@frontmcp/auth 1.7.2 → 1.8.0

package/index.js

@@ -285,6 +285,8 @@ __export(index_exports, {
   InMemoryStoreRequiredError: () => InMemoryStoreRequiredError,
   InvalidClientIdUrlError: () => InvalidClientIdUrlError,
   JwksService: () => JwksService,
+  JwtSecretRequiredError: () => JwtSecretRequiredError,
+  JwtSecretWeakError: () => JwtSecretWeakError,
   LazyCredentialLoader: () => LazyCredentialLoader,
   NoProviderIdError: () => NoProviderIdError,
   NullOrchestratedAuthAccessor: () => NullOrchestratedAuthAccessor,
@@ -455,6 +457,7 @@ __export(index_exports, {
   isSoonExpiring: () => isSoonExpiring,
   isSoonExpiringProvider: () => isSoonExpiringProvider,
   isSqliteTokenStorage: () => isSqliteTokenStorage,
+  isStaticMode: () => isStaticMode,
   isTransparentMode: () => isTransparentMode,
   jsonWebKeySetSchema: () => jsonWebKeySetSchema,
   jwkParametersSchema: () => jwkParametersSchema,
@@ -514,6 +517,7 @@ __export(index_exports, {
   startNextProvider: () => startNextProvider,
   statefulHttpTransportStateSchema: () => statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema: () => statelessHttpTransportStateSchema,
+  staticAuthOptionsSchema: () => staticAuthOptionsSchema,
   storedSessionSchema: () => storedSessionSchema,
   streamableHttpTransportStateSchema: () => streamableHttpTransportStateSchema,
   toEpochSeconds: () => toEpochSeconds,
@@ -855,26 +859,78 @@ function checkIpv4(ip) {
   }
   return { allowed: true, reason: "" };
 }
+function expandIpv6(ip) {
+  let text = ip.toLowerCase();
+  if (text.includes("%")) {
+    text = text.slice(0, text.indexOf("%"));
+  }
+  const dottedQuad = text.match(/^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (dottedQuad) {
+    const octets = dottedQuad[2].split(".").map(Number);
+    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return null;
+    const high = (octets[0] << 8 | octets[1]).toString(16);
+    const low = (octets[2] << 8 | octets[3]).toString(16);
+    text = `${dottedQuad[1]}${high}:${low}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const parseGroups = (part) => {
+    if (part === "") return [];
+    const groups = [];
+    for (const group of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(group)) return null;
+      groups.push(parseInt(group, 16));
+    }
+    return groups;
+  };
+  const head = parseGroups(halves[0]);
+  if (head === null) return null;
+  if (halves.length === 1) {
+    return head.length === 8 ? head : null;
+  }
+  const tail = parseGroups(halves[1]);
+  if (tail === null) return null;
+  if (head.length + tail.length > 7) return null;
+  return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail];
+}
 function checkIpv6(ip) {
-  const normalizedIp = ip.toLowerCase();
-  if (normalizedIp === "::1") {
+  const groups = expandIpv6(ip);
+  if (!groups) {
+    return { allowed: false, reason: `Malformed IPv6 address: ${ip}` };
+  }
+  const isZeroPrefix = groups.slice(0, 7).every((group) => group === 0);
+  if (isZeroPrefix && groups[7] === 1) {
     return { allowed: false, reason: "IPv6 loopback address (::1) is not allowed" };
   }
-  if (normalizedIp === "::" || normalizedIp === "0:0:0:0:0:0:0:0") {
+  if (isZeroPrefix && groups[7] === 0) {
     return { allowed: false, reason: "IPv6 unspecified address (::) is not allowed" };
   }
-  if (normalizedIp.startsWith("fe8") || normalizedIp.startsWith("fe9") || normalizedIp.startsWith("fea") || normalizedIp.startsWith("feb")) {
+  if ((groups[0] & 65472) === 65152) {
     return { allowed: false, reason: "IPv6 link-local addresses (fe80::/10) are not allowed" };
   }
-  if (normalizedIp.startsWith("fc") || normalizedIp.startsWith("fd")) {
+  if ((groups[0] & 65024) === 64512) {
     return { allowed: false, reason: "IPv6 unique local addresses (fc00::/7) are not allowed" };
   }
-  const ipv4MappedMatch = normalizedIp.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (ipv4MappedMatch) {
-    return checkIpv4(ipv4MappedMatch[1]);
+  const embedded = extractEmbeddedIpv4(groups);
+  if (embedded) {
+    return checkIpv4(embedded);
   }
   return { allowed: true, reason: "" };
 }
+function extractEmbeddedIpv4(groups) {
+  const toDotted = () => {
+    const high = groups[6];
+    const low = groups[7];
+    return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+  };
+  const firstFive = groups.slice(0, 5).every((group) => group === 0);
+  if (firstFive && groups[5] === 65535) return toDotted();
+  if (firstFive && groups[5] === 0) return toDotted();
+  if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((group) => group === 0)) {
+    return toDotted();
+  }
+  return null;
+}
 function isDomainInList(hostname, domainList) {
   const lowerHostname = hostname.toLowerCase();
   for (const domain of domainList) {
@@ -3842,6 +3898,22 @@ var SessionSecretRequiredError = class extends AuthInternalError {
     super(`Session secret is required for ${component}`, "SESSION_SECRET_REQUIRED");
   }
 };
+var JwtSecretRequiredError = class extends AuthInternalError {
+  constructor(mode) {
+    super(
+      `JWT_SECRET is required in production for auth.mode "${mode}". Without it the server signs tokens with a random per-process secret, so every restart invalidates outstanding tokens and any second instance or isolate rejects tokens the first one minted.`,
