@frontmcp/sdk 0.7.2 → 0.8.0

package/common/types/options/auth/{auth.interfaces.d.ts → interfaces.d.ts}

@@ -1,5 +1,5 @@
 import { JSONWebKeySet, JWK } from '../../auth';
-import { RedisConfig } from '../../../../auth/session/transport-session.types';
+import type { RedisConfig } from '../../../../auth/session/transport-session.types';
 /**
  * Public access configuration for tools/prompts
  */
@@ -160,6 +160,17 @@ export interface ConsentConfig {
     /** Tools to always include in consent (pre-selected) */
     defaultSelectedTools?: string[];
 }
+/**
+ * Federated authentication configuration
+ */
+export interface FederatedAuthConfig {
+    /**
+     * How strictly to validate the OAuth state parameter on provider callbacks.
+     * - 'strict': Validates the full state parameter matches the session (recommended)
+     * - 'format': Only validates the state format is correct
+     */
+    stateValidation: 'strict' | 'format';
+}
 /**
  * Progressive/Incremental authorization configuration
  */
@@ -185,26 +196,6 @@ export interface IncrementalAuthConfig {
      */
     showAllAppsAtOnce?: boolean;
 }
-/**
- * @deprecated Use top-level transport config instead
- */
-export interface TransportRecreationConfig {
-    enabled?: boolean;
-    redis?: RedisConfig;
-    defaultTtlMs?: number;
-}
-/**
- * @deprecated Use top-level transport config instead
- */
-export interface TransportConfig {
-    enableLegacySSE?: boolean;
-    enableSseListener?: boolean;
-    enableStreamableHttp?: boolean;
-    enableStatelessHttp?: boolean;
-    enableStatefulHttp?: boolean;
-    requireSessionForStreamable?: boolean;
-    recreation?: TransportRecreationConfig;
-}
 /**
  * Public mode - No authentication required
  *
@@ -248,10 +239,6 @@ export interface PublicAuthOptionsInterface {
      * @default auto-generated
      */
     signKey?: JWK | Uint8Array;
-    /**
-     * @deprecated Use top-level transport config instead
-     */
-    transport?: TransportConfig;
 }
 /**
  * Transparent mode - Pass-through OAuth tokens from remote provider
@@ -292,10 +279,6 @@ export interface TransparentAuthOptionsInterface {
     anonymousScopes?: string[];
     /** Public access config for anonymous users */
     publicAccess?: PublicAccessConfig;
-    /**
-     * @deprecated Use top-level transport config instead
-     */
-    transport?: TransportConfig;
 }
 /**
  * Orchestrated local mode - Full local authentication
@@ -322,11 +305,6 @@ export interface OrchestratedLocalOptionsInterface {
      * @default { type: 'memory' }
      */
     tokenStorage?: TokenStorageConfig;
-    /**
-     * Session storage mode
-     * @default 'stateful'
-     */
-    sessionMode?: 'stateful' | 'stateless';
     /**
      * Allow default public access for unauthenticated requests
      * @default false
@@ -341,16 +319,14 @@ export interface OrchestratedLocalOptionsInterface {
     publicAccess?: PublicAccessConfig;
     /** Consent flow configuration */
     consent?: ConsentConfig;
+    /** Federated auth configuration */
+    federatedAuth?: FederatedAuthConfig;
     /** Token refresh settings */
     refresh?: TokenRefreshConfig;
     /** Expected token audience */
     expectedAudience?: string | string[];
     /** Incremental authorization configuration */
     incrementalAuth?: IncrementalAuthConfig;
-    /**
-     * @deprecated Use top-level transport config instead
-     */
-    transport?: TransportConfig;
 }
 /**
  * Orchestrated remote mode - Proxy to remote OAuth provider
@@ -382,11 +358,6 @@ export interface OrchestratedRemoteOptionsInterface {
      * @default { type: 'memory' }
      */
     tokenStorage?: TokenStorageConfig;
-    /**
-     * Session storage mode
-     * @default 'stateful'
-     */
-    sessionMode?: 'stateful' | 'stateless';
     /**
      * Allow default public access for unauthenticated requests
      * @default false
@@ -401,16 +372,14 @@ export interface OrchestratedRemoteOptionsInterface {
     publicAccess?: PublicAccessConfig;
     /** Consent flow configuration */
     consent?: ConsentConfig;
+    /** Federated auth configuration */
+    federatedAuth?: FederatedAuthConfig;
     /** Token refresh settings */
     refresh?: TokenRefreshConfig;
     /** Expected token audience */
     expectedAudience?: string | string[];
     /** Incremental authorization configuration */
     incrementalAuth?: IncrementalAuthConfig;
-    /**
-     * @deprecated Use top-level transport config instead
-     */
-    transport?: TransportConfig;
 }
 /**
  * Authentication configuration for @FrontMcp decorator
@@ -459,4 +428,4 @@ export type AuthMode = 'public' | 'transparent' | 'orchestrated';
  * Orchestrated type
  */
 export type OrchestratedType = 'local' | 'remote';
-//# sourceMappingURL=auth.interfaces.d.ts.map
+//# sourceMappingURL=interfaces.d.ts.map

