import_lazy_zod4.z.string().optional(),
+  connectionState: import_lazy_zod4.z.enum(["connecting", "open", "closed"]).optional()
 });
-var transportStateSchema = import_zod4.z.discriminatedUnion("type", [
+var transportStateSchema = import_lazy_zod4.z.discriminatedUnion("type", [
   sseTransportStateSchema,
   streamableHttpTransportStateSchema,
   statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema,
   legacySseTransportStateSchema
 ]);
-var transportSessionSchema = import_zod4.z.object({
-  id: import_zod4.z.string(),
-  authorizationId: import_zod4.z.string(),
+var transportSessionSchema = import_lazy_zod4.z.object({
+  id: import_lazy_zod4.z.string(),
+  authorizationId: import_lazy_zod4.z.string(),
   protocol: transportProtocolSchema,
-  createdAt: import_zod4.z.number(),
-  expiresAt: import_zod4.z.number().optional(),
-  nodeId: import_zod4.z.string(),
-  clientFingerprint: import_zod4.z.string().optional(),
+  createdAt: import_lazy_zod4.z.number(),
+  expiresAt: import_lazy_zod4.z.number().optional(),
+  nodeId: import_lazy_zod4.z.string(),
+  clientFingerprint: import_lazy_zod4.z.string().optional(),
   transportState: transportStateSchema.optional()
 });
-var sessionJwtPayloadSchema = import_zod4.z.object({
-  sid: import_zod4.z.string(),
-  aid: import_zod4.z.string(),
+var sessionJwtPayloadSchema = import_lazy_zod4.z.object({
+  sid: import_lazy_zod4.z.string(),
+  aid: import_lazy_zod4.z.string(),
   proto: transportProtocolSchema,
-  nid: import_zod4.z.string(),
-  iat: import_zod4.z.number(),
-  exp: import_zod4.z.number().optional()
+  nid: import_lazy_zod4.z.string(),
+  iat: import_lazy_zod4.z.number(),
+  exp: import_lazy_zod4.z.number().optional()
 });
-var encryptedBlobSchema = import_zod4.z.object({
-  alg: import_zod4.z.literal("A256GCM"),
-  kid: import_zod4.z.string().optional(),
-  iv: import_zod4.z.string(),
-  tag: import_zod4.z.string(),
-  data: import_zod4.z.string(),
-  exp: import_zod4.z.number().optional(),
-  meta: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional()
+var encryptedBlobSchema = import_lazy_zod4.z.object({
+  alg: import_lazy_zod4.z.literal("A256GCM"),
+  kid: import_lazy_zod4.z.string().optional(),
+  iv: import_lazy_zod4.z.string(),
+  tag: import_lazy_zod4.z.string(),
+  data: import_lazy_zod4.z.string(),
+  exp: import_lazy_zod4.z.number().optional(),
+  meta: import_lazy_zod4.z.record(import_lazy_zod4.z.string(), import_lazy_zod4.z.unknown()).optional()
 });
-var storedSessionSchema = import_zod4.z.object({
+var storedSessionSchema = import_lazy_zod4.z.object({
   session: transportSessionSchema,
-  authorizationId: import_zod4.z.string(),
-  tokens: import_zod4.z.record(import_zod4.z.string(), encryptedBlobSchema).optional(),
-  createdAt: import_zod4.z.number(),
-  lastAccessedAt: import_zod4.z.number(),
-  initialized: import_zod4.z.boolean().optional(),
-  maxLifetimeAt: import_zod4.z.number().optional(),
-  clientCapabilities: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional()
+  authorizationId: import_lazy_zod4.z.string(),
+  tokens: import_lazy_zod4.z.record(import_lazy_zod4.z.string(), encryptedBlobSchema).optional(),
+  createdAt: import_lazy_zod4.z.number(),
+  lastAccessedAt: import_lazy_zod4.z.number(),
+  initialized: import_lazy_zod4.z.boolean().optional(),
+  maxLifetimeAt: import_lazy_zod4.z.number().optional(),
+  clientCapabilities: import_lazy_zod4.z.record(import_lazy_zod4.z.string(), import_lazy_zod4.z.unknown()).optional()
 });
-var redisConfigSchema = import_zod4.z.object({
-  host: import_zod4.z.string().min(1),
-  port: import_zod4.z.number().int().positive().optional().default(6379),
-  password: import_zod4.z.string().optional(),
-  db: import_zod4.z.number().int().nonnegative().optional().default(0),
-  tls: import_zod4.z.boolean().optional().default(false),
-  keyPrefix: import_zod4.z.string().optional().default("mcp:session:"),
-  defaultTtlMs: import_zod4.z.number().int().positive().optional().default(36e5)
+var redisConfigSchema = import_lazy_zod4.z.object({
+  host: import_lazy_zod4.z.string().min(1),
+  port: import_lazy_zod4.z.number().int().positive().optional().default(6379),
+  password: import_lazy_zod4.z.string().optional(),
+  db: import_lazy_zod4.z.number().int().nonnegative().optional().default(0),
+  tls: import_lazy_zod4.z.boolean().optional().default(false),
+  keyPrefix: import_lazy_zod4.z.string().optional().default("mcp:session:"),
+  defaultTtlMs: import_lazy_zod4.z.number().int().positive().optional().default(36e5)
   // 1 hour default
 });
 
@@ -2658,97 +2681,26 @@ function extractBearerToken(header) {
 }
 
 // libs/auth/src/session/utils/session-crypto.utils.ts
-var import_utils12 = require("@frontmcp/utils");
-
-// libs/auth/src/machine-id/machine-id.ts
 var import_utils11 = require("@frontmcp/utils");
-var DEFAULT_MACHINE_ID_PATH = ".frontmcp/machine-id";
-function isDevPersistenceEnabled() {
-  if ((0, import_utils11.isBrowser)()) return false;
-  return !(0, import_utils11.isProduction)();
-}
-function resolveMachineIdPath() {
-  if ((0, import_utils11.isBrowser)()) return DEFAULT_MACHINE_ID_PATH;
-  const path = require("path");
-  const machineIdPath = (0, import_utils11.getEnv)("MACHINE_ID_PATH") ?? DEFAULT_MACHINE_ID_PATH;
-  return path.isAbsolute(machineIdPath) ? machineIdPath : path.resolve((0, import_utils11.getCwd)(), machineIdPath);
-}
-function loadMachineIdSync() {
-  if (!isDevPersistenceEnabled()) {
-    return null;
-  }
-  const machineIdPath = resolveMachineIdPath();
-  try {
-    const content = (0, import_utils11.readFileSync)(machineIdPath, "utf8").trim();
-    if (/^[0-9a-f-]{32,36}$/i.test(content)) {
-      return content;
-    }
-    console.warn(`[MachineId] Invalid format at ${machineIdPath}, will regenerate`);
-    return null;
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      console.warn(`[MachineId] Failed to load from ${machineIdPath}: ${error.message}`);
-    }
-    return null;
-  }
-}
-function saveMachineIdAsync(machineId2) {
-  if (!isDevPersistenceEnabled()) {
-    return;
-  }
-  const machineIdPath = resolveMachineIdPath();
-  const path = require("path");
-  const dir = path.dirname(machineIdPath);
-  (async () => {
-    try {
-      await (0, import_utils11.mkdir)(dir, { recursive: true, mode: 448 });
-      await (0, import_utils11.writeFile)(machineIdPath, machineId2, { mode: 384 });
-    } catch (error) {
-      console.warn(`[MachineId] Failed to save to ${machineIdPath}: ${error.message}`);
-    }
-  })();
-}
-var machineId = (() => {
-  const envMachineId = (0, import_utils11.getEnv)("MACHINE_ID");
-  if (envMachineId) {
-    return envMachineId;
-  }
-  const loadedId = loadMachineIdSync();
-  if (loadedId) {
-    return loadedId;
-  }
-  const newId = (0, import_utils11.randomUUID)();
-  saveMachineIdAsync(newId);
-  return newId;
-})();
-var machineIdOverride;
-function getMachineId() {
-  return machineIdOverride ?? machineId;
-}
-function setMachineIdOverride(id) {
-  machineIdOverride = id;
-}
-
-// libs/auth/src/session/utils/session-crypto.utils.ts
 var cachedKey = null;
 function getKey() {
   if (cachedKey) return cachedKey;
-  const secret = (0, import_utils12.getEnv)("MCP_SESSION_SECRET");
+  const secret = (0, import_utils11.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils12.isProduction)()) {
+    if ((0, import_utils11.isProduction)()) {
       throw new SessionSecretRequiredError("session ID encryption");
     }
     console.warn(
       "[SessionIdUtils] Using machine ID as session encryption secret - NOT SECURE FOR PRODUCTION. Set MCP_SESSION_SECRET environment variable for secure session encryption."
     );
   }
-  const base = secret || getMachineId();
-  cachedKey = (0, import_utils12.sha256)(new TextEncoder().encode(base));
+  const base = secret || (0, import_utils11.getMachineId)();
+  cachedKey = (0, import_utils11.sha256)(new TextEncoder().encode(base));
   return cachedKey;
 }
 function encryptJson(obj) {
   const key = getKey();
-  const encrypted = (0, import_utils12.encryptValue)(obj, key);
+  const encrypted = (0, import_utils11.encryptValue)(obj, key);
   return `${encrypted.iv}.${encrypted.tag}.${encrypted.data}`;
 }
 function decryptSessionJson(sessionId) {
@@ -2757,7 +2709,7 @@ function decryptSessionJson(sessionId) {
   const [ivB64, tagB64, ctB64] = parts;
   if (!ivB64 || !tagB64 || !ctB64) return null;
   const key = getKey();
-  return (0, import_utils12.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
+  return (0, import_utils11.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
 }
 function safeDecrypt(sessionId) {
   try {
@@ -2771,11 +2723,11 @@ function resetCachedKey() {
 }
 
 // libs/auth/src/session/storage/index.ts
+var import_utils15 = require("@frontmcp/utils");
 var import_utils16 = require("@frontmcp/utils");
-var import_utils17 = require("@frontmcp/utils");
 
 // libs/auth/src/session/storage/storage-token-store.ts
-var import_utils13 = require("@frontmcp/utils");
+var import_utils12 = require("@frontmcp/utils");
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -2787,13 +2739,13 @@ var StorageTokenStore = class {
     this.defaultTtlSeconds = options.defaultTtlSeconds;
     this.storageIsNamespaced = "namespace" in storage && typeof storage.namespace === "function";
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils13.TypedStorage(namespacedStorage);
+    this.storage = new import_utils12.TypedStorage(namespacedStorage);
   }
   /**
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return (0, import_utils13.randomUUID)();
+    return (0, import_utils12.randomUUID)();
   }
   /**
    * Store an encrypted token blob.
@@ -2856,7 +2808,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-var import_utils14 = require("@frontmcp/utils");
+var import_utils13 = require("@frontmcp/utils");
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -2865,7 +2817,7 @@ var StorageAuthorizationVault = class {
     this.namespace = options.namespace ?? "vault";
     this.pendingAuthTtlMs = options.pendingAuthTtlMs ?? 10 * 60 * 1e3;
     const namespacedStorage = this.isNamespacedStorage(storage) ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils14.TypedStorage(namespacedStorage, {
+    this.storage = new import_utils13.TypedStorage(namespacedStorage, {
       schema: options.validateOnRead ? authorizationVaultEntrySchema : void 0,
       throwOnInvalid: false
     });
@@ -2876,7 +2828,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils14.randomUUID)(),
+      id: (0, import_utils13.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -2950,7 +2902,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils14.randomUUID)(),
+      id: (0, import_utils13.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -3154,11 +3106,11 @@ var StorageAuthorizationVault = class {
 };
 
 // libs/auth/src/session/storage/in-memory-authorization-vault.ts
-var import_utils15 = require("@frontmcp/utils");
+var import_utils14 = require("@frontmcp/utils");
 var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
   memoryAdapter;
   constructor(options = {}) {
-    const memoryAdapter = new import_utils15.MemoryStorageAdapter();
+    const memoryAdapter = new import_utils14.MemoryStorageAdapter();
     super(memoryAdapter, {
       namespace: options.namespace ?? "vault",
       pendingAuthTtlMs: options.pendingAuthTtlMs
@@ -3179,7 +3131,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-var import_utils18 = require("@frontmcp/utils");
+var import_utils17 = require("@frontmcp/utils");
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -3201,14 +3153,14 @@ var RedisSessionStore = class {
       });
     }
     if ("redis" in config && config.redis) {
-      this.storage = new import_utils18.RedisStorageAdapter({
+      this.storage = new import_utils17.RedisStorageAdapter({
         client: config.redis,
         keyPrefix: this.keyPrefix
       });
       this.externalInstance = true;
     } else {
       const redisConfig = config;
-      this.storage = new import_utils18.RedisStorageAdapter({
+      this.storage = new import_utils17.RedisStorageAdapter({
         config: {
           host: redisConfig.host,
           port: redisConfig.port ?? 6379,
@@ -3390,7 +3342,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils18.randomUUID)();
+    return (0, import_utils17.randomUUID)();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -3426,7 +3378,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-var import_utils19 = require("@frontmcp/utils");
+var import_utils18 = require("@frontmcp/utils");
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -3446,7 +3398,7 @@ var VercelKvSessionStore = class {
         maxRequests: this.security.rateLimiting?.maxRequests
       });
     }
-    this.storage = new import_utils19.VercelKvStorageAdapter({
+    this.storage = new import_utils18.VercelKvStorageAdapter({
       url: config.url,
       token: config.token,
       keyPrefix: this.keyPrefix
@@ -3620,7 +3572,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils19.randomUUID)();
+    return (0, import_utils18.randomUUID)();
   }
   /**
    * Disconnect from Vercel KV
@@ -3649,7 +3601,7 @@ var VercelKvSessionStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.store.ts
-var import_utils20 = require("@frontmcp/utils");
+var import_utils19 = require("@frontmcp/utils");
 var InMemoryOrchestratedTokenStore = class {
   /** Token storage: Map<compositeKey, ProviderTokenRecord> */
   tokens = /* @__PURE__ */ new Map();
@@ -3691,7 +3643,7 @@ var InMemoryOrchestratedTokenStore = class {
     }
     const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
     const salt = new TextEncoder().encode("frontmcp-token-store");
-    const derivedKey = (0, import_utils20.hkdfSha256)(this.encryptionKey, salt, info, 32);
+    const derivedKey = (0, import_utils19.hkdfSha256)(this.encryptionKey, salt, info, 32);
     this.derivedKeys.set(compositeKey, derivedKey);
     return derivedKey;
   }
@@ -3701,8 +3653,8 @@ var InMemoryOrchestratedTokenStore = class {
   async encryptRecord(compositeKey, record) {
     const key = await this.deriveKeyForRecord(compositeKey);
     const plaintext = JSON.stringify(record);
-    const iv = (0, import_utils20.randomBytes)(12);
-    const { ciphertext, tag } = (0, import_utils20.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils19.randomBytes)(12);
+    const { ciphertext, tag } = (0, import_utils19.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
     return JSON.stringify({
       iv: Buffer.from(iv).toString("base64url"),
       tag: Buffer.from(tag).toString("base64url"),
@@ -3718,7 +3670,7 @@ var InMemoryOrchestratedTokenStore = class {
     const ivBytes = Buffer.from(iv, "base64url");
     const tagBytes = Buffer.from(tag, "base64url");
     const ciphertextBytes = Buffer.from(data, "base64url");
-    const plaintext = (0, import_utils20.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+    const plaintext = (0, import_utils19.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
     return JSON.parse(new TextDecoder().decode(plaintext));
   }
   /**
@@ -3920,7 +3872,7 @@ var InMemoryOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/federated-auth.session.ts
-var import_utils21 = require("@frontmcp/utils");
+var import_utils20 = require("@frontmcp/utils");
 function toSessionRecord(session) {
   return {
     ...session,
@@ -3995,7 +3947,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: (0, import_utils21.randomUUID)(),
+      id: (0, import_utils20.randomUUID)(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -4027,7 +3979,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: (0, import_utils21.randomUUID)(),
+    id: (0, import_utils20.randomUUID)(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -4084,34 +4036,33 @@ function startNextProvider(session, pkce, state) {
 }
 
