@frontmcp/auth 1.11.1-rc.2 → 1.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.11.1-rc.2",
+  "version": "1.11.2",
   "description": "Authentication and authorization for FrontMCP servers: auth modes, OAuth 2.1 (local and remote), JWT and session checks, authorities and the credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://frontmcp.dev/reference/auth",
@@ -68,8 +68,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.11.1-rc.2",
-    "@frontmcp/storage-sqlite": "1.11.1-rc.2",
+    "@frontmcp/lazy-zod": "1.11.2",
+    "@frontmcp/storage-sqlite": "1.11.2",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -85,8 +85,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.11.1-rc.2",
-    "@frontmcp/utils": "1.11.1-rc.2",
+    "@frontmcp/di": "1.11.2",
+    "@frontmcp/utils": "1.11.2",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/vault/auth-providers.accessor.impl.d.ts

@@ -4,14 +4,14 @@
  * Provides runtime access to credential providers in tool contexts.
  * Handles caching, vault storage, lazy loading, and credential refresh.
  */
+import type { AuthLogger } from '../common/auth-logger.interface';
 import type { Credential } from '../session';
-import type { CredentialFactoryContext, GetCredentialOptions, ResolvedCredential } from './auth-providers.types';
-import { CredentialCache } from './credential-cache';
 import type { AuthProvidersAccessor } from './auth-providers.accessor';
 import type { AuthProvidersRegistry } from './auth-providers.registry';
+import type { CredentialFactoryContext, GetCredentialOptions, ResolvedCredential } from './auth-providers.types';
 import type { AuthProvidersVault } from './auth-providers.vault';
+import type { CredentialCache } from './credential-cache';
 import type { LazyCredentialLoader } from './credential-loaders/lazy-loader';
-import type { AuthLogger } from '../common/auth-logger.interface';
 /**
  * AuthProvidersAccessorImpl - Runtime implementation
  */

package/vault/auth-providers.accessor.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.accessor.impl.d.ts","sourceRoot":"","sources":["../../src/vault/auth-providers.accessor.impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,2BAA2B,CAAC;AACjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE;;GAEG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IAEnE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBALP,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,wBAAwB,EACjC,MAAM,CAAC,EAAE,UAAU,YAAA;IAGhC,GAAG,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EACzC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAwClC,OAAO,CACX,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAuB5C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAc9D,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAWrE,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAgCjE,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBjD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAKtC,aAAa,IAAI,IAAI;IAKrB,aAAa,IAAI,MAAM,EAAE;IAInB,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYxC;;OAEG;YACW,aAAa;IA8B3B;;OAEG;YACW,YAAY;IAkB1B;;OAEG;IACH,OAAO,CAAC,OAAO;IAYf;;OAEG;IACH,OAAO,CAAC,cAAc;CAmCvB"}
+{"version":3,"file":"auth-providers.accessor.impl.d.ts","sourceRoot":"","sources":["../../src/vault/auth-providers.accessor.impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,2BAA2B,CAAC;AACjG,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE7E;;GAEG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IAEnE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBALP,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,wBAAwB,EACjC,MAAM,CAAC,EAAE,UAAU,YAAA;IAGhC,GAAG,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EACzC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAwClC,OAAO,CACX,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAuB5C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAc9D,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAWrE,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAgCjE,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBjD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAKtC,aAAa,IAAI,IAAI;IAKrB,aAAa,IAAI,MAAM,EAAE;IAInB,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYxC;;OAEG;YACW,aAAa;IA8B3B;;OAEG;YACW,YAAY;IAmB1B;;OAEG;IACH,OAAO,CAAC,OAAO;IAYf;;OAEG;IACH,OAAO,CAAC,cAAc;CAmCvB"}

package/vault/auth-providers.types.d.ts

@@ -205,7 +205,7 @@ export interface VaultStorageKey {
 export interface AuthProvidersVaultOptions {
     /** Enable AuthProvidersVault (default: true if any providers registered) */
     enabled?: boolean;
-    /** Use shared storage with AuthorizationVault (default: true) */
+    /** Keep credentials, encrypted, in a Redis or SQLite `auth.tokenStorage` (default: true) */
     useSharedStorage?: boolean;
     /** Custom namespace for credential storage (default: 'authproviders:') */
     namespace?: string;

