@frontmcp/auth 1.3.0 → 1.4.0

package/options/schema.d.ts

@@ -43,6 +43,76 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
     }, import("zod/v4/core").$strip>>;
     mode: import("@frontmcp/lazy-zod").ZodLiteral<"transparent">;
 }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    requireEmail: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    anonymousSubject: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
+    login: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        title: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        subtitle: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        logoUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        fields: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodObject<{
+            type: import("@frontmcp/lazy-zod").ZodEnum<{
+                text: "text";
+                password: "password";
+                email: "email";
+                select: "select";
+                hidden: "hidden";
+            }>;
+            label: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            required: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+            placeholder: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            options: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+                value: import("@frontmcp/lazy-zod").ZodString;
+                label: import("@frontmcp/lazy-zod").ZodString;
+            }, import("zod/v4/core").$strip>>>;
+        }, import("zod/v4/core").$strip>>>;
+        render: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<(ctx: import("./interfaces").LoginRenderContext) => string, (ctx: import("./interfaces").LoginRenderContext) => string>>;
+        subject: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            fromField: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            strategy: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+                "per-session": "per-session";
+                "per-account": "per-account";
+            }>>;
+        }, import("zod/v4/core").$strip>>;
+    }, import("zod/v4/core").$strip>>;
+    authenticate: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<import("./interfaces").AuthenticateFn, import("./interfaces").AuthenticateFn>>;
+    providers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        id: import("@frontmcp/lazy-zod").ZodString;
+        name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        authorizationEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        authorizeUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        tokenEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        tokenUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        clientId: import("@frontmcp/lazy-zod").ZodString;
+        clientSecret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+        userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>>;
+    dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedRedirectUris: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+        allowedClientIds: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+        initialAccessToken: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        clients: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+            clientId: import("@frontmcp/lazy-zod").ZodString;
+            clientSecret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            redirectUris: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+            clientName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            tokenEndpointAuthMethod: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodEnum<{
+                none: "none";
+                client_secret_basic: "client_secret_basic";
+                client_secret_post: "client_secret_post";
+            }>>;
+            grantTypes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
+                authorization_code: "authorization_code";
+                refresh_token: "refresh_token";
+            }>>>;
+            responseTypes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
+                code: "code";
+            }>>>;
+            scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>>;
+    }, import("zod/v4/core").$strip>>;
     local: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
         signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("..").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
         jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -60,6 +130,74 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
             keyPrefix: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>>;
             defaultTtlMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
         }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        sqlite: import("@frontmcp/lazy-zod").ZodObject<{
+            path: import("@frontmcp/lazy-zod").ZodString;
+            encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+                secret: import("@frontmcp/lazy-zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
+            ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+            walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>]>>;
+    secureStore: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodLiteral<"memory">, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        sqlite: import("@frontmcp/lazy-zod").ZodObject<{
+            path: import("@frontmcp/lazy-zod").ZodString;
+            encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+                secret: import("@frontmcp/lazy-zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
+            ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+            walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        redis: import("@frontmcp/lazy-zod").ZodObject<{
+            host: import("@frontmcp/lazy-zod").ZodString;
+            port: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+            password: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            db: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+            tls: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>>;
+            keyPrefix: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>>;
+            defaultTtlMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        backend: import("zod").ZodCustom<import("./interfaces").SecureStoreCustomBackend, import("./interfaces").SecureStoreCustomBackend>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>]>>;
     allowDefaultPublic: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
     anonymousScopes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
@@ -84,6 +222,8 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