 // libs/auth/src/session/encrypted-authorization-vault.ts
-var import_zod5 = require("zod");
-var import_utils22 = require("@frontmcp/utils");
-var import_utils23 = require("@frontmcp/utils");
-var redisVaultEntrySchema = import_zod5.z.object({
+var import_lazy_zod5 = require("@frontmcp/lazy-zod");
+var import_utils21 = require("@frontmcp/utils");
+var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Vault ID */
-  id: import_zod5.z.string(),
+  id: import_lazy_zod5.z.string(),
   /** User sub (for lookup) */
-  userSub: import_zod5.z.string(),
+  userSub: import_lazy_zod5.z.string(),
   /** User email (optional, for display) */
-  userEmail: import_zod5.z.string().optional(),
+  userEmail: import_lazy_zod5.z.string().optional(),
   /** User name (optional, for display) */
-  userName: import_zod5.z.string().optional(),
+  userName: import_lazy_zod5.z.string().optional(),
   /** Client ID */
-  clientId: import_zod5.z.string(),
+  clientId: import_lazy_zod5.z.string(),
   /** Creation timestamp */
-  createdAt: import_zod5.z.number(),
+  createdAt: import_lazy_zod5.z.number(),
   /** Last access timestamp */
-  lastAccessAt: import_zod5.z.number(),
+  lastAccessAt: import_lazy_zod5.z.number(),
   /** Authorized app IDs (unencrypted for quick auth checks) */
-  authorizedAppIds: import_zod5.z.array(import_zod5.z.string()),
+  authorizedAppIds: import_lazy_zod5.z.array(import_lazy_zod5.z.string()),
   /** Skipped app IDs (unencrypted for quick checks) */
-  skippedAppIds: import_zod5.z.array(import_zod5.z.string()),
+  skippedAppIds: import_lazy_zod5.z.array(import_lazy_zod5.z.string()),
   /** Pending auth request IDs (unencrypted for lookup) */
-  pendingAuthIds: import_zod5.z.array(import_zod5.z.string()),
+  pendingAuthIds: import_lazy_zod5.z.array(import_lazy_zod5.z.string()),
   /** Encrypted sensitive data blob */
   encrypted: encryptedDataSchema
 });
-var encryptionContextStorage = new import_utils23.AsyncLocalStorage();
+var encryptionContextStorage = new import_utils21.AsyncLocalStorage();
 var EncryptedRedisVault = class {
   constructor(redis, encryption, namespace = "vault:") {
     this.redis = redis;
@@ -4244,7 +4195,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils22.randomUUID)(),
+      id: (0, import_utils21.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -4303,7 +4254,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils22.randomUUID)(),
+      id: (0, import_utils21.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4481,7 +4432,7 @@ function createEncryptedVault(redis, config = {}) {
 }
 
 // libs/auth/src/session/token.refresh.ts
-var import_utils24 = require("@frontmcp/utils");
+var import_utils22 = require("@frontmcp/utils");
 function toEpochSeconds(exp) {
   if (exp == null) return void 0;
   if (exp instanceof Date) return Math.floor(exp.getTime() / 1e3);
@@ -4503,7 +4454,7 @@ function tryJwtExp(token) {
   const parts = token.split(".");
   if (parts.length < 2) return void 0;
   try {
-    const json = JSON.parse(new TextDecoder().decode((0, import_utils24.base64urlDecode)(parts[1])));
+    const json = JSON.parse(new TextDecoder().decode((0, import_utils22.base64urlDecode)(parts[1])));
     const e = json?.exp;
     return typeof e === "number" ? toEpochSeconds(e) : void 0;
   } catch {
@@ -4512,37 +4463,37 @@ function tryJwtExp(token) {
 }
 
 // libs/auth/src/authorization/authorization.types.ts
-var import_zod6 = require("zod");
-var authModeSchema = import_zod6.z.enum(["public", "transparent", "orchestrated"]);
-var authUserSchema = import_zod6.z.object({
-  sub: import_zod6.z.string(),
-  name: import_zod6.z.string().optional(),
-  email: import_zod6.z.string().email().optional(),
-  picture: import_zod6.z.string().url().optional(),
-  anonymous: import_zod6.z.boolean().optional()
+var import_lazy_zod6 = require("@frontmcp/lazy-zod");
+var authModeSchema = import_lazy_zod6.z.enum(["public", "transparent", "orchestrated"]);
+var authUserSchema = import_lazy_zod6.z.object({
+  sub: import_lazy_zod6.z.string(),
+  name: import_lazy_zod6.z.string().optional(),
+  email: import_lazy_zod6.z.string().email().optional(),
+  picture: import_lazy_zod6.z.string().url().optional(),
+  anonymous: import_lazy_zod6.z.boolean().optional()
 });
-var authorizedToolSchema = import_zod6.z.object({
-  executionPath: import_zod6.z.tuple([import_zod6.z.string(), import_zod6.z.string()]),
-  scopes: import_zod6.z.array(import_zod6.z.string()).optional(),
-  details: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.unknown()).optional()
+var authorizedToolSchema = import_lazy_zod6.z.object({
+  executionPath: import_lazy_zod6.z.tuple([import_lazy_zod6.z.string(), import_lazy_zod6.z.string()]),
+  scopes: import_lazy_zod6.z.array(import_lazy_zod6.z.string()).optional(),
+  details: import_lazy_zod6.z.record(import_lazy_zod6.z.string(), import_lazy_zod6.z.unknown()).optional()
 });
-var authorizedPromptSchema = import_zod6.z.object({
-  executionPath: import_zod6.z.tuple([import_zod6.z.string(), import_zod6.z.string()]),
-  scopes: import_zod6.z.array(import_zod6.z.string()).optional(),
-  details: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.unknown()).optional()
+var authorizedPromptSchema = import_lazy_zod6.z.object({
+  executionPath: import_lazy_zod6.z.tuple([import_lazy_zod6.z.string(), import_lazy_zod6.z.string()]),
+  scopes: import_lazy_zod6.z.array(import_lazy_zod6.z.string()).optional(),
+  details: import_lazy_zod6.z.record(import_lazy_zod6.z.string(), import_lazy_zod6.z.unknown()).optional()
 });
-var llmSafeAuthContextSchema = import_zod6.z.object({
-  authorizationId: import_zod6.z.string(),
-  sessionId: import_zod6.z.string(),
+var llmSafeAuthContextSchema = import_lazy_zod6.z.object({
+  authorizationId: import_lazy_zod6.z.string(),
+  sessionId: import_lazy_zod6.z.string(),
   mode: authModeSchema,
-  isAnonymous: import_zod6.z.boolean(),
-  user: import_zod6.z.object({
-    sub: import_zod6.z.string(),
-    name: import_zod6.z.string().optional()
+  isAnonymous: import_lazy_zod6.z.boolean(),
+  user: import_lazy_zod6.z.object({
+    sub: import_lazy_zod6.z.string(),
+    name: import_lazy_zod6.z.string().optional()
   }),
-  scopes: import_zod6.z.array(import_zod6.z.string()),
-  authorizedToolIds: import_zod6.z.array(import_zod6.z.string()),
-  authorizedPromptIds: import_zod6.z.array(import_zod6.z.string())
+  scopes: import_lazy_zod6.z.array(import_lazy_zod6.z.string()),
+  authorizedToolIds: import_lazy_zod6.z.array(import_lazy_zod6.z.string()),
+  authorizedPromptIds: import_lazy_zod6.z.array(import_lazy_zod6.z.string())
 });
 var AppAuthState = /* @__PURE__ */ ((AppAuthState2) => {
   AppAuthState2["AUTHORIZED"] = "authorized";
@@ -4550,23 +4501,23 @@ var AppAuthState = /* @__PURE__ */ ((AppAuthState2) => {
   AppAuthState2["PENDING"] = "pending";
   return AppAuthState2;
 })(AppAuthState || {});
-var appAuthStateSchema = import_zod6.z.nativeEnum(AppAuthState);
-var appAuthorizationRecordSchema = import_zod6.z.object({
-  appId: import_zod6.z.string(),
+var appAuthStateSchema = import_lazy_zod6.z.nativeEnum(AppAuthState);
+var appAuthorizationRecordSchema = import_lazy_zod6.z.object({
+  appId: import_lazy_zod6.z.string(),
   state: appAuthStateSchema,
-  stateChangedAt: import_zod6.z.number(),
-  grantedScopes: import_zod6.z.array(import_zod6.z.string()).optional(),
-  authProviderId: import_zod6.z.string().optional(),
-  toolIds: import_zod6.z.array(import_zod6.z.string())
+  stateChangedAt: import_lazy_zod6.z.number(),
+  grantedScopes: import_lazy_zod6.z.array(import_lazy_zod6.z.string()).optional(),
+  authProviderId: import_lazy_zod6.z.string().optional(),
+  toolIds: import_lazy_zod6.z.array(import_lazy_zod6.z.string())
 });
-var progressiveAuthStateSchema = import_zod6.z.object({
-  apps: import_zod6.z.record(import_zod6.z.string(), appAuthorizationRecordSchema),
-  initiallyAuthorized: import_zod6.z.array(import_zod6.z.string()),
-  initiallySkipped: import_zod6.z.array(import_zod6.z.string())
+var progressiveAuthStateSchema = import_lazy_zod6.z.object({
+  apps: import_lazy_zod6.z.record(import_lazy_zod6.z.string(), appAuthorizationRecordSchema),
+  initiallyAuthorized: import_lazy_zod6.z.array(import_lazy_zod6.z.string()),
+  initiallySkipped: import_lazy_zod6.z.array(import_lazy_zod6.z.string())
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-var import_utils27 = require("@frontmcp/utils");
+var import_utils25 = require("@frontmcp/utils");
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -4614,14 +4565,14 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = (0, import_utils27.randomUUID)();
+    const sessionId = (0, import_utils25.randomUUID)();
     const session = {
       id: sessionId,
       authorizationId: this.id,
       protocol,
       createdAt: Date.now(),
       expiresAt: this.expiresAt,
-      nodeId: getMachineId(),
+      nodeId: (0, import_utils25.getMachineId)(),
       clientFingerprint: fingerprint
     };
     this.#sessions.set(session.id, session);
@@ -4751,7 +4702,7 @@ var AuthorizationBase = class _AuthorizationBase {
    */
   static isJwtHeader(segment) {
     try {
-      const bytes = (0, import_utils27.base64urlDecode)(segment);
+      const bytes = (0, import_utils25.base64urlDecode)(segment);
       const text = new TextDecoder().decode(bytes);
       const parsed = JSON.parse(text);
       return typeof parsed === "object" && parsed !== null && typeof parsed.alg === "string";
@@ -4803,7 +4754,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-var import_utils28 = require("@frontmcp/utils");
+var import_utils26 = require("@frontmcp/utils");
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -4839,7 +4790,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = (0, import_utils28.randomUUID)();
+    const uuid = (0, import_utils26.randomUUID)();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -4923,7 +4874,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
 };
 
 // libs/auth/src/authorization/transparent.authorization.ts
-var import_utils29 = require("@frontmcp/utils");
+var import_utils27 = require("@frontmcp/utils");
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**
@@ -5023,7 +4974,7 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
   static generateAuthorizationId(token) {
     const parts = token.split(".");
     const signature = parts[2] || token;
-    return (0, import_utils29.sha256Hex)(signature).substring(0, 16);
+    return (0, import_utils27.sha256Hex)(signature).substring(0, 16);
   }
   /**
    * Get the issuer from the token claims
@@ -5049,11 +5000,11 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
 };
 
 // libs/auth/src/utils/authorization-id.utils.ts
-var import_utils30 = require("@frontmcp/utils");
+var import_utils28 = require("@frontmcp/utils");
 function deriveAuthorizationId(token) {
   const parts = token.split(".");
   const signature = parts[2] || token;
-  return (0, import_utils30.sha256Hex)(signature).substring(0, 16);
+  return (0, import_utils28.sha256Hex)(signature).substring(0, 16);
 }
 
 // libs/auth/src/authorization/orchestrated.authorization.ts
@@ -5421,42 +5372,42 @@ var OrchestratedAuthAccessorAdapter = class {
 };
 