package/common/types/options/auth/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/interfaces.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAC;AAMpF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;IAE3B;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,cAAc,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,eAAe,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAExC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAMD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IAEf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,aAAa,CAAC;IAEpB,qDAAqD;IACrD,MAAM,EAAE,oBAAoB,CAAC;IAE7B,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAErC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,+CAA+C;IAC/C,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IAEd,kCAAkC;IAClC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2BAA2B;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC,iCAAiC;IACjC,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAErC,8CAA8C;IAC9C,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IAEf,qDAAqD;IACrD,MAAM,EAAE,oBAAoB,CAAC;IAE7B,kCAAkC;IAClC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,2BAA2B;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC,iCAAiC;IACjC,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,mCAAmC;IACnC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,6BAA6B;IAC7B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B,8BAA8B;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAErC,8CAA8C;IAC9C,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,MAAM,oBAAoB,GAC5B,0BAA0B,GAC1B,+BAA+B,GAC/B,iCAAiC,GACjC,kCAAkC,CAAC;AAEvC;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,iCAAiC,GAAG,kCAAkC,CAAC;AAEtH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC"}

package/common/types/options/auth/orchestrated.schema.d.ts

@@ -21,10 +21,6 @@ export declare const orchestratedLocalSchema: z.ZodObject<{
             defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         }, z.core.$strip>;
     }, z.core.$strip>], "type">>;
-    sessionMode: z.ZodDefault<z.ZodEnum<{
-        stateful: "stateful";
-        stateless: "stateless";
-    }>>;
     allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
     anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     publicAccess: z.ZodOptional<z.ZodObject<{
@@ -43,6 +39,12 @@ export declare const orchestratedLocalSchema: z.ZodObject<{
         excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    federatedAuth: z.ZodOptional<z.ZodObject<{
+        stateValidation: z.ZodDefault<z.ZodEnum<{
+            format: "format";
+            strict: "strict";
+        }>>;
+    }, z.core.$strip>>;
     refresh: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         skewSeconds: z.ZodDefault<z.ZodNumber>;
@@ -57,26 +59,43 @@ export declare const orchestratedLocalSchema: z.ZodObject<{
         allowSkip: z.ZodDefault<z.ZodBoolean>;
         showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
-    transport: z.ZodOptional<z.ZodObject<{
-        enableLegacySSE: z.ZodDefault<z.ZodBoolean>;
-        enableSseListener: z.ZodDefault<z.ZodBoolean>;
-        enableStreamableHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatelessHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatefulHttp: z.ZodDefault<z.ZodBoolean>;
-        requireSessionForStreamable: z.ZodDefault<z.ZodBoolean>;
-        recreation: z.ZodOptional<z.ZodLazy<z.ZodObject<{
-            enabled: z.ZodDefault<z.ZodBoolean>;
+    cimd: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        cache: z.ZodOptional<z.ZodObject<{
+            type: z.ZodDefault<z.ZodEnum<{
+                memory: "memory";
+                redis: "redis";
+            }>>;
+            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+            maxTtlMs: z.ZodDefault<z.ZodNumber>;
+            minTtlMs: z.ZodDefault<z.ZodNumber>;
             redis: z.ZodOptional<z.ZodObject<{
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                url: z.ZodOptional<z.ZodString>;
+                host: z.ZodOptional<z.ZodString>;
+                port: z.ZodOptional<z.ZodNumber>;
                 password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                db: z.ZodOptional<z.ZodNumber>;
+                tls: z.ZodOptional<z.ZodBoolean>;
+                keyPrefix: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>;
-            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        security: z.ZodOptional<z.ZodObject<{
+            blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+            allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+            allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        network: z.ZodOptional<z.ZodObject<{
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+            redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                deny: "deny";
+                "same-origin": "same-origin";
+                allow: "allow";
+            }>>;
+            maxRedirects: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     mode: z.ZodLiteral<"orchestrated">;
