@frontmcp/auth 1.11.1-rc.1 → 1.11.1

package/browser/errors/auth-internal.errors.mjs

@@ -64,8 +64,12 @@ var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
   }
 };
 var AuthProvidersNotConfiguredError = class extends AuthInternalError {
-  constructor() {
-    super("Auth providers are not configured", "AUTH_PROVIDERS_NOT_CONFIGURED");
+  constructor(providerName) {
+    const register = "Register it in @FrontMcp({ authProvidersVault: { providers: [...] } }).";
+    super(
+      providerName === void 0 ? "Auth providers are not configured: this server registers no auth providers." : `Auth provider "${providerName}" is not configured: this server registers no auth providers. ${register}`,
+      "AUTH_PROVIDERS_NOT_CONFIGURED"
+    );
   }
 };
 var OrchestratedAuthNotAvailableError = class extends AuthInternalError {

package/browser/index.mjs

@@ -242,6 +242,7 @@ import {
   AUTH_PROVIDERS_REGISTRY,
   AuthProvidersVault,
   AUTH_PROVIDERS_VAULT,
+  UNIDENTIFIED_SESSION_PREFIX,
   EagerCredentialLoader,
   LazyCredentialLoader
 } from "./vault/index.mjs";
@@ -383,6 +384,7 @@ export {
   TransparentAuthorization,
   TransportIdGenerator,
   TypedStorage,
+  UNIDENTIFIED_SESSION_PREFIX,
   VaultEncryption,
   VaultLoadError,
   VaultNotFoundError,