 // libs/auth/src/common/jwt.types.ts
-var import_zod7 = require("zod");
-var jwkParametersSchema = import_zod7.z.object({
-  kty: import_zod7.z.string().optional(),
-  alg: import_zod7.z.string().optional(),
-  key_ops: import_zod7.z.array(import_zod7.z.string()).optional(),
-  ext: import_zod7.z.boolean().optional(),
-  use: import_zod7.z.string().optional(),
-  x5c: import_zod7.z.array(import_zod7.z.string()).optional(),
-  x5t: import_zod7.z.string().optional(),
-  "x5t#S256": import_zod7.z.string().optional(),
-  x5u: import_zod7.z.string().optional(),
-  kid: import_zod7.z.string().optional()
+var import_lazy_zod7 = require("@frontmcp/lazy-zod");
+var jwkParametersSchema = import_lazy_zod7.z.object({
+  kty: import_lazy_zod7.z.string().optional(),
+  alg: import_lazy_zod7.z.string().optional(),
+  key_ops: import_lazy_zod7.z.array(import_lazy_zod7.z.string()).optional(),
+  ext: import_lazy_zod7.z.boolean().optional(),
+  use: import_lazy_zod7.z.string().optional(),
+  x5c: import_lazy_zod7.z.array(import_lazy_zod7.z.string()).optional(),
+  x5t: import_lazy_zod7.z.string().optional(),
+  "x5t#S256": import_lazy_zod7.z.string().optional(),
+  x5u: import_lazy_zod7.z.string().optional(),
+  kid: import_lazy_zod7.z.string().optional()
 });
 var jwkSchema = jwkParametersSchema.extend({
-  crv: import_zod7.z.string().optional(),
-  d: import_zod7.z.string().optional(),
-  dp: import_zod7.z.string().optional(),
-  dq: import_zod7.z.string().optional(),
-  e: import_zod7.z.string().optional(),
-  k: import_zod7.z.string().optional(),
-  n: import_zod7.z.string().optional(),
-  p: import_zod7.z.string().optional(),
-  q: import_zod7.z.string().optional(),
-  qi: import_zod7.z.string().optional(),
-  x: import_zod7.z.string().optional(),
-  y: import_zod7.z.string().optional(),
-  pub: import_zod7.z.string().optional(),
-  priv: import_zod7.z.string().optional()
+  crv: import_lazy_zod7.z.string().optional(),
+  d: import_lazy_zod7.z.string().optional(),
+  dp: import_lazy_zod7.z.string().optional(),
+  dq: import_lazy_zod7.z.string().optional(),
+  e: import_lazy_zod7.z.string().optional(),
+  k: import_lazy_zod7.z.string().optional(),
+  n: import_lazy_zod7.z.string().optional(),
+  p: import_lazy_zod7.z.string().optional(),
+  q: import_lazy_zod7.z.string().optional(),
+  qi: import_lazy_zod7.z.string().optional(),
+  x: import_lazy_zod7.z.string().optional(),
+  y: import_lazy_zod7.z.string().optional(),
+  pub: import_lazy_zod7.z.string().optional(),
+  priv: import_lazy_zod7.z.string().optional()
 });
-var jsonWebKeySetSchema = import_zod7.z.object({
-  keys: import_zod7.z.array(jwkSchema)
+var jsonWebKeySetSchema = import_lazy_zod7.z.object({
+  keys: import_lazy_zod7.z.array(jwkSchema)
 });
 
 // libs/auth/src/common/session.types.ts
-var import_zod8 = require("zod");
-var aiPlatformTypeSchema = import_zod8.z.enum([
+var import_lazy_zod8 = require("@frontmcp/lazy-zod");
+var aiPlatformTypeSchema = import_lazy_zod8.z.enum([
   "openai",
   "claude",
   "gemini",
@@ -5467,45 +5418,45 @@ var aiPlatformTypeSchema = import_zod8.z.enum([
   "ext-apps",
   "unknown"
 ]);
-var userClaimSchema = import_zod8.z.object({
-  iss: import_zod8.z.string(),
-  sid: import_zod8.z.string().optional(),
-  sub: import_zod8.z.string(),
-  exp: import_zod8.z.number().optional(),
-  iat: import_zod8.z.number().optional(),
-  aud: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.array(import_zod8.z.string())]).optional(),
-  email: import_zod8.z.string().optional(),
-  username: import_zod8.z.string().optional(),
-  preferred_username: import_zod8.z.string().optional(),
-  name: import_zod8.z.string().optional(),
-  picture: import_zod8.z.string().optional()
+var userClaimSchema = import_lazy_zod8.z.object({
+  iss: import_lazy_zod8.z.string(),
+  sid: import_lazy_zod8.z.string().optional(),
+  sub: import_lazy_zod8.z.string(),
+  exp: import_lazy_zod8.z.number().optional(),
+  iat: import_lazy_zod8.z.number().optional(),
+  aud: import_lazy_zod8.z.union([import_lazy_zod8.z.string(), import_lazy_zod8.z.array(import_lazy_zod8.z.string())]).optional(),
+  email: import_lazy_zod8.z.string().optional(),
+  username: import_lazy_zod8.z.string().optional(),
+  preferred_username: import_lazy_zod8.z.string().optional(),
+  name: import_lazy_zod8.z.string().optional(),
+  picture: import_lazy_zod8.z.string().optional()
 }).passthrough();
-var sessionIdPayloadSchema = import_zod8.z.object({
-  nodeId: import_zod8.z.string(),
-  authSig: import_zod8.z.string(),
-  uuid: import_zod8.z.string().uuid(),
-  iat: import_zod8.z.number(),
-  protocol: import_zod8.z.enum(["legacy-sse", "sse", "streamable-http", "stateful-http", "stateless-http"]).optional(),
-  isPublic: import_zod8.z.boolean().optional(),
+var sessionIdPayloadSchema = import_lazy_zod8.z.object({
+  nodeId: import_lazy_zod8.z.string(),
+  authSig: import_lazy_zod8.z.string(),
+  uuid: import_lazy_zod8.z.string().uuid(),
+  iat: import_lazy_zod8.z.number(),
+  protocol: import_lazy_zod8.z.enum(["legacy-sse", "sse", "streamable-http", "stateful-http", "stateless-http"]).optional(),
+  isPublic: import_lazy_zod8.z.boolean().optional(),
   platformType: aiPlatformTypeSchema.optional(),
-  clientName: import_zod8.z.string().optional(),
-  clientVersion: import_zod8.z.string().optional(),
-  supportsElicitation: import_zod8.z.boolean().optional(),
-  skillsOnlyMode: import_zod8.z.boolean().optional()
+  clientName: import_lazy_zod8.z.string().optional(),
+  clientVersion: import_lazy_zod8.z.string().optional(),
+  supportsElicitation: import_lazy_zod8.z.boolean().optional(),
+  skillsOnlyMode: import_lazy_zod8.z.boolean().optional()
 });
-var sessionIdSchema = import_zod8.z.object({
-  id: import_zod8.z.string(),
+var sessionIdSchema = import_lazy_zod8.z.object({
+  id: import_lazy_zod8.z.string(),
   /** Payload is optional - may be undefined when session validation failed but ID is passed for transport lookup */
   payload: sessionIdPayloadSchema.optional()
 });
-var authorizationSchema = import_zod8.z.object({
-  token: import_zod8.z.string(),
+var authorizationSchema = import_lazy_zod8.z.object({
+  token: import_lazy_zod8.z.string(),
   session: sessionIdSchema.optional(),
   user: userClaimSchema
 });
 
 // libs/auth/src/options/shared.schemas.ts
-var import_zod10 = require("zod");
+var import_lazy_zod10 = require("@frontmcp/lazy-zod");
 
 // libs/auth/src/cimd/cimd.logger.ts
 var noopLogger = {
@@ -5521,169 +5472,169 @@ var noopLogger = {
 };
 
 // libs/auth/src/cimd/cimd.types.ts
-var import_zod9 = require("zod");
-var clientMetadataDocumentSchema = import_zod9.z.object({
+var import_lazy_zod9 = require("@frontmcp/lazy-zod");
+var clientMetadataDocumentSchema = import_lazy_zod9.z.object({
   // REQUIRED per CIMD spec
   /**
    * Client identifier - MUST match the URL from which this document was fetched.
    */
-  client_id: import_zod9.z.string().url(),
+  client_id: import_lazy_zod9.z.string().url(),
   /**
    * Human-readable name of the client.
    */
-  client_name: import_zod9.z.string().min(1),
+  client_name: import_lazy_zod9.z.string().min(1),
   /**
    * Array of redirect URIs for authorization responses.
    * At least one is required.
    */
-  redirect_uris: import_zod9.z.array(import_zod9.z.string().url()).min(1),
+  redirect_uris: import_lazy_zod9.z.array(import_lazy_zod9.z.string().url()).min(1),
   // OPTIONAL per RFC 7591
   /**
    * Token endpoint authentication method.
    * @default 'none'
    */
-  token_endpoint_auth_method: import_zod9.z.enum(["none", "client_secret_basic", "client_secret_post", "private_key_jwt"]).default("none"),
+  token_endpoint_auth_method: import_lazy_zod9.z.enum(["none", "client_secret_basic", "client_secret_post", "private_key_jwt"]).default("none"),
   /**
    * OAuth grant types the client can use.
    * @default ['authorization_code']
    */
-  grant_types: import_zod9.z.array(import_zod9.z.string()).default(["authorization_code"]),
+  grant_types: import_lazy_zod9.z.array(import_lazy_zod9.z.string()).default(["authorization_code"]),
   /**
    * OAuth response types the client can request.
    * @default ['code']
    */
-  response_types: import_zod9.z.array(import_zod9.z.string()).default(["code"]),
+  response_types: import_lazy_zod9.z.array(import_lazy_zod9.z.string()).default(["code"]),
   /**
    * URL of the client's home page.
    */
-  client_uri: import_zod9.z.string().url().optional(),
+  client_uri: import_lazy_zod9.z.string().url().optional(),
   /**
    * URL of the client's logo image.
    */
-  logo_uri: import_zod9.z.string().url().optional(),
+  logo_uri: import_lazy_zod9.z.string().url().optional(),
   /**
    * URL of the client's JWKS (for private_key_jwt).
    */
-  jwks_uri: import_zod9.z.string().url().optional(),
+  jwks_uri: import_lazy_zod9.z.string().url().optional(),
   /**
    * Inline JWKS (for private_key_jwt).
    */
-  jwks: import_zod9.z.object({
-    keys: import_zod9.z.array(import_zod9.z.record(import_zod9.z.string(), import_zod9.z.unknown()))
+  jwks: import_lazy_zod9.z.object({
+    keys: import_lazy_zod9.z.array(import_lazy_zod9.z.record(import_lazy_zod9.z.string(), import_lazy_zod9.z.unknown()))
   }).optional(),
   /**
    * URL of the client's terms of service.
    */
-  tos_uri: import_zod9.z.string().url().optional(),
+  tos_uri: import_lazy_zod9.z.string().url().optional(),
   /**
    * URL of the client's privacy policy.
    */
-  policy_uri: import_zod9.z.string().url().optional(),
+  policy_uri: import_lazy_zod9.z.string().url().optional(),
   /**
    * Requested OAuth scopes.
    */
-  scope: import_zod9.z.string().optional(),
+  scope: import_lazy_zod9.z.string().optional(),
   /**
    * Array of contact emails for the client.
    */
-  contacts: import_zod9.z.array(import_zod9.z.string().email()).optional(),
+  contacts: import_lazy_zod9.z.array(import_lazy_zod9.z.string().email()).optional(),
   /**
    * Software statement (signed JWT).
    */
-  software_statement: import_zod9.z.string().optional(),
+  software_statement: import_lazy_zod9.z.string().optional(),
   /**
    * Unique identifier for the client software.
    */
-  software_id: import_zod9.z.string().optional(),
+  software_id: import_lazy_zod9.z.string().optional(),
   /**
    * Version of the client software.
    */
-  software_version: import_zod9.z.string().optional()
+  software_version: import_lazy_zod9.z.string().optional()
 });
-var cimdRedisCacheConfigSchema = import_zod9.z.object({
+var cimdRedisCacheConfigSchema = import_lazy_zod9.z.object({
   /**
    * Redis connection URL.
    * e.g., "redis://user:pass@host:6379/0"
    */
-  url: import_zod9.z.string().optional(),
+  url: import_lazy_zod9.z.string().optional(),
   /**
    * Redis host.
    */
-  host: import_zod9.z.string().optional(),
+  host: import_lazy_zod9.z.string().optional(),
   /**
    * Redis port.
    * @default 6379
    */
-  port: import_zod9.z.number().optional(),
+  port: import_lazy_zod9.z.number().optional(),
   /**
    * Redis password.
    */
-  password: import_zod9.z.string().optional(),
+  password: import_lazy_zod9.z.string().optional(),
   /**
    * Redis database number.
    * @default 0
    */
-  db: import_zod9.z.number().optional(),
+  db: import_lazy_zod9.z.number().optional(),
   /**
    * Enable TLS for Redis connection.
    * @default false
    */
-  tls: import_zod9.z.boolean().optional(),
+  tls: import_lazy_zod9.z.boolean().optional(),
   /**
    * Key prefix for CIMD cache entries.
    * @default 'cimd:'
    */
-  keyPrefix: import_zod9.z.string().default("cimd:")
+  keyPrefix: import_lazy_zod9.z.string().default("cimd:")
 });
-var cimdCacheConfigSchema = import_zod9.z.object({
+var cimdCacheConfigSchema = import_lazy_zod9.z.object({
   /**
    * Cache storage type.
    * - 'memory': In-memory cache (default, suitable for dev/single-instance)
    * - 'redis': Redis-backed cache (for production/distributed deployments)
    * @default 'memory'
    */
-  type: import_zod9.z.enum(["memory", "redis"]).default("memory"),
+  type: import_lazy_zod9.z.enum(["memory", "redis"]).default("memory"),
   /**
    * Default TTL for cached metadata documents.
    * @default 3600000 (1 hour)
    */
-  defaultTtlMs: import_zod9.z.number().min(0).default(36e5),
+  defaultTtlMs: import_lazy_zod9.z.number().min(0).default(36e5),
   /**
    * Maximum TTL (even if server suggests longer).
    * @default 86400000 (24 hours)
    */
-  maxTtlMs: import_zod9.z.number().min(0).default(864e5),
+  maxTtlMs: import_lazy_zod9.z.number().min(0).default(864e5),
   /**
    * Minimum TTL (even if server suggests shorter).
    * @default 60000 (1 minute)
    */
-  minTtlMs: import_zod9.z.number().min(0).default(6e4),
+  minTtlMs: import_lazy_zod9.z.number().min(0).default(6e4),
   /**
    * Redis configuration (required when type is 'redis').
    */
   redis: cimdRedisCacheConfigSchema.optional()
 });
-var cimdSecurityConfigSchema = import_zod9.z.object({
+var cimdSecurityConfigSchema = import_lazy_zod9.z.object({
   /**
    * Block fetching from private/internal IP addresses (SSRF protection).
    * @default true
    */
-  blockPrivateIPs: import_zod9.z.boolean().default(true),
+  blockPrivateIPs: import_lazy_zod9.z.boolean().default(true),
   /**
    * Explicit list of allowed domains.
    * If set, only these domains can host CIMD documents.
    */
-  allowedDomains: import_zod9.z.array(import_zod9.z.string()).optional(),
+  allowedDomains: import_lazy_zod9.z.array(import_lazy_zod9.z.string()).optional(),
   /**
    * Explicit list of blocked domains.
    * These domains cannot host CIMD documents.
    */
-  blockedDomains: import_zod9.z.array(import_zod9.z.string()).optional(),
+  blockedDomains: import_lazy_zod9.z.array(import_lazy_zod9.z.string()).optional(),
   /**
    * Warn when a client has only localhost redirect URIs.
    * @default true
    */
-  warnOnLocalhostRedirects: import_zod9.z.boolean().default(true),
+  warnOnLocalhostRedirects: import_lazy_zod9.z.boolean().default(true),
   /**
    * Allow HTTP (instead of HTTPS) for localhost CIMD URLs.
    *
@@ -5694,19 +5645,19 @@ var cimdSecurityConfigSchema = import_zod9.z.object({
    *
    * @default false
    */
-  allowInsecureForTesting: import_zod9.z.boolean().default(false)
+  allowInsecureForTesting: import_lazy_zod9.z.boolean().default(false)
 });
-var cimdNetworkConfigSchema = import_zod9.z.object({
+var cimdNetworkConfigSchema = import_lazy_zod9.z.object({
   /**
    * Request timeout in milliseconds.
    * @default 5000 (5 seconds)
    */
-  timeoutMs: import_zod9.z.number().min(100).default(5e3),
+  timeoutMs: import_lazy_zod9.z.number().min(100).default(5e3),
   /**
    * Maximum response body size in bytes.
    * @default 65536 (64KB)
    */
-  maxResponseSizeBytes: import_zod9.z.number().min(1024).default(65536),
+  maxResponseSizeBytes: import_lazy_zod9.z.number().min(1024).default(65536),
   /**
    * Redirect handling policy for CIMD fetches.
    * - 'deny': reject redirects (default, safest)
@@ -5714,19 +5665,19 @@ var cimdNetworkConfigSchema = import_zod9.z.object({
    * - 'allow': allow redirects to any origin
    * @default 'deny'
    */
-  redirectPolicy: import_zod9.z.enum(["deny", "same-origin", "allow"]).default("deny"),
+  redirectPolicy: import_lazy_zod9.z.enum(["deny", "same-origin", "allow"]).default("deny"),
   /**
    * Maximum number of redirects to follow when redirects are allowed.
    * @default 5
    */
-  maxRedirects: import_zod9.z.number().int().min(0).default(5)
+  maxRedirects: import_lazy_zod9.z.number().int().min(0).default(5)
 });
-var cimdConfigSchema = import_zod9.z.object({
+var cimdConfigSchema = import_lazy_zod9.z.object({
   /**
    * Enable CIMD support.
    * @default true
    */
-  enabled: import_zod9.z.boolean().default(true),
+  enabled: import_lazy_zod9.z.boolean().default(true),
   /**
    * Cache configuration.
    */
@@ -6380,29 +6331,29 @@ function normalizeRedirectUri(uri) {
 }
 
