perf(sdk,auth,utils): build FrontMCP's own zod schemas on first use

libs/auth/src/authorities/__tests__/authorities.schema.cycles.spec.ts

@@ -0,0 +1,14 @@
+import { authoritiesPolicySchema } from '../authorities.schema';
+
+describe('authoritiesPolicySchema with a reference cycle', () => {
+  it('accepts a policy that refers to itself, keeping the cycle in the result', () => {
+    const policy: Record<string, unknown> = { roles: { any: ['admin'] } };
+    policy['anyOf'] = [policy];
+
+    const result = authoritiesPolicySchema.safeParse(policy);
+
+    expect(result.success).toBe(true);
+    const parsed = result.data as Record<string, unknown[]>;
+    expect(parsed['anyOf'][0]).toBe(parsed);
+  });
+});

libs/auth/src/authorization/authorization.types.ts

@@ -5,7 +5,7 @@
  * These types are portable and can be used across different implementations.
  */
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { ProviderSnapshot } from '../session/session.types';
 import type { TransportProtocol, TransportSession } from '../session/transport-session.types';

libs/auth/src/cimd/cimd.types.ts

@@ -6,7 +6,7 @@
  *
  * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00
  */
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 // ============================================
 // CLIENT METADATA DOCUMENT SCHEMA

libs/auth/src/common/jwt.types.ts

@@ -1,4 +1,4 @@
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import { type RawZodShape } from './zod-utils';
 

libs/auth/src/common/session.types.ts

@@ -1,4 +1,4 @@
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import { type RawZodShape } from './zod-utils';
 

libs/auth/src/consent/consent.types.ts

@@ -4,7 +4,7 @@
  * Defines types for the tool consent flow that allows users to select
  * which MCP tools they want to expose to the LLM.
  */
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import { consentConfigSchema } from '../options/shared.schemas';
 

libs/auth/src/detection/auth-provider-detection.ts

@@ -4,7 +4,7 @@
  * Detects unique auth providers across nested apps and determines
  * if orchestrated mode is required at the parent scope level.
  */
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { AuthOptions } from '../options/schema';
 import { staticAuthOptionsSchema } from '../options/static.schema';

libs/auth/src/options/app-auth.schema.ts

@@ -1,7 +1,7 @@
 // options/app-auth.schema.ts
 // App-level auth options with standalone option
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import { type RawZodShape } from '../common/zod-utils';
 import { localAuthSchema, remoteAuthSchema } from './orchestrated.schema';

libs/auth/src/options/orchestrated.schema.ts

@@ -1,7 +1,7 @@
 // options/orchestrated.schema.ts
 // Local and Remote auth modes (formerly orchestrated local/remote)
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { RawZodShape } from '../common/zod-utils';
 import type {

libs/auth/src/options/public.schema.ts

@@ -1,7 +1,7 @@
 // options/public.schema.ts
 // Public mode - No authentication required
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import { jsonWebKeySetSchema, jwkSchema } from '../common/jwt.types';
 import type { RawZodShape } from '../common/zod-utils';

libs/auth/src/options/schema.ts

@@ -1,7 +1,7 @@
 // options/schema.ts
 // Unified auth options schema combining all modes
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { AuthOptionsInterface } from './interfaces';
 import { localAuthSchema, remoteAuthSchema } from './orchestrated.schema';

libs/auth/src/options/shared.schemas.ts

@@ -1,7 +1,7 @@
 // options/shared.schemas.ts
 // Shared configuration schemas used across auth modes
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import { jsonWebKeySetSchema, jwkSchema } from '../common/jwt.types';
 import { redisConfigSchema, type RedisConfig } from '../session/transport-session.types';

libs/auth/src/options/static.schema.ts

@@ -1,7 +1,7 @@
 // options/static.schema.ts
 // Static mode — a fixed shared secret presented on every request.
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { RawZodShape } from '../common/zod-utils';
 import type { StaticAuthOptionsInterface } from './interfaces';

libs/auth/src/options/transparent.schema.ts

@@ -1,7 +1,7 @@
 // options/transparent.schema.ts
 // Transparent mode - Pass-through OAuth tokens from remote provider
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { RawZodShape } from '../common/zod-utils';
 import type { TransparentAuthOptionsInterface } from './interfaces';

libs/auth/src/session/authorization-vault.ts

@@ -21,7 +21,7 @@
  * - No incremental authorization support
  */
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 // randomUUID can be imported from @frontmcp/utils if needed
 

libs/auth/src/session/authorization.store.ts

@@ -6,7 +6,7 @@
  * Supports both in-memory (dev/test) and Redis (production) backends.
  */
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 import { randomUUID, sha256Base64url } from '@frontmcp/utils';
 
 /**

libs/auth/src/session/encrypted-authorization-vault.ts

@@ -23,7 +23,7 @@
  * ```
  */
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 import { AsyncLocalStorage, randomUUID } from '@frontmcp/utils';
 
 import { EncryptionContextNotSetError, VaultLoadError, VaultNotFoundError } from '../errors/auth-internal.errors';

libs/auth/src/session/transport-session.types.ts

@@ -1,6 +1,6 @@
 // session/transport-session.types.ts
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 /**
  * Transport protocol types supported by MCP

libs/auth/src/vault/auth-providers.types.ts

@@ -5,7 +5,7 @@
  * These are portable types that can be used across different implementations.
  */
 
-import { z } from '@frontmcp/lazy-zod';
+import { internalZ as z } from '@frontmcp/lazy-zod';
 
 import type { AuthorizationVault, Credential } from '../session';