package/browser/jwks/jwks.service.mjs

@@ -42,6 +42,40 @@ function isMissingExpError(error) {
   const { code, claim, reason } = error;
   return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
 }
+var FAILURE_DEPTH = [
+  "jwks_unavailable",
+  "malformed",
+  "unsupported_algorithm",
+  "unknown_key",
+  "bad_signature",
+  "missing_claim",
+  "wrong_issuer",
+  "not_yet_valid",
+  "expired"
+];
+function tokenVerifyFailureOf(error) {
+  const { code, claim, reason } = typeof error === "object" && error !== null ? error : {};
+  switch (code) {
+    case "ERR_JWT_EXPIRED":
+      return "expired";
+    case "ERR_JWS_SIGNATURE_VERIFICATION_FAILED":
+      return "bad_signature";
+    case "ERR_JWKS_NO_MATCHING_KEY":
+      return "unknown_key";
+    case "ERR_JOSE_ALG_NOT_ALLOWED":
+    case "ERR_JOSE_NOT_SUPPORTED":
+      return "unsupported_algorithm";
+    case "ERR_JWT_CLAIM_VALIDATION_FAILED":
+      if (claim === "iss") return "wrong_issuer";
+      if (reason === "missing") return "missing_claim";
+      return claim === "nbf" && reason === "check_failed" ? "not_yet_valid" : "malformed";
+    default:
+      return "malformed";
+  }
+}
+function deeperFailure(current, next) {
+  return current && FAILURE_DEPTH.indexOf(current) >= FAILURE_DEPTH.indexOf(next) ? current : next;
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -115,6 +149,7 @@ var JwksService = class {
     } catch {
     }
     let missingExp = false;
+    let failure;
     for (const p of candidates) {
       let jwks;
       try {
@@ -122,7 +157,10 @@ var JwksService = class {
         if (kid && !p.jwks?.keys?.length && !jwks?.keys?.some((key) => key.kid === kid)) {
           jwks = await this.refetchForUnknownKid(p) ?? jwks;
         }
-        if (!jwks?.keys?.length) continue;
+        if (!jwks?.keys?.length) {
+          failure = deeperFailure(failure, "jwks_unavailable");
+          continue;
+        }
         const JWKS = createLocalJWKSet(jwks);
         const issuerConstraint = this.issuerConstraintFor(p);
         const { payload, protectedHeader } = await jwtVerify(token, JWKS, {
@@ -150,14 +188,16 @@ var JwksService = class {
               return fallbackResult;
             }
             if (fallbackResult.error === "missing_exp") missingExp = true;
+            if (fallbackResult.failure) failure = deeperFailure(failure, fallbackResult.failure);
           }
         }
         if (isMissingExpError(e)) missingExp = true;
+        failure = deeperFailure(failure, tokenVerifyFailureOf(e));
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
-    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
-    return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR, failure };
+    return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}`, failure };
   }
   /**
    * Issuer constraint passed to `jose` for a provider: the configured issuer
@@ -199,20 +239,20 @@ var JwksService = class {
     try {
       const parts = token.split(".");
       if (parts.length !== 3) {
-        return { ok: false, error: "invalid_token_format" };
+        return { ok: false, error: "invalid_token_format", failure: "malformed" };
       }
       const [headerB64, payloadB64, signatureB64] = parts;
       const header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
       const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
       const matchingKey = this.findMatchingKey(jwks, header);
       if (!matchingKey) {
-        return { ok: false, error: "no_matching_key" };
+        return { ok: false, error: "no_matching_key", failure: "unknown_key" };
       }
       const signatureInput = `${headerB64}.${payloadB64}`;
       const signature = Buffer.from(signatureB64, "base64url");
       const jwtAlg = typeof header.alg === "string" ? header.alg : void 0;
       if (!jwtAlg) {
-        return { ok: false, error: "missing_alg" };
+        return { ok: false, error: "missing_alg", failure: "malformed" };
       }
       const isValid = await rsaVerify(
         jwtAlg,
@@ -221,30 +261,30 @@ var JwksService = class {
         signature
       );
       if (!isValid) {
-        return { ok: false, error: "signature_invalid" };
+        return { ok: false, error: "signature_invalid", failure: "bad_signature" };
       }
       if (provider.verifyIssuer !== false) {
         const payloadIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
         if (!payloadIssuerRaw) {
-          return { ok: false, error: "issuer_mismatch" };
+          return { ok: false, error: "issuer_mismatch", failure: "wrong_issuer" };
         }
         const trustedIssuers = new Set(
           [provider.issuerUrl, ...provider.additionalIssuers ?? []].map((issuer) => normalizeIssuer(issuer))
         );
         const payloadIssuer = normalizeIssuer(payloadIssuerRaw);
         if (!trustedIssuers.has(payloadIssuer)) {
-          return { ok: false, error: "issuer_mismatch" };
+          return { ok: false, error: "issuer_mismatch", failure: "wrong_issuer" };
         }
       }
       const nowSec = Math.floor(Date.now() / 1e3);
       if (payload.exp === void 0) {
-        return { ok: false, error: "missing_exp" };
+        return { ok: false, error: "missing_exp", failure: "missing_claim" };
       }
       if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= nowSec) {
-        return { ok: false, error: "token_expired" };
+        return { ok: false, error: "token_expired", failure: "expired" };
       }
       if (payload.nbf !== void 0 && (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > nowSec)) {
-        return { ok: false, error: "token_not_yet_valid" };
+        return { ok: false, error: "token_not_yet_valid", failure: "not_yet_valid" };
       }
       if (!this.warnedProviders.has(provider.id)) {
         this.warnedProviders.add(provider.id);
@@ -261,7 +301,7 @@ var JwksService = class {
       };
     } catch (err) {
       const message = err instanceof Error ? err.message : "unknown";
-      return { ok: false, error: `weak_key_verification_failed: ${message}` };
+      return { ok: false, error: `weak_key_verification_failed: ${message}`, failure: "malformed" };
     }
   }
   /**

package/browser/session/credentials-accessor.impl.mjs

@@ -29,16 +29,20 @@ var CredentialsAccessorImpl = class {
   async requireConnect(options) {
     const { key, context } = options;
     const sub = this.resolveSub();
-    if (sub) {
-      const existing = await this.vault.get(sub, key);
-      if (existing) {
-        return { connected: true, key, credential: existing };
-      }
+    if (!sub) {
+      return {
+        connected: false,
+        key,
+        resumeUrl: "",
+        signInRequired: true,
+        message: `Sign in to this server to connect credential "${key}".`
+      };
     }
-    const token = signCredentialResumeToken(
-      { sub: sub ?? "", key, context, ttlMs: this.resumeTtlMs },
-      this.signingSecret
-    );
+    const existing = await this.vault.get(sub, key);
+    if (existing) {
+      return { connected: true, key, credential: existing };
+    }
+    const token = signCredentialResumeToken({ sub, key, context, ttlMs: this.resumeTtlMs }, this.signingSecret);
     const resumeUrl = buildCredentialResumeUrl(this.basePath, token);
     this.logger.debug(`CredentialsAccessor: credential "${key}" not connected; issued resume link`);
     return {

