@frontmcp/auth 1.10.15 → 1.11.0-rc.1

package/browser/jwks/jwks.service.mjs

@@ -0,0 +1,521 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// libs/auth/src/jwks/jwks.service.ts
+import {
+  bytesToHex,
+  createKeyPersistence,
+  isProduction,
+  isRedirectResponse,
+  randomBytes,
+  rsaVerify
+} from "@frontmcp/utils";
+import { resolveAndCheckHostname } from "../cimd/cimd.validator.mjs";
+import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
+import { loadJose } from "./jose.loader.mjs";
+import { normalizeIssuer, trimSlash } from "./jwks.utils.mjs";
+var TRANSPARENT_JWT_ALGS = [
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512",
+  "EdDSA"
+];
+var MAX_JWKS_FETCH_BYTES = 1048576;
+var MAX_JWKS_FETCH_HOPS = 3;
+var UNKNOWN_KID_REFETCH_COOLDOWN_MS = 6e4;
+var MISSING_EXP_ERROR = 'missing required "exp" claim';
+function isMissingExpError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { code, claim, reason } = error;
+  return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
+}
+var WEAK_KEY_WARNING = `
+\u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
+    This is considered insecure and should be updated.
+    Please contact your OAuth provider to upgrade their signing keys.
+    Verification will proceed but with reduced security guarantees.
+`;
+var JwksService = class {
+  opts;
+  logger;
+  warnedProviders = /* @__PURE__ */ new Set();
+  // Orchestrator signing material
+  orchestratorKey;
+  // Provider JWKS cache (providerId -> jwks + fetchedAt)
+  providerJwks = /* @__PURE__ */ new Map();
+  // The last key refetch an unknown `kid` started, per provider (see refetchForUnknownKid)
+  unknownKidRefetches = /* @__PURE__ */ new Map();
+  // Track if key has been initialized (for async loading)
+  keyInitialized = false;
+  // Promise guard to prevent concurrent key generation
+  keyInitPromise;
+  // KeyPersistence instance for unified key storage
+  keyPersistence;
+  constructor(opts) {
+    this.logger = opts?.logger ?? noopAuthLogger;
+    this.opts = {
+      orchestratorAlg: opts?.orchestratorAlg ?? "RS256",
+      rotateDays: opts?.rotateDays ?? 30,
+      providerJwksTtlMs: opts?.providerJwksTtlMs ?? 6 * 60 * 60 * 1e3,
+      // 6h
+      networkTimeoutMs: opts?.networkTimeoutMs ?? 5e3
+      // 5s
+    };
+  }
+  // ===========================================================================
+  // Key Persistence Helpers
+  // ===========================================================================
+  /**
+   * Get or create the KeyPersistence instance.
+   * Returns null if persistence is disabled (production).
+   */
+  async getKeyPersistence() {
+    if (isProduction()) return null;
+    if (!this.keyPersistence) {
+      this.keyPersistence = await createKeyPersistence({
+        baseDir: ".frontmcp/keys"
+      });
+    }
+    return this.keyPersistence;
+  }
+  // ===========================================================================
+  // Public JWKS (what /.well-known/jwks.json serves)
+  // ===========================================================================
+  /** Gateway's public JWKS (publish at /.well-known/jwks.json when orchestrated). */
+  async getPublicJwks() {
+    return this.getOrchestratorJwks();
+  }
+  // ===========================================================================
+  // Scope-aware verification API
+  // ===========================================================================
+  /**
+   * Verify a token against candidate transparent providers.
+   * Ensures JWKS are available (cached/TTL/AS discovery) per provider.
+   */
+  async verifyTransparentToken(token, candidates) {
+    if (!candidates?.length) return { ok: false, error: "no_providers" };
+    const { createLocalJWKSet, decodeProtectedHeader, jwtVerify } = await loadJose();
+    let kid;
+    try {
+      const header = decodeProtectedHeader(token);
+      kid = typeof header?.kid === "string" ? header.kid : void 0;
+    } catch {
+    }
+    let missingExp = false;
+    for (const p of candidates) {
+      let jwks;
+      try {
+        jwks = await this.getJwksForProvider(p);
+        if (kid && !p.jwks?.keys?.length && !jwks?.keys?.some((key) => key.kid === kid)) {
+          jwks = await this.refetchForUnknownKid(p) ?? jwks;
+        }
+        if (!jwks?.keys?.length) continue;
+        const JWKS = createLocalJWKSet(jwks);
+        const issuerConstraint = this.issuerConstraintFor(p);
+        const { payload, protectedHeader } = await jwtVerify(token, JWKS, {
+          // Pin to asymmetric algorithms so a symmetric key in the provider JWKS
+          // can't be used to accept an HMAC-signed token, and `none` is refused.
