@frontmcp/auth 1.2.1 → 1.4.0

package/esm/index.mjs

@@ -1,3 +1,5 @@
+import { createRequire as __frontmcpCreateRequire } from 'module';
+const require = __frontmcpCreateRequire(import.meta.url);
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
@@ -213,15 +215,27 @@ var init_cimd_cache = __esm({
 });
 
 // libs/auth/src/jwks/jwks.service.ts
-import { jwtVerify, createLocalJWKSet, decodeProtectedHeader } from "jose";
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 import {
   bytesToHex,
-  randomBytes,
-  rsaVerify,
   createKeyPersistence,
-  isProduction
+  isProduction,
+  randomBytes,
+  rsaVerify
 } from "@frontmcp/utils";
 
+// libs/auth/src/common/auth-logger.interface.ts
+var noopAuthLogger = {
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  },
+  debug() {
+  }
+};
+
 // libs/auth/src/jwks/jwks.utils.ts
 function trimSlash(s) {
   const str = s ?? "";
@@ -251,18 +265,6 @@ function decodeJwtPayloadSafe(token) {
   }
 }
 
-// libs/auth/src/common/auth-logger.interface.ts
-var noopAuthLogger = {
-  info() {
-  },
-  warn() {
-  },
-  error() {
-  },
-  debug() {
-  }
-};
-
 // libs/auth/src/jwks/jwks.service.ts
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
@@ -321,28 +323,6 @@ var JwksService = class {
   // ===========================================================================
   // Scope-aware verification API
   // ===========================================================================
-  /** Verify a token issued by the gateway itself (orchestrated mode). */
-  async verifyGatewayToken(token, expectedIssuer) {
-    try {
-      const payload = decodeJwtPayloadSafe(token);
-      if (!payload) {
-        return {
-          ok: false,
-          error: "invalid bearer token"
-        };
-      }
-      return {
-        ok: true,
-        issuer: expectedIssuer,
-        sub: payload["sub"],
-        payload,
-        header: decodeProtectedHeader(token)
-      };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : "verification_failed";
-      return { ok: false, error: message };
-    }
-  }
   /**
    * Verify a token against candidate transparent providers.
    * Ensures JWKS are available (cached/TTL/AS discovery) per provider.
@@ -987,32 +967,52 @@ function buildFederatedLoginPage(params) {
   return wideLayout(content, { title: "Select Providers" });
 }
 function buildToolConsentPage(params) {
-  const { tools, clientName, pendingAuthId, csrfToken, callbackPath, userName, userEmail } = params;
-  const toolsByApp = {};
-  for (const tool of tools) {
-    if (!toolsByApp[tool.appId]) {
-      toolsByApp[tool.appId] = { appName: tool.appName, tools: [] };
-    }
-    toolsByApp[tool.appId].tools.push(tool);
-  }
-  const userInfo = userName || userEmail ? `<div class="p-3 bg-gray-50 rounded-lg mb-6 text-sm">
-        <span class="text-gray-500">Signed in as: </span>
-        <span class="font-medium text-gray-900">${escapeHtml3(userName || userEmail || "")}</span>
-      </div>` : "";
-  const appGroups = Object.entries(toolsByApp).map(([appId, { appName, tools: appTools }]) => {
-    const toolItems = appTools.map((tool) => {
-      const desc = tool.description ? `<p class="text-sm text-gray-500 mt-0.5">${escapeHtml3(tool.description)}</p>` : "";
-      return `<label class="flex items-start gap-3 p-3 bg-white rounded-lg cursor-pointer hover:bg-gray-50">
-        <input type="checkbox" name="tools" value="${escapeHtml3(
-        tool.toolId
-      )}" class="mt-0.5 w-5 h-5 rounded border-gray-300" checked>
+  const {
+    tools,
+    clientName,
+    pendingAuthId,
+    csrfToken,
+    callbackPath,
+    userName,
+    userEmail,
+    groupByApp = true,
+    showDescriptions = true,
+    customMessage,
+    allowSelectAll = true,
+    requireSelection = true,
+    defaultSelectedTools,
+    error,
+    hiddenFields = []
+  } = params;
+  const defaultSet = defaultSelectedTools ? new Set(defaultSelectedTools) : void 0;
+  const isChecked = (toolId) => defaultSet ? defaultSet.has(toolId) : true;
+  const checkedCount = tools.filter((t) => isChecked(t.toolId)).length;
+  const renderTool = (tool) => {
+    const desc = showDescriptions && tool.description ? `<p class="text-sm text-gray-500 mt-0.5">${escapeHtml3(tool.description)}</p>` : "";
+    return `<label class="flex items-start gap-3 p-3 bg-white rounded-lg cursor-pointer hover:bg-gray-50">
+        <input type="checkbox" name="tools" value="${escapeHtml3(tool.toolId)}" class="mt-0.5 w-5 h-5 rounded border-gray-300"${isChecked(tool.toolId) ? " checked" : ""}>
         <div>
           <span class="font-medium text-gray-900">${escapeHtml3(tool.toolName)}</span>
           ${desc}
         </div>
       </label>`;
-    }).join("\n");
-    return `<div class="bg-gray-50 rounded-xl overflow-hidden">
+  };
+  let toolSection;
+  if (groupByApp) {
+    const toolsByApp = {};
+    for (const tool of tools) {
+      if (!toolsByApp[tool.appId]) {
+        toolsByApp[tool.appId] = { appName: tool.appName, tools: [] };
+      }
+      toolsByApp[tool.appId].tools.push(tool);
+    }
+    const toggleAllButton = allowSelectAll ? `<button type="button" class="text-sm text-blue-600 hover:text-blue-800"
+          onclick="const container = this.closest('.bg-gray-50').querySelector('[data-app]'); const cbs = container.querySelectorAll('input[name=tools]'); const allChecked = [...cbs].every(cb => cb.checked); cbs.forEach(cb => cb.checked = !allChecked); updateCount();">
+          Toggle All
+        </button>` : "";
+    toolSection = Object.entries(toolsByApp).map(([appId, { appName, tools: appTools }]) => {
+      const toolItems = appTools.map(renderTool).join("\n");
+      return `<div class="bg-gray-50 rounded-xl overflow-hidden">
       <div class="flex items-center justify-between px-4 py-3 bg-gray-100">
         <div class="flex items-center gap-3">
           <div class="w-8 h-8 rounded-lg bg-gradient-to-br from-blue-500 to-purple-600 flex items-center justify-center text-white font-bold text-sm">
@@ -1020,51 +1020,70 @@ function buildToolConsentPage(params) {
           </div>
           <span class="font-semibold text-gray-900">${escapeHtml3(appName)}</span>
         </div>
-        <button type="button" class="text-sm text-blue-600 hover:text-blue-800"
-          onclick="const container = this.closest('.bg-gray-50').querySelector('[data-app]'); const cbs = container.querySelectorAll('input[name=tools]'); const allChecked = [...cbs].every(cb => cb.checked); cbs.forEach(cb => cb.checked = !allChecked); updateCount();">
-          Toggle All
-        </button>
+        ${toggleAllButton}
       </div>
       <div class="p-4 space-y-2" data-app="${escapeHtml3(appId)}">
         ${toolItems}
       </div>
     </div>`;
-  }).join("\n");
+    }).join("\n");
+  } else {
+    toolSection = `<div class="bg-gray-50 rounded-xl p-4 space-y-2" data-app="__all__">
+      ${tools.map(renderTool).join("\n")}
+    </div>`;
+  }
+  const userInfo = userName || userEmail ? `<div class="p-3 bg-gray-50 rounded-lg mb-6 text-sm">
+        <span class="text-gray-500">Signed in as: </span>
+        <span class="font-medium text-gray-900">${escapeHtml3(userName || userEmail || "")}</span>
+      </div>` : "";
+  const errorBanner = error ? `<div class="mb-6 p-4 bg-red-50 border border-red-200 rounded-lg text-sm text-red-800">${escapeHtml3(error)}</div>` : "";
+  const hiddenInputs = hiddenFields.map((f) => `<input type="hidden" name="${escapeHtml3(f.name)}" value="${escapeHtml3(f.value)}">`).join("\n      ");
+  const selectAllControl = allowSelectAll ? `<label class="flex items-center gap-3 cursor-pointer">
+          <input type="checkbox" id="select-all" class="w-5 h-5 rounded border-gray-300"${checkedCount === tools.length && tools.length > 0 ? " checked" : ""}
+            onchange="document.querySelectorAll('input[name=tools]').forEach(cb => cb.checked = this.checked); updateCount();">
+          <span class="text-gray-700">Select all tools</span>
+        </label>` : "<span></span>";
+  const requireSelectionScript = requireSelection ? `
+      const submitBtn = document.getElementById('consent-submit');
+      if (submitBtn) submitBtn.disabled = checked.length === 0;` : "";
   const updateCountScript = `
   <script>
     function updateCount() {
       const all = document.querySelectorAll('input[name="tools"]');
       const checked = document.querySelectorAll('input[name="tools"]:checked');
-      document.getElementById('selection-count').textContent = checked.length + ' of ' + all.length + ' selected';
-      document.getElementById('select-all').checked = all.length > 0 && all.length === checked.length;
+      const countEl = document.getElementById('selection-count');
+      if (countEl) countEl.textContent = checked.length + ' of ' + all.length + ' selected';
+      const selectAll = document.getElementById('select-all');
+      if (selectAll) selectAll.checked = all.length > 0 && all.length === checked.length;${requireSelectionScript}
     }
     document.querySelectorAll('input[name="tools"]').forEach(cb => cb.addEventListener('change', updateCount));
+    updateCount();
   </script>`;
+  const subtitle = customMessage ? escapeHtml3(customMessage) : `Choose which tools ${escapeHtml3(clientName)} can access. You can change this later.`;
   const content = `
     <h1 class="text-3xl font-bold text-gray-900 mb-4">Select Tools to Enable</h1>
     <p class="text-gray-600 mb-6">
-      Choose which tools ${escapeHtml3(clientName)} can access. You can change this later.
+      ${subtitle}
     </p>
 
+    ${errorBanner}
     ${userInfo}
 
-    <form method="POST" action="${escapeHtml3(callbackPath)}" id="consent-form">
+    <form method="GET" action="${escapeHtml3(callbackPath)}" id="consent-form">
       <input type="hidden" name="csrf" value="${escapeHtml3(csrfToken)}">
       <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
+      <input type="hidden" name="consent_submitted" value="1">
+      ${hiddenInputs}
 
       <!-- Select all toggle -->
       <div class="flex items-center justify-between mb-6">
-        <label class="flex items-center gap-3 cursor-pointer">
-          <input type="checkbox" id="select-all" class="w-5 h-5 rounded border-gray-300" checked
-            onchange="document.querySelectorAll('input[name=tools]').forEach(cb => cb.checked = this.checked); updateCount();">
-          <span class="text-gray-700">Select all tools</span>
-        </label>
-        <span id="selection-count" class="text-sm text-gray-500">${tools.length} of ${tools.length} selected</span>
+        ${selectAllControl}
+        <span id="selection-count" class="text-sm text-gray-500">${checkedCount} of ${tools.length} selected</span>
       </div>
 
-      <!-- Tool groups by app -->
+      <!-- Tool groups -->
       <div class="space-y-6 mb-8">
-        ${appGroups}
+        ${toolSection}
       </div>
 
