@frontmcp/auth 1.3.0 → 1.4.0

package/session/session-credential-vault.factory.d.ts

@@ -0,0 +1,50 @@
+/**
+ * SessionCredentialVault factory.
+ *
+ * Follows the CLAUDE.md storage-factory pattern: builds a connected
+ * {@link StorageAdapter} from the SAME `auth.tokenStorage` config that backs the
+ * authorization-code / token stores, then wraps it in a
+ * {@link SessionCredentialVault}. Keeping one config source means a credential
+ * vault is automatically persistent (Redis/SQLite) whenever the rest of the auth
+ * layer is, and in-memory by default otherwise.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type AuthLogger } from '../common/auth-logger.interface';
+import { type TokenStorageConfig } from '../options/interfaces';
+import { SessionCredentialVault } from './session-credential-vault';
+/**
+ * Options for {@link createSessionCredentialVault}.
+ */
+export interface CreateSessionCredentialVaultOptions {
+    /**
+     * Token-storage config — the SAME `auth.tokenStorage` selection used by the
+     * token stores. `'memory'` (or undefined) yields an in-memory vault;
+     * `{ redis }` / `{ sqlite }` a persistent one.
+     */
+    tokenStorage?: TokenStorageConfig;
+    /**
+     * Optionally reuse an already-connected adapter instead of creating one from
+     * `tokenStorage`. When provided, `tokenStorage` is ignored for adapter
+     * construction (used to share the LocalPrimaryAuth adapter).
+     */
+    storage?: StorageAdapter;
+    /** Master pepper override (defaults to `VAULT_SECRET ?? JWT_SECRET`). */
+    pepper?: string;
+    /** Key prefix for all stored keys. @default 'mcp:cred:' */
+    keyPrefix?: string;
+    /** TTL (ms) for credential entries. @default undefined (no expiry) */
+    ttlMs?: number;
+    /** Scoped logger. */
+    logger?: AuthLogger;
+}
+/**
+ * Create a {@link SessionCredentialVault} backed by the configured token storage.
+ *
+ * @returns the vault plus the backing adapter type, mirroring the SDK store
+ *   factories (`{ store, type }`).
+ */
+export declare function createSessionCredentialVault(options: CreateSessionCredentialVaultOptions): Promise<{
+    vault: SessionCredentialVault;
+    type: 'memory' | 'redis' | 'sqlite';
+}>;
+//# sourceMappingURL=session-credential-vault.factory.d.ts.map

package/session/session-credential-vault.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-credential-vault.factory.d.ts","sourceRoot":"","sources":["../../src/session/session-credential-vault.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC,CAmBjF"}

package/session/storage-authorization.store.d.ts

@@ -0,0 +1,51 @@
+/**
+ * StorageAuthorizationStore
+ *
+ * `AuthorizationStore` backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). This is the adapter-backed counterpart to
+ * {@link InMemoryAuthorizationStore}, giving local-mode auth persistent
+ * authorization codes, pending authorizations, and refresh tokens.
+ *
+ * Records are stored as JSON blobs keyed by type, with TTL derived from each
+ * record's `expiresAt`. The pure record-builder helpers (`createCodeRecord`,
+ * etc.) are inherited from the shared `authorization.store` functions, so the
+ * minted records are byte-for-byte identical to the in-memory store's.
+ */
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
+import { type AuthorizationCodeRecord, type AuthorizationStore, type CreateCodeRecordParams, type CreatePendingRecordParams, type CreateRefreshTokenRecordParams, type PendingAuthorizationRecord, type RefreshTokenRecord } from './authorization.store';
+export interface StorageAuthorizationStoreOptions {
+    /**
+     * Namespace prefix for all keys.
+     * @default 'oauth'
+     */
+    namespace?: string;
+}
+export declare class StorageAuthorizationStore implements AuthorizationStore {
+    private readonly codeStore;
+    private readonly pendingStore;
+    private readonly refreshStore;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageAuthorizationStoreOptions);
+    generateCode(): string;
+    generateRefreshToken(): string;
+    createCodeRecord(params: CreateCodeRecordParams): AuthorizationCodeRecord;
+    createPendingRecord(params: CreatePendingRecordParams): PendingAuthorizationRecord;
+    createRefreshTokenRecord(params: CreateRefreshTokenRecordParams): RefreshTokenRecord;
+    storeAuthorizationCode(record: AuthorizationCodeRecord): Promise<void>;
+    getAuthorizationCode(code: string): Promise<AuthorizationCodeRecord | null>;
+    markCodeUsed(code: string): Promise<void>;
+    deleteAuthorizationCode(code: string): Promise<void>;
+    storePendingAuthorization(record: PendingAuthorizationRecord): Promise<void>;
+    getPendingAuthorization(id: string): Promise<PendingAuthorizationRecord | null>;
+    deletePendingAuthorization(id: string): Promise<void>;
+    storeRefreshToken(record: RefreshTokenRecord): Promise<void>;
+    getRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
+    revokeRefreshToken(token: string): Promise<void>;
+    rotateRefreshToken(oldToken: string, newRecord: RefreshTokenRecord): Promise<void>;
+    cleanup(): Promise<void>;
+    private ttl;
+    private key;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-authorization.store.d.ts.map

