@frontmcp/auth 1.10.16 → 1.11.0-rc.2

package/browser/options/orchestrated.schema.mjs

@@ -0,0 +1,128 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+// libs/auth/src/options/orchestrated.schema.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import {
+  cimdConfigSchema,
+  consentConfigSchema,
+  federatedAuthConfigSchema,
+  flatRemoteProviderFields,
+  incrementalAuthConfigSchema,
+  localDcrConfigSchema,
+  localSigningConfigSchema,
+  publicAccessConfigSchema,
+  secureStoreConfigSchema,
+  tokenRefreshConfigSchema,
+  tokenStorageConfigSchema,
+  upstreamProviderSchema
+} from "./shared.schemas.mjs";
+var authSlotSchema = z.enum(["login", "consent", "incremental", "federated", "error"]);
+var authUiMapSchema = z.partialRecord(authSlotSchema, z.string().min(1));
+var authExtraHandlerSchema = z.custom((v) => typeof v === "function", {
+  message: "auth.extras entries must be handler functions (input, ctx) => AuthExtraResult."
+});
+var authExtrasMapSchema = z.record(z.string().min(1), authExtraHandlerSchema);
+var sharedAuthFields = {
+  local: localSigningConfigSchema.optional(),
+  tokenStorage: tokenStorageConfigSchema.default("memory"),
+  // #470 \u2014 backing for the general session secure-secret store (`this.secureStore`).
+  // Optional (no default) so an unset value resolves to the in-memory encrypted
+  // default at runtime; existing configs are unaffected.
+  secureStore: secureStoreConfigSchema.optional(),
+  allowDefaultPublic: z.boolean().default(false),
+  anonymousScopes: z.array(z.string()).default(["anonymous"]),
+  publicAccess: publicAccessConfigSchema.optional(),
+  consent: consentConfigSchema.optional(),
+  federatedAuth: federatedAuthConfigSchema.optional(),
+  refresh: tokenRefreshConfigSchema.optional(),
+  expectedAudience: z.union([z.string(), z.array(z.string())]).optional(),
+  incrementalAuth: incrementalAuthConfigSchema.optional(),
+  /**
+   * Require the OAuth client to be KNOWN (registered via DCR / pre-registered,
+   * or a CIMD client-id URL) before an authorization request is accepted.
+   *
+   * @default true
+   *
+   * SECURITY: an unregistered client id has no trusted `redirect_uris` to
+   * validate against, so accepting it lets anyone start a sign-in whose
+   * authorization code is delivered to a redirect_uri of their choosing
+   * (auth-code interception). `false` is for local development only; a
+   * `dcr.allowedRedirectUris` allowlist still constrains such clients.
+   */
+  requireRegisteredClients: z.boolean().default(true),
+  /**
+   * Scopes the server may grant (exact values or `*` globs). Requested scopes
+   * outside this list are dropped from the grant. Unset \u2192 the standard OpenID
+   * scopes only (see `DEFAULT_ALLOWED_SCOPES`).
+   */
+  allowedScopes: z.array(z.string().trim().min(1, "allowedScopes entries must be non-empty")).optional(),
+  cimd: cimdConfigSchema.optional(),
+  // #469 \u2014 custom auth UI as a slot\u2192file map + extras name\u2192handler map (per-app
+  // under splitByApp). Both optional; omitting them serves the built-in pages.
+  ui: authUiMapSchema.optional(),
+  extras: authExtrasMapSchema.optional()
+};
+var loginFieldSchema = z.object({
+  type: z.enum(["text", "password", "email", "select", "hidden"]),
+  label: z.string().optional(),
+  required: z.boolean().optional(),
+  placeholder: z.string().optional(),
+  options: z.array(z.object({ value: z.string(), label: z.string() })).optional()
+});
+var loginConfigSchema = z.object({
+  title: z.string().optional(),
+  subtitle: z.string().optional(),
+  logoUri: z.string().optional(),
+  fields: z.record(z.string(), loginFieldSchema).optional(),
+  // Full HTML override \u2014 a function, validated structurally like other callbacks
+  // in the codebase (see http/cors handlers using z.custom<\u2026>).