+          algorithms: [...TRANSPARENT_JWT_ALGS],
+          ...issuerConstraint ? { issuer: issuerConstraint } : {},
+          // A bearer token without `exp` would be valid forever (#272).
+          requiredClaims: ["exp"]
+        });
+        return {
+          ok: true,
+          issuer: payload?.iss,
+          sub: payload?.sub,
+          providerId: p.id,
+          header: protectedHeader,
+          payload
+        };
+      } catch (e) {
+        if (this.isWeakKeyError(e)) {
+          const fallbackJwks = jwks ?? await this.getJwksForProvider(p);
+          if (fallbackJwks?.keys?.length) {
+            const fallbackResult = await this.verifyWithWeakKey(token, fallbackJwks, p);
+            if (fallbackResult.ok) {
+              return fallbackResult;
+            }
+            if (fallbackResult.error === "missing_exp") missingExp = true;
+          }
+        }
+        if (isMissingExpError(e)) missingExp = true;
+        this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
+      }
+    }
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
+    return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
+  }
+  /**
+   * Issuer constraint passed to `jose` for a provider: the configured issuer
+   * URL plus any explicitly configured `additionalIssuers`, each accepted with
+   * and without a trailing slash (`jose` compares `iss` byte-for-byte and IdPs
+   * differ on the trailing slash).
+   *
+   * Returns `undefined` ONLY when the provider explicitly opts out via
+   * `verifyIssuer: false`, which disables issuer checking entirely. Otherwise
+   * the set is derived ONLY from configuration \u2014 the token's own `iss` claim
+   * must never be appended, since an allowlist that contains the unverified
+   * claim accepts every issuer (GHSA-hvvp-67p3-j379). An empty/whitespace
+   * `issuerUrl` yields a set that no real token can satisfy (safe fail), never
+   * a silent bypass.
+   */
+  issuerConstraintFor(p) {
+    if (p.verifyIssuer === false) return void 0;
+    const issuers = /* @__PURE__ */ new Set();
+    for (const candidate of [p.issuerUrl, ...p.additionalIssuers ?? []]) {
+      const normalized = normalizeIssuer(candidate);
+      if (!normalized) continue;
+      issuers.add(normalized);
+      issuers.add(`${normalized}/`);
+    }
+    return [...issuers];
+  }
+  /**
+   * Check if the error is due to weak RSA key (< 2048 bits)
+   */
+  isWeakKeyError(error) {
+    const message = typeof error === "object" && error !== null && "message" in error && typeof error.message === "string" ? error.message : String(error);
+    return message.includes("modulusLength") && message.includes("2048");
+  }
+  /**
+   * Fallback verification for providers using RSA keys smaller than 2048 bits.
+   * Logs a security warning but allows verification to proceed.