package/session/storage-authorization.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-authorization.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-authorization.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5F,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,qBAAa,yBAA0B,YAAW,kBAAkB;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2C;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;gBAElC,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,gCAAqC;IAevG,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAI9B,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB;IAIzE,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B;IAIlF,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;IAQ9E,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAU3E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzC,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAU/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/storage-consent.store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * StorageConsentStore
+ *
+ * {@link ConsentStore} backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). Parallel to {@link StorageFederatedAuthSessionStore}:
+ * it stores the {@link RememberedConsentRecord} as a JSON blob keyed by
+ * `consent:{userSub}:{clientId}`.
+ *
+ * Unlike federated sessions (short-lived flow state), a remembered consent
+ * selection is intentionally long-lived — it survives restarts so a returning
+ * user keeps their prior tool selection — so no TTL is applied here.
+ */
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
+import { type ConsentStore, type RememberedConsentRecord } from './consent.store';
+export interface StorageConsentStoreOptions {
+    /**
+     * Namespace prefix for all keys.
+     * @default 'remembered-consent'
+     */
+    namespace?: string;
+}
+export declare class StorageConsentStore implements ConsentStore {
+    private readonly storage;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageConsentStoreOptions);
+    get(userSub: string, clientId: string): Promise<RememberedConsentRecord | null>;
+    set(record: RememberedConsentRecord): Promise<void>;
+    delete(userSub: string, clientId: string): Promise<void>;
+    private key;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-consent.store.d.ts.map

package/session/storage-consent.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-consent.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-consent.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5F,OAAO,EAAoB,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEpG,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,mBAAoB,YAAW,YAAY;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;gBAElC,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,0BAA+B;IAW3F,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI/E,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/storage-federated-auth.session.d.ts

@@ -0,0 +1,36 @@
+/**
+ * StorageFederatedAuthSessionStore
+ *
+ * `FederatedAuthSessionStore` backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). Parallel to {@link StorageTokenStore}: it stores
+ * the serializable {@link FederatedAuthSessionRecord} as a JSON blob keyed by
+ * session id, with a TTL derived from the session's `expiresAt`.
+ *
+ * Federated sessions are short-lived multi-provider OAuth flow state. Persisting
+ * them (Redis/SQLite) lets an in-progress federated login survive a server
+ * restart instead of being silently dropped.
+ */
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
+import { type FederatedAuthSession, type FederatedAuthSessionStore } from './federated-auth.session';
+export interface StorageFederatedAuthSessionStoreOptions {
+    /**
+     * Namespace prefix for all keys.
+     * @default 'fed'
+     */
+    namespace?: string;
+}
+export declare class StorageFederatedAuthSessionStore implements FederatedAuthSessionStore {
+    private readonly storage;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageFederatedAuthSessionStoreOptions);
+    store(session: FederatedAuthSession): Promise<void>;
+    update(session: FederatedAuthSession): Promise<void>;
+    get(id: string): Promise<FederatedAuthSession | null>;
+    delete(id: string): Promise<void>;
+    private put;
+    private calculateTtl;
+    private key;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-federated-auth.session.d.ts.map

package/session/storage-federated-auth.session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-federated-auth.session.d.ts","sourceRoot":"","sources":["../../src/session/storage-federated-auth.session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5F,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,yBAAyB,EAC/B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,uCAAuC;IACtD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,gCAAiC,YAAW,yBAAyB;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;gBAElC,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,uCAA4C;IAWxG,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgBrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIzB,GAAG;IAMjB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/storage-orchestrated-token.store.d.ts