       <!-- Buttons -->
@@ -1073,8 +1092,8 @@ function buildToolConsentPage(params) {
           class="flex-1 px-6 py-3 text-gray-700 bg-gray-100 hover:bg-gray-200 font-medium rounded-lg transition-colors">
           Cancel
         </button>
-        <button type="submit"
-          class="flex-1 px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors">
+        <button type="submit" id="consent-submit"
+          class="flex-1 px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors disabled:opacity-50 disabled:cursor-not-allowed">
           Confirm Selection
         </button>
       </div>
@@ -1082,22 +1101,42 @@ function buildToolConsentPage(params) {
     ${updateCountScript}`;
   return extraWideLayout(content, { title: "Select Tools" });
 }
+function buildLoginFieldHtml(field) {
+  const id = `field-${field.name}`;
+  const safeName = escapeHtml3(field.name);
+  const requiredAttr = field.required ? " required" : "";
+  const labelText = escapeHtml3(field.label ?? field.name);
+  const safeValue = field.value !== void 0 ? escapeHtml3(field.value) : "";
+  if (field.type === "hidden") {
+    return `<input type="hidden" name="${safeName}" value="${safeValue}">`;
+  }
+  const inputClass = "w-full px-4 py-3 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-blue-500";
+  let control;
+  if (field.type === "select") {
+    const opts = (field.options ?? []).map(
+      (o) => `<option value="${escapeHtml3(o.value)}"${o.value === field.value ? " selected" : ""}>${escapeHtml3(
+        o.label
+      )}</option>`
+    ).join("");
+    control = `<select id="${escapeHtml3(id)}" name="${safeName}"${requiredAttr} class="${inputClass}">${opts}</select>`;
+  } else {
+    const placeholder = field.placeholder ? ` placeholder="${escapeHtml3(field.placeholder)}"` : "";
+    control = `<input type="${escapeHtml3(field.type)}" id="${escapeHtml3(
+      id
+    )}" name="${safeName}"${requiredAttr}${placeholder} value="${safeValue}" class="${inputClass}">`;
+  }
+  return `<div class="mb-4">
+          <label for="${escapeHtml3(id)}" class="block text-sm font-medium text-gray-700 mb-2">${labelText}</label>
+          ${control}
+        </div>`;
+}
 function buildLoginPage(params) {
-  const { clientName, scope, pendingAuthId, callbackPath } = params;
+  const { clientName, scope, pendingAuthId, callbackPath, title, subtitle, logoUri, error, extraFields } = params;
   const scopesHtml = scope ? `<div class="p-4 bg-gray-50 rounded-lg mb-6">
         <p class="text-xs font-medium text-gray-500 uppercase tracking-wide mb-2">Requested permissions</p>
         <p class="text-gray-700">${scope.split(" ").map((s) => escapeHtml3(s)).join(", ") || "Default access"}</p>
       </div>` : "";
-  const content = `
-    <div class="bg-white rounded-2xl shadow-xl p-8">
-      <h1 class="text-3xl font-bold text-gray-900 mb-2 text-center">Sign In</h1>
-      <p class="text-gray-600 mb-8 text-center">Authorize access to ${escapeHtml3(clientName)}</p>
-
-      ${scopesHtml}
-
-      <form method="GET" action="${escapeHtml3(callbackPath)}">
-        <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
-
+  const defaultFieldsHtml = `
         <!-- Email -->
         <div class="mb-4">
           <label for="email" class="block text-sm font-medium text-gray-700 mb-2">Email</label>
@@ -1110,7 +1149,27 @@ function buildLoginPage(params) {
           <label for="name" class="block text-sm font-medium text-gray-700 mb-2">Name (optional)</label>
           <input type="text" id="name" name="name" placeholder="Your name"
             class="w-full px-4 py-3 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-blue-500">
-        </div>
+        </div>`;
+  const fieldsHtml = extraFields && extraFields.length > 0 ? extraFields.map((f) => buildLoginFieldHtml(f)).join("\n") : defaultFieldsHtml;
+  const logoHtml = logoUri ? `<div class="flex justify-center mb-4"><img src="${escapeHtml3(
+    logoUri
+  )}" alt="${escapeHtml3(clientName)}" class="h-12 w-12 rounded-lg object-cover"></div>` : "";
+  const errorHtml = error ? `<div class="p-3 mb-6 bg-red-50 border border-red-200 rounded-lg text-sm text-red-700">${escapeHtml3(error)}</div>` : "";
+  const headingText = escapeHtml3(title ?? "Sign In");
+  const subtitleText = subtitle ? escapeHtml3(subtitle) : `Authorize access to ${escapeHtml3(clientName)}`;
+  const content = `
+    <div class="bg-white rounded-2xl shadow-xl p-8">
+      ${logoHtml}
+      <h1 class="text-3xl font-bold text-gray-900 mb-2 text-center">${headingText}</h1>
+      <p class="text-gray-600 mb-8 text-center">${subtitleText}</p>
+
+      ${errorHtml}
+
+      ${scopesHtml}
+
+      <form method="GET" action="${escapeHtml3(callbackPath)}">
+        <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
+${fieldsHtml}
 
         <!-- Submit -->
         <button type="submit"
@@ -1121,7 +1180,51 @@ function buildLoginPage(params) {
 
       <p class="text-center text-sm text-gray-500 mt-6">Client: ${escapeHtml3(clientName)}</p>
     </div>`;
-  return centeredCardLayout(content, { title: "Sign In" });
+  return centeredCardLayout(content, { title: title ?? "Sign In" });
+}
+function buildConnectPage(params) {
+  const { token, field, action, title, subtitle, logoUri, error } = params;
+  const logoHtml = logoUri ? `<div class="flex justify-center mb-4"><img src="${escapeHtml3(
+    logoUri
+  )}" alt="Connect" class="h-12 w-12 rounded-lg object-cover"></div>` : "";
+  const errorHtml = error ? `<div class="p-3 mb-6 bg-red-50 border border-red-200 rounded-lg text-sm text-red-700">${escapeHtml3(error)}</div>` : "";
+  const headingText = escapeHtml3(title ?? "Connect credential");
+  const subtitleText = subtitle ? escapeHtml3(subtitle) : `Connect "${escapeHtml3(field.name)}" to continue`;
+  const content = `
+    <div class="bg-white rounded-2xl shadow-xl p-8">
+      ${logoHtml}
+      <h1 class="text-3xl font-bold text-gray-900 mb-2 text-center">${headingText}</h1>
+      <p class="text-gray-600 mb-8 text-center">${subtitleText}</p>
+
+      ${errorHtml}
+
+      <form method="POST" action="${escapeHtml3(action)}">
+        <input type="hidden" name="token" value="${escapeHtml3(token)}">
+${buildLoginFieldHtml(field)}
+
+        <button type="submit"
+          class="w-full px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors">
+          Connect
+        </button>
+      </form>
+    </div>`;
+  return centeredCardLayout(content, { title: title ?? "Connect credential" });
+}
+function buildConnectSuccessPage(params) {
+  const { key, message } = params;
+  const content = `
+    <div class="bg-white rounded-2xl shadow-xl p-8 text-center">
+      <div class="flex justify-center mb-6">
+        <div class="w-16 h-16 rounded-full bg-green-100 flex items-center justify-center">
+          <svg class="w-8 h-8 text-green-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
+          </svg>
+        </div>
+      </div>
+      <h1 class="text-2xl font-bold text-gray-900 mb-4">Credential connected</h1>
+      <p class="text-gray-600">${escapeHtml3(message ?? `"${key}" is now connected. You can return to your session.`)}</p>
+    </div>`;
+  return centeredCardLayout(content, { title: "Connected" });
 }
 function buildErrorPage(params) {
   const { error, description } = params;
@@ -1148,6 +1251,37 @@ function renderToHtml(html, _options) {
   return html;
 }
 
+// libs/auth/src/ui/local-login.helper.ts
+function toLoginExtraFields(fields, values) {
+  if (!fields) return [];
+  return Object.entries(fields).map(([name, def]) => ({
+    name,
+    type: def.type,
+    label: def.label,
+    required: def.required,
+    placeholder: def.placeholder,
+    options: def.options,
+    value: values?.[name]
+  }));
+}
+function renderLocalLoginPage(login, ctx, values) {
+  if (login?.render) {
+    return login.render({ ...ctx, values });
+  }
+  const extraFields = login?.fields ? toLoginExtraFields(login.fields, values) : void 0;
+  return buildLoginPage({
+    clientName: ctx.clientName,
+    scope: ctx.scopes.join(" "),
+    pendingAuthId: ctx.pendingAuthId,
+    callbackPath: ctx.callbackPath,
+    title: login?.title,
+    subtitle: login?.subtitle,
+    logoUri: login?.logoUri ?? ctx.logoUri,
+    error: ctx.error,
+    extraFields
+  });
+}
+
 // libs/auth/src/session/authorization.store.ts
 import { z } from "@frontmcp/lazy-zod";
 import { randomUUID, sha256Base64url } from "@frontmcp/utils";
@@ -1175,8 +1309,83 @@ var authorizationCodeRecordSchema = z.object({
   skippedProviderIds: z.array(z.string()).optional(),
   consentEnabled: z.boolean().optional(),
   federatedLoginUsed: z.boolean().optional(),
-  pendingAuthId: z.string().optional()
+  pendingAuthId: z.string().optional(),
+  // Progressive/Incremental authorization: granted app-id set.
+  authorizedAppIds: z.array(z.string()).optional(),
+  // Custom claims from a local authenticate() verifier (Checkpoint 3a).
+  customClaims: z.record(z.string(), z.unknown()).optional()
 });
+var AUTH_CODE_TTL_MS = 60 * 1e3;
+var PENDING_AUTH_TTL_MS = 10 * 60 * 1e3;
+var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+function generateAuthorizationCode() {
+  return randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, "");
+}
+function generateRefreshTokenValue() {
+  return randomUUID() + "-" + randomUUID();
+}
+function buildCodeRecord(params) {
+  const now = Date.now();
+  return {
+    code: generateAuthorizationCode(),
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    pkce: params.pkce,
+    userSub: params.userSub,
+    userEmail: params.userEmail,
+    userName: params.userName,
+    state: params.state,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + AUTH_CODE_TTL_MS,
+    used: false,
+    selectedToolIds: params.selectedToolIds,
+    selectedProviderIds: params.selectedProviderIds,
+    skippedProviderIds: params.skippedProviderIds,
+    consentEnabled: params.consentEnabled,
+    federatedLoginUsed: params.federatedLoginUsed,
+    pendingAuthId: params.pendingAuthId,
+    authorizedAppIds: params.authorizedAppIds,
+    customClaims: params.customClaims
+  };
+}
+function buildPendingRecord(params) {
+  const now = Date.now();
+  return {
+    id: randomUUID(),
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    pkce: params.pkce,
+    state: params.state,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + PENDING_AUTH_TTL_MS,
+    isIncremental: params.isIncremental,
+    targetAppId: params.targetAppId,
+    targetToolId: params.targetToolId,
+    existingSessionId: params.existingSessionId,
+    existingAuthorizationId: params.existingAuthorizationId,
+    priorAuthorizedAppIds: params.priorAuthorizedAppIds,
+    federatedLogin: params.federatedLogin,
+    consent: params.consent,
+    authUiCsrf: params.authUiCsrf
+  };
+}
+function buildRefreshTokenRecord(params) {
+  const now = Date.now();
+  return {
+    token: generateRefreshTokenValue(),
+    clientId: params.clientId,
+    userSub: params.userSub,
+    scopes: params.scopes,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + REFRESH_TOKEN_TTL_MS,
+    revoked: false
+  };
+}
 function verifyPkce(codeVerifier, challenge) {
   if (challenge.method !== "S256") {
     return false;
@@ -1192,17 +1401,11 @@ var InMemoryAuthorizationStore = class {
   codes = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   refreshTokens = /* @__PURE__ */ new Map();
-  /** Default TTL for authorization codes (60 seconds) */
-  codeTtlMs = 60 * 1e3;
-  /** Default TTL for pending authorizations (10 minutes) */
-  pendingTtlMs = 10 * 60 * 1e3;
-  /** Default TTL for refresh tokens (30 days) */
-  refreshTtlMs = 30 * 24 * 60 * 60 * 1e3;
   generateCode() {
-    return randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, "");
+    return generateAuthorizationCode();
   }
   generateRefreshToken() {
-    return randomUUID() + "-" + randomUUID();
+    return generateRefreshTokenValue();
   }
   async storeAuthorizationCode(record) {
     this.codes.set(record.code, record);
@@ -1281,76 +1484,22 @@ var InMemoryAuthorizationStore = class {
     }
   }
   /**
-   * Create an authorization code record with defaults
+   * Create an authorization code record with defaults.
    */
   createCodeRecord(params) {
-    const now = Date.now();
-    return {
-      code: this.generateCode(),
-      clientId: params.clientId,
-      redirectUri: params.redirectUri,
-      scopes: params.scopes,
-      pkce: params.pkce,
-      userSub: params.userSub,
-      userEmail: params.userEmail,
-      userName: params.userName,
-      state: params.state,
-      resource: params.resource,
-      createdAt: now,
-      expiresAt: now + this.codeTtlMs,
-      used: false,
-      // Consent and Federated Login Data
-      selectedToolIds: params.selectedToolIds,
-      selectedProviderIds: params.selectedProviderIds,
-      skippedProviderIds: params.skippedProviderIds,
-      consentEnabled: params.consentEnabled,
-      federatedLoginUsed: params.federatedLoginUsed,
-      // Token migration ID (for federated auth)
-      pendingAuthId: params.pendingAuthId
-    };
+    return buildCodeRecord(params);
   }
   /**
-   * Create a pending authorization record with defaults
+   * Create a pending authorization record with defaults.
    */
   createPendingRecord(params) {
-    const now = Date.now();
-    return {
-      id: randomUUID(),
-      clientId: params.clientId,
-      redirectUri: params.redirectUri,
-      scopes: params.scopes,
-      pkce: params.pkce,
-      state: params.state,
-      resource: params.resource,
-      createdAt: now,
-      expiresAt: now + this.pendingTtlMs,
-      // Progressive/Incremental Authorization Fields
-      isIncremental: params.isIncremental,
-      targetAppId: params.targetAppId,
-      targetToolId: params.targetToolId,
-      existingSessionId: params.existingSessionId,
-      existingAuthorizationId: params.existingAuthorizationId,
-      // Federated Login State
-      federatedLogin: params.federatedLogin,
-      // Consent State
-      consent: params.consent
-    };
+    return buildPendingRecord(params);
   }
   /**
-   * Create a refresh token record with defaults
+   * Create a refresh token record with defaults.
    */
   createRefreshTokenRecord(params) {
-    const now = Date.now();
-    return {
-      token: this.generateRefreshToken(),
-      clientId: params.clientId,
-      userSub: params.userSub,
-      scopes: params.scopes,
-      resource: params.resource,
-      createdAt: now,
-      expiresAt: now + this.refreshTtlMs,
-      revoked: false
-    };
+    return buildRefreshTokenRecord(params);
   }
 };
 var RedisAuthorizationStore = class {
@@ -1362,10 +1511,19 @@ var RedisAuthorizationStore = class {
     return `${this.namespace}${type}:${id}`;
   }
   generateCode() {
-    return randomUUID().replace(/-/g, "") + randomUUID().replace(/-/g, "");
+    return generateAuthorizationCode();
   }
   generateRefreshToken() {
-    return randomUUID() + "-" + randomUUID();
+    return generateRefreshTokenValue();
+  }
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
   }
   async storeAuthorizationCode(record) {
     const ttl = Math.max(Math.ceil((record.expiresAt - Date.now()) / 1e3), 1);
@@ -1427,6 +1585,130 @@ var RedisAuthorizationStore = class {
   }
 };
 