+      "JWT_SECRET_REQUIRED"
+    );
+  }
+};
+var JwtSecretWeakError = class extends AuthInternalError {
+  constructor(byteLength) {
+    super(
+      `JWT_SECRET is ${byteLength} bytes; HS256 requires at least 32 (RFC 7518 \xA73.2). A shorter secret is guessable, and whoever guesses it can forge tokens for this server. Generate one with \`openssl rand -hex 32\`.`,
+      "JWT_SECRET_INVALID"
+    );
+  }
+};
 var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
   constructor(name) {
     super(`Credential provider "${name}" is already registered`, "CREDENTIAL_PROVIDER_ALREADY_REGISTERED");
@@ -8508,10 +8580,48 @@ var publicAuthOptionsSchema = import_lazy_zod11.z.object({
   signKey: jwkSchema.or(import_lazy_zod11.z.instanceof(Uint8Array)).optional()
 });
 
-// libs/auth/src/options/transparent.schema.ts
+// libs/auth/src/options/static.schema.ts
 var import_lazy_zod12 = require("@frontmcp/lazy-zod");
-var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
-  mode: import_lazy_zod12.z.literal("transparent"),
+var staticAuthOptionsSchema = import_lazy_zod12.z.object({
+  mode: import_lazy_zod12.z.literal("static"),
+  /**
+   * Accepted credentials. Compared against the presented one in constant time,
+   * over SHA-256 digests so neither the value nor its length leaks by timing.
+   *
+   * Read these from the environment — never commit them.
+   */
+  tokens: import_lazy_zod12.z.array(import_lazy_zod12.z.string().min(1)).min(1),
+  /**
+   * Request header carrying the credential.
+   * @default 'authorization'
+   */
+  header: import_lazy_zod12.z.string().min(1).default("authorization"),
+  /**
+   * Scheme prefix to strip before comparing, matched case-insensitively. Set to
+   * an empty string for headers that carry a bare token (e.g. `x-api-key`).
+   * @default 'Bearer'
+   */
+  scheme: import_lazy_zod12.z.string().default("Bearer"),
+  /**
+   * Scopes granted to a request that presents a valid token.
+   * @default ['static']
+   */
+  scopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default(["static"]),
+  /**
+   * Realm reported in the `WWW-Authenticate` challenge on failure.
+   * @default 'mcp'
+   */
+  realm: import_lazy_zod12.z.string().default("mcp"),
+  /**
+   * Tool/prompt access configuration, same shape the other modes accept.
+   */
+  publicAccess: publicAccessConfigSchema.optional()
+});
+
+// libs/auth/src/options/transparent.schema.ts
+var import_lazy_zod13 = require("@frontmcp/lazy-zod");
+var transparentAuthOptionsSchema = import_lazy_zod13.z.object({
+  mode: import_lazy_zod13.z.literal("transparent"),
   /**
    * Flattened remote provider fields (provider, clientId, clientSecret, scopes, providerConfig)
    */
@@ -8520,28 +8630,28 @@ var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
    * Expected token audience
    * If not set, defaults to the resource URL
    */
-  expectedAudience: import_lazy_zod12.z.union([import_lazy_zod12.z.string(), import_lazy_zod12.z.array(import_lazy_zod12.z.string())]).optional(),
+  expectedAudience: import_lazy_zod13.z.union([import_lazy_zod13.z.string(), import_lazy_zod13.z.array(import_lazy_zod13.z.string())]).optional(),
   /**
    * Require an `aud` claim (reject audience-less tokens). Defaults to `false`
    * for IdP compatibility; set `true` to reject tokens with no audience.
    */
-  requireAudience: import_lazy_zod12.z.boolean().optional(),
+  requireAudience: import_lazy_zod13.z.boolean().optional(),
   /**
    * Required scopes for access
    * Empty array means any valid token is accepted
    * @default []
    */
-  requiredScopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default([]),
+  requiredScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default([]),
   /**
    * Allow anonymous fallback when no token is provided
    * @default false
    */
-  allowAnonymous: import_lazy_zod12.z.boolean().default(false),
+  allowAnonymous: import_lazy_zod13.z.boolean().default(false),
   /**
    * Scopes granted to anonymous sessions (when allowAnonymous=true)
    * @default ['anonymous']
    */
-  anonymousScopes: import_lazy_zod12.z.array(import_lazy_zod12.z.string()).default(["anonymous"]),
+  anonymousScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default(["anonymous"]),
   /**
    * Public access config for anonymous users (when allowAnonymous=true)
    */
@@ -8549,13 +8659,13 @@ var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
 });
 
 // libs/auth/src/options/orchestrated.schema.ts
-var import_lazy_zod13 = require("@frontmcp/lazy-zod");
-var authSlotSchema = import_lazy_zod13.z.enum(["login", "consent", "incremental", "federated", "error"]);
-var authUiMapSchema = import_lazy_zod13.z.partialRecord(authSlotSchema, import_lazy_zod13.z.string().min(1));
-var authExtraHandlerSchema = import_lazy_zod13.z.custom((v) => typeof v === "function", {
+var import_lazy_zod14 = require("@frontmcp/lazy-zod");
+var authSlotSchema = import_lazy_zod14.z.enum(["login", "consent", "incremental", "federated", "error"]);
+var authUiMapSchema = import_lazy_zod14.z.partialRecord(authSlotSchema, import_lazy_zod14.z.string().min(1));
+var authExtraHandlerSchema = import_lazy_zod14.z.custom((v) => typeof v === "function", {
   message: "auth.extras entries must be handler functions (input, ctx) => AuthExtraResult."