@@ -0,0 +1,72 @@
+/**
+ * StorageOrchestratedTokenStore
+ *
+ * Orchestrated-mode `TokenStore` backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). Parallel to {@link InMemoryOrchestratedTokenStore}:
+ * stores upstream provider access/refresh tokens keyed by
+ * `authorizationId:providerId`, with the SAME AES-256-GCM + HKDF encryption at
+ * rest (see `orchestrated-token.crypto.ts`).
+ *
+ * Persisting these (Redis/SQLite) means a user's connected upstream providers
+ * survive a server restart instead of forcing re-authorization.
+ *
+ * Values are stored as raw strings on the adapter so we can choose, per record,
+ * between an encrypted envelope (when `encryptionKey` is set) and plaintext JSON
+ * (dev only) — matching the in-memory store's behavior exactly.
+ */
+import type { NamespacedStorage, StorageAdapter } from '@frontmcp/utils';
+import type { TokenStore } from '../authorization/orchestrated.authorization';
+export interface StorageOrchestratedTokenStoreOptions {
+    /**
+     * Encryption key for token storage. If not provided, tokens are stored in
+     * plain text (dev only). For production always provide a key.
+     */
+    encryptionKey?: Uint8Array;
+    /**
+     * Default TTL in milliseconds applied when a stored token has no `expiresAt`.
+     * @default undefined (no automatic expiration)
+     */
+    defaultTtlMs?: number;
+    /**
+     * Namespace prefix for all keys.
+     * @default 'otok'
+     */
+    namespace?: string;
+}
+export declare class StorageOrchestratedTokenStore implements TokenStore {
+    private readonly storage;
+    private readonly encryptionKey?;
+    private readonly defaultTtlMs?;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    /** HKDF-derived subkey cache, keyed by composite key. */
+    private readonly derivedKeys;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageOrchestratedTokenStoreOptions);
+    getAccessToken(authorizationId: string, providerId: string): Promise<string | null>;
+    getRefreshToken(authorizationId: string, providerId: string): Promise<string | null>;
+    storeTokens(authorizationId: string, providerId: string, tokens: {
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }): Promise<void>;
+    deleteTokens(authorizationId: string, providerId: string): Promise<void>;
+    hasTokens(authorizationId: string, providerId: string): Promise<boolean>;
+    getProviderIds(authorizationId: string): Promise<string[]>;
+    migrateTokens(fromAuthId: string, toAuthId: string): Promise<void>;
+    /**
+     * Delete all tokens for an authorization id.
+     */
+    deleteAllForAuthorization(authorizationId: string): Promise<void>;
+    private getRecord;
+    private keyFor;
+    private compositeKey;
+    private storageKey;
+    /**
+     * List composite keys (authorizationId:providerId) matching a glob over the
+     * composite-key space, stripping any non-namespaced prefix we added.
+     */
+    private listCompositeKeys;
+    private ttlOptions;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-orchestrated-token.store.d.ts.map

package/session/storage-orchestrated-token.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-orchestrated-token.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-orchestrated-token.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAS9E,MAAM,WAAW,oCAAoC;IACnD;;;OAGG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA8B,YAAW,UAAU;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAE9C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;gBAEjD,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,oCAAyC;IAYrG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnF,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKpF,WAAW,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAgBV,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxE,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB1D,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCxE;;OAEG;IACG,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAczD,SAAS;IAkCvB,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,UAAU;IAIlB;;;OAGG;YACW,iBAAiB;IAU/B,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/token-storage.factory.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Token-storage adapter factory
+ *
+ * Builds a `StorageAdapter` (from `@frontmcp/utils`) from an auth
+ * {@link TokenStorageConfig}, so the local-mode auth stores (authorization
+ * codes/tokens, federated-auth sessions, orchestrated provider tokens) can be
+ * backed by memory, Redis, or local SQLite using one consistent adapter.
+ *
+ * Dependency direction (per CLAUDE.md):
+ * - `@frontmcp/utils` stays storage-backend-agnostic and MUST NOT depend on
+ *   `@frontmcp/storage-sqlite`.
+ * - The SQLite knowledge lives here, in the auth layer, via a lazy
+ *   `require('@frontmcp/storage-sqlite')` — mirroring how the SDK's
+ *   `session-store.factory.ts` lazy-loads the SQLite session store. This keeps
+ *   `ioredis`/`better-sqlite3` out of bundles that don't use them.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type TokenStorageConfig, type TokenStorageSqliteConfig } from '../options/interfaces';
+import { type RedisConfig } from './transport-session.types';
+/**
+ * Narrow a {@link TokenStorageConfig} to its Redis variant.
+ */
+export declare function isRedisTokenStorage(config: TokenStorageConfig | undefined): config is {
+    redis: RedisConfig;
+};
+/**
+ * Narrow a {@link TokenStorageConfig} to its SQLite variant.
+ */
+export declare function isSqliteTokenStorage(config: TokenStorageConfig | undefined): config is {
+    sqlite: TokenStorageSqliteConfig;
+};
+/**
+ * Whether a token-storage config persists across process restarts.
+ * `'memory'` (and the undefined default) do not; Redis and SQLite do.
+ */
+export declare function isPersistentTokenStorage(config: TokenStorageConfig | undefined): boolean;
+/**
+ * Create and connect a `StorageAdapter` for the given token-storage config.
+ *
+ * @param config - Token storage configuration. `'memory'` (or `undefined`)
+ *   yields an in-memory adapter; `{ redis }` a Redis adapter; `{ sqlite }` a
+ *   SQLite-file adapter.
+ * @returns A connected `StorageAdapter`.
+ */
+export declare function createTokenStorageAdapter(config: TokenStorageConfig | undefined): Promise<StorageAdapter>;
+//# sourceMappingURL=token-storage.factory.d.ts.map