+// libs/auth/src/session/storage-authorization.store.ts
+import { TypedStorage } from "@frontmcp/utils";
+var StorageAuthorizationStore = class {
+  codeStore;
+  pendingStore;
+  refreshStore;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "oauth";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const base = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.codeStore = new TypedStorage(base);
+    this.pendingStore = new TypedStorage(base);
+    this.refreshStore = new TypedStorage(base);
+  }
+  // ============================================
+  // Record builders (pure; shared with in-memory store)
+  // ============================================
+  generateCode() {
+    return generateAuthorizationCode();
+  }
+  generateRefreshToken() {
+    return generateRefreshTokenValue();
+  }
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
+  }
+  // ============================================
+  // Authorization code operations
+  // ============================================
+  async storeAuthorizationCode(record) {
+    await this.codeStore.set(this.key("code", record.code), record, this.ttl(record.expiresAt));
+  }
+  async getAuthorizationCode(code) {
+    const record = await this.codeStore.get(this.key("code", code));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      await this.codeStore.delete(this.key("code", code));
+      return null;
+    }
+    return record;
+  }
+  async markCodeUsed(code) {
+    const record = await this.getAuthorizationCode(code);
+    if (record) {
+      record.used = true;
+      await this.codeStore.set(this.key("code", code), record, this.ttl(record.expiresAt));
+    }
+  }
+  async deleteAuthorizationCode(code) {
+    await this.codeStore.delete(this.key("code", code));
+  }
+  // ============================================
+  // Pending authorization operations
+  // ============================================
+  async storePendingAuthorization(record) {
+    await this.pendingStore.set(this.key("pending", record.id), record, this.ttl(record.expiresAt));
+  }
+  async getPendingAuthorization(id) {
+    const record = await this.pendingStore.get(this.key("pending", id));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      await this.pendingStore.delete(this.key("pending", id));
+      return null;
+    }
+    return record;
+  }
+  async deletePendingAuthorization(id) {
+    await this.pendingStore.delete(this.key("pending", id));
+  }
+  // ============================================
+  // Refresh token operations
+  // ============================================
+  async storeRefreshToken(record) {
+    await this.refreshStore.set(this.key("refresh", record.token), record, this.ttl(record.expiresAt));
+  }
+  async getRefreshToken(token) {
+    const record = await this.refreshStore.get(this.key("refresh", token));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt || record.revoked) {
+      return null;
+    }
+    return record;
+  }
+  async revokeRefreshToken(token) {
+    const record = await this.refreshStore.get(this.key("refresh", token));
+    if (record) {
+      record.revoked = true;
+      await this.refreshStore.set(this.key("refresh", token), record, this.ttl(record.expiresAt));
+    }
+  }
+  async rotateRefreshToken(oldToken, newRecord) {
+    await this.revokeRefreshToken(oldToken);
+    newRecord.previousToken = oldToken;
+    await this.storeRefreshToken(newRecord);
+  }
+  // ============================================
+  // Utility
+  // ============================================
+  async cleanup() {
+  }
+  // ============================================
+  // Internals
+  // ============================================
+  ttl(expiresAtMs) {
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return { ttlSeconds: ttl > 0 ? ttl : 1 };
+  }
+  key(type, id) {
+    const composite = `${type}:${id}`;
+    return this.storageIsNamespaced ? composite : `${this.namespace}:${composite}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
 // libs/auth/src/session/authorization-vault.ts
 import { z as z2 } from "@frontmcp/lazy-zod";
 var credentialTypeSchema = z2.enum([
@@ -1688,6 +1970,9 @@ var authorizationVaultEntrySchema = z2.object({
   skippedAppIds: z2.array(z2.string())
 });
 
+// libs/auth/src/session/session-credential-vault.ts
+import { getEnv, randomUUID as randomUUID2 } from "@frontmcp/utils";
+
 // libs/auth/src/session/vault-encryption.ts
 import { z as z3 } from "@frontmcp/lazy-zod";
 import {
@@ -1871,6 +2156,639 @@ var encryptedVaultEntrySchema = z3.object({
   pendingAuthIds: z3.array(z3.string()).default([])
 });
 