     type: z.ZodLiteral<"local">;
@@ -103,10 +122,6 @@ export declare const orchestratedRemoteSchema: z.ZodObject<{
             defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         }, z.core.$strip>;
     }, z.core.$strip>], "type">>;
-    sessionMode: z.ZodDefault<z.ZodEnum<{
-        stateful: "stateful";
-        stateless: "stateless";
-    }>>;
     allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
     anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     publicAccess: z.ZodOptional<z.ZodObject<{
@@ -125,6 +140,12 @@ export declare const orchestratedRemoteSchema: z.ZodObject<{
         excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    federatedAuth: z.ZodOptional<z.ZodObject<{
+        stateValidation: z.ZodDefault<z.ZodEnum<{
+            format: "format";
+            strict: "strict";
+        }>>;
+    }, z.core.$strip>>;
     refresh: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         skewSeconds: z.ZodDefault<z.ZodNumber>;
@@ -139,26 +160,43 @@ export declare const orchestratedRemoteSchema: z.ZodObject<{
         allowSkip: z.ZodDefault<z.ZodBoolean>;
         showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
-    transport: z.ZodOptional<z.ZodObject<{
-        enableLegacySSE: z.ZodDefault<z.ZodBoolean>;
-        enableSseListener: z.ZodDefault<z.ZodBoolean>;
-        enableStreamableHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatelessHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatefulHttp: z.ZodDefault<z.ZodBoolean>;
-        requireSessionForStreamable: z.ZodDefault<z.ZodBoolean>;
-        recreation: z.ZodOptional<z.ZodLazy<z.ZodObject<{
-            enabled: z.ZodDefault<z.ZodBoolean>;
+    cimd: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        cache: z.ZodOptional<z.ZodObject<{
+            type: z.ZodDefault<z.ZodEnum<{
+                memory: "memory";
+                redis: "redis";
+            }>>;
+            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+            maxTtlMs: z.ZodDefault<z.ZodNumber>;
+            minTtlMs: z.ZodDefault<z.ZodNumber>;
             redis: z.ZodOptional<z.ZodObject<{
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                url: z.ZodOptional<z.ZodString>;
+                host: z.ZodOptional<z.ZodString>;
+                port: z.ZodOptional<z.ZodNumber>;
                 password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                db: z.ZodOptional<z.ZodNumber>;
+                tls: z.ZodOptional<z.ZodBoolean>;
+                keyPrefix: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>;
-            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        security: z.ZodOptional<z.ZodObject<{
+            blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+            allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+            allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        network: z.ZodOptional<z.ZodObject<{
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+            redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                deny: "deny";
+                "same-origin": "same-origin";
+                allow: "allow";
+            }>>;
+            maxRedirects: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     mode: z.ZodLiteral<"orchestrated">;
     type: z.ZodLiteral<"remote">;
@@ -202,10 +240,6 @@ export declare const orchestratedAuthOptionsSchema: z.ZodDiscriminatedUnion<[z.Z
             defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         }, z.core.$strip>;
     }, z.core.$strip>], "type">>;
-    sessionMode: z.ZodDefault<z.ZodEnum<{
-        stateful: "stateful";
-        stateless: "stateless";
-    }>>;
     allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
     anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     publicAccess: z.ZodOptional<z.ZodObject<{
@@ -224,6 +258,12 @@ export declare const orchestratedAuthOptionsSchema: z.ZodDiscriminatedUnion<[z.Z
         excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    federatedAuth: z.ZodOptional<z.ZodObject<{
+        stateValidation: z.ZodDefault<z.ZodEnum<{
+            format: "format";
+            strict: "strict";
+        }>>;
+    }, z.core.$strip>>;
     refresh: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         skewSeconds: z.ZodDefault<z.ZodNumber>;
@@ -238,26 +278,43 @@ export declare const orchestratedAuthOptionsSchema: z.ZodDiscriminatedUnion<[z.Z
         allowSkip: z.ZodDefault<z.ZodBoolean>;
         showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
-    transport: z.ZodOptional<z.ZodObject<{
-        enableLegacySSE: z.ZodDefault<z.ZodBoolean>;
-        enableSseListener: z.ZodDefault<z.ZodBoolean>;
-        enableStreamableHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatelessHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatefulHttp: z.ZodDefault<z.ZodBoolean>;
-        requireSessionForStreamable: z.ZodDefault<z.ZodBoolean>;
-        recreation: z.ZodOptional<z.ZodLazy<z.ZodObject<{
-            enabled: z.ZodDefault<z.ZodBoolean>;