 });
-var authExtrasMapSchema = import_lazy_zod13.z.record(import_lazy_zod13.z.string().min(1), authExtraHandlerSchema);
+var authExtrasMapSchema = import_lazy_zod14.z.record(import_lazy_zod14.z.string().min(1), authExtraHandlerSchema);
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
@@ -8563,13 +8673,13 @@ var sharedAuthFields = {
   // Optional (no default) so an unset value resolves to the in-memory encrypted
   // default at runtime; existing configs are unaffected.
   secureStore: secureStoreConfigSchema.optional(),
-  allowDefaultPublic: import_lazy_zod13.z.boolean().default(false),
-  anonymousScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default(["anonymous"]),
+  allowDefaultPublic: import_lazy_zod14.z.boolean().default(false),
+  anonymousScopes: import_lazy_zod14.z.array(import_lazy_zod14.z.string()).default(["anonymous"]),
   publicAccess: publicAccessConfigSchema.optional(),
   consent: consentConfigSchema.optional(),
   federatedAuth: federatedAuthConfigSchema.optional(),
   refresh: tokenRefreshConfigSchema.optional(),
-  expectedAudience: import_lazy_zod13.z.union([import_lazy_zod13.z.string(), import_lazy_zod13.z.array(import_lazy_zod13.z.string())]).optional(),
+  expectedAudience: import_lazy_zod14.z.union([import_lazy_zod14.z.string(), import_lazy_zod14.z.array(import_lazy_zod14.z.string())]).optional(),
   incrementalAuth: incrementalAuthConfigSchema.optional(),
   /**
    * Require the OAuth client to be KNOWN (registered via DCR / pre-registered,
@@ -8585,46 +8695,46 @@ var sharedAuthFields = {
    * matching for every client. Clients on a configured
    * `dcr.allowedRedirectUris` allowlist still pass.
    */
-  requireRegisteredClients: import_lazy_zod13.z.boolean().default(false),
+  requireRegisteredClients: import_lazy_zod14.z.boolean().default(false),
   cimd: cimdConfigSchema.optional(),
   // #469 — custom auth UI as a slot→file map + extras name→handler map (per-app
   // under splitByApp). Both optional; omitting them serves the built-in pages.
   ui: authUiMapSchema.optional(),
   extras: authExtrasMapSchema.optional()
 };
-var loginFieldSchema = import_lazy_zod13.z.object({
-  type: import_lazy_zod13.z.enum(["text", "password", "email", "select", "hidden"]),
-  label: import_lazy_zod13.z.string().optional(),
-  required: import_lazy_zod13.z.boolean().optional(),
-  placeholder: import_lazy_zod13.z.string().optional(),
-  options: import_lazy_zod13.z.array(import_lazy_zod13.z.object({ value: import_lazy_zod13.z.string(), label: import_lazy_zod13.z.string() })).optional()
+var loginFieldSchema = import_lazy_zod14.z.object({
+  type: import_lazy_zod14.z.enum(["text", "password", "email", "select", "hidden"]),
+  label: import_lazy_zod14.z.string().optional(),
+  required: import_lazy_zod14.z.boolean().optional(),
+  placeholder: import_lazy_zod14.z.string().optional(),
+  options: import_lazy_zod14.z.array(import_lazy_zod14.z.object({ value: import_lazy_zod14.z.string(), label: import_lazy_zod14.z.string() })).optional()
 });
-var loginConfigSchema = import_lazy_zod13.z.object({
-  title: import_lazy_zod13.z.string().optional(),
-  subtitle: import_lazy_zod13.z.string().optional(),
-  logoUri: import_lazy_zod13.z.string().optional(),
-  fields: import_lazy_zod13.z.record(import_lazy_zod13.z.string(), loginFieldSchema).optional(),
+var loginConfigSchema = import_lazy_zod14.z.object({
+  title: import_lazy_zod14.z.string().optional(),
+  subtitle: import_lazy_zod14.z.string().optional(),
+  logoUri: import_lazy_zod14.z.string().optional(),
+  fields: import_lazy_zod14.z.record(import_lazy_zod14.z.string(), loginFieldSchema).optional(),
   // Full HTML override — a function, validated structurally like other callbacks
   // in the codebase (see http/cors handlers using z.custom<…>).