             format: "format";
             strict: "strict";
         }>>;
+        minProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        requiredProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
     }, import("zod/v4/core").$strip>>;
     refresh: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
         enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -137,6 +277,14 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
             maxRedirects: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>>;
+    ui: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodEnum<{
+        error: "error";
+        login: "login";
+        consent: "consent";
+        incremental: "incremental";
+        federated: "federated";
+    }> & import("zod/v4/core").$partial, import("@frontmcp/lazy-zod").ZodString>>;
+    extras: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("zod").ZodCustom<import("./interfaces").AuthExtraHandler, import("./interfaces").AuthExtraHandler>>>;
     mode: import("@frontmcp/lazy-zod").ZodLiteral<"local">;
 }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
     local: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -156,6 +304,74 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
             keyPrefix: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>>;
             defaultTtlMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
         }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        sqlite: import("@frontmcp/lazy-zod").ZodObject<{
+            path: import("@frontmcp/lazy-zod").ZodString;
+            encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+                secret: import("@frontmcp/lazy-zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
+            ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+            walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>]>>;
+    secureStore: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodLiteral<"memory">, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        sqlite: import("@frontmcp/lazy-zod").ZodObject<{
+            path: import("@frontmcp/lazy-zod").ZodString;
+            encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+                secret: import("@frontmcp/lazy-zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
+            ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+            walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        redis: import("@frontmcp/lazy-zod").ZodObject<{
+            host: import("@frontmcp/lazy-zod").ZodString;
+            port: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+            password: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            db: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+            tls: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>>;
+            keyPrefix: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>>;
+            defaultTtlMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        backend: import("zod").ZodCustom<import("./interfaces").SecureStoreCustomBackend, import("./interfaces").SecureStoreCustomBackend>;
+    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            user: "user";
+            session: "session";
+            global: "global";
+        }>>;
+        ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>]>>;
     allowDefaultPublic: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
     anonymousScopes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
@@ -180,6 +396,8 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
             format: "format";
             strict: "strict";
         }>>;
+        minProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        requiredProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
     }, import("zod/v4/core").$strip>>;
     refresh: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
         enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -233,6 +451,14 @@ export declare const authOptionsSchema: import("@frontmcp/lazy-zod").ZodUnion<re
             maxRedirects: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>>;
+    ui: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodEnum<{
+        error: "error";
+        login: "login";
+        consent: "consent";
+        incremental: "incremental";
+        federated: "federated";
+    }> & import("zod/v4/core").$partial, import("@frontmcp/lazy-zod").ZodString>>;
+    extras: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("zod").ZodCustom<import("./interfaces").AuthExtraHandler, import("./interfaces").AuthExtraHandler>>>;
     provider: import("@frontmcp/lazy-zod").ZodString;
     clientId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     clientSecret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;

package/options/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/options/schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AASzD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAK5B,CAAC;AAMH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACpD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/options/schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AASzD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAK5B,CAAC;AAMH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACpD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC"}

package/options/shared.schemas.d.ts

@@ -1,5 +1,6 @@
 import { z } from '@frontmcp/lazy-zod';
 import { type RedisConfig } from '../session/transport-session.types';
+import type { SecureStoreCustomBackend } from './interfaces';
 /**
  * Public access configuration for tools/prompts
  */
@@ -64,6 +65,109 @@ export declare const remoteProviderConfigSchema: import("@frontmcp/lazy-zod").Zo
 }, import("zod/v4/core").$strip>;
 export type RemoteProviderConfig = z.infer<typeof remoteProviderConfigSchema>;
 export type RemoteProviderConfigInput = z.input<typeof remoteProviderConfigSchema>;
+/**
+ * Declarative configuration for an upstream OAuth provider that the local-mode
+ * MCP server orchestrates (e.g. GitHub, Slack, Jira). When `providers` are
+ * declared on `mode: 'local'`, FrontMCP federates them at `/oauth/authorize`,
+ * exchanges each provider's code at `/oauth/provider/{id}/callback`, stores the
+ * tokens encrypted, and exposes them to tools via `this.orchestration.getToken(id)`.
+ *
+ * This mirrors the internal `UpstreamProviderConfig` consumed by
+ * `LocalPrimaryAuth.registerProvider`. The endpoint fields accept the canonical
+ * `authorizationEndpoint`/`tokenEndpoint` names as well as the shorter
+ * `authorizeUrl`/`tokenUrl` aliases for ergonomics — at least one of each pair
+ * must be provided. No PII is stored: only provider tokens (encrypted at rest).