+// libs/auth/src/session/session-credential-vault.ts
+var DEFAULT_KEY_PREFIX = "mcp:cred:";
+var DEFAULT_PENDING_TTL_MS = 6e5;
+var SessionCredentialVault = class {
+  storage;
+  encryption;
+  keyPrefix;
+  ttlMs;
+  pendingTtlMs;
+  logger;
+  /** Cache of derived AES keys, keyed by `${sub}:${vaultId}`. */
+  keyCache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.storage = options.storage;
+    this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
+    this.ttlMs = options.ttlMs;
+    this.pendingTtlMs = options.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.logger = options.logger ?? noopAuthLogger;
+    const pepper = options.pepper ?? resolveVaultPepper(this.logger);
+    this.encryption = new VaultEncryption({ pepper, hkdfInfo: "frontmcp-session-credential-vault-v1" });
+  }
+  // ============================================
+  // Storage-key helpers
+  // ============================================
+  /** `cred:idx:<sub>` → current vaultId (the sub → vaultId indirection). */
+  indexKey(sub) {
+    return `${this.keyPrefix}idx:${sub}`;
+  }
+  /** `cred:keys:<sub>:<vaultId>` → JSON array of credential key names (the SET). */
+  keysKey(sub, vaultId) {
+    return `${this.keyPrefix}keys:${sub}:${vaultId}`;
+  }
+  /** `cred:data:<sub>:<vaultId>:<key>` → encrypted credential record. */
+  dataKey(sub, vaultId, key) {
+    return `${this.keyPrefix}data:${sub}:${vaultId}:${key}`;
+  }
+  /** `cred:pending:<pendingId>` → encrypted pending-authorize accumulator. */
+  pendingKey(pendingId) {
+    return `${this.keyPrefix}pending:${pendingId}`;
+  }
+  /** Convert the configured `ttlMs` into `SetOptions` (storage uses `ttlSeconds`). */
+  get credentialSetOpts() {
+    return this.ttlMs ? { ttlSeconds: Math.ceil(this.ttlMs / 1e3) } : void 0;
+  }
+  // ============================================
+  // Key derivation
+  // ============================================
+  /**
+   * Derive (and cache) the AES-256 key for a `(sub, vaultId)` pair. The vaultId
+   * acts as the HKDF salt, so rotating it makes prior ciphertext undecryptable.
+   */
+  deriveKey(sub, vaultId) {
+    const cacheKey = `${sub}:${vaultId}`;
+    const cached = this.keyCache.get(cacheKey);
+    if (cached) return cached;
+    const promise = this.encryption.deriveKey({ jti: vaultId, vaultKey: vaultId, sub, iat: 0 });
+    this.keyCache.set(cacheKey, promise);
+    return promise;
+  }
+  // ============================================
+  // vaultId indirection
+  // ============================================
+  /**
+   * Read the current vaultId for a subject, or undefined when the subject has no
+   * live vault (never authorized, or rotated away).
+   */
+  async getVaultId(sub) {
+    const raw = await this.storage.get(this.indexKey(sub));
+    return raw ?? void 0;
+  }
+  /**
+   * Mint a FRESH vaultId for a subject and point the indirection at it. Called
+   * at the start of each authorize so reconnect = empty vault. Returns the new
+   * vaultId. The old vaultId's ciphertext is left in storage but is
+   * unreachable (no index pointer) and undecryptable (different derived key);
+   * it expires via TTL when configured.
+   */
+  async rotateVault(sub) {
+    const vaultId = randomUUID2();
+    await this.storage.set(this.indexKey(sub), vaultId, this.credentialSetOpts);
+    return vaultId;
+  }
+  // ============================================
+  // Credential CRUD (committed vault)
+  // ============================================
+  /**
+   * Encrypt + store a single credential into the vault identified by
+   * `(sub, vaultId)` and add its key to the key set. Used both to commit
+   * authorize-time credentials and to additively add a credential mid-session.
+   */
+  async store(sub, vaultId, key, value) {
+    const aesKey = await this.deriveKey(sub, vaultId);
+    const enc = await this.encryption.encryptObject(this.normalize(value), aesKey);
+    const record = { enc };
+    await this.storage.set(this.dataKey(sub, vaultId, key), JSON.stringify(record), this.credentialSetOpts);
+    await this.addKeyToSet(sub, vaultId, key);
+  }
+  /**
+   * Decrypt and return a credential by key for a subject's CURRENT vault.
+   * Returns undefined when there is no live vault or no such key, or when
+   * decryption fails (e.g. a stale pointer to rotated-away ciphertext).
+   */
+  async get(sub, key) {
+    const vaultId = await this.getVaultId(sub);
+    if (!vaultId) return void 0;
+    const raw = await this.storage.get(this.dataKey(sub, vaultId, key));
+    if (!raw) return void 0;
+    try {
+      const record = JSON.parse(raw);
+      const aesKey = await this.deriveKey(sub, vaultId);
+      return await this.encryption.decryptObject(record.enc, aesKey);
+    } catch (err) {
+      this.logger.warn(`SessionCredentialVault: failed to read credential "${key}": ${errMsg(err)}`);
+      return void 0;
+    }
+  }
+  /**
+   * List the credential keys available in a subject's current vault. Returns an
+   * empty array when there is no live vault (e.g. after rotation on reconnect).
+   */
+  async list(sub) {
+    const vaultId = await this.getVaultId(sub);
+    if (!vaultId) return [];
+    return this.readKeySet(sub, vaultId);
+  }
+  /**
+   * Remove a credential by key from a subject's current vault (deletes the
+   * ciphertext and drops the key from the set). No-op when absent.
+   */
+  async remove(sub, key) {
+    const vaultId = await this.getVaultId(sub);
+    if (!vaultId) return;
+    await this.storage.delete(this.dataKey(sub, vaultId, key));
+    const keys = await this.readKeySet(sub, vaultId);
+    const next = keys.filter((k) => k !== key);
+    if (next.length !== keys.length) {
+      await this.writeKeySet(sub, vaultId, next);
+    }
+  }
+  // ============================================
+  // Authorize-time accumulation + commit
+  // ============================================
+  /**
+   * Stage credentials returned by `authenticate()` under a pending id, encrypted
+   * against a freshly-rotated vaultId for `sub`. They are NOT visible to tools
+   * until {@link commit} flushes them — this lets the authorize flow accumulate
+   * credentials before the subject's identity is final.
+   *
+   * @returns the vaultId the credentials were staged against.
+   */
+  async stage(pendingId, sub, credentials) {
+    const vaultId = await this.rotateVault(sub);
+    const creds = {};
+    for (const cred of credentials) {
+      const aesKey = await this.deriveKey(sub, vaultId);
+      const { key, ...value } = cred;
+      creds[key] = { enc: await this.encryption.encryptObject(this.normalize(value), aesKey) };
+    }
+    const batch = { sub, vaultId, creds };
+    await this.storage.set(this.pendingKey(pendingId), JSON.stringify(batch), {
+      ttlSeconds: Math.ceil(this.pendingTtlMs / 1e3)
+    });
+    return vaultId;
+  }
+  /**
+   * Flush a staged batch into the live vault, binding it to `sub`. The staged
+   * batch's `sub` must equal the supplied `sub` (the one baked into the minted
+   * token) — a mismatch is refused so credentials can never be committed under a
+   * different identity than the one that will read them.
+   *
+   * @returns true when a batch was committed, false when none was staged.
+   */
+  async commit(pendingId, sub) {
+    const raw = await this.storage.get(this.pendingKey(pendingId));
+    if (!raw) return false;
+    let batch;
+    try {
+      batch = JSON.parse(raw);
+    } catch {
+      await this.storage.delete(this.pendingKey(pendingId));
+      return false;
+    }
+    if (batch.sub !== sub) {
+      this.logger.warn("SessionCredentialVault: pending batch subject mismatch on commit; discarding");
+      await this.storage.delete(this.pendingKey(pendingId));
+      return false;
+    }
+    await this.storage.set(this.indexKey(sub), batch.vaultId, this.credentialSetOpts);
+    const keys = [];
+    for (const [key, record] of Object.entries(batch.creds)) {
+      await this.storage.set(this.dataKey(sub, batch.vaultId, key), JSON.stringify(record), this.credentialSetOpts);
+      keys.push(key);
+    }
+    await this.writeKeySet(sub, batch.vaultId, keys);
+    await this.storage.delete(this.pendingKey(pendingId));
+    return true;
+  }
+  // ============================================
+  // Key-set helpers
+  // ============================================
+  async readKeySet(sub, vaultId) {
+    const raw = await this.storage.get(this.keysKey(sub, vaultId));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.filter((k) => typeof k === "string") : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeKeySet(sub, vaultId, keys) {
+    const unique = [...new Set(keys)];
+    await this.storage.set(this.keysKey(sub, vaultId), JSON.stringify(unique), this.credentialSetOpts);
+  }
+  async addKeyToSet(sub, vaultId, key) {
+    const keys = await this.readKeySet(sub, vaultId);
+    if (!keys.includes(key)) {
+      keys.push(key);
+      await this.writeKeySet(sub, vaultId, keys);
+    }
+  }
+  /** Strip undefined metadata so the encrypted JSON stays minimal. */
+  normalize(value) {
+    return value.metadata === void 0 ? { secret: value.secret } : { secret: value.secret, metadata: value.metadata };
+  }
+};
+function resolveVaultPepper(logger) {
+  const fromEnv = getEnv("VAULT_SECRET") ?? getEnv("JWT_SECRET");
+  if (fromEnv && fromEnv.trim().length > 0) return fromEnv;
+  logger.warn(
+    "SessionCredentialVault: neither VAULT_SECRET nor JWT_SECRET is set; using a random per-process pepper. Stored credentials will NOT survive a restart and cannot be shared across instances. Set VAULT_SECRET (or JWT_SECRET) for persistent, multi-instance credential storage."
+  );
+  return randomUUID2() + randomUUID2();
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// libs/auth/src/session/token-storage.factory.ts
+import { MemoryStorageAdapter, RedisStorageAdapter } from "@frontmcp/utils";
+function isRedisTokenStorage(config) {
+  return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
+}
+function isSqliteTokenStorage(config) {
+  return typeof config === "object" && config !== null && "sqlite" in config && !!config.sqlite;
+}
+function isPersistentTokenStorage(config) {
+  return config !== void 0 && config !== "memory";
+}
+async function createTokenStorageAdapter(config) {
+  if (config === void 0 || config === "memory") {
+    const adapter = new MemoryStorageAdapter();
+    await adapter.connect();
+    return adapter;
+  }
+  if (isSqliteTokenStorage(config)) {
+    const { SqliteStorageAdapter } = __require("@frontmcp/storage-sqlite");
+    const adapter = new SqliteStorageAdapter({
+      path: config.sqlite.path,
+      encryption: config.sqlite.encryption,
+      ttlCleanupIntervalMs: config.sqlite.ttlCleanupIntervalMs ?? 6e4,
+      walMode: config.sqlite.walMode ?? true
+    });
+    await adapter.connect();
+    return adapter;
+  }
+  if (isRedisTokenStorage(config)) {
+    const { host, port, password, db, tls, keyPrefix } = config.redis;
+    const adapter = new RedisStorageAdapter({
+      config: { host, port, password, db, tls },
+      keyPrefix: keyPrefix ?? ""
+    });
+    await adapter.connect();
+    return adapter;
+  }
+  const fallback = new MemoryStorageAdapter();
+  await fallback.connect();
+  return fallback;
+}
+
+// libs/auth/src/session/session-credential-vault.factory.ts
+async function createSessionCredentialVault(options) {
+  const storage = options.storage ?? await createTokenStorageAdapter(options.tokenStorage);
+  const vault = new SessionCredentialVault({
+    storage,
+    pepper: options.pepper,
+    keyPrefix: options.keyPrefix,
+    ttlMs: options.ttlMs,
+    logger: options.logger
+  });
+  const type = options.tokenStorage === void 0 || options.tokenStorage === "memory" ? "memory" : "sqlite" in options.tokenStorage ? "sqlite" : "redis";
+  return { vault, type };
+}
+
+// libs/auth/src/session/credential-resume-link.ts
+import { signData, verifyData } from "@frontmcp/utils";
+var DEFAULT_RESUME_TTL_MS = 6e5;
+function signCredentialResumeToken(input, secret) {
+  const payload = {
+    sub: input.sub,
+    key: input.key,
+    ...input.context !== void 0 ? { context: input.context } : {},
+    exp: Date.now() + (input.ttlMs ?? DEFAULT_RESUME_TTL_MS)
+  };
+  const signedJson = signData(payload, { secret });
+  return Buffer.from(signedJson, "utf8").toString("base64url");
+}
+function verifyCredentialResumeToken(token, secret, now = Date.now()) {
+  let signedJson;
+  try {
+    signedJson = Buffer.from(token, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  const payload = verifyData(signedJson, { secret });
+  if (!payload) return null;
+  if (typeof payload.sub !== "string" || typeof payload.key !== "string" || !Number.isFinite(payload.exp)) {
+    return null;
+  }
+  if (payload.context !== void 0 && typeof payload.context !== "string") {
+    return null;
+  }
+  if (now >= payload.exp) {
+    return null;
+  }
+  return payload;
+}
+function buildCredentialResumeUrl(basePath, token) {
+  const trimmed = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+  return `${trimmed}/oauth/connect?token=${encodeURIComponent(token)}`;
+}
+
+// libs/auth/src/session/credentials-accessor.ts
+var CREDENTIALS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:CREDENTIALS_ACCESSOR");
+
+// libs/auth/src/session/credentials-accessor.impl.ts
+var CredentialsAccessorImpl = class {
+  vault;
+  resolveSub;
+  signingSecret;
+  basePath;
+  resumeTtlMs;
+  logger;
+  constructor(deps) {
+    this.vault = deps.vault;
+    this.resolveSub = deps.resolveSub;
+    this.signingSecret = deps.signingSecret;
+    this.basePath = deps.basePath;
+    this.resumeTtlMs = deps.resumeTtlMs;
+    this.logger = deps.logger ?? noopAuthLogger;
+  }
+  async get(key) {
+    const sub = this.resolveSub();
+    if (!sub) return void 0;
+    return this.vault.get(sub, key);
+  }
+  async list() {
+    const sub = this.resolveSub();
+    if (!sub) return [];
+    return this.vault.list(sub);
+  }
+  async requireConnect(options) {
+    const { key, context } = options;
+    const sub = this.resolveSub();
+    if (sub) {
+      const existing = await this.vault.get(sub, key);
+      if (existing) {
+        return { connected: true, key, credential: existing };
+      }
+    }
+    const token = signCredentialResumeToken(
+      { sub: sub ?? "", key, context, ttlMs: this.resumeTtlMs },
+      this.signingSecret
+    );
+    const resumeUrl = buildCredentialResumeUrl(this.basePath, token);
+    this.logger.debug(`CredentialsAccessor: credential "${key}" not connected; issued resume link`);
+    return {
+      connected: false,
+      key,
+      resumeUrl,
+      message: `Credential "${key}" is not connected. Open the resume URL to connect it.`
+    };
+  }
+};
+
+// libs/auth/src/session/secure-store-backends.ts
+var DEFAULT_KEY_PREFIX2 = "mcp:secret:";
+var EncryptedStorageSecureStoreBackend = class {
+  storage;
+  encryption;
+  keyPrefix;
+  logger;
+  /** Cache of derived AES keys, keyed by namespace. */
+  keyCache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.storage = options.storage;
+    this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX2;
+    this.logger = options.logger ?? noopAuthLogger;
+    this.encryption = new VaultEncryption({
+      pepper: options.pepper,
+      hkdfInfo: "frontmcp-secure-store-v1"
+    });
+  }
+  // ============================================
+  // Storage-key helpers
+  // ============================================
+  /** `secret:keys:<namespace>` → JSON array of key names. */
+  keysKey(namespace) {
+    return `${this.keyPrefix}keys:${namespace}`;
+  }
+  /** `secret:data:<namespace>:<key>` → encrypted record. */
+  dataKey(namespace, key) {
+    return `${this.keyPrefix}data:${namespace}:${key}`;
+  }
+  /**
+   * Derive (and cache) the AES-256 key for a namespace. The namespace acts as
+   * the HKDF salt material, so values are cryptographically isolated per scope.
+   */
+  deriveKey(namespace) {
+    const cached = this.keyCache.get(namespace);
+    if (cached) return cached;
+    const promise = this.encryption.deriveKey({ jti: namespace, vaultKey: namespace, sub: namespace, iat: 0 });
+    this.keyCache.set(namespace, promise);
+    return promise;
+  }
+  setOpts(ttlMs) {
+    return ttlMs && ttlMs > 0 ? { ttlSeconds: Math.ceil(ttlMs / 1e3) } : void 0;
+  }
+  // ============================================
+  // SecureStoreBackend
+  // ============================================
+  async get(namespace, key) {
+    const raw = await this.storage.get(this.dataKey(namespace, key));
+    if (!raw) return null;
+    try {
+      const record = JSON.parse(raw);
+      const aesKey = await this.deriveKey(namespace);
+      return await this.encryption.decrypt(record.enc, aesKey);
+    } catch (err) {
+      this.logger.warn(`SecureStore: failed to read secret "${key}": ${errMsg2(err)}`);
+      return null;
+    }
+  }
+  async set(namespace, key, value, ttlMs) {
+    const aesKey = await this.deriveKey(namespace);
+    const enc = await this.encryption.encrypt(value, aesKey);
+    const record = { enc };
+    const opts = this.setOpts(ttlMs);
+    await this.storage.set(this.dataKey(namespace, key), JSON.stringify(record), opts);
+    await this.addKeyToSet(namespace, key, opts);
+  }
+  async delete(namespace, key) {
+    const existed = await this.storage.delete(this.dataKey(namespace, key));
+    const keys = await this.readKeySet(namespace);
+    const next = keys.filter((k) => k !== key);
+    if (next.length !== keys.length) {
+      await this.writeKeySet(namespace, next);
+    }
+    return existed;
+  }
+  async list(namespace) {
+    return this.readKeySet(namespace);
+  }
+  // ============================================
+  // Key-set helpers (the namespace's key SET)
+  // ============================================
+  async readKeySet(namespace) {
+    const raw = await this.storage.get(this.keysKey(namespace));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.filter((k) => typeof k === "string") : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeKeySet(namespace, keys, opts) {
+    const unique = [...new Set(keys)];
+    await this.storage.set(this.keysKey(namespace), JSON.stringify(unique), opts);
+  }
+  async addKeyToSet(namespace, key, opts) {
+    const keys = await this.readKeySet(namespace);
+    if (!keys.includes(key)) {
+      keys.push(key);
+      await this.writeKeySet(namespace, keys, opts);
+    }
+  }
+};
+function errMsg2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// libs/auth/src/session/secure-store-accessor.ts
+var SECURE_STORE_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_ACCESSOR");
+
+// libs/auth/src/session/secure-store-accessor.impl.ts
+import { sha256Hex } from "@frontmcp/utils";
+var GLOBAL_NAMESPACE = "global";
+var SecureStoreAccessorImpl = class {
+  backend;
+  scope;
+  resolveSub;
+  resolveSessionId;
+  ttlMs;
+  logger;
+  constructor(deps) {
+    this.backend = deps.backend;
+    this.scope = deps.scope ?? "user";
+    this.resolveSub = deps.resolveSub;
+    this.resolveSessionId = deps.resolveSessionId;
+    this.ttlMs = deps.ttlMs;
+    this.logger = deps.logger ?? noopAuthLogger;
+  }
+  /**
+   * Resolve the namespace for the current request from the configured scope.
+   * Returns undefined when the scope's identity is unavailable (anonymous user
+   * under `user` scope, or no session under `session` scope), in which case
+   * reads return empty and writes are skipped.
+   */
+  resolveNamespace() {
+    switch (this.scope) {
+      case "global":
+        return GLOBAL_NAMESPACE;
+      case "session": {
+        const sid = this.resolveSessionId();
+        return sid ? `s:${sha256Hex(sid).slice(0, 32)}` : void 0;
+      }
+      case "user":
+      default: {
+        const sub = this.resolveSub();
+        return sub ? `u:${sha256Hex(sub).slice(0, 32)}` : void 0;
+      }
+    }
+  }
+  async get(key) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return void 0;
+    const raw = await this.backend.get(namespace, key);
+    if (raw === null) return void 0;
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      this.logger.warn(`SecureStore: failed to parse secret "${key}": ${errMsg3(err)}`);
+      return void 0;
+    }
+  }
+  async set(key, value, options) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) {
+      this.logger.debug(`SecureStore: no ${this.scope} scope for request; skipping set("${key}")`);
+      return;
+    }
+    const ttlMs = options?.ttlMs ?? this.ttlMs;
+    await this.backend.set(namespace, key, JSON.stringify(value), ttlMs);
+  }
+  async delete(key) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return false;
+    return this.backend.delete(namespace, key);
+  }
+  async list() {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return [];
+    return this.backend.list(namespace);
+  }
+};
+function errMsg3(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// libs/auth/src/session/secure-store.factory.ts
+import { MemoryStorageAdapter as MemoryStorageAdapter2 } from "@frontmcp/utils";
+function isCustomBackendConfig(config) {
+  return typeof config === "object" && config !== null && "backend" in config && !!config.backend;
+}
+function isSqliteConfig(config) {
+  return typeof config === "object" && config !== null && "sqlite" in config && !!config.sqlite;
+}
+function isRedisConfig(config) {
+  return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
+}
+function readScope(config) {
+  if (typeof config === "object" && config !== null && "scope" in config && config.scope) {
+    return config.scope;
+  }
+  return "user";
+}
+function readTtlMs(config) {
+  if (typeof config === "object" && config !== null && "ttlMs" in config) {
+    return config.ttlMs;
+  }
+  return void 0;
+}
+function readPepper(config) {
+  if (typeof config === "object" && config !== null && "encryption" in config && config.encryption) {
+    return config.encryption.pepper;
+  }
+  return void 0;
+}
+function toTokenStorageConfig(config) {
+  if (isSqliteConfig(config)) {
+    return { sqlite: config.sqlite };
+  }
+  if (isRedisConfig(config)) {
+    return { redis: config.redis };
+  }
+  return "memory";
+}
+async function createSecureStore(options) {
+  const { config, pepper, storage, logger } = options;
+  const scope = readScope(config);
+  const ttlMs = readTtlMs(config);
+  if (isCustomBackendConfig(config)) {
+    return { backend: config.backend, scope, ttlMs, kind: "custom" };
+  }
+  const kind = isSqliteConfig(config) ? "sqlite" : isRedisConfig(config) ? "redis" : "memory";
+  let adapter;
+  if (storage) {
+    adapter = storage;
+  } else if (kind === "memory") {
+    adapter = new MemoryStorageAdapter2();
+    await adapter.connect();
+  } else {
+    adapter = await createTokenStorageAdapter(toTokenStorageConfig(config));
+  }
+  const backend = new EncryptedStorageSecureStoreBackend({
+    storage: adapter,
+    pepper: readPepper(config) ?? pepper,
+    logger
+  });
+  return { backend, scope, ttlMs, kind };
+}
+
 // libs/auth/src/session/token.vault.ts
 import { encryptAesGcm as encryptAesGcm2, decryptAesGcm as decryptAesGcm2, randomBytes as randomBytes3, base64urlEncode as base64urlEncode2, base64urlDecode as base64urlDecode2 } from "@frontmcp/utils";
 var TokenVault = class {
@@ -1932,11 +2850,11 @@ var TokenVault = class {
 