-  render: import_lazy_zod13.z.custom((v) => typeof v === "function", {
+  render: import_lazy_zod14.z.custom((v) => typeof v === "function", {
     message: "login.render must be a function"
   }).optional(),
-  subject: import_lazy_zod13.z.object({
-    fromField: import_lazy_zod13.z.string().optional(),
-    strategy: import_lazy_zod13.z.enum(["per-session", "per-account"]).optional()
+  subject: import_lazy_zod14.z.object({
+    fromField: import_lazy_zod14.z.string().optional(),
+    strategy: import_lazy_zod14.z.enum(["per-session", "per-account"]).optional()
   }).optional()
 });
-var authenticateFnSchema = import_lazy_zod13.z.custom((v) => typeof v === "function", {
+var authenticateFnSchema = import_lazy_zod14.z.custom((v) => typeof v === "function", {
   message: "authenticate must be a function"
 });
-var localAuthSchema = import_lazy_zod13.z.object({
-  mode: import_lazy_zod13.z.literal("local"),
+var localAuthSchema = import_lazy_zod14.z.object({
+  mode: import_lazy_zod14.z.literal("local"),
   ...sharedAuthFields,
   // #468 — opt-out of the email requirement at /oauth/callback for
   // single-operator local setups. Defaults preserve the historical behavior
   // (email required) so existing configs are unaffected.
-  requireEmail: import_lazy_zod13.z.boolean().default(true),
-  anonymousSubject: import_lazy_zod13.z.string().min(1).default("local-operator"),
+  requireEmail: import_lazy_zod14.z.boolean().default(true),
+  anonymousSubject: import_lazy_zod14.z.string().min(1).default("local-operator"),
   // Checkpoint 3a — declarative login customization + custom verification.
   // Both optional; omitting them preserves the default login path exactly.
   login: loginConfigSchema.optional(),
@@ -8632,7 +8742,7 @@ var localAuthSchema = import_lazy_zod13.z.object({
   // Multi-OAuth-provider orchestration — declare upstream providers (GitHub,
   // Slack, Jira, …) to federate at /oauth/authorize. Optional; omitting it
   // preserves the default single-operator local login exactly.
-  providers: import_lazy_zod13.z.array(upstreamProviderSchema).optional(),
+  providers: import_lazy_zod14.z.array(upstreamProviderSchema).optional(),
   // Local-AS Dynamic Client Registration control surface (#462) — gate
   // `POST /oauth/register`, allowlist redirect_uris/client_ids, require an
   // initial access token, and seed pre-registered trusted clients. Optional;
@@ -8640,8 +8750,8 @@ var localAuthSchema = import_lazy_zod13.z.object({
   // no allowlist; no initial access token).
   dcr: localDcrConfigSchema.optional()
 });
-var remoteAuthSchema = import_lazy_zod13.z.object({
-  mode: import_lazy_zod13.z.literal("remote"),
+var remoteAuthSchema = import_lazy_zod14.z.object({
+  mode: import_lazy_zod14.z.literal("remote"),
   ...flatRemoteProviderFields,
   ...sharedAuthFields
 });
@@ -8649,21 +8759,22 @@ var orchestratedLocalSchema = localAuthSchema;
 var orchestratedRemoteSchema = remoteAuthSchema;
 
 // libs/auth/src/options/schema.ts
-var import_lazy_zod14 = require("@frontmcp/lazy-zod");
-var authOptionsSchema = import_lazy_zod14.z.union([
+var import_lazy_zod15 = require("@frontmcp/lazy-zod");
+var authOptionsSchema = import_lazy_zod15.z.union([
   publicAuthOptionsSchema,
+  staticAuthOptionsSchema,
   transparentAuthOptionsSchema,
   localAuthSchema,
   remoteAuthSchema
 ]);
 
 // libs/auth/src/options/app-auth.schema.ts
-var import_lazy_zod15 = require("@frontmcp/lazy-zod");
+var import_lazy_zod16 = require("@frontmcp/lazy-zod");
 var standaloneOptionSchema = {
-  standalone: import_lazy_zod15.z.boolean().optional(),
-  excludeFromParent: import_lazy_zod15.z.boolean().optional()
+  standalone: import_lazy_zod16.z.boolean().optional(),
+  excludeFromParent: import_lazy_zod16.z.boolean().optional()
 };
-var appAuthOptionsSchema = import_lazy_zod15.z.union([
+var appAuthOptionsSchema = import_lazy_zod16.z.union([
   publicAuthOptionsSchema.extend(standaloneOptionSchema),
   transparentAuthOptionsSchema.extend(standaloneOptionSchema),
   localAuthSchema.extend(standaloneOptionSchema),
@@ -8677,6 +8788,9 @@ function parseAuthOptions(input) {
 function isPublicMode(options) {
   return options.mode === "public";
 }
+function isStaticMode(options) {
+  return options.mode === "static";
+}
 function isTransparentMode(options) {
   return options.mode === "transparent";
 }
@@ -8703,108 +8817,108 @@ function allowsPublicAccess(options) {
 }
 
 // libs/auth/src/consent/consent.types.ts
-var import_lazy_zod16 = require("@frontmcp/lazy-zod");
-var consentToolItemSchema = import_lazy_zod16.z.object({
+var import_lazy_zod17 = require("@frontmcp/lazy-zod");
+var consentToolItemSchema = import_lazy_zod17.z.object({
   /** Tool ID (e.g., 'slack:send_message') */
-  id: import_lazy_zod16.z.string().min(1),
+  id: import_lazy_zod17.z.string().min(1),
   /** Tool name for display */