package/browser/session/session-credential-vault.mjs

@@ -83,6 +83,14 @@ var SessionCredentialVault = class {
     await this.storage.set(this.indexKey(sub), vaultId, this.credentialSetOpts);
     return vaultId;
   }
+  /** The subject's vaultId, or a new vault when it has none; unlike {@link rotateVault}, it never replaces one. */
+  async ensureVault(sub) {
+    const currentVaultId = await this.getVaultId(sub);
+    if (currentVaultId) return currentVaultId;
+    const createdVaultId = randomUUID();
+    await this.storage.set(this.indexKey(sub), createdVaultId, { ...this.credentialSetOpts, ifNotExists: true });
+    return await this.getVaultId(sub) ?? createdVaultId;
+  }
   // ============================================
   // Credential CRUD (committed vault)
   // ============================================

package/browser/vault/auth-providers.accessor.impl.mjs

@@ -1,6 +1,6 @@
 // libs/auth/src/vault/auth-providers.accessor.impl.ts
-import { extractCredentialExpiry } from "./credential-helpers.mjs";
 import { base64Encode } from "@frontmcp/utils";
+import { extractCredentialExpiry } from "./credential-helpers.mjs";
 var AuthProvidersAccessorImpl = class {
   constructor(registry, vault, cache, loader, context, logger) {
     this.registry = registry;
@@ -180,7 +180,8 @@ var AuthProvidersAccessorImpl = class {
         providerName,
         resolved.credential,
         config.scope,
-        this.context.userSub
+        this.context.userSub,
+        config.cacheTtl
       );
     } catch (error) {
       this.logger?.warn(`Failed to store in vault "${providerName}":`, error);