 // libs/auth/src/session/index.ts
 import {
-  hkdfSha256 as hkdfSha2563,
+  hkdfSha256 as hkdfSha2564,
   encryptValue as encryptValue2,
   decryptValue as decryptValue2,
-  encryptAesGcm as encryptAesGcm4,
-  decryptAesGcm as decryptAesGcm4
+  encryptAesGcm as encryptAesGcm5,
+  decryptAesGcm as decryptAesGcm5
 } from "@frontmcp/utils";
 
 // libs/auth/src/session/transport-session.types.ts
@@ -2034,11 +2952,11 @@ var redisConfigSchema = z4.object({
 
 // libs/auth/src/session/session-crypto.ts
 import {
-  signData,
-  verifyData,
+  signData as signData2,
+  verifyData as verifyData2,
   isSignedData,
   verifyOrParseData,
-  getEnv,
+  getEnv as getEnv2,
   isProduction as isProduction2
 } from "@frontmcp/utils";
 
@@ -2188,7 +3106,7 @@ var AuthFlowError = class extends AuthInternalError {
 
 // libs/auth/src/session/session-crypto.ts
 function getSigningSecret(config) {
-  const secret = config?.secret || getEnv("MCP_SESSION_SECRET");
+  const secret = config?.secret || getEnv2("MCP_SESSION_SECRET");
   if (!secret) {
     if (isProduction2()) {
       throw new SessionSecretRequiredError("session signing");
@@ -2202,10 +3120,10 @@ function resolveConfig(config) {
   return { secret: getSigningSecret(config) };
 }
 function signSession(session, config) {
-  return signData(session, resolveConfig(config));
+  return signData2(session, resolveConfig(config));
 }
 function verifySession(signedData, config) {
-  return verifyData(signedData, resolveConfig(config));
+  return verifyData2(signedData, resolveConfig(config));
 }
 function verifyOrParseSession(data, config) {
   return verifyOrParseData(data, resolveConfig(config));
@@ -2327,7 +3245,7 @@ var SessionRateLimiter = class {
 var defaultSessionRateLimiter = new SessionRateLimiter();
 
 // libs/auth/src/session/session.transport.ts
-import { randomUUID as randomUUID2 } from "@frontmcp/utils";
+import { randomUUID as randomUUID3 } from "@frontmcp/utils";
 var TransportIdGenerator = class {
   /**
    * Create a transport session ID.
@@ -2336,7 +3254,7 @@ var TransportIdGenerator = class {
    * @returns A transport session ID (UUID without dashes)
    */
   static createId() {
-    return randomUUID2().replace(/-/g, "");
+    return randomUUID3().replace(/-/g, "");
   }
 };
 
@@ -2426,11 +3344,11 @@ function extractBearerToken(header) {
 }
 
 // libs/auth/src/session/utils/session-crypto.utils.ts
-import { decryptValue, encryptValue, getEnv as getEnv2, getMachineId, isProduction as isProduction3, sha256 } from "@frontmcp/utils";
+import { decryptValue, encryptValue, getEnv as getEnv3, getMachineId, isProduction as isProduction3, sha256 } from "@frontmcp/utils";
 var cachedKey = null;
 function getKey() {
   if (cachedKey) return cachedKey;
-  const secret = getEnv2("MCP_SESSION_SECRET");
+  const secret = getEnv3("MCP_SESSION_SECRET");
   if (!secret) {
     if (isProduction3()) {
       throw new SessionSecretRequiredError("session ID encryption");
@@ -2468,11 +3386,11 @@ function resetCachedKey() {
 }
 
 // libs/auth/src/session/storage/index.ts
-import { TypedStorage as TypedStorage3 } from "@frontmcp/utils";
+import { TypedStorage as TypedStorage4 } from "@frontmcp/utils";
 import { EncryptedTypedStorage, EncryptedStorageError } from "@frontmcp/utils";
 
 // libs/auth/src/session/storage/storage-token-store.ts
-import { randomUUID as randomUUID3, TypedStorage } from "@frontmcp/utils";
+import { randomUUID as randomUUID4, TypedStorage as TypedStorage2 } from "@frontmcp/utils";
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -2484,13 +3402,13 @@ var StorageTokenStore = class {
     this.defaultTtlSeconds = options.defaultTtlSeconds;
     this.storageIsNamespaced = "namespace" in storage && typeof storage.namespace === "function";
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new TypedStorage(namespacedStorage);
+    this.storage = new TypedStorage2(namespacedStorage);
   }
   /**
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return randomUUID3();
+    return randomUUID4();
   }
   /**
    * Store an encrypted token blob.
@@ -2553,7 +3471,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-import { randomUUID as randomUUID4, TypedStorage as TypedStorage2 } from "@frontmcp/utils";
+import { randomUUID as randomUUID5, TypedStorage as TypedStorage3 } from "@frontmcp/utils";
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -2562,7 +3480,7 @@ var StorageAuthorizationVault = class {
     this.namespace = options.namespace ?? "vault";
     this.pendingAuthTtlMs = options.pendingAuthTtlMs ?? 10 * 60 * 1e3;
     const namespacedStorage = this.isNamespacedStorage(storage) ? storage.namespace(this.namespace) : storage;
-    this.storage = new TypedStorage2(namespacedStorage, {
+    this.storage = new TypedStorage3(namespacedStorage, {
       schema: options.validateOnRead ? authorizationVaultEntrySchema : void 0,
       throwOnInvalid: false
     });
@@ -2573,7 +3491,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: randomUUID4(),
+      id: randomUUID5(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -2647,7 +3565,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: randomUUID4(),
+      id: randomUUID5(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -2851,11 +3769,11 @@ var StorageAuthorizationVault = class {
 };
 
 // libs/auth/src/session/storage/in-memory-authorization-vault.ts
-import { MemoryStorageAdapter } from "@frontmcp/utils";
+import { MemoryStorageAdapter as MemoryStorageAdapter3 } from "@frontmcp/utils";
 var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
   memoryAdapter;
   constructor(options = {}) {
-    const memoryAdapter = new MemoryStorageAdapter();
+    const memoryAdapter = new MemoryStorageAdapter3();
     super(memoryAdapter, {
       namespace: options.namespace ?? "vault",
       pendingAuthTtlMs: options.pendingAuthTtlMs
@@ -2876,7 +3794,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-import { randomUUID as randomUUID5, RedisStorageAdapter } from "@frontmcp/utils";
+import { randomUUID as randomUUID6, RedisStorageAdapter as RedisStorageAdapter2 } from "@frontmcp/utils";
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -2898,14 +3816,14 @@ var RedisSessionStore = class {
       });
     }
     if ("redis" in config && config.redis) {
-      this.storage = new RedisStorageAdapter({
+      this.storage = new RedisStorageAdapter2({
         client: config.redis,
         keyPrefix: this.keyPrefix
       });
       this.externalInstance = true;
     } else {
       const redisConfig = config;
-      this.storage = new RedisStorageAdapter({
+      this.storage = new RedisStorageAdapter2({
         config: {
           host: redisConfig.host,
           port: redisConfig.port ?? 6379,
@@ -3087,7 +4005,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return randomUUID5();
+    return randomUUID6();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -3123,7 +4041,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-import { randomUUID as randomUUID6, VercelKvStorageAdapter } from "@frontmcp/utils";
+import { randomUUID as randomUUID7, VercelKvStorageAdapter } from "@frontmcp/utils";
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -3317,7 +4235,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return randomUUID6();
+    return randomUUID7();
   }
   /**
    * Disconnect from Vercel KV
@@ -3616,8 +4534,214 @@ var InMemoryOrchestratedTokenStore = class {
   }
 };
 