+   */
+  async verifyWithWeakKey(token, jwks, provider) {
+    try {
+      const parts = token.split(".");
+      if (parts.length !== 3) {
+        return { ok: false, error: "invalid_token_format" };
+      }
+      const [headerB64, payloadB64, signatureB64] = parts;
+      const header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
+      const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+      const matchingKey = this.findMatchingKey(jwks, header);
+      if (!matchingKey) {
+        return { ok: false, error: "no_matching_key" };
+      }
+      const signatureInput = `${headerB64}.${payloadB64}`;
+      const signature = Buffer.from(signatureB64, "base64url");
+      const jwtAlg = typeof header.alg === "string" ? header.alg : void 0;
+      if (!jwtAlg) {
+        return { ok: false, error: "missing_alg" };
+      }
+      const isValid = await rsaVerify(
+        jwtAlg,
+        Buffer.from(signatureInput),
+        matchingKey,
+        signature
+      );
+      if (!isValid) {
+        return { ok: false, error: "signature_invalid" };
+      }
+      if (provider.verifyIssuer !== false) {
+        const payloadIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
+        if (!payloadIssuerRaw) {
+          return { ok: false, error: "issuer_mismatch" };
+        }
+        const trustedIssuers = new Set(
+          [provider.issuerUrl, ...provider.additionalIssuers ?? []].map((issuer) => normalizeIssuer(issuer))
+        );
+        const payloadIssuer = normalizeIssuer(payloadIssuerRaw);
+        if (!trustedIssuers.has(payloadIssuer)) {
+          return { ok: false, error: "issuer_mismatch" };
+        }
+      }
+      const nowSec = Math.floor(Date.now() / 1e3);
+      if (payload.exp === void 0) {
+        return { ok: false, error: "missing_exp" };
+      }
+      if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= nowSec) {
+        return { ok: false, error: "token_expired" };
+      }
+      if (payload.nbf !== void 0 && (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > nowSec)) {
+        return { ok: false, error: "token_not_yet_valid" };
+      }
+      if (!this.warnedProviders.has(provider.id)) {
+        this.warnedProviders.add(provider.id);
+        this.logger.warn(WEAK_KEY_WARNING);
+        this.logger.warn("    Provider: %s (%s)", provider.id, provider.issuerUrl);
+      }
+      return {
+        ok: true,
+        issuer: payload.iss,
+        sub: payload.sub,
+        providerId: provider.id,
+        header,
+        payload
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "unknown";
+      return { ok: false, error: `weak_key_verification_failed: ${message}` };
+    }
+  }
+  /**
+   * Find a matching key from JWKS based on token header
+   */
+  findMatchingKey(jwks, header) {
+    if (header.kid) {
+      return jwks.keys.find((k) => k.kid === header.kid);
+    }
+    if (header.alg) {
+      const byAlg = jwks.keys.find((k) => k.alg === header.alg || k.kty === "RSA" && header.alg?.startsWith("RS"));
+      if (byAlg) return byAlg;
+    }
+    return jwks.keys.find((k) => k.kty === "RSA");
+  }
+  // ===========================================================================
+  // Provider JWKS (cache + preload + discovery)
+  // ===========================================================================
+  /** Directly set provider JWKS (e.g., inline keys from config). */
+  setProviderJwks(providerId, jwks) {
+    this.providerJwks.set(providerId, { jwks, fetchedAt: Date.now() });
+  }
+  /**
+   * Ensure JWKS for a provider:
+   *   1) inline jwks (if provided) \u2192 cache & return
+   *   2) cached & fresh (TTL)      \u2192 return
+   *   3) explicit jwksUri          \u2192 fetch, cache, return
+   *   4) `<issuer>/.well-known/jwks.json` \u2192 fetch, cache, return
+   *   5) discover jwks_uri         \u2192 the issuer's OAuth authorization server
+   *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+   *      Discovery 1.0 \u00a74, where Google, Okta, Auth0 and Entra publish it),
+   *      then fetch jwks_uri, cache, return
+   */
+  async getJwksForProvider(ref) {
+    if (ref.jwks?.keys?.length) {
+      this.setProviderJwks(ref.id, ref.jwks);
+      return ref.jwks;
+    }
+    const cached = this.providerJwks.get(ref.id);
+    if (cached && Date.now() - cached.fetchedAt < this.opts.providerJwksTtlMs) {
+      return cached.jwks;
+    }
+    const fetched = await this.fetchProviderJwks(ref);
+    if (fetched) return fetched;
+    const maxStaleMs = Math.max(this.opts.providerJwksTtlMs * 4, 6e4);
+    if (cached && Date.now() - cached.fetchedAt < maxStaleMs) {
+      return cached.jwks;
+    }
+    return void 0;
+  }
+  /**
+   * Fetch a provider's keys again for a token whose `kid` the cached keys don't have (a key the
+   * provider started using since), ahead of the cache's TTL. At most one refetch per provider per
+   * {@link UNKNOWN_KID_REFETCH_COOLDOWN_MS}: tokens that arrive meanwhile wait for the one in flight or
+   * use its result, so a flood of tokens with made-up `kid`s can't hammer the provider. Only freshly
+   * fetched keys are returned: a failed refetch never revives cached keys past the stale window.