package/browser/vault/auth-providers.vault.mjs

@@ -1,26 +1,52 @@
 // libs/auth/src/vault/auth-providers.vault.ts
-import { extractCredentialExpiry } from "./credential-helpers.mjs";
+import {
+  EncryptedTypedStorage,
+  hkdfSha256,
+  MAX_TTL_SECONDS,
+  randomBytes,
+  sha256Hex
+} from "@frontmcp/utils";
 import { AuthInvalidInputError, CredentialStorageError } from "../errors/auth-internal.errors.mjs";
+import { extractCredentialExpiry } from "./credential-helpers.mjs";
+var UNIDENTIFIED_SESSION_PREFIX = "unidentified:";
+var DEFAULT_CREDENTIAL_TTL_MS = 36e5;
+var ENCRYPTION_KEY_INFO = new TextEncoder().encode("frontmcp-auth-providers-vault-v1");
+function positiveOr(value, fallback) {
+  return value !== void 0 && value > 0 ? value : fallback;
+}
+function encryptionKeyFrom(pepper) {
+  if (!pepper) return randomBytes(32);
+  return hkdfSha256(new TextEncoder().encode(pepper), new Uint8Array(0), ENCRYPTION_KEY_INFO, 32);
+}
 var AuthProvidersVault = class {
-  constructor(baseVault, namespace = "authproviders:", logger) {
-    this.baseVault = baseVault;
-    this.namespace = namespace;
-    this.logger = logger;
-  }
-  baseVault;
+  credentials;
   namespace;
+  defaultCacheTtl;
   logger;
+  constructor(storage, options = {}) {
+    this.credentials = new EncryptedTypedStorage(storage, {
+      keys: [{ kid: "authproviders-v1", key: encryptionKeyFrom(options.pepper) }]
+    });
+    this.namespace = options.namespace ?? "authproviders:";
+    this.defaultCacheTtl = positiveOr(options.defaultCacheTtl, DEFAULT_CREDENTIAL_TTL_MS);
+    this.logger = options.logger;
+  }
   /**
-   * Store a credential in the vault
+   * Store a credential in the vault, until it expires; one without an expiry for `cacheTtl`, else `defaultCacheTtl`
    *
    * @param sessionId - Current session ID
    * @param providerId - Provider name
    * @param credential - Credential to store
    * @param scope - Credential scope
    * @param userId - User ID (required for user scope)
+   * @param cacheTtl - How long to keep a credential without an expiry, in ms
    */
-  async storeCredential(sessionId, providerId, credential, scope, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+  async storeCredential(sessionId, providerId, credential, scope, userId, cacheTtl) {
+    if (scope === "session" && sessionId.startsWith(UNIDENTIFIED_SESSION_PREFIX)) {
+      this.logger?.debug(`Not storing credential "${providerId}": the caller has no verified session`);
+      return;
+    }
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     const appCredential = {
       appId: this.namespace,
       providerId,
@@ -30,7 +56,7 @@ var AuthProvidersVault = class {
       expiresAt: extractCredentialExpiry(credential)
     };
     try {
-      await this.baseVault.addAppCredential(vaultKey, appCredential);
+      await this.write(key, appCredential, cacheTtl);
       this.logger?.debug(`Stored credential "${providerId}" with scope "${scope}"`);
     } catch (error) {
       this.logger?.warn(`Failed to store credential "${providerId}":`, error);
@@ -47,9 +73,9 @@ var AuthProvidersVault = class {
    * @returns Credential or null if not found
    */
   async getCredential(sessionId, providerId, scope, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      const appCredential = await this.baseVault.getCredential(vaultKey, this.namespace, providerId);
+      const appCredential = await this.read(key);
       if (!appCredential) {
         return null;
       }
@@ -81,9 +107,9 @@ var AuthProvidersVault = class {
    * @param userId - User ID (required for user scope)
    */
   async removeCredential(sessionId, providerId, scope, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      await this.baseVault.removeAppCredential(vaultKey, this.namespace, providerId);
+      await this.credentials.delete(key);
       this.logger?.debug(`Removed credential "${providerId}"`);
     } catch (error) {
       this.logger?.warn(`Failed to remove credential "${providerId}":`, error);
@@ -99,9 +125,11 @@ var AuthProvidersVault = class {
    * @param userId - User ID (required for user scope)
    */
   async invalidateCredential(sessionId, providerId, scope, reason, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      await this.baseVault.invalidateCredential(vaultKey, this.namespace, providerId, reason);
+      const appCredential = await this.read(key);
+      if (!appCredential) return;
+      await this.write(key, { ...appCredential, isValid: false, invalidReason: reason });
       this.logger?.debug(`Invalidated credential "${providerId}": ${reason}`);
     } catch (error) {
       this.logger?.warn(`Failed to invalidate credential "${providerId}":`, error);
@@ -117,9 +145,25 @@ var AuthProvidersVault = class {
    * @param userId - User ID (required for user scope)
    */
   async refreshOAuthCredential(sessionId, providerId, scope, tokens, userId) {
-    const vaultKey = this.buildVaultKey(sessionId, scope, userId);
+    const key = this.credentialKey(sessionId, providerId, scope, userId);
     try {
-      await this.baseVault.refreshOAuthCredential(vaultKey, this.namespace, providerId, tokens);
+      const appCredential = await this.read(key);
+      if (!appCredential) return;
+      const credential = appCredential.credential;
+      if (credential.type !== "oauth" && credential.type !== "oauth_pkce") return;
+      const refreshed = {
+        ...appCredential,
+        credential: {
+          ...credential,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken ?? credential.refreshToken,
+          expiresAt: tokens.expiresAt ?? credential.expiresAt
+        },
+        expiresAt: tokens.expiresAt ?? appCredential.expiresAt,
+        isValid: true,
+        invalidReason: void 0
+      };
+      await this.write(key, refreshed);
       this.logger?.debug(`Refreshed OAuth credential "${providerId}"`);
     } catch (error) {
       this.logger?.warn(`Failed to refresh OAuth credential "${providerId}":`, error);
@@ -135,49 +179,47 @@ var AuthProvidersVault = class {
    */
   async getAllCredentials(sessionId, scope, userId) {
     if (scope) {
-      const vaultKey = this.buildVaultKey(sessionId, scope, userId);
-      try {
-        return await this.baseVault.getAppCredentials(vaultKey, this.namespace);
-      } catch {
-        return [];
-      }
+      return this.listCredentials(this.buildVaultKey(sessionId, scope, userId));
     }
-    const credentials = [];
+    const scopes = userId ? ["session", "user", "global"] : ["session", "global"];
+    const credentialsPerScope = await Promise.all(
+      scopes.map((eachScope) => this.listCredentials(this.buildVaultKey(sessionId, eachScope, userId)))
+    );
+    return credentialsPerScope.flat();
+  }
+  async listCredentials(vaultKey) {
     try {
-      const sessionCreds = await this.baseVault.getAppCredentials(
-        this.buildVaultKey(sessionId, "session"),
-        this.namespace
-      );
-      credentials.push(...sessionCreds);
+      const keys = await this.credentials.keys(`${vaultKey}:*`);
+      const records = await this.credentials.mget(keys);
+      return records.flatMap((record, index) => record?.storageKey === keys[index] ? [record.appCredential] : []);
     } catch {
+      return [];
     }
-    if (userId) {
-      try {
-        const userCreds = await this.baseVault.getAppCredentials(
-          this.buildVaultKey(sessionId, "user", userId),
-          this.namespace
-        );
-        credentials.push(...userCreds);
-      } catch {
-      }
-    }
-    try {
-      const globalCreds = await this.baseVault.getAppCredentials(
-        this.buildVaultKey(sessionId, "global"),
-        this.namespace
-      );
-      credentials.push(...globalCreds);
-    } catch {
+  }
+  async read(key) {
+    const record = await this.credentials.get(key);
+    return record?.storageKey === key ? record.appCredential : null;
+  }
+  /** Writes until the credential expires, else for `cacheTtl` or `defaultCacheTtl`; an expired one is deleted. */
+  async write(key, appCredential, cacheTtl) {
+    const ttlMs = appCredential.expiresAt === void 0 ? positiveOr(cacheTtl, this.defaultCacheTtl) : appCredential.expiresAt - Date.now();
+    if (ttlMs <= 0) {
+      await this.credentials.delete(key);
+      return;
     }
-    return credentials;
+    const ttlSeconds = Math.min(Math.ceil(ttlMs / 1e3), MAX_TTL_SECONDS);
+    await this.credentials.set(key, { storageKey: key, appCredential }, { ttlSeconds });
+  }
+  credentialKey(sessionId, providerId, scope, userId) {
+    return `${this.buildVaultKey(sessionId, scope, userId)}:${providerId}`;
   }
   /**
-   * Build vault key based on scope
+   * Build vault key based on scope; user and session ids are hashed, so no id can reach into another's keys
    *
    * Key patterns:
    * - global: `authproviders:global`
-   * - user: `authproviders:user:{userId}`
-   * - session: `authproviders:session:{sessionId}`
+   * - user: `authproviders:user:{sha256(userId)}`
+   * - session: `authproviders:session:{sha256(sessionId)}`
    */
   buildVaultKey(sessionId, scope, userId) {
     switch (scope) {
@@ -189,9 +231,9 @@ var AuthProvidersVault = class {
             `userId is required for user-scoped credentials (namespace: ${this.namespace})`
           );
         }
-        return `${this.namespace}user:${userId}`;
+        return `${this.namespace}user:${sha256Hex(userId)}`;
       case "session":
-        return `${this.namespace}session:${sessionId}`;
+        return `${this.namespace}session:${sha256Hex(sessionId)}`;
       default: {
         const _exhaustive = scope;
         throw new AuthInvalidInputError(`Unknown credential scope: ${_exhaustive}`);
@@ -202,5 +244,6 @@ var AuthProvidersVault = class {
 var AUTH_PROVIDERS_VAULT = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_VAULT");
 export {
   AUTH_PROVIDERS_VAULT,
-  AuthProvidersVault
+  AuthProvidersVault,
+  UNIDENTIFIED_SESSION_PREFIX
 };