-  name: import_lazy_zod16.z.string().min(1),
+  name: import_lazy_zod17.z.string().min(1),
   /** Tool description */
-  description: import_lazy_zod16.z.string().optional(),
+  description: import_lazy_zod17.z.string().optional(),
   /** App ID this tool belongs to */
-  appId: import_lazy_zod16.z.string().min(1),
+  appId: import_lazy_zod17.z.string().min(1),
   /** App name for display */
-  appName: import_lazy_zod16.z.string().min(1),
+  appName: import_lazy_zod17.z.string().min(1),
   /** Whether the tool is selected by default */
-  defaultSelected: import_lazy_zod16.z.boolean().default(true),
+  defaultSelected: import_lazy_zod17.z.boolean().default(true),
   /** Whether this tool requires specific scopes */
-  requiredScopes: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional(),
+  requiredScopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()).optional(),
   /** Category for grouping (e.g., 'read', 'write', 'admin') */
-  category: import_lazy_zod16.z.string().optional()
+  category: import_lazy_zod17.z.string().optional()
 });
-var consentSelectionSchema = import_lazy_zod16.z.object({
+var consentSelectionSchema = import_lazy_zod17.z.object({
   /** Selected tool IDs */
-  selectedTools: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  selectedTools: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Whether all tools were selected */
-  allSelected: import_lazy_zod16.z.boolean(),
+  allSelected: import_lazy_zod17.z.boolean(),
   /** Timestamp when consent was given */
-  consentedAt: import_lazy_zod16.z.string().datetime(),
+  consentedAt: import_lazy_zod17.z.string().datetime(),
   /** Consent version for tracking changes */
-  consentVersion: import_lazy_zod16.z.string().default("1.0")
+  consentVersion: import_lazy_zod17.z.string().default("1.0")
 });
-var consentStateSchema = import_lazy_zod16.z.object({
+var consentStateSchema = import_lazy_zod17.z.object({
   /** Whether consent flow is enabled */
-  enabled: import_lazy_zod16.z.boolean(),
+  enabled: import_lazy_zod17.z.boolean(),
   /** Available tools for consent */
-  availableTools: import_lazy_zod16.z.array(consentToolItemSchema),
+  availableTools: import_lazy_zod17.z.array(consentToolItemSchema),
   /** Pre-selected tools (from previous consent or defaults) */
-  preselectedTools: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional(),
+  preselectedTools: import_lazy_zod17.z.array(import_lazy_zod17.z.string()).optional(),
   /** Whether to show all tools or group by app */
-  groupByApp: import_lazy_zod16.z.boolean().default(true),
+  groupByApp: import_lazy_zod17.z.boolean().default(true),
   /** Custom consent message */
-  customMessage: import_lazy_zod16.z.string().optional()
+  customMessage: import_lazy_zod17.z.string().optional()
 });
-var federatedProviderItemSchema = import_lazy_zod16.z.object({
+var federatedProviderItemSchema = import_lazy_zod17.z.object({
   /** Provider ID (derived or explicit) */
-  id: import_lazy_zod16.z.string().min(1),
+  id: import_lazy_zod17.z.string().min(1),
   /** Provider display name */
-  name: import_lazy_zod16.z.string().min(1),
+  name: import_lazy_zod17.z.string().min(1),
   /** Provider description */
-  description: import_lazy_zod16.z.string().optional(),
+  description: import_lazy_zod17.z.string().optional(),
   /** Provider icon URL or emoji */
-  icon: import_lazy_zod16.z.string().optional(),
+  icon: import_lazy_zod17.z.string().optional(),
   /** Provider type */
-  type: import_lazy_zod16.z.enum(["local", "remote", "transparent"]),
+  type: import_lazy_zod17.z.enum(["local", "remote", "transparent"]),
   /** OAuth provider URL (for remote providers) */
-  providerUrl: import_lazy_zod16.z.string().url().optional(),
+  providerUrl: import_lazy_zod17.z.string().url().optional(),
   /** Apps using this provider */
-  appIds: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  appIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** App names using this provider */
-  appNames: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  appNames: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Scopes required by this provider */
-  scopes: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  scopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Whether this is the primary/parent provider */
-  isPrimary: import_lazy_zod16.z.boolean(),
+  isPrimary: import_lazy_zod17.z.boolean(),
   /** Whether this provider is optional (can be skipped) */
-  isOptional: import_lazy_zod16.z.boolean().default(false)
+  isOptional: import_lazy_zod17.z.boolean().default(false)
 });
-var federatedLoginStateSchema = import_lazy_zod16.z.object({
+var federatedLoginStateSchema = import_lazy_zod17.z.object({
   /** All available providers */
-  providers: import_lazy_zod16.z.array(federatedProviderItemSchema),
+  providers: import_lazy_zod17.z.array(federatedProviderItemSchema),