+   */
+  refetchForUnknownKid(ref) {
+    let refetch = this.unknownKidRefetches.get(ref.id);
+    if (!refetch || Date.now() - refetch.startedAt >= UNKNOWN_KID_REFETCH_COOLDOWN_MS) {
+      refetch = { startedAt: Date.now(), done: this.fetchProviderJwks(ref) };
+      this.unknownKidRefetches.set(ref.id, refetch);
+    }
+    return refetch.done;
+  }
+  /**
+   * Fetch a provider's keys, and cache them: from `jwksUri`, else the conventional location, else
+   * the `jwks_uri` of the issuer's OAuth or OpenID metadata. Every URL goes through the same scheme
+   * and SSRF checks (`fetchJson`), `jwks_uri` included.
+   */
+  async fetchProviderJwks(ref) {
+    if (ref.jwksUri) {
+      const fromUri = await this.tryFetchJwks(ref.id, ref.jwksUri);
+      if (fromUri?.keys?.length) return fromUri;
+    }
+    const issuer = trimSlash(ref.issuerUrl);
+    const fromWellKnown = await this.tryFetchJwks(ref.id, `${issuer}/.well-known/jwks.json`);
+    if (fromWellKnown?.keys?.length) return fromWellKnown;
+    for (const document of ["oauth-authorization-server", "openid-configuration"]) {
+      const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
+      const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
+      if (uri) {
+        const fromMeta = await this.tryFetchJwks(ref.id, uri);
+        if (fromMeta?.keys?.length) return fromMeta;
+      }
+    }
+    return void 0;
+  }
+  // ===========================================================================
+  // Orchestrator keys (generation/rotation)
+  // ===========================================================================
+  /** Return the orchestrator public JWKS (generates/rotates as needed). */
+  async getOrchestratorJwks() {
+    await this.ensureOrchestratorKey();
+    return this.orchestratorKey.publicJwk;
+  }
+  /** Return private signing key + kid for issuing orchestrator tokens. */
+  async getOrchestratorSigningKey() {
+    await this.ensureOrchestratorKey();
+    return { kid: this.orchestratorKey.kid, key: this.orchestratorKey.privateKey, alg: this.opts.orchestratorAlg };
+  }
+  // ===========================================================================
+  // Internals (fetch, rotation, helpers)
+  // ===========================================================================
+  async tryFetchJwks(providerId, uri) {
+    try {
+      const jwks = await this.fetchJson(uri);
+      if (jwks?.keys?.length) {
+        this.setProviderJwks(providerId, jwks);
+        return jwks;
+      }
+    } catch {
+    }
+    return void 0;
+  }
+  async tryFetchAsMeta(url) {
+    try {
+      return await this.fetchJson(url);
+    } catch {
+      return void 0;
+    }
+  }
+  async fetchJson(url) {
+    const ctl = typeof AbortController !== "undefined" ? new AbortController() : void 0;
+    const timer = setTimeout(() => ctl?.abort(), this.opts.networkTimeoutMs);
+    try {
+      let currentUrl = url;
+      for (let hop = 0; ; hop++) {
+        const parsed = new URL(currentUrl);
+        const host = parsed.hostname.toLowerCase();
+        const isLocalhost = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && (isLocalhost || !isProduction()))) {
+          throw new Error(`insecure scheme "${parsed.protocol}"`);
+        }
+        if (!(isLocalhost && !isProduction())) {
+          const ssrf = await resolveAndCheckHostname(parsed.hostname);
+          if (!ssrf.allowed) throw new Error(`blocked host: ${ssrf.reason}`);
+        }
+        const res = await fetch(currentUrl, {
+          method: "GET",
+          headers: { accept: "application/json" },
+          signal: ctl?.signal,
+          // Follow redirects manually so each hop is re-validated (scheme + SSRF).