package/browser/vault/credential-loaders/lazy-loader.mjs

@@ -1,32 +1,36 @@
 // libs/auth/src/vault/credential-loaders/lazy-loader.ts
 import { extractCredentialExpiry } from "../credential-helpers.mjs";
+function inFlightKey(providerName, context) {
+  return JSON.stringify([providerName, context.sessionId, context.userSub ?? null]);
+}
 var LazyCredentialLoader = class {
   constructor(logger) {
     this.logger = logger;
   }
   logger;
-  /** In-flight loading promises for deduplication */
+  /** In-flight loading promises for deduplication, by provider and caller */
   loading = /* @__PURE__ */ new Map();
   /**
    * Load a credential lazily.
-   * If already loading, returns the in-flight promise (deduplication).
+   * If already loading for the same caller, returns the in-flight promise (deduplication).
    *
    * @param config - Provider configuration
    * @param context - Factory context
    * @returns Resolved credential or null
    */
   async load(config, context) {
-    const existing = this.loading.get(config.name);
+    const key = inFlightKey(config.name, context);
+    const existing = this.loading.get(key);
     if (existing) {
       this.logger?.debug(`Waiting for in-flight load: ${config.name}`);
       return existing;
     }
     const promise = this.doLoad(config, context);
-    this.loading.set(config.name, promise);
+    this.loading.set(key, promise);
     try {
       return await promise;
     } finally {
-      this.loading.delete(config.name);
+      this.loading.delete(key);
     }
   }
   /**
@@ -100,13 +104,14 @@ var LazyCredentialLoader = class {
     }
   }
   /**
-   * Check if a credential is currently being loaded
+   * Check if a credential is currently being loaded for a caller
    *
    * @param name - Provider name
+   * @param context - Factory context of the caller
    * @returns true if loading is in progress
    */
-  isLoading(name) {
-    return this.loading.has(name);
+  isLoading(name, context) {
+    return this.loading.has(inFlightKey(name, context));
   }
   /**
    * Cancel all in-flight loads (for cleanup)