+    cimd: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        cache: z.ZodOptional<z.ZodObject<{
+            type: z.ZodDefault<z.ZodEnum<{
+                memory: "memory";
+                redis: "redis";
+            }>>;
+            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+            maxTtlMs: z.ZodDefault<z.ZodNumber>;
+            minTtlMs: z.ZodDefault<z.ZodNumber>;
             redis: z.ZodOptional<z.ZodObject<{
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                url: z.ZodOptional<z.ZodString>;
+                host: z.ZodOptional<z.ZodString>;
+                port: z.ZodOptional<z.ZodNumber>;
                 password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                db: z.ZodOptional<z.ZodNumber>;
+                tls: z.ZodOptional<z.ZodBoolean>;
+                keyPrefix: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>;
-            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        security: z.ZodOptional<z.ZodObject<{
+            blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+            allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+            allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        network: z.ZodOptional<z.ZodObject<{
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+            redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                deny: "deny";
+                "same-origin": "same-origin";
+                allow: "allow";
+            }>>;
+            maxRedirects: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     mode: z.ZodLiteral<"orchestrated">;
     type: z.ZodLiteral<"local">;
@@ -283,10 +340,6 @@ export declare const orchestratedAuthOptionsSchema: z.ZodDiscriminatedUnion<[z.Z
             defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         }, z.core.$strip>;
     }, z.core.$strip>], "type">>;
-    sessionMode: z.ZodDefault<z.ZodEnum<{
-        stateful: "stateful";
-        stateless: "stateless";
-    }>>;
     allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
     anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     publicAccess: z.ZodOptional<z.ZodObject<{
@@ -305,6 +358,12 @@ export declare const orchestratedAuthOptionsSchema: z.ZodDiscriminatedUnion<[z.Z
         excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    federatedAuth: z.ZodOptional<z.ZodObject<{
+        stateValidation: z.ZodDefault<z.ZodEnum<{
+            format: "format";
+            strict: "strict";
+        }>>;
+    }, z.core.$strip>>;
     refresh: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         skewSeconds: z.ZodDefault<z.ZodNumber>;
@@ -319,26 +378,43 @@ export declare const orchestratedAuthOptionsSchema: z.ZodDiscriminatedUnion<[z.Z
         allowSkip: z.ZodDefault<z.ZodBoolean>;
         showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
-    transport: z.ZodOptional<z.ZodObject<{
-        enableLegacySSE: z.ZodDefault<z.ZodBoolean>;
-        enableSseListener: z.ZodDefault<z.ZodBoolean>;
-        enableStreamableHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatelessHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatefulHttp: z.ZodDefault<z.ZodBoolean>;
-        requireSessionForStreamable: z.ZodDefault<z.ZodBoolean>;
-        recreation: z.ZodOptional<z.ZodLazy<z.ZodObject<{
-            enabled: z.ZodDefault<z.ZodBoolean>;
+    cimd: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        cache: z.ZodOptional<z.ZodObject<{
+            type: z.ZodDefault<z.ZodEnum<{
+                memory: "memory";
+                redis: "redis";
+            }>>;
+            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+            maxTtlMs: z.ZodDefault<z.ZodNumber>;
+            minTtlMs: z.ZodDefault<z.ZodNumber>;
             redis: z.ZodOptional<z.ZodObject<{
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                url: z.ZodOptional<z.ZodString>;
+                host: z.ZodOptional<z.ZodString>;
+                port: z.ZodOptional<z.ZodNumber>;
                 password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                db: z.ZodOptional<z.ZodNumber>;
+                tls: z.ZodOptional<z.ZodBoolean>;
+                keyPrefix: z.ZodDefault<z.ZodString>;
             }, z.core.$strip>>;
-            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        security: z.ZodOptional<z.ZodObject<{
+            blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+            allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+            allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        network: z.ZodOptional<z.ZodObject<{
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+            redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                deny: "deny";
+                "same-origin": "same-origin";
+                allow: "allow";
+            }>>;
+            maxRedirects: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     mode: z.ZodLiteral<"orchestrated">;
     type: z.ZodLiteral<"remote">;