package/session/token-storage.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.factory.d.ts","sourceRoot":"","sources":["../../src/session/token-storage.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,IAAI;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAE5G;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GACrC,MAAM,IAAI;IAAE,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAEhD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAExF;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAoC/G"}

package/ui/index.d.ts

@@ -5,6 +5,7 @@
  */
 export { CDN, DEFAULT_THEME, baseLayout, createLayout, authLayout, centeredCardLayout, wideLayout, extraWideLayout, escapeHtml, } from './base-layout';
 export type { ThemeColors, ThemeFonts, ThemeConfig, BaseLayoutOptions } from './base-layout';
-export { buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildErrorPage, renderToHtml, } from './templates';
-export type { AppAuthCard, ProviderCard, ToolCard } from './templates';
+export { buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildConnectPage, buildConnectSuccessPage, buildErrorPage, renderToHtml, } from './templates';
+export type { AppAuthCard, ProviderCard, ToolCard, LoginExtraField, ConsentHiddenField } from './templates';
+export { renderLocalLoginPage, toLoginExtraFields } from './local-login.helper';
 //# sourceMappingURL=index.d.ts.map

package/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/ui/local-login.helper.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Local-login page rendering helper (Checkpoint 3a).
+ *
+ * Single source of truth for turning a {@link LoginConfig} + {@link LoginRenderContext}
+ * into HTML, shared by the authorize flow (initial render) and the callback flow
+ * (error re-render). Keeps the flows lean and the precedence rules in one place:
+ *
+ *   1. `login.render`  → full HTML override (caller owns the markup).
+ *   2. `login.fields`  → built-in page with the custom fields REPLACING email/name.
+ *   3. otherwise       → the unchanged default email/name login page.
+ */
+import type { LoginConfig, LoginRenderContext } from '../options/interfaces';
+import { type LoginExtraField } from './templates';
+/**
+ * Map a {@link LoginConfig.fields} record (+ optional pre-filled values) into the
+ * ordered {@link LoginExtraField} array consumed by {@link buildLoginPage}.
+ */
+export declare function toLoginExtraFields(fields: LoginConfig['fields'] | undefined, values?: Record<string, string>): LoginExtraField[];
+/**
+ * Render the local login page for the given config + context.
+ *
+ * When `login` is undefined (and no values/error to pre-fill) this returns the
+ * byte-for-byte default login page via {@link buildLoginPage}, preserving the
+ * zero-config behavior.
+ *
+ * @param login  The `auth.login` config (may be undefined).
+ * @param ctx    Render context (client identity, scopes, pendingAuthId, callbackPath, error).
+ * @param values Optional submitted values to pre-fill on re-render (after a failed authenticate()).
+ */
+export declare function renderLocalLoginPage(login: LoginConfig | undefined, ctx: LoginRenderContext, values?: Record<string, string>): string;
+//# sourceMappingURL=local-login.helper.d.ts.map

package/ui/local-login.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-login.helper.d.ts","sourceRoot":"","sources":["../../src/ui/local-login.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,EACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,eAAe,EAAE,CAWnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,GAAG,EAAE,kBAAkB,EACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAsBR"}