+  render: z.custom((v) => typeof v === "function", {
+    message: "login.render must be a function"
+  }).optional(),
+  subject: z.object({
+    fromField: z.string().optional(),
+    strategy: z.enum(["per-session", "per-account"]).optional()
+  }).optional()
+});
+var authenticateFnSchema = z.custom((v) => typeof v === "function", {
+  message: "authenticate must be a function"
+});
+var localAuthSchema = z.object({
+  mode: z.literal("local"),
+  ...sharedAuthFields,
+  // #468 \u2014 opt-out of the email requirement at /oauth/callback for
+  // single-operator local setups. Defaults preserve the historical behavior
+  // (email required) so existing configs are unaffected.
+  requireEmail: z.boolean().default(true),
+  anonymousSubject: z.string().min(1).default("local-operator"),
+  // Checkpoint 3a \u2014 declarative login customization + custom verification.
+  // Both optional; omitting them preserves the default login path exactly.
+  login: loginConfigSchema.optional(),
+  authenticate: authenticateFnSchema.optional(),
+  // Multi-OAuth-provider orchestration \u2014 declare upstream providers (GitHub,
+  // Slack, Jira, \u2026) to federate at /oauth/authorize. Optional; omitting it
+  // preserves the default single-operator local login exactly.
+  providers: z.array(upstreamProviderSchema).optional(),
+  // Local-AS Dynamic Client Registration control surface (#462) \u2014 gate
+  // `POST /oauth/register`, allowlist redirect_uris/client_ids, require an
+  // initial access token, and seed pre-registered trusted clients. Optional;
+  // omitting it preserves today's behavior exactly (DCR on in dev, off in prod;
+  // no allowlist; no initial access token).
+  dcr: localDcrConfigSchema.optional()
+});
+var remoteAuthSchema = z.object({
+  mode: z.literal("remote"),
+  ...flatRemoteProviderFields,
+  ...sharedAuthFields
+});
+var orchestratedLocalSchema = localAuthSchema;
+var orchestratedRemoteSchema = remoteAuthSchema;
+export {
+  authenticateFnSchema,
+  localAuthSchema,
+  loginConfigSchema,
+  orchestratedLocalSchema,
+  orchestratedRemoteSchema,
+  remoteAuthSchema
+};

package/browser/options/public.schema.mjs

@@ -0,0 +1,39 @@
+// libs/auth/src/options/public.schema.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { jsonWebKeySetSchema, jwkSchema } from "../common/jwt.types.mjs";
+import { publicAccessConfigSchema } from "./shared.schemas.mjs";
+var publicAuthOptionsSchema = z.object({
+  mode: z.literal("public"),
+  /**
+   * Issuer identifier for anonymous JWTs
+   * @default auto-derived from server URL
+   */
+  issuer: z.string().optional(),
+  /**
+   * Anonymous session TTL in seconds
+   * @default 3600 (1 hour)
+   */
+  sessionTtl: z.number().int().positive().default(3600),
+  /**
+   * Scopes granted to anonymous sessions
+   * @default ['anonymous']
+   */
+  anonymousScopes: z.array(z.string()).default(["anonymous"]),
+  /**
+   * Tool/prompt access configuration for anonymous users
+   */
+  publicAccess: publicAccessConfigSchema.optional(),
+  /**
+   * JWKS for token verification
+   * @default auto-generated
+   */
+  jwks: jsonWebKeySetSchema.optional(),
+  /**
+   * Private key for signing anonymous tokens
+   * @default auto-generated
+   */
+  signKey: jwkSchema.or(z.instanceof(Uint8Array)).optional()
+});
+export {
+  publicAuthOptionsSchema
+};

package/browser/options/schema.mjs