+ */
+export declare const upstreamProviderSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    id: import("@frontmcp/lazy-zod").ZodString;
+    name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    authorizationEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    authorizeUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    tokenEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    tokenUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    clientId: import("@frontmcp/lazy-zod").ZodString;
+    clientSecret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+export type UpstreamProviderOptions = z.infer<typeof upstreamProviderSchema>;
+export type UpstreamProviderOptionsInput = z.input<typeof upstreamProviderSchema>;
+/**
+ * A pre-registered (trusted) OAuth client for the LOCAL Authorization Server.
+ *
+ * Seeded into the in-memory client registry at startup so the authorize/token
+ * flows accept it WITHOUT requiring a Dynamic Client Registration round-trip.
+ * This is the declarative way to ship a known `client_id` (e.g. an internal
+ * dashboard) without leaving `POST /oauth/register` open.
+ *
+ * No PII: only OAuth client metadata (ids, redirect URIs, grant/response types)
+ * is stored — never end-user identity.
+ */
+export declare const localDcrClientSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    clientId: import("@frontmcp/lazy-zod").ZodString;
+    clientSecret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    redirectUris: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+    clientName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    tokenEndpointAuthMethod: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodEnum<{
+        none: "none";
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+    }>>;
+    grantTypes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>>;
+    responseTypes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
+        code: "code";
+    }>>>;
+    scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+export type LocalDcrClientConfig = z.infer<typeof localDcrClientSchema>;
+export type LocalDcrClientConfigInput = z.input<typeof localDcrClientSchema>;
+/**
+ * Declarative control surface for the LOCAL Authorization Server's Dynamic
+ * Client Registration endpoint (`POST /oauth/register`, RFC 7591) and the
+ * client allowlist enforced at `/oauth/authorize`.
+ *
+ * IMPORTANT: this is the LOCAL-AS DCR config and is entirely distinct from the
+ * upstream-provider `dcrEnabled`/`registrationEndpoint` fields on
+ * {@link providerConfigSchema}/{@link remoteProviderConfigSchema}, which govern
+ * registering THIS server as a client AGAINST an upstream IdP and are not read
+ * by the local AS.
+ *
+ * Every field is optional. Omitting the whole `dcr` block preserves the
+ * historical behavior exactly: DCR is enabled in dev and disabled in
+ * production (via `isProduction()`), no allowlist is enforced, and no initial
+ * access token is required.
+ */
+export declare const localDcrConfigSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    allowedRedirectUris: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    allowedClientIds: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    initialAccessToken: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    clients: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        clientId: import("@frontmcp/lazy-zod").ZodString;
+        clientSecret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        redirectUris: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
+        clientName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        tokenEndpointAuthMethod: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodEnum<{
+            none: "none";
+            client_secret_basic: "client_secret_basic";
+            client_secret_post: "client_secret_post";
+        }>>;
+        grantTypes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
+            authorization_code: "authorization_code";
+            refresh_token: "refresh_token";
+        }>>>;
+        responseTypes: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
+            code: "code";
+        }>>>;
+        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>>;
+}, import("zod/v4/core").$strip>;
+export type LocalDcrConfig = z.infer<typeof localDcrConfigSchema>;
+export type LocalDcrConfigInput = z.input<typeof localDcrConfigSchema>;
 /**
  * Flattened remote provider fields for top-level use in auth schemas.
  * Basic fields (provider, clientId, clientSecret, scopes) are at top level.
@@ -96,11 +200,28 @@ export declare const flatRemoteProviderFields: {
         userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     }, import("zod/v4/core").$strip>>;
 };
+/**
+ * SQLite configuration for token storage.
+ *
+ * Mirrors the SQLite options consumed by `@frontmcp/storage-sqlite`. Unlike the
+ * SDK's transport/session SQLite config, `path` is REQUIRED here: the auth layer
+ * has no default-path resolver, so persistence is opt-in and explicit.