+          redirect: "manual"
+        });
+        if (isRedirectResponse(res)) {
+          const location = res.headers.get("location");
+          if (!location) throw new Error("redirect without a readable Location header");
+          if (hop >= MAX_JWKS_FETCH_HOPS) throw new Error("too many redirects");
+          currentUrl = new URL(location, currentUrl).toString();
+          continue;
+        }
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const contentLength = res.headers.get("content-length");
+        if (contentLength && Number(contentLength) > MAX_JWKS_FETCH_BYTES) {
+          throw new Error("response too large");
+        }
+        const text = await res.text();
+        if (text.length > MAX_JWKS_FETCH_BYTES) {
+          throw new Error("response too large");
+        }
+        return JSON.parse(text);
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async ensureOrchestratorKey() {
+    const now = Date.now();
+    const maxAge = this.opts.rotateDays * 24 * 60 * 60 * 1e3;
+    if (this.orchestratorKey && now - this.orchestratorKey.createdAt <= maxAge) {
+      return;
+    }
+    if (this.keyInitPromise) {
+      await this.keyInitPromise;
+      return;
+    }
+    this.keyInitPromise = this.initializeOrchestratorKey(now, maxAge);
+    try {
+      await this.keyInitPromise;
+    } finally {
+      this.keyInitPromise = void 0;
+    }
+  }
+  async initializeOrchestratorKey(now, maxAge) {
+    const persistence = await this.getKeyPersistence();
+    if (persistence && !this.keyInitialized) {
+      this.keyInitialized = true;
+      const loaded = await persistence.getAsymmetric("jwks-orchestrator");
+      if (loaded && now - loaded.createdAt <= maxAge) {
+        if (loaded.alg !== this.opts.orchestratorAlg) {
+          this.logger.warn(
+            "[JwksService] Persisted key algorithm (%s) doesn't match config (%s), generating new key",
+            loaded.alg,
+            this.opts.orchestratorAlg
+          );
+        } else {
+          try {
+            const { createPrivateKey } = __require("node:crypto");
+            const privateKey = createPrivateKey({
+              key: loaded.privateKey,
+              format: "jwk"
+            });
+            this.orchestratorKey = {
+              kid: loaded.kid,
+              privateKey,
+              publicJwk: loaded.publicJwk,
+              createdAt: loaded.createdAt
+            };
+            return;
+          } catch (error) {
+            this.logger.warn(
+              "[JwksService] Failed to load persisted key: %s, generating new key",
+              error.message
+            );
+          }
+        }
+      }
+    }
+    this.orchestratorKey = this.generateKey(this.opts.orchestratorAlg);
+    this.keyInitialized = true;
+    if (persistence) {
+      try {
+        await persistence.set({
+          type: "asymmetric",
+          kid: this.orchestratorKey.kid,
+          alg: this.opts.orchestratorAlg,
+          privateKey: this.orchestratorKey.privateKey.export({ format: "jwk" }),
+          publicJwk: this.orchestratorKey.publicJwk,
+          createdAt: this.orchestratorKey.createdAt,
+          version: 1
+        });
+      } catch (error) {
+        this.logger.warn("[JwksService] Failed to persist dev key: %s", error.message);
+      }
+    }
+  }
+  generateKey(alg) {
+    const { generateKeyPairSync } = __require("node:crypto");
+    if (alg === "RS256") {
+      const { privateKey, publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+      const kid = bytesToHex(randomBytes(8));
+      const publicJwk = publicKey.export({ format: "jwk" });
+      Object.assign(publicJwk, { kid, alg: "RS256", use: "sig", kty: "RSA" });
+      return { kid, privateKey, publicJwk: { keys: [publicJwk] }, createdAt: Date.now() };
+    } else {
+      const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+      const kid = bytesToHex(randomBytes(8));
+      const publicJwk = publicKey.export({ format: "jwk" });
+      Object.assign(publicJwk, { kid, alg: "ES256", use: "sig", kty: "EC" });
+      return { kid, privateKey, publicJwk: { keys: [publicJwk] }, createdAt: Date.now() };