@@ -0,0 +1,16 @@
+// libs/auth/src/options/schema.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { localAuthSchema, remoteAuthSchema } from "./orchestrated.schema.mjs";
+import { publicAuthOptionsSchema } from "./public.schema.mjs";
+import { staticAuthOptionsSchema } from "./static.schema.mjs";
+import { transparentAuthOptionsSchema } from "./transparent.schema.mjs";
+var authOptionsSchema = z.union([
+  publicAuthOptionsSchema,
+  staticAuthOptionsSchema,
+  transparentAuthOptionsSchema,
+  localAuthSchema,
+  remoteAuthSchema
+]);
+export {
+  authOptionsSchema
+};

package/browser/options/shared.schemas.mjs

@@ -0,0 +1,506 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
+// libs/auth/src/options/shared.schemas.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import { jsonWebKeySetSchema, jwkSchema } from "../common/jwt.types.mjs";
+import { redisConfigSchema } from "../session/transport-session.types.mjs";
+import {
+  cimdCacheConfigSchema,
+  cimdSecurityConfigSchema,
+  cimdNetworkConfigSchema,
+  cimdConfigSchema
+} from "../cimd/index.mjs";
+var publicAccessConfigSchema = z.object({
+  /**
+   * Allow all tools or explicit whitelist
+   * @default 'all'
+   */
+  tools: z.union([z.literal("all"), z.array(z.string())]).default("all"),
+  /**
+   * Allow all prompts or explicit whitelist
+   * @default 'all'
+   */
+  prompts: z.union([z.literal("all"), z.array(z.string())]).default("all"),
+  /**
+   * Rate limit per IP per minute
+   * @default 60
+   */
+  rateLimit: z.number().default(60)
+});
+var localSigningConfigSchema = z.object({
+  /**
+   * Private key for signing tokens
+   * @default auto-generated
+   */
+  signKey: jwkSchema.or(z.instanceof(Uint8Array)).optional(),
+  /**
+   * JWKS for token verification
+   * @default auto-generated
+   */
+  jwks: jsonWebKeySetSchema.optional(),
+  /**
+   * Issuer identifier for tokens
+   * @default auto-derived from server URL
+   */
+  issuer: z.string().optional()
+});
+var providerConfigSchema = z.object({
+  /** Provider display name */
+  name: z.string().optional(),
+  /**
+   * Unique identifier for this provider
+   * @default derived from provider URL
+   */
+  id: z.string().optional(),
+  /**
+   * Inline JWKS for offline token verification
+   * Falls back to fetching from provider's /.well-known/jwks.json
+   */
+  jwks: jsonWebKeySetSchema.optional(),
+  /** Custom JWKS URI if not at standard path */
+  jwksUri: z.string().url().optional(),
+  /**
+   * Additional `iss` values to trust beyond the provider issuer URL.
+   *
+   * SECURITY: trusted verbatim \u2014 set only to issuers you control (e.g. a
+   * gateway that re-mints tokens), never derived from request or token data.
+   * Entries are trimmed and blank values are rejected (a blank issuer would
+   * otherwise be trusted as `''`/`'/'`).
+   */
+  additionalIssuers: z.array(z.string().trim().min(1, "additionalIssuers entries must be non-empty")).optional(),
+  /**
+   * Validate the token's `iss` claim against the provider issuer (and
+   * {@link additionalIssuers}). Defaults to `true`.
+   *
+   * SECURITY: `false` disables issuer verification entirely \u2014 any token signed
+   * by a provider JWKS key is accepted regardless of issuer. Only for a trusted
+   * gateway whose re-minted issuer cannot be enumerated; prefer
+   * `additionalIssuers` when the issuer set is known.