+ */
+export declare const tokenStorageSqliteSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    path: import("@frontmcp/lazy-zod").ZodString;
+    encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        secret: import("@frontmcp/lazy-zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+    ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+    walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>;
+export type TokenStorageSqliteConfig = z.infer<typeof tokenStorageSqliteSchema>;
 /**
  * Token storage configuration for local/remote modes.
  *
- * Simple string 'memory' for in-memory storage,
- * or an object with redis config for Redis storage.
+ * - `'memory'` — in-memory storage (default; lost on restart).
+ * - `{ redis }` — Redis-backed persistence.
+ * - `{ sqlite }` — local SQLite-file persistence (survives restart, no Redis).
  */
 export declare const tokenStorageConfigSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodLiteral<"memory">, import("@frontmcp/lazy-zod").ZodObject<{
     redis: import("@frontmcp/lazy-zod").ZodObject<{
@@ -112,9 +233,121 @@ export declare const tokenStorageConfigSchema: import("@frontmcp/lazy-zod").ZodU
         keyPrefix: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>>;
         defaultTtlMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
     }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    sqlite: import("@frontmcp/lazy-zod").ZodObject<{
+        path: import("@frontmcp/lazy-zod").ZodString;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            secret: import("@frontmcp/lazy-zod").ZodString;
+        }, import("zod/v4/core").$strip>>;
+        ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    }, import("zod/v4/core").$strip>;
 }, import("zod/v4/core").$strip>]>;
 export type TokenStorageConfig = z.infer<typeof tokenStorageConfigSchema>;
 export type TokenStorageConfigInput = z.input<typeof tokenStorageConfigSchema>;
+/**
+ * How a secure-store namespace is derived from the request:
+ * - `user` (default): keyed by the authenticated subject (`sub`).
+ * - `session`: keyed by the transport `sessionId`.
+ * - `global`: a single server-wide namespace.
+ */
+export declare const secureStoreScopeSchema: import("@frontmcp/lazy-zod").ZodEnum<{
+    user: "user";
+    session: "session";
+    global: "global";
+}>;
+export type SecureStoreScope = z.infer<typeof secureStoreScopeSchema>;
+/**
+ * At-rest encryption settings for the BUILT-IN secure-store backings (memory /
+ * sqlite / redis). Ignored for a custom `{ backend }` backing (e.g. an OS
+ * keychain), which owns its own at-rest protection.
+ */
+export declare const secureStoreEncryptionSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+export type SecureStoreEncryptionConfig = z.infer<typeof secureStoreEncryptionSchema>;
+/**
+ * A custom secure-store backing. The framework does NOT bundle any native
+ * dependency (keytar/wincred/libsecret); to use an OS keychain (or any other
+ * store), supply an object implementing the `SecureStoreBackend` interface here.
+ * Validated structurally (`get`/`set`/`delete`/`list` are functions), like the
+ * other callback schemas in this file.
+ */
+export declare const secureStoreCustomBackendSchema: import("zod").ZodCustom<SecureStoreCustomBackend, SecureStoreCustomBackend>;
+/**
+ * Secure-store configuration (#470). Mirrors the {@link tokenStorageConfigSchema}
+ * selection pattern, plus a namespace `scope` and a pluggable custom `backend`:
+ *
+ * - `'memory'` — in-memory, AES-256-GCM-encrypted (default; lost on restart).
+ * - `{ sqlite }` — local SQLite-file persistence (survives restart).
+ * - `{ redis }` — Redis-backed persistence.
+ * - `{ backend }` — a custom backing implementing `SecureStoreBackend` (e.g. an
+ *   OS keychain). The framework bundles NO native dependency for this.
+ *
+ * The object forms additionally accept `scope`, `ttlMs`, and (for built-ins)
+ * `encryption`.