+// libs/auth/src/session/orchestrated-token.crypto.ts
+import { decryptAesGcm as decryptAesGcm4, encryptAesGcm as encryptAesGcm4, hkdfSha256 as hkdfSha2563, randomBytes as randomBytes6 } from "@frontmcp/utils";
+var HKDF_SALT = new TextEncoder().encode("frontmcp-token-store");
+function deriveKeyForRecord(masterKey, compositeKey, cache) {
+  const cached = cache.get(compositeKey);
+  if (cached) {
+    return cached;
+  }
+  const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
+  const derived = hkdfSha2563(masterKey, HKDF_SALT, info, 32);
+  cache.set(compositeKey, derived);
+  return derived;
+}
+function encryptRecord(key, record) {
+  const plaintext = JSON.stringify(record);
+  const iv = randomBytes6(12);
+  const { ciphertext, tag } = encryptAesGcm4(key, new TextEncoder().encode(plaintext), iv);
+  return JSON.stringify({
+    iv: Buffer.from(iv).toString("base64url"),
+    tag: Buffer.from(tag).toString("base64url"),
+    data: Buffer.from(ciphertext).toString("base64url")
+  });
+}
+function decryptRecord(key, encrypted) {
+  const { iv, tag, data } = JSON.parse(encrypted);
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag, "base64url");
+  const ciphertextBytes = Buffer.from(data, "base64url");
+  const plaintext = decryptAesGcm4(key, ciphertextBytes, ivBytes, tagBytes);
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+
+// libs/auth/src/session/storage-orchestrated-token.store.ts
+var StorageOrchestratedTokenStore = class {
+  storage;
+  encryptionKey;
+  defaultTtlMs;
+  namespace;
+  storageIsNamespaced;
+  /** HKDF-derived subkey cache, keyed by composite key. */
+  derivedKeys = /* @__PURE__ */ new Map();
+  constructor(storage, options = {}) {
+    this.encryptionKey = options.encryptionKey;
+    this.defaultTtlMs = options.defaultTtlMs;
+    this.namespace = options.namespace ?? "otok";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    this.storage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+  }
+  // ============================================
+  // TokenStore interface
+  // ============================================
+  async getAccessToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record?.accessToken ?? null;
+  }
+  async getRefreshToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record?.refreshToken ?? null;
+  }
+  async storeTokens(authorizationId, providerId, tokens) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    const now = Date.now();
+    const record = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt ?? (this.defaultTtlMs ? now + this.defaultTtlMs : void 0),
+      createdAt: now,
+      updatedAt: now
+    };
+    const value = this.encryptionKey ? encryptRecord(this.keyFor(compositeKey), record) : JSON.stringify(record);
+    await this.storage.set(this.storageKey(compositeKey), value, this.ttlOptions(record.expiresAt));
+  }
+  async deleteTokens(authorizationId, providerId) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    await this.storage.delete(this.storageKey(compositeKey));
+    this.derivedKeys.delete(compositeKey);
+  }
+  async hasTokens(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record !== null;
+  }
+  async getProviderIds(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    const providerIds = [];
+    for (const compositeKey of compositeKeys) {
+      if (!compositeKey.startsWith(prefix)) continue;
+      const providerId = compositeKey.slice(prefix.length);
+      const record = await this.getRecord(authorizationId, providerId);
+      if (record) {
+        providerIds.push(providerId);
+      }
+    }
+    return providerIds;
+  }
+  async migrateTokens(fromAuthId, toAuthId) {
+    const prefix = `${fromAuthId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    for (const oldComposite of compositeKeys) {
+      if (!oldComposite.startsWith(prefix)) continue;
+      const providerId = oldComposite.slice(prefix.length);
+      const newComposite = this.compositeKey(toAuthId, providerId);
+      const stored = await this.storage.get(this.storageKey(oldComposite));
+      if (stored === null) continue;
+      if (this.encryptionKey) {
+        let record;
+        try {
+          record = decryptRecord(this.keyFor(oldComposite), stored);
+        } catch {
+          continue;
+        }
+        const value = encryptRecord(this.keyFor(newComposite), record);
+        await this.storage.set(this.storageKey(newComposite), value, this.ttlOptions(record.expiresAt));
+      } else {
+        let expiresAt;
+        try {
+          expiresAt = JSON.parse(stored).expiresAt;
+        } catch {
+          expiresAt = void 0;
+        }
+        await this.storage.set(this.storageKey(newComposite), stored, this.ttlOptions(expiresAt));
+      }
+      await this.storage.delete(this.storageKey(oldComposite));
+      this.derivedKeys.delete(oldComposite);
+    }
+  }
+  /**
+   * Delete all tokens for an authorization id.
+   */
+  async deleteAllForAuthorization(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    for (const compositeKey of compositeKeys) {
+      if (!compositeKey.startsWith(prefix)) continue;
+      await this.storage.delete(this.storageKey(compositeKey));
+      this.derivedKeys.delete(compositeKey);
+    }
+  }
+  // ============================================
+  // Internals
+  // ============================================
+  async getRecord(authorizationId, providerId) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    const stored = await this.storage.get(this.storageKey(compositeKey));
+    if (stored === null) {
+      return null;
+    }
+    let record;
+    if (this.encryptionKey) {
+      try {
+        record = decryptRecord(this.keyFor(compositeKey), stored);
+      } catch {
+        await this.storage.delete(this.storageKey(compositeKey));
+        return null;
+      }
+    } else {
+      try {
+        record = JSON.parse(stored);
+      } catch {
+        await this.storage.delete(this.storageKey(compositeKey));
+        return null;
+      }
+    }
+    if (record.expiresAt && record.expiresAt < Date.now()) {
+      await this.storage.delete(this.storageKey(compositeKey));
+      return null;
+    }
+    return record;
+  }
+  keyFor(compositeKey) {
+    if (!this.encryptionKey) {
+      throw new EncryptionKeyNotConfiguredError();
+    }
+    return deriveKeyForRecord(this.encryptionKey, compositeKey, this.derivedKeys);
+  }
+  compositeKey(authorizationId, providerId) {
+    return `${authorizationId}:${providerId}`;
+  }
+  storageKey(compositeKey) {
+    return this.storageIsNamespaced ? compositeKey : `${this.namespace}:${compositeKey}`;
+  }
+  /**
+   * List composite keys (authorizationId:providerId) matching a glob over the
+   * composite-key space, stripping any non-namespaced prefix we added.
+   */
+  async listCompositeKeys(compositeGlob) {
+    const pattern = this.storageIsNamespaced ? compositeGlob : `${this.namespace}:${compositeGlob}`;
+    const raw = await this.storage.keys(pattern);
+    if (this.storageIsNamespaced) {
+      return raw;
+    }
+    const stripPrefix = `${this.namespace}:`;
+    return raw.map((k) => k.startsWith(stripPrefix) ? k.slice(stripPrefix.length) : k);
+  }
+  ttlOptions(expiresAtMs) {
+    if (!expiresAtMs) {
+      return void 0;
+    }
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return { ttlSeconds: ttl > 0 ? ttl : 1 };
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
 // libs/auth/src/session/federated-auth.session.ts
-import { randomUUID as randomUUID7 } from "@frontmcp/utils";
+import { randomUUID as randomUUID8 } from "@frontmcp/utils";
 function toSessionRecord(session) {
   return {
     ...session,
@@ -3692,7 +4816,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: randomUUID7(),
+      id: randomUUID8(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -3724,7 +4848,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: randomUUID7(),
+    id: randomUUID8(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -3780,9 +4904,119 @@ function startNextProvider(session, pkce, state) {
   return providerId;
 }
 
+// libs/auth/src/session/storage-federated-auth.session.ts
+import { TypedStorage as TypedStorage5 } from "@frontmcp/utils";
+var StorageFederatedAuthSessionStore = class {
+  storage;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "fed";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new TypedStorage5(namespacedStorage);
+  }
+  async store(session) {
+    await this.put(session);
+  }
+  async update(session) {
+    await this.put(session);
+  }
+  async get(id) {
+    const record = await this.storage.get(this.key(id));
+    if (!record) {
+      return null;
+    }
+    if (Date.now() > record.expiresAt) {
+      await this.storage.delete(this.key(id));
+      return null;
+    }
+    return fromSessionRecord(record);
+  }
+  async delete(id) {
+    await this.storage.delete(this.key(id));
+  }
+  async put(session) {
+    const record = toSessionRecord(session);
+    const ttlSeconds = this.calculateTtl(record.expiresAt);
+    await this.storage.set(this.key(session.id), record, ttlSeconds ? { ttlSeconds } : void 0);
+  }
+  calculateTtl(expiresAtMs) {
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return ttl > 0 ? ttl : 1;
+  }
+  key(id) {
+    return this.storageIsNamespaced ? id : `${this.namespace}:${id}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
+// libs/auth/src/session/consent.store.ts
+function consentRecordKey(userSub, clientId) {
+  return `consent:${userSub}:${clientId}`;
+}
+var InMemoryConsentStore = class {
+  records = /* @__PURE__ */ new Map();
+  async get(userSub, clientId) {
+    const record = this.records.get(consentRecordKey(userSub, clientId));
+    if (!record) return null;
+    return { ...record, selectedToolIds: [...record.selectedToolIds], seenToolIds: [...record.seenToolIds] };
+  }
+  async set(record) {
+    this.records.set(consentRecordKey(record.userSub, record.clientId), {
+      ...record,
+      selectedToolIds: [...record.selectedToolIds],
+      seenToolIds: [...record.seenToolIds]
+    });
+  }
+  async delete(userSub, clientId) {
+    this.records.delete(consentRecordKey(userSub, clientId));
+  }
+  /** Number of remembered records (for testing/monitoring). */
+  get size() {
+    return this.records.size;
+  }
+  /** Clear all remembered records (for testing). */
+  clear() {
+    this.records.clear();
+  }
+};
+
+// libs/auth/src/session/storage-consent.store.ts
+import { TypedStorage as TypedStorage6 } from "@frontmcp/utils";
+var StorageConsentStore = class {
+  storage;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "remembered-consent";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new TypedStorage6(namespacedStorage);
+  }
+  async get(userSub, clientId) {
+    return this.storage.get(this.key(userSub, clientId));
+  }
+  async set(record) {
+    await this.storage.set(this.key(record.userSub, record.clientId), record);
+  }
+  async delete(userSub, clientId) {
+    await this.storage.delete(this.key(userSub, clientId));
+  }
+  key(userSub, clientId) {
+    const base = consentRecordKey(userSub, clientId);
+    return this.storageIsNamespaced ? base : `${this.namespace}:${base}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
 // libs/auth/src/session/encrypted-authorization-vault.ts
 import { z as z5 } from "@frontmcp/lazy-zod";
-import { AsyncLocalStorage, randomUUID as randomUUID8 } from "@frontmcp/utils";
+import { AsyncLocalStorage, randomUUID as randomUUID9 } from "@frontmcp/utils";
 var redisVaultEntrySchema = z5.object({
   /** Vault ID */
   id: z5.string(),
@@ -3940,7 +5174,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: randomUUID8(),
+      id: randomUUID9(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -3999,7 +5233,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: randomUUID8(),
+      id: randomUUID9(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4262,7 +5496,7 @@ var progressiveAuthStateSchema = z6.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-import { base64urlDecode as base64urlDecode4, getMachineId as getMachineId2, randomUUID as randomUUID9 } from "@frontmcp/utils";
+import { base64urlDecode as base64urlDecode4, getMachineId as getMachineId2, randomUUID as randomUUID10 } from "@frontmcp/utils";
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -4310,7 +5544,7 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = randomUUID9();
+    const sessionId = randomUUID10();
     const session = {
       id: sessionId,
       authorizationId: this.id,
@@ -4499,7 +5733,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-import { randomUUID as randomUUID10 } from "@frontmcp/utils";
+import { randomUUID as randomUUID11 } from "@frontmcp/utils";
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -4535,7 +5769,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = randomUUID10();
+    const uuid = randomUUID11();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -4619,7 +5853,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
 };
 
 // libs/auth/src/authorization/transparent.authorization.ts
-import { sha256Hex } from "@frontmcp/utils";
+import { sha256Hex as sha256Hex2 } from "@frontmcp/utils";
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**
@@ -4719,7 +5953,7 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
   static generateAuthorizationId(token) {
     const parts = token.split(".");
     const signature = parts[2] || token;
-    return sha256Hex(signature).substring(0, 16);
+    return sha256Hex2(signature).substring(0, 16);
   }
   /**
    * Get the issuer from the token claims
@@ -4745,11 +5979,11 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
 };
 
 // libs/auth/src/utils/authorization-id.utils.ts
-import { sha256Hex as sha256Hex2 } from "@frontmcp/utils";
+import { sha256Hex as sha256Hex3 } from "@frontmcp/utils";
 function deriveAuthorizationId(token) {
   const parts = token.split(".");
   const signature = parts[2] || token;
-  return sha256Hex2(signature).substring(0, 16);
+  return sha256Hex3(signature).substring(0, 16);
 }
 
 // libs/auth/src/authorization/orchestrated.authorization.ts
@@ -5116,6 +6350,103 @@ var OrchestratedAuthAccessorAdapter = class {
   }
 };
 