+   */
+  verifyIssuer: z.boolean().optional(),
+  /**
+   * Enable Dynamic Client Registration (DCR)
+   * @default false
+   */
+  dcrEnabled: z.boolean().default(false),
+  /** Authorization endpoint override */
+  authEndpoint: z.string().url().optional(),
+  /** Token endpoint override */
+  tokenEndpoint: z.string().url().optional(),
+  /** Registration endpoint override (for DCR) */
+  registrationEndpoint: z.string().url().optional(),
+  /** User info endpoint override */
+  userInfoEndpoint: z.string().url().optional()
+});
+var remoteProviderConfigSchema = z.object({
+  /**
+   * OAuth provider base URL
+   * @example 'https://auth.example.com'
+   */
+  provider: z.string().url(),
+  /**
+   * Provider display name
+   */
+  name: z.string().optional(),
+  /**
+   * Unique identifier for this provider
+   * @default derived from provider URL
+   */
+  id: z.string().optional(),
+  /**
+   * Inline JWKS for offline token verification
+   * Falls back to fetching from provider's /.well-known/jwks.json
+   */
+  jwks: jsonWebKeySetSchema.optional(),
+  /**
+   * Custom JWKS URI if not at standard path
+   */
+  jwksUri: z.string().url().optional(),
+  /**
+   * Client ID for this MCP server
+   */
+  clientId: z.string().optional(),
+  /**
+   * Client secret (for confidential clients)
+   */
+  clientSecret: z.string().optional(),
+  /**
+   * Scopes to request from the upstream provider
+   */
+  scopes: z.array(z.string()).optional(),
+  /**
+   * Enable Dynamic Client Registration (DCR)
+   * @default false
+   */
+  dcrEnabled: z.boolean().default(false),
+  /**
+   * Authorization endpoint override
+   */
+  authEndpoint: z.string().url().optional(),
+  /**
+   * Token endpoint override
+   */
+  tokenEndpoint: z.string().url().optional(),
+  /**
+   * Registration endpoint override (for DCR)
+   */
+  registrationEndpoint: z.string().url().optional(),
+  /**
+   * User info endpoint override
+   */
+  userInfoEndpoint: z.string().url().optional()
+});
+var upstreamProviderSchema = z.object({
+  /** Stable provider id (e.g. `'github'`). Used in `this.orchestration.getToken(id)`. */
+  id: z.string().min(1),
+  /** Human-readable display name. Defaults to `id` when omitted. */
+  name: z.string().optional(),
+  /** Authorization endpoint (canonical name). */
+  authorizationEndpoint: z.string().url().optional(),
+  /** Authorization endpoint (alias for {@link authorizationEndpoint}). */
+  authorizeUrl: z.string().url().optional(),
+  /** Token endpoint (canonical name). */
+  tokenEndpoint: z.string().url().optional(),
+  /** Token endpoint (alias for {@link tokenEndpoint}). */
+  tokenUrl: z.string().url().optional(),
+  /** OAuth client id issued by the upstream provider. */
+  clientId: z.string().min(1),
+  /** OAuth client secret (confidential clients). */
+  clientSecret: z.string().optional(),
+  /** Scopes to request from the upstream provider. */
+  scopes: z.array(z.string()).optional(),
+  /** User info endpoint (optional, used to enrich the session identity). */
+  userInfoEndpoint: z.string().url().optional(),
+  /** JWKS URI for upstream id_token validation (optional). */
+  jwksUri: z.string().url().optional(),
+  /**
+   * The provider's issuer identifier (its OIDC `iss`). When set, an RFC 9207
+   * `iss` on the provider's callback and the `iss` of its `id_token` must name
+   * it (or one of {@link additionalIssuers}). Without it the provider's
+   * `id_token` is not used for identity; `userInfoEndpoint` is asked instead.
+   */
+  issuer: z.string().url().optional(),
+  /** Other issuer values this provider legitimately uses. */
+  additionalIssuers: z.array(z.string().trim().min(1, "additionalIssuers entries must be non-empty")).optional()
+}).refine((p) => !!(p.authorizationEndpoint ?? p.authorizeUrl), {
+  message: "authorizationEndpoint (or authorizeUrl) is required",
+  path: ["authorizationEndpoint"]
+}).refine((p) => !!(p.tokenEndpoint ?? p.tokenUrl), {
+  message: "tokenEndpoint (or tokenUrl) is required",
+  path: ["tokenEndpoint"]
+}).refine((p) => !(p.authorizationEndpoint && p.authorizeUrl), {
+  message: "provide only one of authorizationEndpoint or authorizeUrl",
+  path: ["authorizationEndpoint"]
+}).refine((p) => !(p.tokenEndpoint && p.tokenUrl), {
+  message: "provide only one of tokenEndpoint or tokenUrl",
+  path: ["tokenEndpoint"]
+});
+var localDcrClientSchema = z.object({
+  /** Stable, pre-assigned client identifier the client authenticates with. */
+  clientId: z.string().min(1),
+  /**
+   * Confidential-client secret. Omit for public clients
+   * (`token_endpoint_auth_method: 'none'`, the default).