+ */
+export declare const secureStoreConfigSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodLiteral<"memory">, import("@frontmcp/lazy-zod").ZodObject<{
+    scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+        user: "user";
+        session: "session";
+        global: "global";
+    }>>;
+    ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+    encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    sqlite: import("@frontmcp/lazy-zod").ZodObject<{
+        path: import("@frontmcp/lazy-zod").ZodString;
+        encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+            secret: import("@frontmcp/lazy-zod").ZodString;
+        }, import("zod/v4/core").$strip>>;
+        ttlCleanupIntervalMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        walMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+        user: "user";
+        session: "session";
+        global: "global";
+    }>>;
+    ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+    encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    redis: import("@frontmcp/lazy-zod").ZodObject<{
+        host: import("@frontmcp/lazy-zod").ZodString;
+        port: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+        password: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        db: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+        tls: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>>;
+        keyPrefix: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>>;
+        defaultTtlMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>>;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+        user: "user";
+        session: "session";
+        global: "global";
+    }>>;
+    ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+    encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    backend: import("zod").ZodCustom<SecureStoreCustomBackend, SecureStoreCustomBackend>;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+        user: "user";
+        session: "session";
+        global: "global";
+    }>>;
+    ttlMs: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+    encryption: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
+        pepper: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>]>;
+export type SecureStoreConfig = z.infer<typeof secureStoreConfigSchema>;
+export type SecureStoreConfigInput = z.input<typeof secureStoreConfigSchema>;
 /**
  * Token refresh configuration
  */
@@ -157,6 +390,8 @@ export declare const federatedAuthConfigSchema: import("@frontmcp/lazy-zod").Zod
         format: "format";
         strict: "strict";
     }>>;
+    minProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+    requiredProviders: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
 }, import("zod/v4/core").$strip>;
 export type FederatedAuthConfig = z.infer<typeof federatedAuthConfigSchema>;
 export type FederatedAuthConfigInput = z.input<typeof federatedAuthConfigSchema>;

package/options/shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.schemas.d.ts","sourceRoot":"","sources":["../../src/options/shared.schemas.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAMzF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;gCAkBnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;gCAkBnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;gCAoC/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMvE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;gCAqErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAOnF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAGH,oCAAoC;;IAGpC,+CAA+C;;IAG/C,mDAAmD;;IAGnD,sCAAsC;;;;;;;;;;;;;;CAEvC,CAAC;AAMF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;kCAAyE,CAAC;AAE/G,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;gCAYnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;EAAwC,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;gCAqD9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMrE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;gCAQpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAMjF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;gCA4BtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMrF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,SAAS,CAAC;AAGjB,YAAY,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"shared.schemas.d.ts","sourceRoot":"","sources":["../../src/options/shared.schemas.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAM7D;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;gCAkBnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;gCAkBnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;gCAoC/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMvE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;gCAqErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAMnF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;gCA0C/B,CAAC;AAEL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMlF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;gCAsB/B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACxE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;gCAuC/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAOvE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAGH,oCAAoC;;IAGpC,+CAA+C;;IAG/C,mDAAmD;;IAGnD,sCAAsC;;;;;;;;;;;;;;CAEvC,CAAC;AAMF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;gCA0BnC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kCAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;EAAwC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;gCAMtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,6EAS1C,CAAC;AAgBF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAUlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAM7E;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;gCAYnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM/E;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;EAAwC,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;gCAqD9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMrE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;gCAyBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAMjF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;gCA4BtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMrF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,SAAS,CAAC;AAGjB,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -49,8 +49,8 @@
   "peerDependencies": {
     "ioredis": "^5.0.0",
     "@vercel/kv": "^3.0.0",
-    "@frontmcp/storage-sqlite": "1.3.0",
-    "@frontmcp/lazy-zod": "1.3.0"
+    "@frontmcp/storage-sqlite": "1.4.0",
+    "@frontmcp/lazy-zod": "1.4.0"
   },
   "peerDependenciesMeta": {
     "ioredis": {
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/utils": "1.3.0",
-    "@frontmcp/di": "1.3.0",
+    "@frontmcp/utils": "1.4.0",
+    "@frontmcp/di": "1.4.0",
     "jose": "^6.0.0"
   },
   "devDependencies": {