package/vault/auth-providers.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.types.d.ts","sourceRoot":"","sources":["../../src/vault/auth-providers.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMjE;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5D,eAAO,MAAM,qBAAqB;;;;EAAwC,CAAC;AAM3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C,eAAO,MAAM,qBAAqB;;;EAA4B,CAAC;AAM/D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,0BAA0B;;;;iCAM5B,CAAC;AAMZ;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IACnE,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC;IACd,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,KAAK,EAAE,eAAe,CAAC;CACxB;AAMD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,UAAU,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CACjE,OAAO,EAAE,wBAAwB,KAC9B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CACnE,OAAO,EAAE,wBAAwB,GAAG;IAAE,kBAAkB,EAAE,CAAC,CAAA;CAAE,KAC1D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAM/G;;GAEG;AACH,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IACzE,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IAEb,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iEAAiE;IACjE,KAAK,EAAE,eAAe,CAAC;IAEvB,qDAAqD;IACrD,OAAO,EAAE,eAAe,CAAC;IAEzB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE9B;;;OAGG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAEjC;;;OAGG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAEnC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;iCAchC,CAAC;AAMZ;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,yBAAyB;;;;;mCAUpC,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IACrE,8BAA8B;IAC9B,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAChC,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,qDAAqD;IACrD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC,uCAAuC;IACvC,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;iCASjC,CAAC;AAMZ;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjG;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf"}
+{"version":3,"file":"auth-providers.types.d.ts","sourceRoot":"","sources":["../../src/vault/auth-providers.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAMjE;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5D,eAAO,MAAM,qBAAqB;;;;EAAwC,CAAC;AAM3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C,eAAO,MAAM,qBAAqB;;;EAA4B,CAAC;AAM/D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,0BAA0B;;;;iCAM5B,CAAC;AAMZ;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IACnE,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC;IACd,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,KAAK,EAAE,eAAe,CAAC;CACxB;AAMD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,UAAU,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CACjE,OAAO,EAAE,wBAAwB,KAC9B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CACnE,OAAO,EAAE,wBAAwB,GAAG;IAAE,kBAAkB,EAAE,CAAC,CAAA;CAAE,KAC1D,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAM/G;;GAEG;AACH,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IACzE,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IAEb,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iEAAiE;IACjE,KAAK,EAAE,eAAe,CAAC;IAEvB,qDAAqD;IACrD,OAAO,EAAE,eAAe,CAAC;IAEzB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE9B;;;OAGG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAEjC;;;OAGG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAEnC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;iCAchC,CAAC;AAMZ;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,yBAAyB;;;;;mCAUpC,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IACrE,8BAA8B;IAC9B,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAChC,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,qDAAqD;IACrD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC,uCAAuC;IACvC,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;iCASjC,CAAC;AAMZ;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjG;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf"}