+   */
+  clientSecret: z.string().min(1).optional(),
+  /** Exact redirect URIs this client is allowed to use (at least one). */
+  redirectUris: z.array(z.string().url()).min(1, "At least one redirect_uri is required"),
+  /** Human-readable name shown on consent/login screens. */
+  clientName: z.string().optional(),
+  /**
+   * Token-endpoint auth method. Defaults to `'none'` (public PKCE client).
+   */
+  tokenEndpointAuthMethod: z.enum(["none", "client_secret_basic", "client_secret_post"]).default("none"),
+  /** Allowed grant types. Defaults to `['authorization_code']`. */
+  grantTypes: z.array(z.enum(["authorization_code", "refresh_token"])).default(["authorization_code"]),
+  /** Allowed response types. Defaults to `['code']`. */
+  responseTypes: z.array(z.enum(["code"])).default(["code"]),
+  /** Optional space-delimited default scope string. */
+  scope: z.string().optional()
+});
+var localDcrConfigSchema = z.object({
+  /**
+   * Whether `POST /oauth/register` is mounted/active and whether
+   * `registration_endpoint` is advertised in AS metadata.
+   *
+   * When unset (default), the historical guard applies: enabled in
+   * development, disabled in production. Set explicitly to force it on or off
+   * regardless of `NODE_ENV`.
+   */
+  enabled: z.boolean().optional(),
+  /**
+   * Allowlist of redirect URIs. Each entry is matched EXACTLY or as a simple
+   * glob (`*` matches any run of characters). When set, both DCR registrations
+   * and `/oauth/authorize` requests are rejected unless their `redirect_uri`
+   * matches an entry. When unset, no redirect_uri allowlist is enforced.
+   */
+  allowedRedirectUris: z.array(z.string().min(1)).optional(),
+  /**
+   * Allowlist of client ids. When set, only these `client_id`s may register
+   * (DCR registrations are forced to one of these ids) or be used at
+   * `/oauth/authorize`. When unset, any client id is accepted (subject to the
+   * other checks). CIMD URL client ids are validated by the CIMD layer and are
+   * exempt from this allowlist.
+   */
+  allowedClientIds: z.array(z.string().min(1)).optional(),
+  /**
+   * Initial Access Token (RFC 7591 \u00a73). When set, `POST /oauth/register`
+   * requires an `Authorization: Bearer <token>` header that matches this value
+   * (constant-time compared); requests without it (or with a wrong value) are
+   * rejected `401 invalid_token`. When unset, registration is unauthenticated
+   * (the historical behavior).
+   */
+  initialAccessToken: z.string().min(1).optional(),
+  /**
+   * Pre-registered trusted clients seeded into the registry at startup. These
+   * are accepted by the authorize/token flows WITHOUT a DCR round-trip, which
+   * lets you disable DCR entirely while still shipping known clients.
+   */
+  clients: z.array(localDcrClientSchema).optional(),
+  /**
+   * Maximum number of DYNAMICALLY-registered (DCR) clients kept in memory.
+   * Once reached, further dynamic registrations are REJECTED (existing clients,
+   * including confidential ones, are preserved \u2014 never evicted). A cap of `0`
+   * disables dynamic registration entirely. Pre-registered / declarative
+   * `clients` never count toward this cap. Defaults to 1000; guards against
+   * unbounded memory growth from unauthenticated DCR.
+   */
+  maxDynamicClients: z.number().int().min(0).optional()
+});
+var flatRemoteProviderFields = {
+  /**
+   * OAuth provider base URL (required)
+   * @example 'https://auth.example.com'
+   */
+  provider: z.string().url(),
+  /** Client ID for this MCP server */
+  clientId: z.string().optional(),
+  /** Client secret (for confidential clients) */
+  clientSecret: z.string().optional(),
+  /** Scopes to request from the upstream provider */
+  scopes: z.array(z.string()).optional(),
+  /** Advanced provider configuration */
+  providerConfig: providerConfigSchema.optional()
+};
+var tokenStorageSqliteSchema = z.object({
+  /** Path to the `.sqlite` database file used for auth persistence. */
+  path: z.string().min(1),
+  /**
+   * Encryption configuration for at-rest encryption of stored values.
+   * Independent of the AES-GCM blob encryption already applied to upstream
+   * provider tokens by the orchestrated-token store.