package/common/types/options/auth/orchestrated.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrated.schema.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/orchestrated.schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiGxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AAOH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUnC,CAAC;AAMH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAGxC,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC/E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACjF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEtF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEzF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"orchestrated.schema.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/orchestrated.schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkGxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AAOH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUnC,CAAC;AAMH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAGxC,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC/E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACjF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEtF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEzF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC"}

package/common/types/options/auth/public.schema.d.ts

@@ -13,27 +13,6 @@ export declare const publicAuthOptionsSchema: z.ZodObject<{
         keys: z.ZodArray<z.ZodType<import("../../auth").JWK, unknown, z.core.$ZodTypeInternals<import("../../auth").JWK, unknown>>>;
     }, z.core.$strip>>;
     signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("../../auth").JWK, unknown, z.core.$ZodTypeInternals<import("../../auth").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
-    transport: z.ZodOptional<z.ZodObject<{
-        enableLegacySSE: z.ZodDefault<z.ZodBoolean>;
-        enableSseListener: z.ZodDefault<z.ZodBoolean>;
-        enableStreamableHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatelessHttp: z.ZodDefault<z.ZodBoolean>;
-        enableStatefulHttp: z.ZodDefault<z.ZodBoolean>;
-        requireSessionForStreamable: z.ZodDefault<z.ZodBoolean>;
-        recreation: z.ZodOptional<z.ZodLazy<z.ZodObject<{
-            enabled: z.ZodDefault<z.ZodBoolean>;
-            redis: z.ZodOptional<z.ZodObject<{
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>>;
-            defaultTtlMs: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>;
 }, z.core.$strip>;
 /**
  * Public mode options (output type with defaults applied)

package/common/types/options/auth/public.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.schema.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/public.schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0ClC,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"public.schema.d.ts","sourceRoot":"","sources":["../../../../../src/common/types/options/auth/public.schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;iBAqClC,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}