@frontmcp/auth 1.10.8 → 1.10.9-rc.1

package/esm/index.mjs

@@ -478,7 +478,6 @@ var init_cimd_cache = __esm({
 });
 
 // libs/auth/src/jwks/jwks.service.ts
-import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 import {
   bytesToHex,
   createKeyPersistence,
@@ -833,6 +832,22 @@ var noopAuthLogger = {
   }
 };
 
+// libs/auth/src/jwks/jose.loader.ts
+var jose;
+function loadJose() {
+  jose ??= import("jose").catch((importError) => {
+    try {
+      return __require("jose");
+    } catch {
+      throw importError;
+    }
+  }).catch((error) => {
+    jose = void 0;
+    throw error;
+  });
+  return jose;
+}
+
 // libs/auth/src/jwks/jwks.utils.ts
 function trimSlash(s) {
   const str = s ?? "";
@@ -949,6 +964,7 @@ var JwksService = class {
    */
   async verifyTransparentToken(token, candidates) {
     if (!candidates?.length) return { ok: false, error: "no_providers" };
+    const { createLocalJWKSet, decodeProtectedHeader, jwtVerify } = await loadJose();
     let kid;
     try {
       const header = decodeProtectedHeader(token);

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.10.8",
+  "version": "1.10.9-rc.1",
   "description": "Authentication and authorization for FrontMCP servers: auth modes, OAuth 2.1 (local and remote), JWT and session checks, authorities and the credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://frontmcp.dev/reference/auth",
@@ -52,8 +52,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.10.8",
-    "@frontmcp/storage-sqlite": "1.10.8",
+    "@frontmcp/lazy-zod": "1.10.9-rc.1",
+    "@frontmcp/storage-sqlite": "1.10.9-rc.1",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -69,8 +69,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.10.8",
-    "@frontmcp/utils": "1.10.8",
+    "@frontmcp/di": "1.10.9-rc.1",
+    "@frontmcp/utils": "1.10.9-rc.1",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res, err) => function __init() {
   if (err) throw err[0];
@@ -23,6 +25,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // libs/auth/src/cimd/cimd-redis.cache.ts
@@ -822,7 +832,6 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // libs/auth/src/jwks/jwks.service.ts
-var import_jose = require("jose");
 var import_utils2 = require("@frontmcp/utils");
 
 // libs/auth/src/cimd/cimd.validator.ts
@@ -1170,6 +1179,22 @@ var noopAuthLogger = {
   }
 };
 
+// libs/auth/src/jwks/jose.loader.ts
+var jose;
+function loadJose() {
+  jose ??= import("jose").catch((importError) => {
+    try {
+      return require("jose");
+    } catch {
+      throw importError;
+    }
+  }).catch((error) => {
+    jose = void 0;
+    throw error;
+  });
+  return jose;
+}
+
 // libs/auth/src/jwks/jwks.utils.ts
 function trimSlash(s) {
   const str = s ?? "";
@@ -1286,9 +1311,10 @@ var JwksService = class {
    */
   async verifyTransparentToken(token, candidates) {
     if (!candidates?.length) return { ok: false, error: "no_providers" };
+    const { createLocalJWKSet, decodeProtectedHeader, jwtVerify } = await loadJose();
     let kid;
     try {
-      const header = (0, import_jose.decodeProtectedHeader)(token);
+      const header = decodeProtectedHeader(token);
       kid = typeof header?.kid === "string" ? header.kid : void 0;
     } catch {
     }
@@ -1301,9 +1327,9 @@ var JwksService = class {
           jwks = await this.refetchForUnknownKid(p) ?? jwks;
         }
         if (!jwks?.keys?.length) continue;
-        const JWKS = (0, import_jose.createLocalJWKSet)(jwks);
+        const JWKS = createLocalJWKSet(jwks);
         const issuerConstraint = this.issuerConstraintFor(p);
-        const { payload, protectedHeader } = await (0, import_jose.jwtVerify)(token, JWKS, {
+        const { payload, protectedHeader } = await jwtVerify(token, JWKS, {
           // Pin to asymmetric algorithms so a symmetric key in the provider JWKS
           // can't be used to accept an HMAC-signed token, and `none` is refused.
           algorithms: [...TRANSPARENT_JWT_ALGS],

package/jwks/jose.loader.d.ts

@@ -0,0 +1,5 @@
+type Jose = typeof import('jose');
+/** `jose`, loaded on the first token check; `require` only where the runtime cannot run a dynamic import (Jest). */
+export declare function loadJose(): Promise<Jose>;
+export {};
+//# sourceMappingURL=jose.loader.d.ts.map

package/jwks/jose.loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.loader.d.ts","sourceRoot":"","sources":["../../src/jwks/jose.loader.ts"],"names":[],"mappings":"AAAA,KAAK,IAAI,GAAG,cAAc,MAAM,CAAC,CAAC;AAIlC,oHAAoH;AACpH,wBAAgB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAcxC"}

package/jwks/jwks.service.d.ts

@@ -1,4 +1,4 @@
-import { type JSONWebKeySet } from 'jose';
+import type { JSONWebKeySet } from 'jose';
 import { type JwksServiceOptions, type ProviderVerifyRef, type VerifyResult } from './jwks.types';
 export declare class JwksService {
     private readonly opts;

package/jwks/jwks.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAmDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,mBAAmB,CAAsF;IAGjH,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAsEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2BpF;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAS5B;;;;OAIG;YACW,iBAAiB;IAwB/B,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}
+{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAO,MAAM,MAAM,CAAC;AAe/C,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAmDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,mBAAmB,CAAsF;IAGjH,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAuEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2BpF;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAS5B;;;;OAIG;YACW,iBAAiB;IAwB/B,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.10.8",
+  "version": "1.10.9-rc.1",
   "description": "Authentication and authorization for FrontMCP servers: auth modes, OAuth 2.1 (local and remote), JWT and session checks, authorities and the credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://frontmcp.dev/reference/auth",
@@ -52,8 +52,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.10.8",
-    "@frontmcp/storage-sqlite": "1.10.8",
+    "@frontmcp/lazy-zod": "1.10.9-rc.1",
+    "@frontmcp/storage-sqlite": "1.10.9-rc.1",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -69,8 +69,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.10.8",
-    "@frontmcp/utils": "1.10.8",
+    "@frontmcp/di": "1.10.9-rc.1",
+    "@frontmcp/utils": "1.10.9-rc.1",
     "jose": "^6.0.0"
   },
   "devDependencies": {