package/browser/vault/index.mjs

@@ -12,7 +12,11 @@ import { CredentialCache } from "./credential-cache.mjs";
 import { AUTH_PROVIDERS_ACCESSOR } from "./auth-providers.accessor.mjs";
 import { AuthProvidersAccessorImpl } from "./auth-providers.accessor.impl.mjs";
 import { AuthProvidersRegistry, AUTH_PROVIDERS_REGISTRY } from "./auth-providers.registry.mjs";
-import { AuthProvidersVault, AUTH_PROVIDERS_VAULT } from "./auth-providers.vault.mjs";
+import {
+  AuthProvidersVault,
+  AUTH_PROVIDERS_VAULT,
+  UNIDENTIFIED_SESSION_PREFIX
+} from "./auth-providers.vault.mjs";
 import { EagerCredentialLoader } from "./credential-loaders/eager-loader.mjs";
 import { LazyCredentialLoader } from "./credential-loaders/lazy-loader.mjs";
 export {
@@ -25,6 +29,7 @@ export {
   CredentialCache,
   EagerCredentialLoader,
   LazyCredentialLoader,
+  UNIDENTIFIED_SESSION_PREFIX,
   authProviderMappingSchema,
   authProvidersVaultOptionsSchema,
   credentialProviderConfigSchema,

package/errors/auth-internal.errors.d.ts

@@ -67,10 +67,10 @@ export declare class CredentialProviderAlreadyRegisteredError extends AuthIntern
     constructor(name: string);
 }
 /**
- * Thrown when auth providers are not configured.
+ * Thrown when a tool reads an auth provider's credential on a server that registers no auth providers.
  */
 export declare class AuthProvidersNotConfiguredError extends AuthInternalError {
-    constructor();
+    constructor(providerName?: string);
 }
 /**
  * Thrown when orchestrated auth is not available.

package/errors/auth-internal.errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-internal.errors.d.ts","sourceRoot":"","sources":["../../src/errors/auth-internal.errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,iBAAiB;;CAIlE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK;CAInD;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;CAG3C;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;gBAChD,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,iBAAiB;gBAC1C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,MAAM,EAAE,MAAM;CAG3B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,IAAI,EAAE,MAAM;CAQzB;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM;CAQ/B;AAED;;GAEG;AACH,qBAAa,wCAAyC,SAAQ,iBAAiB;gBACjE,IAAI,EAAE,MAAM;CAGzB;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;;CAIrE;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;;CAIrE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;gBAC5C,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,iBAAiB;;CAIpE;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;gBACzC,UAAU,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,iBAAiB;gBAC9C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,iBAAiB;gBACtC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAoB;CAGtD"}
+{"version":3,"file":"auth-internal.errors.d.ts","sourceRoot":"","sources":["../../src/errors/auth-internal.errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,iBAAiB;;CAIlE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK;CAInD;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;CAG3C;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;gBAChD,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,iBAAiB;gBAC1C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,MAAM,EAAE,MAAM;CAG3B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,IAAI,EAAE,MAAM;CAQzB;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAC3C,UAAU,EAAE,MAAM;CAQ/B;AAED;;GAEG;AACH,qBAAa,wCAAyC,SAAQ,iBAAiB;gBACjE,IAAI,EAAE,MAAM;CAGzB;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;gBACxD,YAAY,CAAC,EAAE,MAAM;CASlC;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,iBAAiB;;CAIrE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;gBAC5C,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,iBAAiB;;CAIpE;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;gBACzC,UAAU,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,SAAS,EAAE,MAAM;CAG9B;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,iBAAiB;;CAIvE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,iBAAiB;gBAC9C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAC/C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,iBAAiB;gBACtC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAoB;CAGtD"}