   /** Primary provider ID (if any) */
-  primaryProviderId: import_lazy_zod16.z.string().optional(),
+  primaryProviderId: import_lazy_zod17.z.string().optional(),
   /** Whether user can skip optional providers */
-  allowSkip: import_lazy_zod16.z.boolean().default(true),
+  allowSkip: import_lazy_zod17.z.boolean().default(true),
   /** Pre-selected provider IDs (from previous session) */
-  preselectedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()).optional()
+  preselectedProviders: import_lazy_zod17.z.array(import_lazy_zod17.z.string()).optional()
 });
-var federatedSelectionSchema = import_lazy_zod16.z.object({
+var federatedSelectionSchema = import_lazy_zod17.z.object({
   /** Selected provider IDs */
-  selectedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  selectedProviders: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Skipped provider IDs */
-  skippedProviders: import_lazy_zod16.z.array(import_lazy_zod16.z.string()),
+  skippedProviders: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
   /** Provider-specific metadata */
-  providerMetadata: import_lazy_zod16.z.record(import_lazy_zod16.z.string(), import_lazy_zod16.z.unknown()).optional()
+  providerMetadata: import_lazy_zod17.z.record(import_lazy_zod17.z.string(), import_lazy_zod17.z.unknown()).optional()
 });
 
 // libs/auth/src/detection/auth-provider-detection.ts
-var import_lazy_zod17 = require("@frontmcp/lazy-zod");
-var detectedAuthProviderSchema = import_lazy_zod17.z.object({
-  id: import_lazy_zod17.z.string(),
-  providerUrl: import_lazy_zod17.z.string().optional(),
-  mode: import_lazy_zod17.z.enum(["public", "transparent", "local", "remote"]),
-  appIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  scopes: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  isParentProvider: import_lazy_zod17.z.boolean()
+var import_lazy_zod18 = require("@frontmcp/lazy-zod");
+var detectedAuthProviderSchema = import_lazy_zod18.z.object({
+  id: import_lazy_zod18.z.string(),
+  providerUrl: import_lazy_zod18.z.string().optional(),
+  mode: import_lazy_zod18.z.enum(["public", "static", "transparent", "local", "remote"]),
+  appIds: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  isParentProvider: import_lazy_zod18.z.boolean()
 });
-var authProviderDetectionResultSchema = import_lazy_zod17.z.object({
-  providers: import_lazy_zod17.z.map(import_lazy_zod17.z.string(), detectedAuthProviderSchema),
-  requiresOrchestration: import_lazy_zod17.z.boolean(),
-  parentProviderId: import_lazy_zod17.z.string().optional(),
-  childProviderIds: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  uniqueProviderCount: import_lazy_zod17.z.number(),
-  validationErrors: import_lazy_zod17.z.array(import_lazy_zod17.z.string()),
-  warnings: import_lazy_zod17.z.array(import_lazy_zod17.z.string())
+var authProviderDetectionResultSchema = import_lazy_zod18.z.object({
+  providers: import_lazy_zod18.z.map(import_lazy_zod18.z.string(), detectedAuthProviderSchema),
+  requiresOrchestration: import_lazy_zod18.z.boolean(),
+  parentProviderId: import_lazy_zod18.z.string().optional(),
+  childProviderIds: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  uniqueProviderCount: import_lazy_zod18.z.number(),
+  validationErrors: import_lazy_zod18.z.array(import_lazy_zod18.z.string()),
+  warnings: import_lazy_zod18.z.array(import_lazy_zod18.z.string())
 });
 function deriveProviderId(options) {
   if (isPublicMode(options)) {
@@ -9193,43 +9307,43 @@ var AudienceValidator = class _AudienceValidator {
 };
 
 // libs/auth/src/vault/auth-providers.types.ts
-var import_lazy_zod18 = require("@frontmcp/lazy-zod");
-var credentialScopeSchema = import_lazy_zod18.z.enum(["global", "user", "session"]);
-var loadingStrategySchema = import_lazy_zod18.z.enum(["eager", "lazy"]);
-var getCredentialOptionsSchema = import_lazy_zod18.z.object({
-  forceRefresh: import_lazy_zod18.z.boolean().optional(),
-  scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()).optional(),
-  timeout: import_lazy_zod18.z.number().positive().optional()
+var import_lazy_zod19 = require("@frontmcp/lazy-zod");
+var credentialScopeSchema = import_lazy_zod19.z.enum(["global", "user", "session"]);
+var loadingStrategySchema = import_lazy_zod19.z.enum(["eager", "lazy"]);
+var getCredentialOptionsSchema = import_lazy_zod19.z.object({
+  forceRefresh: import_lazy_zod19.z.boolean().optional(),
+  scopes: import_lazy_zod19.z.array(import_lazy_zod19.z.string()).optional(),
+  timeout: import_lazy_zod19.z.number().positive().optional()
 }).strict();
-var credentialProviderConfigSchema = import_lazy_zod18.z.object({
-  name: import_lazy_zod18.z.string().min(1),
-  description: import_lazy_zod18.z.string().optional(),
+var credentialProviderConfigSchema = import_lazy_zod19.z.object({
+  name: import_lazy_zod19.z.string().min(1),