package/vault/auth-providers.vault.d.ts

@@ -1,31 +1,45 @@
 /**
- * AuthProvidersVault - Dedicated storage namespace for auth provider credentials
- *
- * Uses the same underlying storage (Redis/Vercel KV) as AuthorizationVault
- * but with a separate namespace to avoid conflicts.
+ * AuthProvidersVault - Keeps auth provider credentials between requests, each encrypted under its own key with a TTL
  */
-import { Token } from '@frontmcp/di';
-import type { Credential, AuthorizationVault, AppCredential } from '../session';
-import type { CredentialScope } from './auth-providers.types';
+import type { Token } from '@frontmcp/di';
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
 import type { AuthLogger } from '../common/auth-logger.interface';
+import type { AppCredential, Credential } from '../session';
+import type { CredentialScope } from './auth-providers.types';
+/** Session id prefix of a caller without a verified session, whose session credentials are never stored. */
+export declare const UNIDENTIFIED_SESSION_PREFIX = "unidentified:";
+/**
+ * Options of an AuthProvidersVault
+ */
+export interface AuthProvidersVaultStorageOptions {
+    /** Prefix of every key the vault writes (default: 'authproviders:') */
+    namespace?: string;
+    /** How long a credential without an expiry is kept, in ms (default: 3600000 = 1 hour) */
+    defaultCacheTtl?: number;
+    /** Secret the encryption key is derived from; without one, the key is random and only this process holds it */
+    pepper?: string;
+    logger?: AuthLogger;
+}
 /**
  * AuthProvidersVault - Storage layer for auth provider credentials
  */
 export declare class AuthProvidersVault {
-    private readonly baseVault;
+    private readonly credentials;
     private readonly namespace;
+    private readonly defaultCacheTtl;
     private readonly logger?;
-    constructor(baseVault: AuthorizationVault, namespace?: string, logger?: AuthLogger | undefined);
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: AuthProvidersVaultStorageOptions);
     /**
-     * Store a credential in the vault
+     * Store a credential in the vault, until it expires; one without an expiry for `cacheTtl`, else `defaultCacheTtl`
      *
      * @param sessionId - Current session ID
      * @param providerId - Provider name
      * @param credential - Credential to store
      * @param scope - Credential scope
      * @param userId - User ID (required for user scope)
+     * @param cacheTtl - How long to keep a credential without an expiry, in ms
      */
-    storeCredential<T extends Credential>(sessionId: string, providerId: string, credential: T, scope: CredentialScope, userId?: string): Promise<void>;
+    storeCredential<T extends Credential>(sessionId: string, providerId: string, credential: T, scope: CredentialScope, userId?: string, cacheTtl?: number): Promise<void>;
     /**
      * Get a credential from the vault
      *
@@ -77,13 +91,18 @@ export declare class AuthProvidersVault {
      * @param userId - User ID (required for user scope)
      */
     getAllCredentials(sessionId: string, scope?: CredentialScope, userId?: string): Promise<AppCredential[]>;
+    private listCredentials;
+    private read;
+    /** Writes until the credential expires, else for `cacheTtl` or `defaultCacheTtl`; an expired one is deleted. */
+    private write;
+    private credentialKey;
     /**
-     * Build vault key based on scope
+     * Build vault key based on scope; user and session ids are hashed, so no id can reach into another's keys
      *
      * Key patterns:
      * - global: `authproviders:global`
-     * - user: `authproviders:user:{userId}`
-     * - session: `authproviders:session:{sessionId}`
+     * - user: `authproviders:user:{sha256(userId)}`
+     * - session: `authproviders:session:{sha256(sessionId)}`
      */
     private buildVaultKey;
 }

package/vault/auth-providers.vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.vault.d.ts","sourceRoot":"","sources":["../../src/vault/auth-providers.vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAGlE;;GAEG;AACH,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAFP,SAAS,EAAE,kBAAkB,EAC7B,SAAS,SAAmB,EAC5B,MAAM,CAAC,EAAE,UAAU,YAAA;IAGtC;;;;;;;;OAQG;IACG,eAAe,CAAC,CAAC,SAAS,UAAU,EACxC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,CAAC,EACb,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;;;OAQG;IACG,aAAa,CAAC,CAAC,SAAS,UAAU,EACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAkCpB;;;;;;;OAOG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;OAQG;IACG,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAoD9G;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CAoBtB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"auth-providers.vault.d.ts","sourceRoot":"","sources":["../../src/vault/auth-providers.vault.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D,4GAA4G;AAC5G,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAK3D;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAiBD;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0C;IACtE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa;gBAEzB,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,gCAAqC;IASvG;;;;;;;;;OASG;IACG,eAAe,CAAC,CAAC,SAAS,UAAU,EACxC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,CAAC,EACb,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAyBhB;;;;;;;;OAQG;IACG,aAAa,CAAC,CAAC,SAAS,UAAU,EACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAiCpB;;;;;;;OAOG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAahB;;;;;;;;OAQG;IACG,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YAYhG,eAAe;YAUf,IAAI;IAKlB,gHAAgH;YAClG,KAAK;IAenB,OAAO,CAAC,aAAa;IAIrB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CAoBtB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,kBAAkB,CAAC,CAAC"}

package/vault/index.d.ts

@@ -12,7 +12,7 @@ export { AUTH_PROVIDERS_ACCESSOR } from './auth-providers.accessor';
 export { AuthProvidersAccessorImpl } from './auth-providers.accessor.impl';
 export { AuthProvidersRegistry, AUTH_PROVIDERS_REGISTRY } from './auth-providers.registry';
 export type { NormalizedProviderConfig } from './auth-providers.registry';
-export { AuthProvidersVault, AUTH_PROVIDERS_VAULT } from './auth-providers.vault';
+export { AuthProvidersVault, AUTH_PROVIDERS_VAULT, UNIDENTIFIED_SESSION_PREFIX, type AuthProvidersVaultStorageOptions, } from './auth-providers.vault';
 export { EagerCredentialLoader } from './credential-loaders/eager-loader';
 export type { EagerLoadResult } from './credential-loaders/eager-loader';
 export { LazyCredentialLoader } from './credential-loaders/lazy-loader';

package/vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGlF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAG1E,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,gCAAgC,GACtC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC"}