 // libs/auth/src/options/shared.schemas.ts
-var publicAccessConfigSchema = import_zod10.z.object({
+var publicAccessConfigSchema = import_lazy_zod10.z.object({
   /**
    * Allow all tools or explicit whitelist
    * @default 'all'
    */
-  tools: import_zod10.z.union([import_zod10.z.literal("all"), import_zod10.z.array(import_zod10.z.string())]).default("all"),
+  tools: import_lazy_zod10.z.union([import_lazy_zod10.z.literal("all"), import_lazy_zod10.z.array(import_lazy_zod10.z.string())]).default("all"),
   /**
    * Allow all prompts or explicit whitelist
    * @default 'all'
    */
-  prompts: import_zod10.z.union([import_zod10.z.literal("all"), import_zod10.z.array(import_zod10.z.string())]).default("all"),
+  prompts: import_lazy_zod10.z.union([import_lazy_zod10.z.literal("all"), import_lazy_zod10.z.array(import_lazy_zod10.z.string())]).default("all"),
   /**
    * Rate limit per IP per minute
    * @default 60
    */
-  rateLimit: import_zod10.z.number().default(60)
+  rateLimit: import_lazy_zod10.z.number().default(60)
 });
-var localSigningConfigSchema = import_zod10.z.object({
+var localSigningConfigSchema = import_lazy_zod10.z.object({
   /**
    * Private key for signing tokens
    * @default auto-generated
    */
-  signKey: jwkSchema.or(import_zod10.z.instanceof(Uint8Array)).optional(),
+  signKey: jwkSchema.or(import_lazy_zod10.z.instanceof(Uint8Array)).optional(),
   /**
    * JWKS for token verification
    * @default auto-generated
@@ -6412,52 +6363,52 @@ var localSigningConfigSchema = import_zod10.z.object({
    * Issuer identifier for tokens
    * @default auto-derived from server URL
    */
-  issuer: import_zod10.z.string().optional()
+  issuer: import_lazy_zod10.z.string().optional()
 });
-var providerConfigSchema = import_zod10.z.object({
+var providerConfigSchema = import_lazy_zod10.z.object({
   /** Provider display name */
-  name: import_zod10.z.string().optional(),
+  name: import_lazy_zod10.z.string().optional(),
   /**
    * Unique identifier for this provider
    * @default derived from provider URL
    */
-  id: import_zod10.z.string().optional(),
+  id: import_lazy_zod10.z.string().optional(),
   /**
    * Inline JWKS for offline token verification
    * Falls back to fetching from provider's /.well-known/jwks.json
    */
   jwks: jsonWebKeySetSchema.optional(),
   /** Custom JWKS URI if not at standard path */
-  jwksUri: import_zod10.z.string().url().optional(),
+  jwksUri: import_lazy_zod10.z.string().url().optional(),
   /**
    * Enable Dynamic Client Registration (DCR)
    * @default false
    */
-  dcrEnabled: import_zod10.z.boolean().default(false),
+  dcrEnabled: import_lazy_zod10.z.boolean().default(false),
   /** Authorization endpoint override */
-  authEndpoint: import_zod10.z.string().url().optional(),
+  authEndpoint: import_lazy_zod10.z.string().url().optional(),
   /** Token endpoint override */
-  tokenEndpoint: import_zod10.z.string().url().optional(),
+  tokenEndpoint: import_lazy_zod10.z.string().url().optional(),
   /** Registration endpoint override (for DCR) */
-  registrationEndpoint: import_zod10.z.string().url().optional(),
+  registrationEndpoint: import_lazy_zod10.z.string().url().optional(),
   /** User info endpoint override */
-  userInfoEndpoint: import_zod10.z.string().url().optional()
+  userInfoEndpoint: import_lazy_zod10.z.string().url().optional()
 });
-var remoteProviderConfigSchema = import_zod10.z.object({
+var remoteProviderConfigSchema = import_lazy_zod10.z.object({
   /**
    * OAuth provider base URL
    * @example 'https://auth.example.com'
    */
-  provider: import_zod10.z.string().url(),
+  provider: import_lazy_zod10.z.string().url(),
   /**
    * Provider display name
    */
-  name: import_zod10.z.string().optional(),
+  name: import_lazy_zod10.z.string().optional(),
   /**
    * Unique identifier for this provider
    * @default derived from provider URL
    */
-  id: import_zod10.z.string().optional(),
+  id: import_lazy_zod10.z.string().optional(),
   /**
    * Inline JWKS for offline token verification
    * Falls back to fetching from provider's /.well-known/jwks.json
@@ -6466,133 +6417,133 @@ var remoteProviderConfigSchema = import_zod10.z.object({
   /**
    * Custom JWKS URI if not at standard path
    */
-  jwksUri: import_zod10.z.string().url().optional(),
+  jwksUri: import_lazy_zod10.z.string().url().optional(),
   /**
    * Client ID for this MCP server
    */
-  clientId: import_zod10.z.string().optional(),
+  clientId: import_lazy_zod10.z.string().optional(),
   /**
    * Client secret (for confidential clients)
    */
-  clientSecret: import_zod10.z.string().optional(),
+  clientSecret: import_lazy_zod10.z.string().optional(),
   /**
    * Scopes to request from the upstream provider
    */
-  scopes: import_zod10.z.array(import_zod10.z.string()).optional(),
+  scopes: import_lazy_zod10.z.array(import_lazy_zod10.z.string()).optional(),
   /**
    * Enable Dynamic Client Registration (DCR)
    * @default false
    */
-  dcrEnabled: import_zod10.z.boolean().default(false),
+  dcrEnabled: import_lazy_zod10.z.boolean().default(false),
   /**
    * Authorization endpoint override
    */
-  authEndpoint: import_zod10.z.string().url().optional(),
+  authEndpoint: import_lazy_zod10.z.string().url().optional(),
   /**
    * Token endpoint override
    */
-  tokenEndpoint: import_zod10.z.string().url().optional(),
+  tokenEndpoint: import_lazy_zod10.z.string().url().optional(),
   /**
    * Registration endpoint override (for DCR)
    */
-  registrationEndpoint: import_zod10.z.string().url().optional(),
+  registrationEndpoint: import_lazy_zod10.z.string().url().optional(),
   /**
    * User info endpoint override
    */
-  userInfoEndpoint: import_zod10.z.string().url().optional()
+  userInfoEndpoint: import_lazy_zod10.z.string().url().optional()
 });
 var flatRemoteProviderFields = {
   /**
    * OAuth provider base URL (required)
    * @example 'https://auth.example.com'
    */
-  provider: import_zod10.z.string().url(),
+  provider: import_lazy_zod10.z.string().url(),
   /** Client ID for this MCP server */
-  clientId: import_zod10.z.string().optional(),
+  clientId: import_lazy_zod10.z.string().optional(),
   /** Client secret (for confidential clients) */
-  clientSecret: import_zod10.z.string().optional(),
+  clientSecret: import_lazy_zod10.z.string().optional(),
   /** Scopes to request from the upstream provider */
-  scopes: import_zod10.z.array(import_zod10.z.string()).optional(),
+  scopes: import_lazy_zod10.z.array(import_lazy_zod10.z.string()).optional(),
   /** Advanced provider configuration */
   providerConfig: providerConfigSchema.optional()
 };
-var tokenStorageConfigSchema = import_zod10.z.union([import_zod10.z.literal("memory"), import_zod10.z.object({ redis: redisConfigSchema })]);
-var tokenRefreshConfigSchema = import_zod10.z.object({
+var tokenStorageConfigSchema = import_lazy_zod10.z.union([import_lazy_zod10.z.literal("memory"), import_lazy_zod10.z.object({ redis: redisConfigSchema })]);
+var tokenRefreshConfigSchema = import_lazy_zod10.z.object({
   /**
    * Enable automatic token refresh
    * @default true
    */
-  enabled: import_zod10.z.boolean().default(true),
+  enabled: import_lazy_zod10.z.boolean().default(true),
   /**
    * Refresh token before expiry by this many seconds
    * @default 60
    */
-  skewSeconds: import_zod10.z.number().default(60)
+  skewSeconds: import_lazy_zod10.z.number().default(60)
 });
-var skippedAppBehaviorSchema = import_zod10.z.enum(["anonymous", "require-auth"]);
-var consentConfigSchema = import_zod10.z.object({
+var skippedAppBehaviorSchema = import_lazy_zod10.z.enum(["anonymous", "require-auth"]);
+var consentConfigSchema = import_lazy_zod10.z.object({
   /**
    * Enable consent flow for tool selection
    * When enabled, users can choose which tools to expose to the LLM
    * @default false
    */
-  enabled: import_zod10.z.boolean().default(false),
+  enabled: import_lazy_zod10.z.boolean().default(false),
   /**
    * Group tools by app in the consent UI
    * @default true
    */
-  groupByApp: import_zod10.z.boolean().default(true),
+  groupByApp: import_lazy_zod10.z.boolean().default(true),
   /**
    * Show tool descriptions in consent UI
    * @default true
    */
-  showDescriptions: import_zod10.z.boolean().default(true),
+  showDescriptions: import_lazy_zod10.z.boolean().default(true),
   /**
    * Allow selecting all tools at once
    * @default true
    */
-  allowSelectAll: import_zod10.z.boolean().default(true),
+  allowSelectAll: import_lazy_zod10.z.boolean().default(true),
   /**
    * Require at least one tool to be selected
    * @default true
    */
-  requireSelection: import_zod10.z.boolean().default(true),
+  requireSelection: import_lazy_zod10.z.boolean().default(true),
   /**
    * Custom message to display on consent page
    */
-  customMessage: import_zod10.z.string().optional(),
+  customMessage: import_lazy_zod10.z.string().optional(),
   /**
    * Remember consent for future sessions
    * @default true
    */
-  rememberConsent: import_zod10.z.boolean().default(true),
+  rememberConsent: import_lazy_zod10.z.boolean().default(true),
   /**
    * Tools to exclude from consent (always available)
    * Useful for essential tools that should always be accessible
    */
-  excludedTools: import_zod10.z.array(import_zod10.z.string()).optional(),
+  excludedTools: import_lazy_zod10.z.array(import_lazy_zod10.z.string()).optional(),
   /**
    * Tools to always include in consent (pre-selected)
    */
-  defaultSelectedTools: import_zod10.z.array(import_zod10.z.string()).optional()
+  defaultSelectedTools: import_lazy_zod10.z.array(import_lazy_zod10.z.string()).optional()
 });
-var federatedAuthConfigSchema = import_zod10.z.object({
+var federatedAuthConfigSchema = import_lazy_zod10.z.object({
   /**
    * How strictly to validate the OAuth state parameter on provider callbacks.
    * - 'strict': require exact match to stored state (default, safest)
    * - 'format': validate only "federated:{sessionId}:{nonce}" format
    * @default 'strict'
    */
-  stateValidation: import_zod10.z.enum(["strict", "format"]).default("strict")
+  stateValidation: import_lazy_zod10.z.enum(["strict", "format"]).default("strict")
 });
-var incrementalAuthConfigSchema = import_zod10.z.object({
+var incrementalAuthConfigSchema = import_lazy_zod10.z.object({
   /**
    * Enable incremental (progressive) authorization
    * When enabled, users can skip app authorizations during initial auth
    * and authorize individual apps later when needed
    * @default true
    */
-  enabled: import_zod10.z.boolean().default(true),
+  enabled: import_lazy_zod10.z.boolean().default(true),
   /**
    * Behavior when a tool from a skipped app is called
    * - 'anonymous': If app supports anonymous access, use it; otherwise require auth
@@ -6604,33 +6555,33 @@ var incrementalAuthConfigSchema = import_zod10.z.object({
    * Allow users to skip app authorization during initial auth flow
    * @default true
    */
-  allowSkip: import_zod10.z.boolean().default(true),
+  allowSkip: import_lazy_zod10.z.boolean().default(true),
   /**
    * Show all apps in a single authorization page (vs step-by-step)
    * @default true
    */
-  showAllAppsAtOnce: import_zod10.z.boolean().default(true)
+  showAllAppsAtOnce: import_lazy_zod10.z.boolean().default(true)
 });
 