+   */
+  encryption: z.object({
+    secret: z.string().min(1)
+  }).optional(),
+  /**
+   * Interval in milliseconds for purging expired keys.
+   * @default 60000
+   */
+  ttlCleanupIntervalMs: z.number().int().nonnegative().optional(),
+  /**
+   * Enable WAL mode for better read concurrency.
+   * @default true
+   */
+  walMode: z.boolean().optional(),
+  /**
+   * Milliseconds to wait for a lock held by another process before a write
+   * fails with `SQLITE_BUSY`.
+   * @default 5000
+   */
+  busyTimeoutMs: z.number().int().nonnegative().optional()
+});
+var tokenStorageConfigSchema = z.union([
+  z.literal("memory"),
+  z.object({ redis: redisConfigSchema }),
+  z.object({ sqlite: tokenStorageSqliteSchema })
+]);
+var secureStoreScopeSchema = z.enum(["user", "session", "global"]);
+var secureStoreEncryptionSchema = z.object({
+  /**
+   * Server pepper mixed into HKDF key derivation (defense-in-depth). Defaults to
+   * `VAULT_SECRET ?? JWT_SECRET` at runtime when omitted.
+   */
+  pepper: z.string().min(1).optional()
+});
+var secureStoreCustomBackendSchema = z.custom(
+  (v) => typeof v === "object" && v !== null && typeof v.get === "function" && typeof v.set === "function" && typeof v.delete === "function" && typeof v.list === "function",
+  { message: "secureStore.backend must implement get/set/delete/list (SecureStoreBackend)" }
+);
+var secureStoreCommonFields = {
+  /** Namespace scope. @default 'user' */
+  scope: secureStoreScopeSchema.optional(),
+  /** Default TTL (ms) for stored secrets. @default undefined (no expiry) */
+  ttlMs: z.number().int().positive().optional(),
+  /** At-rest encryption settings (built-in backings only). */
+  encryption: secureStoreEncryptionSchema.optional()
+};
+var secureStoreBackingSchemas = {
+  sqlite: tokenStorageSqliteSchema,
+  redis: redisConfigSchema,
+  backend: secureStoreCustomBackendSchema
+};
+function secureStoreBackingError(issue) {
+  if (typeof issue.input !== "object" || issue.input === null) return void 0;
+  const config = issue.input;
+  const named = Object.keys(secureStoreBackingSchemas).filter((backing) => config[backing] !== void 0);
+  if (named.length > 1) return `secureStore takes one backing, not ${named.join(" and ")}`;
+  for (const [backing, schema] of Object.entries(secureStoreBackingSchemas)) {
+    if (config[backing] === void 0) continue;
+    const nested = schema.safeParse(config[backing]).error?.issues[0];
+    if (!nested) continue;
+    const where = ["secureStore", backing, ...nested.path.map(String)].join(".");
+    return nested.message.startsWith(where) ? nested.message : `${where}: ${nested.message}`;
+  }
+  return void 0;
+}
+var noBacking = {
+  sqlite: z.undefined().optional(),
+  redis: z.undefined().optional(),
+  backend: z.undefined().optional()
+};
+var secureStoreConfigSchema = z.union(
+  [
+    z.literal("memory"),
+    z.object({ ...noBacking, sqlite: secureStoreBackingSchemas.sqlite, ...secureStoreCommonFields }),
+    z.object({ ...noBacking, redis: secureStoreBackingSchemas.redis, ...secureStoreCommonFields }),
+    z.object({ ...noBacking, backend: secureStoreBackingSchemas.backend, ...secureStoreCommonFields }),
+    z.object({ ...noBacking, ...secureStoreCommonFields })
+  ],
+  { error: secureStoreBackingError }
+);
+var tokenRefreshConfigSchema = z.object({
+  /**
+   * Enable automatic token refresh
+   * @default true
+   */
+  enabled: z.boolean().default(true),
+  /**
+   * Refresh token before expiry by this many seconds
+   * @default 60
+   */
+  skewSeconds: z.number().nonnegative().default(60)
+});
+var skippedAppBehaviorSchema = z.enum(["anonymous", "require-auth"]);
+var consentConfigSchema = z.object({
+  /**
+   * Enable consent flow for tool selection
+   * When enabled, users can choose which tools to expose to the LLM
+   * @default false
+   */