+// libs/auth/src/authorization/dcr-client.registry.ts
+import { sha256 as sha2562, timingSafeEqual } from "@frontmcp/utils";
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, (ch) => ch === "*" ? "\0" : `\\${ch}`);
+  const withWildcards = escaped.split("\0").join(".*");
+  return new RegExp(`^${withWildcards}$`);
+}
+var DcrClientRegistry = class {
+  constructor(config = {}) {
+    this.config = config;
+    this.redirectMatchers = config.allowedRedirectUris?.map(globToRegExp);
+    this.seedPreRegisteredClients();
+  }
+  clients = /* @__PURE__ */ new Map();
+  redirectMatchers;
+  /** Seed `dcr.clients` so the authorize/token flows accept them without DCR. */
+  seedPreRegisteredClients() {
+    const clients = this.config.clients ?? [];
+    const now = Math.floor(Date.now() / 1e3);
+    for (const c of clients) {
+      this.clients.set(c.clientId, {
+        client_id: c.clientId,
+        client_secret: c.clientSecret,
+        token_endpoint_auth_method: c.tokenEndpointAuthMethod ?? "none",
+        grant_types: c.grantTypes ?? ["authorization_code"],
+        response_types: c.responseTypes ?? ["code"],
+        redirect_uris: c.redirectUris,
+        client_name: c.clientName,
+        scope: c.scope,
+        created_at: now,
+        dev: false,
+        preRegistered: true
+      });
+    }
+  }
+  /** Look up a client by id (pre-registered or dynamically registered). */
+  get(clientId) {
+    return this.clients.get(clientId);
+  }
+  /** Whether a client id is known to the registry. */
+  has(clientId) {
+    return this.clients.has(clientId);
+  }
+  /** Add a dynamically-registered client (called by the register flow). */
+  register(client) {
+    this.clients.set(client.client_id, client);
+  }
+  /** Whether a redirect_uri allowlist is configured. */
+  hasRedirectAllowlist() {
+    return !!this.redirectMatchers && this.redirectMatchers.length > 0;
+  }
+  /**
+   * Whether `redirectUri` is permitted by the configured allowlist. Always
+   * `true` when no allowlist is configured (preserves default behavior).
+   */
+  isRedirectUriAllowed(redirectUri) {
+    if (!this.redirectMatchers || this.redirectMatchers.length === 0) {
+      return true;
+    }
+    return this.redirectMatchers.some((re) => re.test(redirectUri));
+  }
+  /** Whether a client-id allowlist is configured. */
+  hasClientIdAllowlist() {
+    return !!this.config.allowedClientIds && this.config.allowedClientIds.length > 0;
+  }
+  /**
+   * Whether `clientId` is permitted by the configured client-id allowlist.
+   * Always `true` when no allowlist is configured (preserves default behavior).
+   */
+  isClientIdAllowed(clientId) {
+    const allow = this.config.allowedClientIds;
+    if (!allow || allow.length === 0) {
+      return true;
+    }
+    return allow.includes(clientId);
+  }
+  /** Whether an initial access token is required for DCR registration. */
+  requiresInitialAccessToken() {
+    return typeof this.config.initialAccessToken === "string" && this.config.initialAccessToken.length > 0;
+  }
+  /**
+   * Constant-time check of a presented bearer token against the configured
+   * initial access token. Returns `false` when none is configured (callers
+   * should gate on {@link requiresInitialAccessToken} first).
+   */
+  verifyInitialAccessToken(presented) {
+    const expected = this.config.initialAccessToken;
+    if (!expected) {
+      return false;
+    }
+    if (typeof presented !== "string" || presented.length === 0) {
+      return false;
+    }
+    return timingSafeEqual(sha2562(presented), sha2562(expected));
+  }
+};
+
 // libs/auth/src/common/jwt.types.ts
 import { z as z7 } from "@frontmcp/lazy-zod";
 var jwkParametersSchema = z7.object({
@@ -6063,10 +7394,15 @@ var CimdService = class {
     }
   }
 };
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "[::1]", "localhost"]);
+function isLoopbackHostname(hostname) {
+  return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
+}
 function normalizeRedirectUri(uri) {
   try {
     const url = new URL(uri);
-    let normalized = `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}`;
+    const host = isLoopbackHostname(url.hostname) ? url.hostname.toLowerCase() : url.host.toLowerCase();
+    let normalized = `${url.protocol.toLowerCase()}//${host}`;
     normalized += url.pathname.replace(/\/+$/, "") || "/";
     if (url.search) normalized += url.search;
     return normalized;
@@ -6197,6 +7533,105 @@ var remoteProviderConfigSchema = z10.object({
    */
   userInfoEndpoint: z10.string().url().optional()
 });
+var upstreamProviderSchema = z10.object({
+  /** Stable provider id (e.g. `'github'`). Used in `this.orchestration.getToken(id)`. */
+  id: z10.string().min(1),
+  /** Human-readable display name. Defaults to `id` when omitted. */
+  name: z10.string().optional(),
+  /** Authorization endpoint (canonical name). */
+  authorizationEndpoint: z10.string().url().optional(),
+  /** Authorization endpoint (alias for {@link authorizationEndpoint}). */
+  authorizeUrl: z10.string().url().optional(),
+  /** Token endpoint (canonical name). */
+  tokenEndpoint: z10.string().url().optional(),
+  /** Token endpoint (alias for {@link tokenEndpoint}). */
+  tokenUrl: z10.string().url().optional(),
+  /** OAuth client id issued by the upstream provider. */
+  clientId: z10.string().min(1),
+  /** OAuth client secret (confidential clients). */
+  clientSecret: z10.string().optional(),
+  /** Scopes to request from the upstream provider. */
+  scopes: z10.array(z10.string()).optional(),
+  /** User info endpoint (optional, used to enrich the session identity). */
+  userInfoEndpoint: z10.string().url().optional(),
+  /** JWKS URI for upstream id_token validation (optional). */
+  jwksUri: z10.string().url().optional()
+}).refine((p) => !!(p.authorizationEndpoint ?? p.authorizeUrl), {
+  message: "authorizationEndpoint (or authorizeUrl) is required",
+  path: ["authorizationEndpoint"]
+}).refine((p) => !!(p.tokenEndpoint ?? p.tokenUrl), {
+  message: "tokenEndpoint (or tokenUrl) is required",
+  path: ["tokenEndpoint"]
+}).refine((p) => !(p.authorizationEndpoint && p.authorizeUrl), {
+  message: "provide only one of authorizationEndpoint or authorizeUrl",
+  path: ["authorizationEndpoint"]
+}).refine((p) => !(p.tokenEndpoint && p.tokenUrl), {
+  message: "provide only one of tokenEndpoint or tokenUrl",
+  path: ["tokenEndpoint"]
+});
+var localDcrClientSchema = z10.object({
+  /** Stable, pre-assigned client identifier the client authenticates with. */
+  clientId: z10.string().min(1),
+  /**
+   * Confidential-client secret. Omit for public clients
+   * (`token_endpoint_auth_method: 'none'`, the default).
+   */
+  clientSecret: z10.string().min(1).optional(),
+  /** Exact redirect URIs this client is allowed to use (at least one). */
+  redirectUris: z10.array(z10.string().url()).min(1, "At least one redirect_uri is required"),
+  /** Human-readable name shown on consent/login screens. */
+  clientName: z10.string().optional(),
+  /**
+   * Token-endpoint auth method. Defaults to `'none'` (public PKCE client).
+   */
+  tokenEndpointAuthMethod: z10.enum(["none", "client_secret_basic", "client_secret_post"]).default("none"),
+  /** Allowed grant types. Defaults to `['authorization_code']`. */
+  grantTypes: z10.array(z10.enum(["authorization_code", "refresh_token"])).default(["authorization_code"]),
+  /** Allowed response types. Defaults to `['code']`. */
+  responseTypes: z10.array(z10.enum(["code"])).default(["code"]),
+  /** Optional space-delimited default scope string. */
+  scope: z10.string().optional()
+});
+var localDcrConfigSchema = z10.object({
+  /**
+   * Whether `POST /oauth/register` is mounted/active and whether
+   * `registration_endpoint` is advertised in AS metadata.
+   *
+   * When unset (default), the historical guard applies: enabled in
+   * development, disabled in production. Set explicitly to force it on or off
+   * regardless of `NODE_ENV`.
+   */
+  enabled: z10.boolean().optional(),
+  /**
+   * Allowlist of redirect URIs. Each entry is matched EXACTLY or as a simple
+   * glob (`*` matches any run of characters). When set, both DCR registrations
+   * and `/oauth/authorize` requests are rejected unless their `redirect_uri`
+   * matches an entry. When unset, no redirect_uri allowlist is enforced.
+   */
+  allowedRedirectUris: z10.array(z10.string().min(1)).optional(),
+  /**
+   * Allowlist of client ids. When set, only these `client_id`s may register
+   * (DCR registrations are forced to one of these ids) or be used at
+   * `/oauth/authorize`. When unset, any client id is accepted (subject to the
+   * other checks). CIMD URL client ids are validated by the CIMD layer and are
+   * exempt from this allowlist.
+   */
+  allowedClientIds: z10.array(z10.string().min(1)).optional(),
+  /**
+   * Initial Access Token (RFC 7591 §3). When set, `POST /oauth/register`
+   * requires an `Authorization: Bearer <token>` header that matches this value
+   * (constant-time compared); requests without it (or with a wrong value) are
+   * rejected `401 invalid_token`. When unset, registration is unauthenticated
+   * (the historical behavior).
+   */
+  initialAccessToken: z10.string().min(1).optional(),
+  /**
+   * Pre-registered trusted clients seeded into the registry at startup. These
+   * are accepted by the authorize/token flows WITHOUT a DCR round-trip, which
+   * lets you disable DCR entirely while still shipping known clients.
+   */
+  clients: z10.array(localDcrClientSchema).optional()
+});
 var flatRemoteProviderFields = {
   /**
    * OAuth provider base URL (required)
@@ -6212,7 +7647,64 @@ var flatRemoteProviderFields = {
   /** Advanced provider configuration */
   providerConfig: providerConfigSchema.optional()
 };
-var tokenStorageConfigSchema = z10.union([z10.literal("memory"), z10.object({ redis: redisConfigSchema })]);
+var tokenStorageSqliteSchema = z10.object({
+  /** Path to the `.sqlite` database file used for auth persistence. */
+  path: z10.string().min(1),
+  /**
+   * Encryption configuration for at-rest encryption of stored values.
+   * Independent of the AES-GCM blob encryption already applied to upstream
+   * provider tokens by the orchestrated-token store.
+   */
+  encryption: z10.object({
+    secret: z10.string().min(1)
+  }).optional(),
+  /**
+   * Interval in milliseconds for purging expired keys.
+   * @default 60000
+   */
+  ttlCleanupIntervalMs: z10.number().int().nonnegative().optional(),
+  /**
+   * Enable WAL mode for better read concurrency.
+   * @default true
+   */
+  walMode: z10.boolean().optional()
+});
+var tokenStorageConfigSchema = z10.union([
+  z10.literal("memory"),
+  z10.object({ redis: redisConfigSchema }),
+  z10.object({ sqlite: tokenStorageSqliteSchema })
+]);
+var secureStoreScopeSchema = z10.enum(["user", "session", "global"]);
+var secureStoreEncryptionSchema = z10.object({
+  /**
+   * Server pepper mixed into HKDF key derivation (defense-in-depth). Defaults to
+   * `VAULT_SECRET ?? JWT_SECRET` at runtime when omitted.
+   */
+  pepper: z10.string().min(1).optional()
+});
+var secureStoreCustomBackendSchema = z10.custom(
+  (v) => typeof v === "object" && v !== null && typeof v.get === "function" && typeof v.set === "function" && typeof v.delete === "function" && typeof v.list === "function",
+  { message: "secureStore.backend must implement get/set/delete/list (SecureStoreBackend)" }
+);
+var secureStoreCommonFields = {
+  /** Namespace scope. @default 'user' */
+  scope: secureStoreScopeSchema.optional(),
+  /** Default TTL (ms) for stored secrets. @default undefined (no expiry) */
+  ttlMs: z10.number().int().positive().optional(),
+  /** At-rest encryption settings (built-in backings only). */
+  encryption: secureStoreEncryptionSchema.optional()
+};
+var secureStoreConfigSchema = z10.union([
+  z10.literal("memory"),
+  // Backing-bearing variants MUST precede the bare-object variant: Zod object
+  // schemas are non-strict (extra keys allowed), so a bare `z.object({ scope })`
+  // would otherwise match `{ sqlite, scope }` first and silently strip the
+  // backing. Ordering most-specific-first keeps sqlite/redis/custom intact.
+  z10.object({ sqlite: tokenStorageSqliteSchema, ...secureStoreCommonFields }),
+  z10.object({ redis: redisConfigSchema, ...secureStoreCommonFields }),
+  z10.object({ backend: secureStoreCustomBackendSchema, ...secureStoreCommonFields }),
+  z10.object({ ...secureStoreCommonFields })
+]);
 var tokenRefreshConfigSchema = z10.object({
   /**
    * Enable automatic token refresh
@@ -6279,7 +7771,22 @@ var federatedAuthConfigSchema = z10.object({
    * - 'format': validate only "federated:{sessionId}:{nonce}" format
    * @default 'strict'
    */
-  stateValidation: z10.enum(["strict", "format"]).default("strict")
+  stateValidation: z10.enum(["strict", "format"]).default("strict"),
+  /**
+   * Minimum number of upstream providers a user must link before a FrontMCP JWT
+   * is minted. The federated callback refuses to issue a token until at least
+   * this many providers have been authorized. Defaults to `1` at runtime when
+   * `providers` are configured (i.e. "no JWT until ≥1 linked"). Left optional
+   * here so existing configs without `providers` are completely unaffected.
+   */
+  minProviders: z10.number().int().positive().optional(),
+  /**
+   * Provider ids that MUST be among the linked providers before a JWT is minted.
+   * The federated callback rejects the login unless every id listed here is in
+   * the user's selected providers. Optional — omit to allow any combination that
+   * satisfies {@link minProviders}.
+   */
+  requiredProviders: z10.array(z10.string()).optional()
 });
 var incrementalAuthConfigSchema = z10.object({
   /**
@@ -6380,9 +7887,19 @@ var transparentAuthOptionsSchema = z12.object({
 