 // libs/auth/src/options/public.schema.ts
-var import_zod11 = require("zod");
-var publicAuthOptionsSchema = import_zod11.z.object({
-  mode: import_zod11.z.literal("public"),
+var import_lazy_zod11 = require("@frontmcp/lazy-zod");
+var publicAuthOptionsSchema = import_lazy_zod11.z.object({
+  mode: import_lazy_zod11.z.literal("public"),
   /**
    * Issuer identifier for anonymous JWTs
    * @default auto-derived from server URL
    */
-  issuer: import_zod11.z.string().optional(),
+  issuer: import_lazy_zod11.z.string().optional(),
   /**
    * Anonymous session TTL in seconds
    * @default 3600 (1 hour)
    */
-  sessionTtl: import_zod11.z.number().default(3600),
+  sessionTtl: import_lazy_zod11.z.number().default(3600),
   /**
    * Scopes granted to anonymous sessions
    * @default ['anonymous']
    */
-  anonymousScopes: import_zod11.z.array(import_zod11.z.string()).default(["anonymous"]),
+  anonymousScopes: import_lazy_zod11.z.array(import_lazy_zod11.z.string()).default(["anonymous"]),
   /**
    * Tool/prompt access configuration for anonymous users
    */
@@ -6644,13 +6595,13 @@ var publicAuthOptionsSchema = import_zod11.z.object({
    * Private key for signing anonymous tokens
    * @default auto-generated
    */
-  signKey: jwkSchema.or(import_zod11.z.instanceof(Uint8Array)).optional()
+  signKey: jwkSchema.or(import_lazy_zod11.z.instanceof(Uint8Array)).optional()
 });
 
 // libs/auth/src/options/transparent.schema.ts
-var import_zod12 = require("zod");
-var transparentAuthOptionsSchema = import_zod12.z.object({
-  mode: import_zod12.z.literal("transparent"),
+var import_lazy_zod12 = require("@frontmcp/lazy-zod");
+var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
+  mode: import_lazy_zod12.z.literal("transparent"),
   /**
    * Flattened remote provider fields (provider, clientId, clientSecret, scopes, providerConfig)
    */
@@ -6659,23 +6610,23 @@ var transparentAuthOptionsSchema = import_zod12.z.object({
    * Expected token audience
    * If not set, defaults to the resource URL
    */
-  expectedAudience: import_zod12.z.union([import_zod12.z.string(), import_zod12.z.array(import_zod12.z.string())]).optional(),
+  expectedAudience: import_lazy_zod12.z.union([import_lazy_zod12.z.string(), import_lazy_zod12.z.array(import_lazy_zod12.z.string())]).optional(),
   /**
    * Required scopes for access
    * Empty array means any valid token is accepted
    * @default []
    */
-  requiredScopes: import_zod12.z.array(import_zod12.z.string()).default([]),
+  requiredScopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default([]),
   /**
    * Allow anonymous fallback when no token is provided
    * @default false
    */
-  allowAnonymous: import_zod12.z.boolean().default(false),
+  allowAnonymous: import_lazy_zod12.z.boolean().default(false),
   /**
    * Scopes granted to anonymous sessions (when allowAnonymous=true)
    * @default ['anonymous']
    */
-  anonymousScopes: import_zod12.z.array(import_zod12.z.string()).default(["anonymous"]),
+  anonymousScopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default(["anonymous"]),
   /**
    * Public access config for anonymous users (when allowAnonymous=true)
    */
@@ -6683,26 +6634,26 @@ var transparentAuthOptionsSchema = import_zod12.z.object({
 });
 
 // libs/auth/src/options/orchestrated.schema.ts
-var import_zod13 = require("zod");
+var import_lazy_zod13 = require("@frontmcp/lazy-zod");
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
-  allowDefaultPublic: import_zod13.z.boolean().default(false),
-  anonymousScopes: import_zod13.z.array(import_zod13.z.string()).default(["anonymous"]),
+  allowDefaultPublic: import_lazy_zod13.z.boolean().default(false),
+  anonymousScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default(["anonymous"]),
   publicAccess: publicAccessConfigSchema.optional(),
   consent: consentConfigSchema.optional(),
   federatedAuth: federatedAuthConfigSchema.optional(),
   refresh: tokenRefreshConfigSchema.optional(),
-  expectedAudience: import_zod13.z.union([import_zod13.z.string(), import_zod13.z.array(import_zod13.z.string())]).optional(),
+  expectedAudience: import_lazy_zod13.z.union([import_lazy_zod13.z.string(), import_lazy_zod13.z.array(import_lazy_zod13.z.string())]).optional(),
   incrementalAuth: incrementalAuthConfigSchema.optional(),
   cimd: cimdConfigSchema.optional()
 };
-var localAuthSchema = import_zod13.z.object({
-  mode: import_zod13.z.literal("local"),
+var localAuthSchema = import_lazy_zod13.z.object({
+  mode: import_lazy_zod13.z.literal("local"),
   ...sharedAuthFields
 });
-var remoteAuthSchema = import_zod13.z.object({
-  mode: import_zod13.z.literal("remote"),
+var remoteAuthSchema = import_lazy_zod13.z.object({
+  mode: import_lazy_zod13.z.literal("remote"),
   ...flatRemoteProviderFields,
   ...sharedAuthFields
 });
@@ -6710,8 +6661,8 @@ var orchestratedLocalSchema = localAuthSchema;
 var orchestratedRemoteSchema = remoteAuthSchema;
 
 // libs/auth/src/options/schema.ts
-var import_zod14 = require("zod");
-var authOptionsSchema = import_zod14.z.union([
+var import_lazy_zod14 = require("@frontmcp/lazy-zod");
+var authOptionsSchema = import_lazy_zod14.z.union([
   publicAuthOptionsSchema,
   transparentAuthOptionsSchema,
   localAuthSchema,
@@ -6719,12 +6670,12 @@ var authOptionsSchema = import_zod14.z.union([
 ]);
 
 // libs/auth/src/options/app-auth.schema.ts
-var import_zod15 = require("zod");
+var import_lazy_zod15 = require("@frontmcp/lazy-zod");
 var standaloneOptionSchema = {
-  standalone: import_zod15.z.boolean().optional(),
-  excludeFromParent: import_zod15.z.boolean().optional()
+  standalone: import_lazy_zod15.z.boolean().optional(),
+  excludeFromParent: import_lazy_zod15.z.boolean().optional()
 };
-var appAuthOptionsSchema = import_zod15.z.union([
+var appAuthOptionsSchema = import_lazy_zod15.z.union([
   publicAuthOptionsSchema.extend(standaloneOptionSchema),
   transparentAuthOptionsSchema.extend(standaloneOptionSchema),
   localAuthSchema.extend(standaloneOptionSchema),
@@ -6764,108 +6715,108 @@ function allowsPublicAccess(options) {
 }
 
 // libs/auth/src/consent/consent.types.ts
-var import_zod16 = require("zod");
-var consentToolItemSchema = import_zod16.z.object({
+var import_lazy_zod16 = require("@frontmcp/lazy-zod");
+var consentToolItemSchema = import_lazy_zod16.z.object({
   /** Tool ID (e.g., 'slack:send_message') */
-  id: import_zod16.z.string().min(1),
+  id: import_lazy_zod16.z.string().min(1),
   /** Tool name for display */
-  name: import_zod16.z.string().min(1),
+  name: import_lazy_zod16.z.string().min(1),
   /** Tool description */
-  description: import_zod16.z.string().optional(),
+  description: import_lazy_zod16.z.string().optional(),
   /** App ID this tool belongs to */
-  appId: import_zod16.z.string().min(1),
+  appId: import_lazy_zod16.z.string().min(1),
   /** App name for display */
-  appName: import_zod16.z.string().min(1),
+  appName: import_lazy_zod16.z.string().min(1),
   /** Whether the tool is selected by default */
-  defaultSelected: import_zod16.z.boolean().default(true),
+  defaultSelected: import_lazy_zod16.z.boolean().default(true),
   /** Whether this tool requires specific scopes */
-  requiredScopes: import_zod16.z.array(import_zod16.z.string()).optional(),
+  requiredScopes: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional(),
   /** Category for grouping (e.g., 'read', 'write', 'admin') */
-  category: import_zod16.z.string().optional()
+  category: import_lazy_zod16.z.string().optional()
 });
-var consentSelectionSchema = import_zod16.z.object({
+var consentSelectionSchema = import_lazy_zod16.z.object({
   /** Selected tool IDs */
-  selectedTools: import_zod16.z.array(import_zod16.z.string()),
+  selectedTools: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
   /** Whether all tools were selected */
-  allSelected: import_zod16.z.boolean(),
+  allSelected: import_lazy_zod16.z.boolean(),
   /** Timestamp when consent was given */
-  consentedAt: import_zod16.z.string().datetime(),
+  consentedAt: import_lazy_zod16.z.string().datetime(),
   /** Consent version for tracking changes */
-  consentVersion: import_zod16.z.string().default("1.0")
+  consentVersion: import_lazy_zod16.z.string().default("1.0")
 });
-var consentStateSchema = import_zod16.z.object({
+var consentStateSchema = import_lazy_zod16.z.object({
   /** Whether consent flow is enabled */
-  enabled: import_zod16.z.boolean(),
+  enabled: import_lazy_zod16.z.boolean(),
   /** Available tools for consent */
-  availableTools: import_zod16.z.array(consentToolItemSchema),
+  availableTools: import_lazy_zod16.z.array(consentToolItemSchema),
   /** Pre-selected tools (from previous consent or defaults) */
-  preselectedTools: import_zod16.z.array(import_zod16.z.string()).optional(),
+  preselectedTools: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional(),
   /** Whether to show all tools or group by app */
-  groupByApp: import_zod16.z.boolean().default(true),
+  groupByApp: import_lazy_zod16.z.boolean().default(true),
   /** Custom consent message */
-  customMessage: import_zod16.z.string().optional()
+  customMessage: import_lazy_zod16.z.string().optional()
 });
-var federatedProviderItemSchema = import_zod16.z.object({
+var federatedProviderItemSchema = import_lazy_zod16.z.object({
   /** Provider ID (derived or explicit) */
-  id: import_zod16.z.string().min(1),
+  id: import_lazy_zod16.z.string().min(1),
   /** Provider display name */
-  name: import_zod16.z.string().min(1),
+  name: import_lazy_zod16.z.string().min(1),
   /** Provider description */
-  description: import_zod16.z.string().optional(),
+  description: import_lazy_zod16.z.string().optional(),
   /** Provider icon URL or emoji */
-  icon: import_zod16.z.string().optional(),
+  icon: import_lazy_zod16.z.string().optional(),
   /** Provider type */
-  type: import_zod16.z.enum(["local", "remote", "transparent"]),
+  type: import_lazy_zod16.z.enum(["local", "remote", "transparent"]),
   /** OAuth provider URL (for remote providers) */
-  providerUrl: import_zod16.z.string().url().optional(),
+  providerUrl: import_lazy_zod16.z.string().url().optional(),
   /** Apps using this provider */
-  appIds: import_zod16.z.array(import_zod16.z.string()),
+  appIds: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
   /** App names using this provider */
-  appNames: import_zod16.z.array(import_zod16.z.string()),
+  appNames: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
   /** Scopes required by this provider */
-  scopes: import_zod16.z.array(import_zod16.z.string()),
+  scopes: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
   /** Whether this is the primary/parent provider */
-  isPrimary: import_zod16.z.boolean(),
+  isPrimary: import_lazy_zod16.z.boolean(),
   /** Whether this provider is optional (can be skipped) */
-  isOptional: import_zod16.z.boolean().default(false)
+  isOptional: import_lazy_zod16.z.boolean().default(false)
 });
-var federatedLoginStateSchema = import_zod16.z.object({
+var federatedLoginStateSchema = import_lazy_zod16.z.object({
   /** All available providers */
-  providers: import_zod16.z.array(federatedProviderItemSchema),
+  providers: import_lazy_zod16.z.array(federatedProviderItemSchema),
   /** Primary provider ID (if any) */
-  primaryProviderId: import_zod16.z.string().optional(),
+  primaryProviderId: import_lazy_zod16.z.string().optional(),
   /** Whether user can skip optional providers */
-  allowSkip: import_zod16.z.boolean().default(true),
+  allowSkip: import_lazy_zod16.z.boolean().default(true),
   /** Pre-selected provider IDs (from previous session) */
-  preselectedProviders: import_zod16.z.array(import_zod16.z.string()).optional()
+  preselectedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional()
 });
-var federatedSelectionSchema = import_zod16.z.object({
+var federatedSelectionSchema = import_lazy_zod16.z.object({
   /** Selected provider IDs */
-  selectedProviders: import_zod16.z.array(import_zod16.z.string()),
+  selectedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
   /** Skipped provider IDs */
-  skippedProviders: import_zod16.z.array(import_zod16.z.string()),
+  skippedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
   /** Provider-specific metadata */
-  providerMetadata: import_zod16.z.record(import_zod16.z.string(), import_zod16.z.unknown()).optional()
+  providerMetadata: import_lazy_zod16.z.record(import_lazy_zod16.z.string(), import_lazy_zod16.z.unknown()).optional()
 });
 