+  description: import_lazy_zod19.z.string().optional(),
   scope: credentialScopeSchema,
   loading: loadingStrategySchema,
-  cacheTtl: import_lazy_zod18.z.number().nonnegative().optional(),
+  cacheTtl: import_lazy_zod19.z.number().nonnegative().optional(),
   // Functions validated at runtime, not via Zod (Zod 4 compatibility)
-  factory: import_lazy_zod18.z.any(),
-  refresh: import_lazy_zod18.z.any().optional(),
-  toHeaders: import_lazy_zod18.z.any().optional(),
-  metadata: import_lazy_zod18.z.record(import_lazy_zod18.z.string(), import_lazy_zod18.z.unknown()).optional(),
-  required: import_lazy_zod18.z.boolean().optional()
+  factory: import_lazy_zod19.z.any(),
+  refresh: import_lazy_zod19.z.any().optional(),
+  toHeaders: import_lazy_zod19.z.any().optional(),
+  metadata: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
+  required: import_lazy_zod19.z.boolean().optional()
 }).strict();
-var authProviderMappingSchema = import_lazy_zod18.z.union([
-  import_lazy_zod18.z.string(),
-  import_lazy_zod18.z.object({
-    name: import_lazy_zod18.z.string().min(1),
-    required: import_lazy_zod18.z.boolean().optional().default(true),
-    scopes: import_lazy_zod18.z.array(import_lazy_zod18.z.string()).optional(),
-    alias: import_lazy_zod18.z.string().optional()
+var authProviderMappingSchema = import_lazy_zod19.z.union([
+  import_lazy_zod19.z.string(),
+  import_lazy_zod19.z.object({
+    name: import_lazy_zod19.z.string().min(1),
+    required: import_lazy_zod19.z.boolean().optional().default(true),
+    scopes: import_lazy_zod19.z.array(import_lazy_zod19.z.string()).optional(),
+    alias: import_lazy_zod19.z.string().optional()
   }).strict()
 ]);
-var authProvidersVaultOptionsSchema = import_lazy_zod18.z.object({
-  enabled: import_lazy_zod18.z.boolean().optional(),
-  useSharedStorage: import_lazy_zod18.z.boolean().optional().default(true),
-  namespace: import_lazy_zod18.z.string().optional().default("authproviders:"),
-  defaultCacheTtl: import_lazy_zod18.z.number().nonnegative().optional().default(36e5),
-  maxCredentialsPerSession: import_lazy_zod18.z.number().positive().optional().default(100),
-  providers: import_lazy_zod18.z.array(credentialProviderConfigSchema).optional()
+var authProvidersVaultOptionsSchema = import_lazy_zod19.z.object({
+  enabled: import_lazy_zod19.z.boolean().optional(),
+  useSharedStorage: import_lazy_zod19.z.boolean().optional().default(true),
+  namespace: import_lazy_zod19.z.string().optional().default("authproviders:"),
+  defaultCacheTtl: import_lazy_zod19.z.number().nonnegative().optional().default(36e5),
+  maxCredentialsPerSession: import_lazy_zod19.z.number().positive().optional().default(100),
+  providers: import_lazy_zod19.z.array(credentialProviderConfigSchema).optional()
 }).strict();
 
 // libs/auth/src/vault/credential-helpers.ts
@@ -10451,20 +10565,20 @@ function resolveRequiredScopes(denial, mapping, authorities) {
 }
 
 // libs/auth/src/authorities/authorities.schema.ts
-var import_lazy_zod19 = require("@frontmcp/lazy-zod");
-var rbacRolesPolicySchema = import_lazy_zod19.z.object({
-  all: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional(),
-  any: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional()
+var import_lazy_zod20 = require("@frontmcp/lazy-zod");
+var rbacRolesPolicySchema = import_lazy_zod20.z.object({
+  all: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional(),
+  any: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional()
 }).refine((data) => data.all !== void 0 || data.any !== void 0, {
   message: 'Roles policy must have at least "all" or "any"'
 });
-var rbacPermissionsPolicySchema = import_lazy_zod19.z.object({
-  all: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional(),
-  any: import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).optional()
+var rbacPermissionsPolicySchema = import_lazy_zod20.z.object({
+  all: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional(),
+  any: import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).optional()
 }).refine((data) => data.all !== void 0 || data.any !== void 0, {
   message: 'Permissions policy must have at least "all" or "any"'
 });
-var abacOperatorSchema = import_lazy_zod19.z.enum([
+var abacOperatorSchema = import_lazy_zod20.z.enum([
   "eq",
   "neq",
   "in",
@@ -10479,55 +10593,55 @@ var abacOperatorSchema = import_lazy_zod19.z.enum([
   "exists",
   "matches"
 ]);
-var abacConditionSchema = import_lazy_zod19.z.object({
-  path: import_lazy_zod19.z.string().min(1),
+var abacConditionSchema = import_lazy_zod20.z.object({
+  path: import_lazy_zod20.z.string().min(1),
   op: abacOperatorSchema,
-  value: import_lazy_zod19.z.unknown()
+  value: import_lazy_zod20.z.unknown()
 });
-var abacPolicySchema = import_lazy_zod19.z.object({
-  match: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