+  enabled: z.boolean().default(false),
+  /**
+   * Group tools by app in the consent UI
+   * @default true
+   */
+  groupByApp: z.boolean().default(true),
+  /**
+   * Show tool descriptions in consent UI
+   * @default true
+   */
+  showDescriptions: z.boolean().default(true),
+  /**
+   * Allow selecting all tools at once
+   * @default true
+   */
+  allowSelectAll: z.boolean().default(true),
+  /**
+   * Require at least one tool to be selected
+   * @default true
+   */
+  requireSelection: z.boolean().default(true),
+  /**
+   * Custom message to display on consent page
+   */
+  customMessage: z.string().optional(),
+  /**
+   * Remember consent for future sessions
+   * @default true
+   */
+  rememberConsent: z.boolean().default(true),
+  /**
+   * Tools to exclude from consent (always available)
+   * Useful for essential tools that should always be accessible
+   */
+  excludedTools: z.array(z.string()).optional(),
+  /**
+   * Tools to always include in consent (pre-selected)
+   */
+  defaultSelectedTools: z.array(z.string()).optional()
+});
+var federatedAuthConfigSchema = z.object({
+  /**
+   * How strictly to validate the OAuth state parameter on provider callbacks.
+   * - 'strict': require exact match to stored state (default, safest)
+   * - 'format': validate only "federated:{sessionId}:{nonce}" format
+   * @default 'strict'
+   */
+  stateValidation: z.enum(["strict", "format"]).default("strict"),
+  /**
+   * Minimum number of upstream providers a user must link before a FrontMCP JWT
+   * is minted. The federated callback refuses to issue a token until at least
+   * this many providers have been authorized. Defaults to `1` at runtime when
+   * `providers` are configured (i.e. "no JWT until \u22651 linked"). Left optional
+   * here so existing configs without `providers` are completely unaffected.
+   */
+  minProviders: z.number().int().positive().optional(),
+  /**
+   * Provider ids that MUST be among the linked providers before a JWT is minted.
+   * The federated callback rejects the login unless every id listed here is in
+   * the user's selected providers. Optional \u2014 omit to allow any combination that
+   * satisfies {@link minProviders}.
+   */
+  requiredProviders: z.array(z.string()).optional()
+});
+var incrementalAuthConfigSchema = z.object({
+  /**
+   * Enable incremental (progressive) authorization
+   * When enabled, users can skip app authorizations during initial auth
+   * and authorize individual apps later when needed
+   * @default true
+   */
+  enabled: z.boolean().default(true),
+  /**
+   * Behavior when a tool from a skipped app is called
+   * - 'anonymous': If app supports anonymous access, use it; otherwise require auth
+   * - 'require-auth': Always require authorization (return auth_url)
+   * @default 'anonymous'
+   */
+  skippedAppBehavior: skippedAppBehaviorSchema.default("anonymous"),
+  /**
+   * Allow users to skip app authorization during initial auth flow
+   * @default true
+   */
+  allowSkip: z.boolean().default(true),
+  /**
+   * Show all apps in a single authorization page (vs step-by-step)
+   * @default true
+   */
+  showAllAppsAtOnce: z.boolean().default(true)
+});
+export {
+  cimdCacheConfigSchema,
+  cimdConfigSchema,
+  cimdNetworkConfigSchema,
+  cimdSecurityConfigSchema,
+  consentConfigSchema,
+  federatedAuthConfigSchema,
+  flatRemoteProviderFields,
+  incrementalAuthConfigSchema,
+  localDcrClientSchema,
+  localDcrConfigSchema,
+  localSigningConfigSchema,
+  providerConfigSchema,
+  publicAccessConfigSchema,
+  remoteProviderConfigSchema,
+  secureStoreConfigSchema,
+  secureStoreCustomBackendSchema,
+  secureStoreEncryptionSchema,
+  secureStoreScopeSchema,
+  skippedAppBehaviorSchema,
+  tokenRefreshConfigSchema,
+  tokenStorageConfigSchema,
+  tokenStorageSqliteSchema,
+  upstreamProviderSchema
+};