 // libs/auth/src/detection/auth-provider-detection.ts
-var import_zod17 = require("zod");
-var detectedAuthProviderSchema = import_zod17.z.object({
-  id: import_zod17.z.string(),
-  providerUrl: import_zod17.z.string().optional(),
-  mode: import_zod17.z.enum(["public", "transparent", "local", "remote"]),
-  appIds: import_zod17.z.array(import_zod17.z.string()),
-  scopes: import_zod17.z.array(import_zod17.z.string()),
-  isParentProvider: import_zod17.z.boolean()
+var import_lazy_zod17 = require("@frontmcp/lazy-zod");
+var detectedAuthProviderSchema = import_lazy_zod17.z.object({
+  id: import_lazy_zod17.z.string(),
+  providerUrl: import_lazy_zod17.z.string().optional(),
+  mode: import_lazy_zod17.z.enum(["public", "transparent", "local", "remote"]),
+  appIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
+  scopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
+  isParentProvider: import_lazy_zod17.z.boolean()
 });
-var authProviderDetectionResultSchema = import_zod17.z.object({
-  providers: import_zod17.z.map(import_zod17.z.string(), detectedAuthProviderSchema),
-  requiresOrchestration: import_zod17.z.boolean(),
-  parentProviderId: import_zod17.z.string().optional(),
-  childProviderIds: import_zod17.z.array(import_zod17.z.string()),
-  uniqueProviderCount: import_zod17.z.number(),
-  validationErrors: import_zod17.z.array(import_zod17.z.string()),
-  warnings: import_zod17.z.array(import_zod17.z.string())
+var authProviderDetectionResultSchema = import_lazy_zod17.z.object({
+  providers: import_lazy_zod17.z.map(import_lazy_zod17.z.string(), detectedAuthProviderSchema),
+  requiresOrchestration: import_lazy_zod17.z.boolean(),
+  parentProviderId: import_lazy_zod17.z.string().optional(),
+  childProviderIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
+  uniqueProviderCount: import_lazy_zod17.z.number(),
+  validationErrors: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
+  warnings: import_lazy_zod17.z.array(import_lazy_zod17.z.string())
 });
 function deriveProviderId(options) {
   if (isPublicMode(options)) {
@@ -7255,43 +7206,43 @@ var AudienceValidator = class _AudienceValidator {
 };
 
 // libs/auth/src/vault/auth-providers.types.ts
-var import_zod18 = require("zod");
-var credentialScopeSchema = import_zod18.z.enum(["global", "user", "session"]);
-var loadingStrategySchema = import_zod18.z.enum(["eager", "lazy"]);
-var getCredentialOptionsSchema = import_zod18.z.object({
-  forceRefresh: import_zod18.z.boolean().optional(),
-  scopes: import_zod18.z.array(import_zod18.z.string()).optional(),
-  timeout: import_zod18.z.number().positive().optional()
+var import_lazy_zod18 = require("@frontmcp/lazy-zod");
+var credentialScopeSchema = import_lazy_zod18.z.enum(["global", "user", "session"]);
+var loadingStrategySchema = import_lazy_zod18.z.enum(["eager", "lazy"]);
+var getCredentialOptionsSchema = import_lazy_zod18.z.object({
+  forceRefresh: import_lazy_zod18.z.boolean().optional(),
+  scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()).optional(),
+  timeout: import_lazy_zod18.z.number().positive().optional()
 }).strict();
-var credentialProviderConfigSchema = import_zod18.z.object({
-  name: import_zod18.z.string().min(1),
-  description: import_zod18.z.string().optional(),
+var credentialProviderConfigSchema = import_lazy_zod18.z.object({
+  name: import_lazy_zod18.z.string().min(1),
+  description: import_lazy_zod18.z.string().optional(),
   scope: credentialScopeSchema,
   loading: loadingStrategySchema,
-  cacheTtl: import_zod18.z.number().nonnegative().optional(),
+  cacheTtl: import_lazy_zod18.z.number().nonnegative().optional(),
   // Functions validated at runtime, not via Zod (Zod 4 compatibility)
-  factory: import_zod18.z.any(),
-  refresh: import_zod18.z.any().optional(),
-  toHeaders: import_zod18.z.any().optional(),
-  metadata: import_zod18.z.record(import_zod18.z.string(), import_zod18.z.unknown()).optional(),
-  required: import_zod18.z.boolean().optional()
+  factory: import_lazy_zod18.z.any(),
+  refresh: import_lazy_zod18.z.any().optional(),
+  toHeaders: import_lazy_zod18.z.any().optional(),
+  metadata: import_lazy_zod18.z.record(import_lazy_zod18.z.string(), import_lazy_zod18.z.unknown()).optional(),
+  required: import_lazy_zod18.z.boolean().optional()
 }).strict();
-var authProviderMappingSchema = import_zod18.z.union([
-  import_zod18.z.string(),
-  import_zod18.z.object({
-    name: import_zod18.z.string().min(1),
-    required: import_zod18.z.boolean().optional().default(true),
-    scopes: import_zod18.z.array(import_zod18.z.string()).optional(),
-    alias: import_zod18.z.string().optional()
+var authProviderMappingSchema = import_lazy_zod18.z.union([
+  import_lazy_zod18.z.string(),
+  import_lazy_zod18.z.object({
+    name: import_lazy_zod18.z.string().min(1),
+    required: import_lazy_zod18.z.boolean().optional().default(true),
+    scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()).optional(),
+    alias: import_lazy_zod18.z.string().optional()
   }).strict()
 ]);
-var authProvidersVaultOptionsSchema = import_zod18.z.object({
-  enabled: import_zod18.z.boolean().optional(),
-  useSharedStorage: import_zod18.z.boolean().optional().default(true),
-  namespace: import_zod18.z.string().optional().default("authproviders:"),
-  defaultCacheTtl: import_zod18.z.number().nonnegative().optional().default(36e5),
-  maxCredentialsPerSession: import_zod18.z.number().positive().optional().default(100),
-  providers: import_zod18.z.array(credentialProviderConfigSchema).optional()
+var authProvidersVaultOptionsSchema = import_lazy_zod18.z.object({
+  enabled: import_lazy_zod18.z.boolean().optional(),
+  useSharedStorage: import_lazy_zod18.z.boolean().optional().default(true),
+  namespace: import_lazy_zod18.z.string().optional().default("authproviders:"),
+  defaultCacheTtl: import_lazy_zod18.z.number().nonnegative().optional().default(36e5),
+  maxCredentialsPerSession: import_lazy_zod18.z.number().positive().optional().default(100),
+  providers: import_lazy_zod18.z.array(credentialProviderConfigSchema).optional()
 }).strict();
 
 // libs/auth/src/vault/credential-helpers.ts
@@ -7496,7 +7447,7 @@ var CredentialCache = class {
 var AUTH_PROVIDERS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_ACCESSOR");
 