-  conditions: import_lazy_zod19.z.array(abacConditionSchema).optional()
+var abacPolicySchema = import_lazy_zod20.z.object({
+  match: import_lazy_zod20.z.record(import_lazy_zod20.z.string(), import_lazy_zod20.z.unknown()).optional(),
+  conditions: import_lazy_zod20.z.array(abacConditionSchema).optional()
 }).refine((data) => data.match !== void 0 || data.conditions !== void 0, {
   message: 'Attributes policy must have at least "match" or "conditions"'
 });
-var resourceIdRefSchema = import_lazy_zod19.z.union([
-  import_lazy_zod19.z.string().min(1),
-  import_lazy_zod19.z.object({ fromInput: import_lazy_zod19.z.string().min(1) }).strict(),
-  import_lazy_zod19.z.object({ fromClaims: import_lazy_zod19.z.string().min(1) }).strict()
+var resourceIdRefSchema = import_lazy_zod20.z.union([
+  import_lazy_zod20.z.string().min(1),
+  import_lazy_zod20.z.object({ fromInput: import_lazy_zod20.z.string().min(1) }).strict(),
+  import_lazy_zod20.z.object({ fromClaims: import_lazy_zod20.z.string().min(1) }).strict()
 ]);
-var rebacPolicySchema = import_lazy_zod19.z.object({
-  type: import_lazy_zod19.z.string().min(1),
-  resource: import_lazy_zod19.z.string().min(1),
+var rebacPolicySchema = import_lazy_zod20.z.object({
+  type: import_lazy_zod20.z.string().min(1),
+  resource: import_lazy_zod20.z.string().min(1),
   resourceId: resourceIdRefSchema
 });
 var basePolicyShape = {
   roles: rbacRolesPolicySchema.optional(),
   permissions: rbacPermissionsPolicySchema.optional(),
   attributes: abacPolicySchema.optional(),
-  relationships: import_lazy_zod19.z.union([rebacPolicySchema, import_lazy_zod19.z.array(rebacPolicySchema)]).optional(),
-  custom: import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.unknown()).optional(),
-  guards: import_lazy_zod19.z.array(import_lazy_zod19.z.instanceof(Function)).optional(),
-  operator: import_lazy_zod19.z.enum(["AND", "OR"]).optional()
+  relationships: import_lazy_zod20.z.union([rebacPolicySchema, import_lazy_zod20.z.array(rebacPolicySchema)]).optional(),
+  custom: import_lazy_zod20.z.record(import_lazy_zod20.z.string(), import_lazy_zod20.z.unknown()).optional(),
+  guards: import_lazy_zod20.z.array(import_lazy_zod20.z.instanceof(Function)).optional(),
+  operator: import_lazy_zod20.z.enum(["AND", "OR"]).optional()
 };
-var authoritiesPolicySchema = import_lazy_zod19.z.lazy(
-  () => import_lazy_zod19.z.object({
+var authoritiesPolicySchema = import_lazy_zod20.z.lazy(
+  () => import_lazy_zod20.z.object({
     ...basePolicyShape,
     not: authoritiesPolicySchema.optional(),
-    anyOf: import_lazy_zod19.z.array(authoritiesPolicySchema).optional(),
-    allOf: import_lazy_zod19.z.array(authoritiesPolicySchema).optional()
+    anyOf: import_lazy_zod20.z.array(authoritiesPolicySchema).optional(),
+    allOf: import_lazy_zod20.z.array(authoritiesPolicySchema).optional()
   })
 );
-var authoritiesMetadataSchema = import_lazy_zod19.z.union([
-  import_lazy_zod19.z.string().min(1),
-  import_lazy_zod19.z.array(import_lazy_zod19.z.string().min(1)).min(1),
+var authoritiesMetadataSchema = import_lazy_zod20.z.union([
+  import_lazy_zod20.z.string().min(1),
+  import_lazy_zod20.z.array(import_lazy_zod20.z.string().min(1)).min(1),
   authoritiesPolicySchema
 ]);
-var authoritiesClaimsMappingSchema = import_lazy_zod19.z.record(import_lazy_zod19.z.string(), import_lazy_zod19.z.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
+var authoritiesClaimsMappingSchema = import_lazy_zod20.z.record(import_lazy_zod20.z.string(), import_lazy_zod20.z.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
   message: "Claims mapping must have at least one mapping"
 });
-var authoritiesConfigSchema = import_lazy_zod19.z.object({
+var authoritiesConfigSchema = import_lazy_zod20.z.object({
   claimsMapping: authoritiesClaimsMappingSchema.optional(),
-  profiles: import_lazy_zod19.z.record(import_lazy_zod19.z.string().min(1), authoritiesPolicySchema).optional()
+  profiles: import_lazy_zod20.z.record(import_lazy_zod20.z.string().min(1), authoritiesPolicySchema).optional()
 });
 
 // libs/auth/src/authorities/authorities.evaluator.ts
@@ -11231,6 +11345,8 @@ var FetchCredentialMiddleware = class {
   InMemoryStoreRequiredError,
   InvalidClientIdUrlError,
   JwksService,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
   LazyCredentialLoader,
   NoProviderIdError,
   NullOrchestratedAuthAccessor,
@@ -11401,6 +11517,7 @@ var FetchCredentialMiddleware = class {
   isSoonExpiring,
   isSoonExpiringProvider,
   isSqliteTokenStorage,
+  isStaticMode,
   isTransparentMode,
   jsonWebKeySetSchema,
   jwkParametersSchema,
@@ -11460,6 +11577,7 @@ var FetchCredentialMiddleware = class {
   startNextProvider,
   statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema,
+  staticAuthOptionsSchema,
   storedSessionSchema,
   streamableHttpTransportStateSchema,
   toEpochSeconds,