+    }
+  }
+};
+export {
+  JwksService
+};

package/browser/jwks/jwks.utils.mjs

@@ -0,0 +1,33 @@
+// libs/auth/src/jwks/jwks.utils.ts
+function trimSlash(s) {
+  const str = s ?? "";
+  let end = str.length;
+  while (end > 0 && str[end - 1] === "/") {
+    end--;
+  }
+  return str.slice(0, end);
+}
+function normalizeIssuer(u) {
+  return trimSlash(String(u ?? ""));
+}
+function decodeJwtPayloadSafe(token) {
+  if (!token) return void 0;
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const json = typeof Buffer !== "undefined" ? Buffer.from(b64, "base64").toString("utf8") : (
+      // browser fallback
+      atob(b64)
+    );
+    const obj = JSON.parse(json);
+    return obj && typeof obj === "object" && !Array.isArray(obj) ? obj : void 0;
+  } catch {
+    return void 0;
+  }
+}
+export {
+  decodeJwtPayloadSafe,
+  normalizeIssuer,
+  trimSlash
+};

package/browser/options/app-auth.schema.mjs

@@ -0,0 +1,18 @@
+// libs/auth/src/options/app-auth.schema.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { localAuthSchema, remoteAuthSchema } from "./orchestrated.schema.mjs";
+import { publicAuthOptionsSchema } from "./public.schema.mjs";
+import { transparentAuthOptionsSchema } from "./transparent.schema.mjs";
+var standaloneOptionSchema = {
+  standalone: z.boolean().optional(),
+  excludeFromParent: z.boolean().optional()
+};
+var appAuthOptionsSchema = z.union([
+  publicAuthOptionsSchema.extend(standaloneOptionSchema),
+  transparentAuthOptionsSchema.extend(standaloneOptionSchema),
+  localAuthSchema.extend(standaloneOptionSchema),
+  remoteAuthSchema.extend(standaloneOptionSchema)
+]);
+export {
+  appAuthOptionsSchema
+};

package/browser/options/index.mjs

@@ -0,0 +1,89 @@
+// libs/auth/src/options/index.ts
+import {
+  publicAccessConfigSchema,
+  localSigningConfigSchema,
+  providerConfigSchema,
+  remoteProviderConfigSchema,
+  flatRemoteProviderFields,
+  tokenStorageConfigSchema,
+  tokenStorageSqliteSchema,
+  secureStoreConfigSchema,
+  secureStoreScopeSchema,
+  secureStoreEncryptionSchema,
+  secureStoreCustomBackendSchema,
+  tokenRefreshConfigSchema,
+  skippedAppBehaviorSchema,
+  consentConfigSchema,
+  federatedAuthConfigSchema,
+  incrementalAuthConfigSchema,
+  upstreamProviderSchema,
+  localDcrClientSchema,
+  localDcrConfigSchema
+} from "./shared.schemas.mjs";
+import { publicAuthOptionsSchema } from "./public.schema.mjs";
+import { staticAuthOptionsSchema } from "./static.schema.mjs";
+import { transparentAuthOptionsSchema } from "./transparent.schema.mjs";
+import {
+  localAuthSchema,
+  remoteAuthSchema,
+  loginConfigSchema,
+  authenticateFnSchema,
+  orchestratedLocalSchema,
+  orchestratedRemoteSchema
+} from "./orchestrated.schema.mjs";
+import { authOptionsSchema } from "./schema.mjs";
+import { appAuthOptionsSchema } from "./app-auth.schema.mjs";
+import {
+  parseAuthOptions,
+  isPublicMode,
+  isStaticMode,
+  isTransparentMode,
+  isLocalMode,
+  isRemoteMode,
+  isOrchestratedMode,
+  isOrchestratedLocal,
+  isOrchestratedRemote,
+  allowsPublicAccess
+} from "./utils.mjs";
+export {
+  allowsPublicAccess,
+  appAuthOptionsSchema,
+  authOptionsSchema,
+  authenticateFnSchema,
+  consentConfigSchema,
+  federatedAuthConfigSchema,
+  flatRemoteProviderFields,
+  incrementalAuthConfigSchema,
+  isLocalMode,
+  isOrchestratedLocal,
+  isOrchestratedMode,
+  isOrchestratedRemote,
+  isPublicMode,
+  isRemoteMode,
+  isStaticMode,
+  isTransparentMode,
+  localAuthSchema,
+  localDcrClientSchema,
+  localDcrConfigSchema,
+  localSigningConfigSchema,
+  loginConfigSchema,
+  orchestratedLocalSchema,
+  orchestratedRemoteSchema,
+  parseAuthOptions,
+  providerConfigSchema,
+  publicAccessConfigSchema,
+  publicAuthOptionsSchema,
+  remoteAuthSchema,
+  remoteProviderConfigSchema,
+  secureStoreConfigSchema,
+  secureStoreCustomBackendSchema,
+  secureStoreEncryptionSchema,
+  secureStoreScopeSchema,
+  skippedAppBehaviorSchema,
+  staticAuthOptionsSchema,
+  tokenRefreshConfigSchema,
+  tokenStorageConfigSchema,
+  tokenStorageSqliteSchema,
+  transparentAuthOptionsSchema,
+  upstreamProviderSchema
+};