 // libs/auth/src/vault/auth-providers.accessor.impl.ts
-var import_utils33 = require("@frontmcp/utils");
+var import_utils31 = require("@frontmcp/utils");
 var AuthProvidersAccessorImpl = class {
   constructor(registry, vault, cache, loader, context, logger) {
     this.registry = registry;
@@ -7705,7 +7656,7 @@ var AuthProvidersAccessorImpl = class {
         return { [credential.headerName]: credential.key };
       case "basic": {
         const value = `${credential.username}:${credential.password}`;
-        const encoded = credential.encodedValue ?? (0, import_utils33.base64Encode)(new TextEncoder().encode(value));
+        const encoded = credential.encodedValue ?? (0, import_utils31.base64Encode)(new TextEncoder().encode(value));
         return { Authorization: `Basic ${encoded}` };
       }
       case "custom":
@@ -8256,6 +8207,971 @@ var LazyCredentialLoader = class {
     this.loading.clear();
   }
 };
+
+// libs/auth/src/authorities/authorities.context.ts
+function resolveDotPath(obj, path) {
+  if (path in obj) {
+    return obj[path];
+  }
+  const segments = path.split(".");
+  let current = obj;
+  for (const segment of segments) {
+    if (current === null || current === void 0 || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  if (typeof value === "string") {
+    return value.split(/\s+/).filter(Boolean);
+  }
+  return [];
+}
+var noopRelationshipResolver = {
+  async check() {
+    return false;
+  }
+};
+var AuthoritiesContextBuilder = class {
+  claimsMapping;
+  claimsResolver;
+  relationshipResolver;
+  constructor(options = {}) {
+    this.claimsMapping = options.claimsMapping;
+    this.claimsResolver = options.claimsResolver;
+    this.relationshipResolver = options.relationshipResolver ?? noopRelationshipResolver;
+  }
+  /**
+   * Build an evaluation context from AuthInfo and tool input.
+   */
+  build(authInfo, input = {}, env = {}) {
+    if (this.claimsResolver) {
+      const resolved = this.claimsResolver(authInfo);
+      return {
+        user: {
+          sub: authInfo?.user?.sub ?? "",
+          roles: resolved.roles,
+          permissions: resolved.permissions,
+          claims: resolved.claims
+        },
+        input,
+        env,
+        relationships: this.relationshipResolver
+      };
+    }
+    const user = authInfo?.user ?? {};
+    const authorization = authInfo?.extra?.["authorization"];
+    const authorizationClaims = authorization?.["claims"] ?? {};
+    const rawClaims = {
+      ...authorizationClaims,
+      ...user
+    };
+    let roles;
+    if (this.claimsMapping?.roles) {
+      roles = toStringArray(resolveDotPath(rawClaims, this.claimsMapping.roles));
+    } else {
+      roles = toStringArray(
+        user["roles"] ?? authorization?.["scopes"] ?? []
+      );
+    }
+    let permissions;
+    if (this.claimsMapping?.permissions) {
+      permissions = toStringArray(resolveDotPath(rawClaims, this.claimsMapping.permissions));
+    } else {
+      permissions = toStringArray(user["permissions"] ?? []);
+    }
+    const sub = this.claimsMapping?.userId ? String(resolveDotPath(rawClaims, this.claimsMapping.userId) ?? "") : user.sub ?? "";
+    return {
+      user: {
+        sub,
+        roles,
+        permissions,
+        claims: rawClaims
+      },
+      input,
+      env,
+      relationships: this.relationshipResolver
+    };
+  }
+};
+
+// libs/auth/src/context/frontmcp-auth-context.impl.ts
+function toStringArray2(value) {
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  if (typeof value === "string") {
+    return value.split(/\s+/).filter(Boolean);
+  }
+  return [];
+}
+var FrontMcpAuthContextImpl = class {
+  user;
+  isAnonymous;
+  mode;
+  sessionId;
+  scopes;
+  claims;
+  roles;
+  permissions;
+  constructor(source, claimsMapping) {
+    const rawUser = source.user ?? {};
+    const sub = claimsMapping?.userId ? String(resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) ?? rawUser.sub ?? "") : String(rawUser.sub ?? "");
+    this.user = Object.freeze({
+      sub,
+      name: rawUser.name,
+      email: rawUser.email,
+      picture: rawUser.picture
+    });
+    this.isAnonymous = sub === "" || sub.startsWith("anon:");
+    const extraAuth = source.extra?.["authorization"];
+    this.mode = String(
+      source.extra?.["authMode"] ?? extraAuth?.["mode"] ?? (source.extra?.["isPublic"] === true || rawUser["anonymous"] === true ? "public" : "authenticated")
+    );
+    this.sessionId = typeof source.sessionId === "string" ? source.sessionId : "";
+    this.scopes = Object.freeze(
+      Array.isArray(source.scopes) ? source.scopes.filter((s) => typeof s === "string") : []
+    );
+    const rawClaims = this.buildRawClaims(source);
+    this.claims = Object.freeze({ ...rawClaims });
+    if (claimsMapping?.roles) {
+      this.roles = Object.freeze([...toStringArray2(resolveDotPath(rawClaims, claimsMapping.roles))]);
+    } else {
+      this.roles = Object.freeze([
+        ...toStringArray2(rawUser["roles"] ?? extraAuth?.["scopes"] ?? [])
+      ]);
+    }
+    if (claimsMapping?.permissions) {
+      this.permissions = Object.freeze([...toStringArray2(resolveDotPath(rawClaims, claimsMapping.permissions))]);
+    } else {
+      this.permissions = Object.freeze([...toStringArray2(rawUser["permissions"] ?? [])]);
+    }
+  }
+  // -- Query methods -------------------------------------------------
+  hasRole(role) {
+    return this.roles.includes(role);
+  }
+  hasAllRoles(roles) {
+    return roles.every((r) => this.roles.includes(r));
+  }
+  hasAnyRole(roles) {
+    return roles.some((r) => this.roles.includes(r));
+  }
+  hasPermission(permission) {
+    return this.permissions.includes(permission);
+  }
+  hasAllPermissions(permissions) {
+    return permissions.every((p) => this.permissions.includes(p));
+  }
+  hasAnyPermission(permissions) {
+    return permissions.some((p) => this.permissions.includes(p));
+  }
+  hasScope(scope) {
+    return this.scopes.includes(scope);
+  }
+  hasAllScopes(scopes) {
+    return scopes.every((s) => this.scopes.includes(s));
+  }
+  hasAnyScope(scopes) {
+    return scopes.some((s) => this.scopes.includes(s));
+  }
+  // -- Internal helpers ----------------------------------------------
+  /**
+   * Build the merged raw claims map from user fields + extra.authorization.claims.
+   * Mirrors the logic in AuthoritiesContextBuilder.build().
+   */
+  buildRawClaims(source) {
+    const rawUser = source.user ?? {};
+    const extraAuth = source.extra?.["authorization"];
+    const authorizationClaims = extraAuth?.["claims"] ?? {};
+    return {
+      ...authorizationClaims,
+      ...rawUser
+    };
+  }
+};
+
+// libs/auth/src/context/frontmcp-auth-context.factory.ts
+function buildAuthContext(authInfo, claimsMapping, pipes) {
+  const base = new FrontMcpAuthContextImpl(authInfo, claimsMapping);
+  if (!pipes || pipes.length === 0) {
+    return base;
+  }
+  return runPipes(base, pipes);
+}
+async function runPipes(base, pipes) {
+  const extensions = {};
+  for (const pipe of pipes) {
+    try {
+      const result = await pipe(base.claims);
+      if (result && typeof result === "object") {
+        Object.assign(extensions, result);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[FrontMcpAuth] pipe failed: ${message}`);
+    }
+  }
+  const merged = Object.create(Object.getPrototypeOf(base));
+  Object.assign(merged, base, extensions);
+  return Object.freeze(merged);
+}
+
+// libs/auth/src/authorities/authorities.scope-mapping.ts
+function resolveRequiredScopes(denial, mapping, authorities) {
+  const scopes = /* @__PURE__ */ new Set();
+  if (typeof authorities === "string" && mapping.profiles?.[authorities]) {
+    mapping.profiles[authorities].forEach((s) => scopes.add(s));
+  }
+  if (Array.isArray(authorities)) {
+    for (const profileName of authorities) {
+      if (typeof profileName === "string" && mapping.profiles?.[profileName]) {
+        mapping.profiles[profileName].forEach((s) => scopes.add(s));
+      }
+    }
+  }
+  if (denial.kind === "roles" && denial.missing && mapping.roles) {
+    for (const role of denial.missing) {
+      const mapped = mapping.roles[role];
+      if (mapped) mapped.forEach((s) => scopes.add(s));
+    }
+  }
+  if (denial.kind === "permissions" && denial.missing && mapping.permissions) {
+    for (const perm of denial.missing) {
+      const mapped = mapping.permissions[perm];
+      if (mapped) mapped.forEach((s) => scopes.add(s));
+    }
+  }
+  return scopes.size > 0 ? [...scopes].sort() : void 0;
+}
+
+// libs/auth/src/authorities/authorities.schema.ts
+var import_lazy_zod19 = require("@frontmcp/lazy-zod");
+var rbacRolesPolicySchema = import_lazy_zod19.z.object({
+  all: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional(),
+  any: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional()
+}).refine((data) => data.all !== void 0 || data.any !== void 0, {
+  message: 'Roles policy must have at least "all" or "any"'
+});
+var rbacPermissionsPolicySchema = import_lazy_zod19.z.object({
+  all: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional(),
+  any: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional()
+}).refine((data) => data.all !== void 0 || data.any !== void 0, {
+  message: 'Permissions policy must have at least "all" or "any"'
+});
+var abacOperatorSchema = import_lazy_zod19.z.enum([
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "exists",
+  "matches"
+]);
+var abacConditionSchema = import_lazy_zod19.z.object({
+  path: import_lazy_zod19.z.string().min(1),
+  op: abacOperatorSchema,
+  value: import_lazy_zod19.z.unknown()
+});
+var abacPolicySchema = import_lazy_zod19.z.object({
+  match: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
+  conditions: import_lazy_zod19.z.array(abacConditionSchema).optional()
+}).refine((data) => data.match !== void 0 || data.conditions !== void 0, {
+  message: 'Attributes policy must have at least "match" or "conditions"'
+});
+var resourceIdRefSchema = import_lazy_zod19.z.union([
+  import_lazy_zod19.z.string().min(1),
+  import_lazy_zod19.z.object({ fromInput: import_lazy_zod19.z.string().min(1) }).strict(),
+  import_lazy_zod19.z.object({ fromClaims: import_lazy_zod19.z.string().min(1) }).strict()
+]);
+var rebacPolicySchema = import_lazy_zod19.z.object({
+  type: import_lazy_zod19.z.string().min(1),
+  resource: import_lazy_zod19.z.string().min(1),
+  resourceId: resourceIdRefSchema
+});
+var basePolicyShape = {
+  roles: rbacRolesPolicySchema.optional(),
+  permissions: rbacPermissionsPolicySchema.optional(),
+  attributes: abacPolicySchema.optional(),
+  relationships: import_lazy_zod19.z.union([rebacPolicySchema, import_lazy_zod19.z.array(rebacPolicySchema)]).optional(),
+  custom: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
+  guards: import_lazy_zod19.z.array(import_lazy_zod19.z.instanceof(Function)).optional(),
+  operator: import_lazy_zod19.z.enum(["AND", "OR"]).optional()
+};
+var authoritiesPolicySchema = import_lazy_zod19.z.lazy(
+  () => import_lazy_zod19.z.object({
+    ...basePolicyShape,
+    not: authoritiesPolicySchema.optional(),
+    anyOf: import_lazy_zod19.z.array(authoritiesPolicySchema).optional(),
+    allOf: import_lazy_zod19.z.array(authoritiesPolicySchema).optional()
+  })
+);
+var authoritiesMetadataSchema = import_lazy_zod19.z.union([
+  import_lazy_zod19.z.string().min(1),
+  import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).min(1),
+  authoritiesPolicySchema
+]);
+var authoritiesClaimsMappingSchema = import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
+  message: "Claims mapping must have at least one mapping"
+});
+var authoritiesConfigSchema = import_lazy_zod19.z.object({
+  claimsMapping: authoritiesClaimsMappingSchema.optional(),
+  profiles: import_lazy_zod19.z.record(import_lazy_zod19.z.string().min(1), authoritiesPolicySchema).optional()
+});
+
+// libs/auth/src/authorities/authorities.evaluator.ts
+function evaluateRbacRoles(policy, ctx) {
+  const userRoles = ctx.user.roles;
+  if (policy.all) {
+    const missing = policy.all.filter((r) => !userRoles.includes(r));
+    if (missing.length > 0) {
+      return {
+        granted: false,
+        deniedBy: `roles.all: missing ${missing.map((r) => `'${r}'`).join(", ")}`,
+        denial: { kind: "roles", path: "roles.all", missing },
+        evaluatedPolicies: ["roles.all"]
+      };
+    }
+  }
+  if (policy.any) {
+    const hasAny = policy.any.some((r) => userRoles.includes(r));
+    if (!hasAny) {
+      return {
+        granted: false,
+        deniedBy: `roles.any: user has none of ${policy.any.map((r) => `'${r}'`).join(", ")}`,
+        denial: { kind: "roles", path: "roles.any", missing: policy.any },
+        evaluatedPolicies: ["roles.any"]
+      };
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["roles"] };
+}
+function evaluateRbacPermissions(policy, ctx) {
+  const userPerms = ctx.user.permissions;
+  if (policy.all) {
+    const missing = policy.all.filter((p) => !userPerms.includes(p));
+    if (missing.length > 0) {
+      return {
+        granted: false,
+        deniedBy: `permissions.all: missing ${missing.map((p) => `'${p}'`).join(", ")}`,
+        denial: { kind: "permissions", path: "permissions.all", missing },
+        evaluatedPolicies: ["permissions.all"]
+      };
+    }
+  }
+  if (policy.any) {
+    const hasAny = policy.any.some((p) => userPerms.includes(p));
+    if (!hasAny) {
+      return {
+        granted: false,
+        deniedBy: `permissions.any: user has none of ${policy.any.map((p) => `'${p}'`).join(", ")}`,
+        denial: { kind: "permissions", path: "permissions.any", missing: policy.any },
+        evaluatedPolicies: ["permissions.any"]
+      };
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["permissions"] };
+}
+function buildContextEnvelope(ctx) {
+  return {
+    user: ctx.user,
+    claims: ctx.user.claims,
+    input: ctx.input,
+    env: ctx.env
+  };
+}
+function resolveValue(value, ctx) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    if ("fromInput" in obj && typeof obj["fromInput"] === "string") {
+      return ctx.input[obj["fromInput"]];
+    }
+    if ("fromClaims" in obj && typeof obj["fromClaims"] === "string") {
+      return resolveDotPath(ctx.user.claims, obj["fromClaims"]);
+    }
+  }
+  return value;
+}
+function applyOperator(actual, op, expected) {
+  switch (op) {
+    case "eq":
+      return actual === expected;
+    case "neq":
+      return actual !== expected;
+    case "in":
+      return Array.isArray(expected) && expected.includes(actual);
+    case "notIn":
+      return Array.isArray(expected) && !expected.includes(actual);
+    case "gt":
+      return typeof actual === "number" && typeof expected === "number" && actual > expected;
+    case "gte":
+      return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+    case "lt":
+      return typeof actual === "number" && typeof expected === "number" && actual < expected;
+    case "lte":
+      return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+    case "contains":
+      if (typeof actual === "string" && typeof expected === "string") return actual.includes(expected);
+      if (Array.isArray(actual)) return actual.includes(expected);
+      return false;
+    case "startsWith":
+      return typeof actual === "string" && typeof expected === "string" && actual.startsWith(expected);
+    case "endsWith":
+      return typeof actual === "string" && typeof expected === "string" && actual.endsWith(expected);
+    case "exists":
+      return expected ? actual !== void 0 && actual !== null : actual === void 0 || actual === null;
+    case "matches":
+      if (typeof actual !== "string" || typeof expected !== "string") return false;
+      if (expected.length > 256) return false;
+      if (/(\+\+|\*\*|\{\d+,\d*\}\{)/.test(expected)) return false;
+      try {
+        return new RegExp(expected).test(actual);
+      } catch {
+        return false;
+      }
+    default:
+      return false;
+  }
+}
+function evaluateCondition(condition, envelope, ctx) {
+  const actual = resolveDotPath(envelope, condition.path);
+  const expected = resolveValue(condition.value, ctx);
+  return applyOperator(actual, condition.op, expected);
+}
+function evaluateAbac(policy, ctx) {
+  const envelope = buildContextEnvelope(ctx);
+  if (policy.match) {
+    for (const [path, expectedRaw] of Object.entries(policy.match)) {
+      const actual = resolveDotPath(envelope, path);
+      const expected = resolveValue(expectedRaw, ctx);
+      if (actual !== expected) {
+        return {
+          granted: false,
+          deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
+          denial: { kind: "attributes", path: "attributes.match", expected, actual },
+          evaluatedPolicies: ["attributes.match"]
+        };
+      }
+    }
+  }
+  if (policy.conditions) {
+    for (let i = 0; i < policy.conditions.length; i++) {
+      const condition = policy.conditions[i];
+      if (!evaluateCondition(condition, envelope, ctx)) {
+        const expected = resolveValue(condition.value, ctx);
+        const actual = resolveDotPath(envelope, condition.path);
+        return {
+          granted: false,
+          deniedBy: `attributes.conditions: '${condition.path}' failed '${condition.op}' check against '${String(expected)}'`,