 // libs/auth/src/options/orchestrated.schema.ts
 import { z as z13 } from "@frontmcp/lazy-zod";
+var authSlotSchema = z13.enum(["login", "consent", "incremental", "federated", "error"]);
+var authUiMapSchema = z13.partialRecord(authSlotSchema, z13.string().min(1));
+var authExtraHandlerSchema = z13.custom((v) => typeof v === "function", {
+  message: "auth.extras entries must be handler functions (input, ctx) => AuthExtraResult."
+});
+var authExtrasMapSchema = z13.record(z13.string().min(1), authExtraHandlerSchema);
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
+  // #470 — backing for the general session secure-secret store (`this.secureStore`).
+  // Optional (no default) so an unset value resolves to the in-memory encrypted
+  // default at runtime; existing configs are unaffected.
+  secureStore: secureStoreConfigSchema.optional(),
   allowDefaultPublic: z13.boolean().default(false),
   anonymousScopes: z13.array(z13.string()).default(["anonymous"]),
   publicAccess: publicAccessConfigSchema.optional(),
@@ -6391,11 +7908,59 @@ var sharedAuthFields = {
   refresh: tokenRefreshConfigSchema.optional(),
   expectedAudience: z13.union([z13.string(), z13.array(z13.string())]).optional(),
   incrementalAuth: incrementalAuthConfigSchema.optional(),
-  cimd: cimdConfigSchema.optional()
+  cimd: cimdConfigSchema.optional(),
+  // #469 — custom auth UI as a slot→file map + extras name→handler map (per-app
+  // under splitByApp). Both optional; omitting them serves the built-in pages.
+  ui: authUiMapSchema.optional(),
+  extras: authExtrasMapSchema.optional()
 };
+var loginFieldSchema = z13.object({
+  type: z13.enum(["text", "password", "email", "select", "hidden"]),
+  label: z13.string().optional(),
+  required: z13.boolean().optional(),
+  placeholder: z13.string().optional(),
+  options: z13.array(z13.object({ value: z13.string(), label: z13.string() })).optional()
+});
+var loginConfigSchema = z13.object({
+  title: z13.string().optional(),
+  subtitle: z13.string().optional(),
+  logoUri: z13.string().optional(),
+  fields: z13.record(z13.string(), loginFieldSchema).optional(),
+  // Full HTML override — a function, validated structurally like other callbacks
+  // in the codebase (see http/cors handlers using z.custom<…>).
+  render: z13.custom((v) => typeof v === "function", {
+    message: "login.render must be a function"
+  }).optional(),
+  subject: z13.object({
+    fromField: z13.string().optional(),
+    strategy: z13.enum(["per-session", "per-account"]).optional()
+  }).optional()
+});
+var authenticateFnSchema = z13.custom((v) => typeof v === "function", {
+  message: "authenticate must be a function"
+});
 var localAuthSchema = z13.object({
   mode: z13.literal("local"),
-  ...sharedAuthFields
+  ...sharedAuthFields,
+  // #468 — opt-out of the email requirement at /oauth/callback for
+  // single-operator local setups. Defaults preserve the historical behavior
+  // (email required) so existing configs are unaffected.
+  requireEmail: z13.boolean().default(true),
+  anonymousSubject: z13.string().min(1).default("local-operator"),
+  // Checkpoint 3a — declarative login customization + custom verification.
+  // Both optional; omitting them preserves the default login path exactly.
+  login: loginConfigSchema.optional(),
+  authenticate: authenticateFnSchema.optional(),
+  // Multi-OAuth-provider orchestration — declare upstream providers (GitHub,
+  // Slack, Jira, …) to federate at /oauth/authorize. Optional; omitting it
+  // preserves the default single-operator local login exactly.
+  providers: z13.array(upstreamProviderSchema).optional(),
+  // Local-AS Dynamic Client Registration control surface (#462) — gate
+  // `POST /oauth/register`, allowlist redirect_uris/client_ids, require an
+  // initial access token, and seed pre-registered trusted clients. Optional;
+  // omitting it preserves today's behavior exactly (DCR on in dev, off in prod;
+  // no allowlist; no initial access token).
+  dcr: localDcrConfigSchema.optional()
 });
 var remoteAuthSchema = z13.object({
   mode: z13.literal("remote"),
@@ -8936,6 +10501,7 @@ export {
   AuthorityDeniedError,
   AuthorizationBase,
   CDN,
+  CREDENTIALS_ACCESSOR,
   CimdClientIdMismatchError,
   CimdDisabledError,
   CimdError,
@@ -8947,11 +10513,15 @@ export {
   CredentialCache,
   CredentialProviderAlreadyRegisteredError,
   CredentialStorageError,
+  CredentialsAccessorImpl,
+  DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME,
+  DcrClientRegistry,
   EagerCredentialLoader,
   ElicitationSecretRequiredError,
   EncryptedRedisVault,
   EncryptedStorageError,
+  EncryptedStorageSecureStoreBackend,
   EncryptedTypedStorage,
   EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError,
@@ -8960,6 +10530,7 @@ export {
   InMemoryAuthorizationStore,
   InMemoryAuthorizationVault,
   InMemoryCimdCache,
+  InMemoryConsentStore,
   InMemoryFederatedAuthSessionStore,
   InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError,
@@ -8977,11 +10548,18 @@ export {
   RedirectUriMismatchError,
   RedisAuthorizationStore,
   RedisSessionStore,
+  SECURE_STORE_ACCESSOR,
   ScopeDeniedError,
+  SecureStoreAccessorImpl,
+  SessionCredentialVault,
   SessionIdEmptyError,
   SessionRateLimiter,
   SessionSecretRequiredError,
+  StorageAuthorizationStore,
   StorageAuthorizationVault,
+  StorageConsentStore,
+  StorageFederatedAuthSessionStore,
+  StorageOrchestratedTokenStore,
   StorageTokenStore,
   TinyTtlCache,
   TokenLeakDetectedError,
@@ -8990,7 +10568,7 @@ export {
   TokenVault,
   TransparentAuthorization,
   TransportIdGenerator,
-  TypedStorage3 as TypedStorage,
+  TypedStorage4 as TypedStorage,
   VaultEncryption,
   VaultLoadError,
   VaultNotFoundError,
@@ -9013,6 +10591,7 @@ export {
   authProviderMappingSchema,
   authProvidersVaultOptionsSchema,
   authUserSchema,
+  authenticateFnSchema,
   authoritiesClaimsMappingSchema,
   authoritiesConfigSchema,
   authoritiesMetadataSchema,
@@ -9027,7 +10606,11 @@ export {
   bearerApplier,
   bearerCredentialSchema,
   buildAuthContext,
+  buildCodeRecord,
+  buildConnectPage,
+  buildConnectSuccessPage,
   buildConsentPage,
+  buildCredentialResumeUrl,
   buildErrorPage,
   buildFederatedLoginPage,
   buildIncrementalAuthPage,
@@ -9035,7 +10618,9 @@ export {
   buildInvalidRequestHeader,
   buildInvalidTokenHeader,
   buildLoginPage,
+  buildPendingRecord,
   buildPrmUrl,
+  buildRefreshTokenRecord,
   buildToolConsentPage,
   buildUnauthorizedHeader,
   buildWwwAuthenticate,
@@ -9048,6 +10633,7 @@ export {
   clientMetadataDocumentSchema,
   completeCurrentProvider,
   consentConfigSchema,
+  consentRecordKey,
   consentSelectionSchema,
   consentStateSchema,
   consentToolItemSchema,
@@ -9055,13 +10641,16 @@ export {
   createEncryptedVault,
   createFederatedAuthSession,
   createLayout,
+  createSecureStore,
+  createSessionCredentialVault,
+  createTokenStorageAdapter,
   credentialProviderConfigSchema,
   credentialSchema,
   credentialScopeSchema,
   credentialTypeSchema,
   customCredentialSchema,
   decodeJwtPayloadSafe,
-  decryptAesGcm4 as decryptAesGcm,
+  decryptAesGcm5 as decryptAesGcm,
   decryptSessionJson,
   decryptValue2 as decryptValue,
   defaultSessionRateLimiter,
@@ -9071,7 +10660,7 @@ export {
   deriveTypedUser,
   detectAuthProviders,
   detectedAuthProviderSchema,
-  encryptAesGcm4 as encryptAesGcm,
+  encryptAesGcm5 as encryptAesGcm,
   encryptJson,
   encryptValue2 as encryptValue,
   encryptedBlobSchema,
@@ -9088,7 +10677,9 @@ export {
   federatedSelectionSchema,
   flatRemoteProviderFields,
   fromSessionRecord,
+  generateAuthorizationCode,
   generatePkceChallenge,
+  generateRefreshTokenValue,
   getCredentialOptionsSchema,
   getKey,
   getNextProvider,
@@ -9097,7 +10688,7 @@ export {
   getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris,
   headerApplier,
-  hkdfSha2563 as hkdfSha256,
+  hkdfSha2564 as hkdfSha256,
   incrementalAuthConfigSchema,
   isCimdClientId,
   isFrontMcpCredentials,
@@ -9106,12 +10697,15 @@ export {
   isOrchestratedLocal,
   isOrchestratedMode,
   isOrchestratedRemote,
+  isPersistentTokenStorage,
   isPublicMode,
+  isRedisTokenStorage,
   isRemoteMode,
   isSessionComplete,
   isSignedData as isSignedSession,
   isSoonExpiring,
   isSoonExpiringProvider,
+  isSqliteTokenStorage,
   isTransparentMode,
   jsonWebKeySetSchema,
   jwkParametersSchema,
@@ -9120,7 +10714,10 @@ export {
   llmSafeAuthContextSchema,
   loadingStrategySchema,
   localAuthSchema,
+  localDcrClientSchema,
+  localDcrConfigSchema,
   localSigningConfigSchema,
+  loginConfigSchema,
   mtlsCredentialSchema,
   noopLogger,
   normalizeIssuer,
@@ -9146,14 +10743,20 @@ export {
   redisVaultEntrySchema,
   remoteAuthSchema,
   remoteProviderConfigSchema,
+  renderLocalLoginPage,
   renderToHtml,
   resetCachedKey,
   resolveRequiredScopes,
   resourceIdRefSchema,
   safeDecrypt,
+  secureStoreConfigSchema,
+  secureStoreCustomBackendSchema,
+  secureStoreEncryptionSchema,
+  secureStoreScopeSchema,
   serviceAccountCredentialSchema,
   sessionIdPayloadSchema,
   sessionJwtPayloadSchema,
+  signCredentialResumeToken,
   signSession,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,
@@ -9164,20 +10767,24 @@ export {
   storedSessionSchema,
   streamableHttpTransportStateSchema,
   toEpochSeconds,
+  toLoginExtraFields,
   toSessionRecord,
   tokenRefreshConfigSchema,
   tokenStorageConfigSchema,
+  tokenStorageSqliteSchema,
   transparentAuthOptionsSchema,
   transportProtocolSchema,
   transportSessionSchema,
   transportStateSchema,
   trimSlash,
   tryJwtExp,
+  upstreamProviderSchema,
   userClaimSchema,
   validateAudience,
   validateClientIdUrl,
   vaultConsentRecordSchema,
   vaultFederatedRecordSchema,
+  verifyCredentialResumeToken,
   verifyOrParseSession,
   verifyPkce,
   verifySession,