+          denial: { kind: "attributes", path: `attributes.conditions[${i}]`, expected, actual },
+          evaluatedPolicies: ["attributes.conditions"]
+        };
+      }
+    }
+  }
+  return { granted: true, evaluatedPolicies: ["attributes"] };
+}
+function resolveResourceId(ref, ctx) {
+  if (typeof ref === "string") return ref;
+  if ("fromInput" in ref) {
+    const val = ctx.input[ref.fromInput];
+    return typeof val === "string" ? val : void 0;
+  }
+  if ("fromClaims" in ref) {
+    const val = resolveDotPath(ctx.user.claims, ref.fromClaims);
+    return typeof val === "string" ? val : void 0;
+  }
+  return void 0;
+}
+async function evaluateSingleRebac(policy, ctx) {
+  const resourceId = resolveResourceId(policy.resourceId, ctx);
+  if (resourceId === void 0) {
+    return {
+      granted: false,
+      deniedBy: `relationships: could not resolve resourceId for ${policy.resource}`,
+      denial: {
+        kind: "relationships",
+        path: "relationships",
+        expected: `${policy.resource}:resourceId`,
+        actual: void 0
+      },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, ctx.user.sub, ctx);
+  if (!hasRelationship) {
+    return {
+      granted: false,
+      deniedBy: `relationships: user '${ctx.user.sub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
+      denial: {
+        kind: "relationships",
+        path: "relationships",
+        expected: `${policy.type}:${policy.resource}:${resourceId}`
+      },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
+  return { granted: true, evaluatedPolicies: ["relationships"] };
+}
+async function evaluateRebac(policy, ctx) {
+  const policies = Array.isArray(policy) ? policy : [policy];
+  for (const p of policies) {
+    const result = await evaluateSingleRebac(p, ctx);
+    if (!result.granted) return result;
+  }
+  return { granted: true, evaluatedPolicies: ["relationships"] };
+}
+
+// libs/auth/src/authorities/authorities.engine.ts
+function mergeResult(base, ...others) {
+  const evaluatedPolicies = [...base.evaluatedPolicies];
+  for (const other of others) {
+    evaluatedPolicies.push(...other.evaluatedPolicies);
+  }
+  return { ...base, evaluatedPolicies };
+}
+function granted(policies) {
+  return { granted: true, evaluatedPolicies: policies };
+}
+var AuthoritiesEngine = class {
+  constructor(profiles, evaluators) {
+    this.profiles = profiles;
+    this.evaluators = evaluators;
+  }
+  /**
+   * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
+   */
+  async evaluate(authorities, ctx) {
+    if (typeof authorities === "string") {
+      return this.evaluateProfile(authorities, ctx);
+    }
+    if (Array.isArray(authorities)) {
+      return this.evaluateProfileArray(authorities, ctx);
+    }
+    return this.evaluatePolicy(authorities, ctx);
+  }
+  /**
+   * Resolve and evaluate a single named profile.
+   */
+  async evaluateProfile(name, ctx) {
+    const policy = this.profiles.resolve(name);
+    if (!policy) {
+      return {
+        granted: false,
+        deniedBy: `profile '${name}' is not registered`,
+        evaluatedPolicies: [`profile:${name}`]
+      };
+    }
+    const result = await this.evaluatePolicy(policy, ctx);
+    if (!result.granted) {
+      return {
+        ...result,
+        deniedBy: `profile:${name}: ${result.deniedBy}`,
+        evaluatedPolicies: [`profile:${name}`, ...result.evaluatedPolicies]
+      };
+    }
+    return mergeResult(result, { granted: true, evaluatedPolicies: [`profile:${name}`] });
+  }
+  /**
+   * Evaluate an array of profile names (AND semantics).
+   */
+  async evaluateProfileArray(names, ctx) {
+    const allPolicies = [];
+    for (const name of names) {
+      const result = await this.evaluateProfile(name, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * Evaluate an inline policy object.
+   */
+  async evaluatePolicy(policy, ctx) {
+    const operator = policy.operator ?? "AND";
+    const results = [];
+    if (policy.roles) {
+      results.push(evaluateRbacRoles(policy.roles, ctx));
+    }
+    if (policy.permissions) {
+      results.push(evaluateRbacPermissions(policy.permissions, ctx));
+    }
+    if (policy.attributes) {
+      results.push(evaluateAbac(policy.attributes, ctx));
+    }
+    if (policy.relationships) {
+      results.push(await evaluateRebac(policy.relationships, ctx));
+    }
+    if (policy.custom) {
+      results.push(await this.evaluateCustom(policy.custom, ctx));
+    }
+    if (policy.guards && policy.guards.length > 0) {
+      results.push(await this.evaluateGuards(policy.guards, ctx));
+    }
+    if (policy.allOf) {
+      results.push(await this.evaluateAllOf(policy.allOf, ctx));
+    }
+    if (policy.anyOf) {
+      results.push(await this.evaluateAnyOf(policy.anyOf, ctx));
+    }
+    if (policy.not) {
+      results.push(await this.evaluateNot(policy.not, ctx));
+    }
+    if (results.length === 0) {
+      return granted([]);
+    }
+    return this.combineResults(results, operator);
+  }
+  /**
+   * Combine results with AND or OR semantics.
+   */
+  combineResults(results, operator) {
+    const allPolicies = results.flatMap((r) => r.evaluatedPolicies);
+    if (operator === "AND") {
+      const denied = results.find((r) => !r.granted);
+      if (denied) {
+        return { ...denied, evaluatedPolicies: allPolicies };
+      }
+      return { granted: true, evaluatedPolicies: allPolicies };
+    }
+    const anyGranted = results.some((r) => r.granted);
+    if (anyGranted) {
+      return { granted: true, evaluatedPolicies: allPolicies };
+    }
+    const firstDenied = results.find((r) => !r.granted);
+    return {
+      granted: false,
+      deniedBy: firstDenied?.deniedBy ?? "all policies denied (OR)",
+      evaluatedPolicies: allPolicies
+    };
+  }
+  /**
+   * Evaluate custom evaluators.
+   */
+  async evaluateCustom(custom, ctx) {
+    const allPolicies = [];
+    for (const [name, config] of Object.entries(custom)) {
+      const evaluator = this.evaluators.get(name);
+      if (!evaluator) {
+        return {
+          granted: false,
+          deniedBy: `custom evaluator '${name}' is not registered`,
+          evaluatedPolicies: [...allPolicies, `custom.${name}`]
+        };
+      }
+      const result = await evaluator.evaluate(config, ctx);
+      allPolicies.push(`custom.${name}`, ...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * Evaluate async guard functions in sequence.
+   * Each guard returns true (granted) or a string (denial message).
+   */
+  async evaluateGuards(guards, ctx) {
+    for (let i = 0; i < guards.length; i++) {
+      const guard = guards[i];
+      const result = await guard(ctx);
+      if (result === false || typeof result === "string") {
+        const denialMessage = typeof result === "string" ? result : `guard[${i}] denied`;
+        return {
+          granted: false,
+          deniedBy: `guards[${i}]: ${denialMessage}`,
+          denial: { kind: "custom", path: `guards[${i}]` },
+          evaluatedPolicies: ["guards"]
+        };
+      }
+    }
+    return { granted: true, evaluatedPolicies: ["guards"] };
+  }
+  /**
+   * allOf combinator — all nested policies must pass.
+   */
+  async evaluateAllOf(policies, ctx) {
+    const allPolicies = ["allOf"];
+    for (const policy of policies) {
+      const result = await this.evaluatePolicy(policy, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (!result.granted) {
+        return { ...result, evaluatedPolicies: allPolicies };
+      }
+    }
+    return { granted: true, evaluatedPolicies: allPolicies };
+  }
+  /**
+   * anyOf combinator — at least one nested policy must pass.
+   */
+  async evaluateAnyOf(policies, ctx) {
+    const allPolicies = ["anyOf"];
+    let lastDenied;
+    for (const policy of policies) {
+      const result = await this.evaluatePolicy(policy, ctx);
+      allPolicies.push(...result.evaluatedPolicies);
+      if (result.granted) {
+        return { granted: true, evaluatedPolicies: allPolicies };
+      }
+      lastDenied = result;
+    }
+    return {
+      granted: false,
+      deniedBy: lastDenied?.deniedBy ?? "no policies in anyOf",
+      denial: lastDenied?.denial ?? { kind: "anyOf", path: "anyOf" },
+      evaluatedPolicies: allPolicies
+    };
+  }
+  /**
+   * not combinator — inverts the nested policy result.
+   */
+  async evaluateNot(policy, ctx) {
+    const result = await this.evaluatePolicy(policy, ctx);
+    return {
+      granted: !result.granted,
+      deniedBy: result.granted ? "not: inner policy was granted (negated to denied)" : void 0,
+      denial: result.granted ? { kind: "not", path: "not" } : void 0,
+      evaluatedPolicies: ["not", ...result.evaluatedPolicies]
+    };
+  }
+};
+
+// libs/auth/src/authorities/authorities.registry.ts
+var AuthoritiesProfileRegistry = class {
+  profiles = /* @__PURE__ */ new Map();
+  /**
+   * Register a named profile.
+   * Overwrites any existing profile with the same name.
+   */
+  register(name, policy) {
+    this.profiles.set(name, policy);
+  }
+  /**
+   * Register multiple profiles at once.
+   */
+  registerAll(profiles) {
+    for (const [name, policy] of Object.entries(profiles)) {
+      this.profiles.set(name, policy);
+    }
+  }
+  /**
+   * Resolve a profile name to its policy.
+   * Returns `undefined` if the profile is not registered.
+   */
+  resolve(name) {
+    return this.profiles.get(name);
+  }
+  /**
+   * Check if a profile is registered.
+   */
+  has(name) {
+    return this.profiles.has(name);
+  }
+  /**
+   * Get all registered profiles.
+   */
+  getAll() {
+    const result = {};
+    for (const [name, policy] of this.profiles) {
+      result[name] = policy;
+    }
+    return result;
+  }
+  /**
+   * Get the number of registered profiles.
+   */
+  get size() {
+    return this.profiles.size;
+  }
+  /**
+   * Remove a profile by name.
+   */
+  remove(name) {
+    return this.profiles.delete(name);
+  }
+  /**
+   * Clear all profiles.
+   */
+  clear() {
+    this.profiles.clear();
+  }
+};
+var AuthoritiesEvaluatorRegistry = class {
+  evaluators = /* @__PURE__ */ new Map();
+  /**
+   * Register a custom evaluator.
+   * The evaluator's name must match the key used in `custom.*`.
+   */
+  register(name, evaluator) {
+    this.evaluators.set(name, evaluator);
+  }
+  /**
+   * Register multiple evaluators at once.
+   */
+  registerAll(evaluators) {
+    for (const [name, evaluator] of Object.entries(evaluators)) {
+      this.evaluators.set(name, evaluator);
+    }
+  }
+  /**
+   * Get an evaluator by name.
+   */
+  get(name) {
+    return this.evaluators.get(name);
+  }
+  /**
+   * Check if an evaluator is registered.
+   */
+  has(name) {
+    return this.evaluators.has(name);
+  }
+  /**
+   * Get the number of registered evaluators.
+   */
+  get size() {
+    return this.evaluators.size;
+  }
+  /**
+   * Remove an evaluator by name.
+   */
+  remove(name) {
+    return this.evaluators.delete(name);
+  }
+  /**
+   * Clear all evaluators.
+   */
+  clear() {
+    this.evaluators.clear();
+  }
+};
+
+// libs/auth/src/authorities/authorities.errors.ts
+var FORBIDDEN_CODE = -32003;
+var AuthorityDeniedError = class extends Error {
+  /** MCP error code for JSON-RPC responses */
+  mcpErrorCode = FORBIDDEN_CODE;
+  /** HTTP status code equivalent */
+  statusCode = 403;
+  /** Error classification code */
+  code = "AUTHORITY_DENIED";
+  /** Entry type that was denied */
+  entryType;
+  /** Entry name that was denied */
+  entryName;
+  /** Policy that caused the denial */
+  deniedBy;
+  /** Structured denial data (machine-parsable) */
+  denial;
+  /** Required scopes for scope challenges */
+  requiredScopes;
+  constructor(params) {
+    const msg = params.message ?? `Access denied to ${params.entryType} "${params.entryName}": ${params.deniedBy}`;
+    super(msg);
+    this.name = "AuthorityDeniedError";
+    this.entryType = params.entryType;
+    this.entryName = params.entryName;
+    this.deniedBy = params.deniedBy;
+    this.denial = params.denial;
+    this.requiredScopes = params.requiredScopes;
+  }
+  /**
+   * Convert to JSON-RPC error format.
+   */
+  toJsonRpcError() {
+    const data = {
+      entryType: this.entryType,
+      entryName: this.entryName,
+      deniedBy: this.deniedBy
+    };
+    if (this.denial !== void 0) data["denial"] = this.denial;
+    if (this.requiredScopes !== void 0) data["requiredScopes"] = this.requiredScopes;
+    return {
+      code: this.mcpErrorCode,
+      message: this.message,
+      data
+    };
+  }
+};
+
+// libs/auth/src/fetch/fetch-credential-middleware.ts
+var bearerApplier = {
+  apply(token, _url, init) {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return { init: { ...init, headers } };
+  }
+};
+function headerApplier(headerName, prefix) {
+  return {
+    apply(token, _url, init) {
+      const headers = new Headers(init.headers);
+      headers.set(headerName, prefix ? `${prefix} ${token}` : token);
+      return { init: { ...init, headers } };
+    }
+  };
+}
+function queryApplier(paramName) {
+  return {
+    apply(token, url, init) {
+      const urlObj = new URL(url);
+      urlObj.searchParams.set(paramName, token);
+      return { init, url: urlObj.toString() };
+    }
+  };
+}
+var basicApplier = {
+  apply(token, _url, init) {
+    const headers = new Headers(init.headers);
+    const encoded = typeof btoa === "function" ? btoa(token) : Buffer.from(token).toString("base64");
+    headers.set("Authorization", `Basic ${encoded}`);
+    return { init: { ...init, headers } };
+  }
+};
+function isFrontMcpCredentials(creds) {
+  return typeof creds === "object" && creds !== null && "provider" in creds && typeof creds.provider === "string" && creds.provider.length > 0;
+}
+var FetchCredentialMiddleware = class {
+  constructor(tokenAccessor, appliers) {
+    this.tokenAccessor = tokenAccessor;
+    this.appliers = new Map(Object.entries(appliers ?? {}));
+  }
+  appliers;
+  /**
+   * Inspect the `credentials` field. If it references a named provider,
+   * resolve the token and delegate to the provider's applier.
+   */
+  async applyCredentials(url, init) {
+    const creds = init.credentials;
+    if (!creds || typeof creds === "string") {
+      return { init };
+    }
+    if (!isFrontMcpCredentials(creds)) {
+      const { credentials: _removed2, ...rest } = init;
+      return { init: rest };
+    }
+    const token = await this.tokenAccessor.getToken(creds.provider);
+    if (!token) {
+      const { credentials: _removed2, ...rest } = init;
+      return { init: rest };
+    }
+    const applier = this.appliers.get(creds.provider) ?? bearerApplier;
+    const { credentials: _removed, ...cleanInit } = init;
+    return applier.apply(token, url, cleanInit);
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTH_PROVIDERS_ACCESSOR,
@@ -8269,6 +9185,11 @@ var LazyCredentialLoader = class {
   AuthProvidersNotConfiguredError,
   AuthProvidersRegistry,
   AuthProvidersVault,
+  AuthoritiesContextBuilder,
+  AuthoritiesEngine,
+  AuthoritiesEvaluatorRegistry,
+  AuthoritiesProfileRegistry,
+  AuthorityDeniedError,
   AuthorizationBase,
   CDN,
   CimdClientIdMismatchError,
@@ -8290,6 +9211,8 @@ var LazyCredentialLoader = class {
   EncryptedTypedStorage,
   EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError,
+  FetchCredentialMiddleware,
+  FrontMcpAuthContextImpl,
   InMemoryAuthorizationStore,
   InMemoryAuthorizationVault,
   InMemoryCimdCache,
@@ -8328,6 +9251,9 @@ var LazyCredentialLoader = class {
   VaultLoadError,
   VaultNotFoundError,
   VercelKvSessionStore,
+  abacConditionSchema,
+  abacOperatorSchema,
+  abacPolicySchema,
   aiPlatformTypeSchema,
   allowsPublicAccess,
   apiKeyCredentialSchema,
@@ -8343,13 +9269,20 @@ var LazyCredentialLoader = class {
   authProviderMappingSchema,
   authProvidersVaultOptionsSchema,
   authUserSchema,
+  authoritiesClaimsMappingSchema,
+  authoritiesConfigSchema,
+  authoritiesMetadataSchema,
+  authoritiesPolicySchema,
   authorizationCodeRecordSchema,
   authorizationVaultEntrySchema,
   authorizedPromptSchema,
   authorizedToolSchema,
   baseLayout,
+  basicApplier,
   basicAuthCredentialSchema,
+  bearerApplier,
   bearerCredentialSchema,
+  buildAuthContext,
   buildConsentPage,
   buildErrorPage,
   buildFederatedLoginPage,
@@ -8414,15 +9347,16 @@ var LazyCredentialLoader = class {
   generatePkceChallenge,
   getCredentialOptionsSchema,
   getKey,
-  getMachineId,
   getNextProvider,
   getProviderApps,
   getProviderScopes,
   getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris,
+  headerApplier,
   hkdfSha256,
   incrementalAuthConfigSchema,
   isCimdClientId,
+  isFrontMcpCredentials,
   isJwt,
   isLocalMode,
   isOrchestratedLocal,
@@ -8460,17 +9394,22 @@ var LazyCredentialLoader = class {
   providerConfigSchema,
   publicAccessConfigSchema,
   publicAuthOptionsSchema,
+  queryApplier,
+  rbacPermissionsPolicySchema,
+  rbacRolesPolicySchema,
+  rebacPolicySchema,
   redisConfigSchema,
   redisVaultEntrySchema,
   remoteAuthSchema,
   remoteProviderConfigSchema,
   renderToHtml,
   resetCachedKey,
+  resolveRequiredScopes,
+  resourceIdRefSchema,
   safeDecrypt,
   serviceAccountCredentialSchema,
   sessionIdPayloadSchema,
   sessionJwtPayloadSchema,
-  setMachineIdOverride,
   signSession,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,