package/ui/templates.d.ts

@@ -97,7 +97,33 @@ export declare function buildFederatedLoginPage(params: {
     callbackPath: string;
 }): string;
 /**
- * Build consent page for tool selection
+ * A hidden field to round-trip on the consent form (identity / federated
+ * context) so the consent POST back to `/oauth/callback` carries everything the
+ * mint step needs.
+ */
+export interface ConsentHiddenField {
+    /** Form field name. */
+    name: string;
+    /** Field value (rendered escaped). */
+    value: string;
+}
+/**
+ * Build consent page for tool selection.
+ *
+ * The form GETs/POSTs back to `callbackPath` (`/oauth/callback`) carrying
+ * `pending_auth_id`, the chosen `tools=` checkboxes, and any caller-supplied
+ * {@link ConsentHiddenField hidden context} (identity / `federated=true` /
+ * `providers=`). Honors the `auth.consent` config flags:
+ *
+ * - `groupByApp`      — group tools under per-app cards (default) or render a flat list.
+ * - `showDescriptions`— show tool descriptions (default) or hide them.
+ * - `customMessage`   — replace the default subtitle.
+ * - `allowSelectAll`  — render the select-all + per-app toggle controls (default).
+ * - `requireSelection`— require ≥1 tool; disables the submit button at 0 selected.
+ * - `defaultSelectedTools` — the set of tool ids to pre-check (others unchecked).
+ *   When omitted, ALL tools are pre-checked (the historical default).
+ *
+ * Note: `excludedTools` are filtered out by the caller and never appear here.
  */
 export declare function buildToolConsentPage(params: {
     tools: ToolCard[];
@@ -107,15 +133,105 @@ export declare function buildToolConsentPage(params: {
     callbackPath: string;
     userName?: string;
     userEmail?: string;
+    /** Group tools by app (default true). When false, a single flat list is rendered. */
+    groupByApp?: boolean;
+    /** Show per-tool descriptions (default true). */
+    showDescriptions?: boolean;
+    /** Replace the default subtitle with a custom message. */
+    customMessage?: string;
+    /** Render the select-all / toggle-all controls (default true). */
+    allowSelectAll?: boolean;
+    /** Require at least one tool to be selected (default true). */
+    requireSelection?: boolean;
+    /**
+     * Tool ids to pre-check. When omitted, every tool is pre-checked (historical
+     * default). When provided, only listed ids are checked.
+     */
+    defaultSelectedTools?: string[];
+    /** Optional error banner (e.g. re-render after an empty `requireSelection` submit). */
+    error?: string;
+    /** Hidden fields to round-trip (identity / federated context) back to the callback. */
+    hiddenFields?: ConsentHiddenField[];
 }): string;
 /**
- * Build simple login page
+ * A custom login field rendered on the built-in login page (Checkpoint 3a).
+ * Mirrors `LoginFieldConfig` from `@frontmcp/auth` options, plus the field `name`.
+ */
+export interface LoginExtraField {
+    /** Field name (form key submitted to the callback). */
+    name: string;
+    /** HTML input type. `hidden` is submitted but not shown. */
+    type: 'text' | 'password' | 'email' | 'select' | 'hidden';
+    /** Field label. Defaults to the field name. */
+    label?: string;
+    /** Whether the field is required. */
+    required?: boolean;
+    /** Placeholder text. */
+    placeholder?: string;
+    /** Options for a `select` field. */
+    options?: Array<{
+        value: string;
+        label: string;
+    }>;
+    /** Pre-filled value (e.g. when re-rendering after an error). */
+    value?: string;
+}
+/**
+ * Build simple login page.
+ *
+ * The default email/name form is rendered when no `extraFields` are supplied —
+ * byte-for-byte identical to the historical page (the optional params below all
+ * default to falsy). When `extraFields` is provided (Checkpoint 3a local-login
+ * customization), the built-in email/name fields are REPLACED by the supplied
+ * fields and `title`/`subtitle`/`logoUri`/`error` customize the chrome.
  */
 export declare function buildLoginPage(params: {
     clientName: string;
     scope: string;
     pendingAuthId: string;
     callbackPath: string;
+    /** Optional page heading override. Defaults to "Sign In". */
+    title?: string;
+    /** Optional sub-heading. Defaults to "Authorize access to {clientName}". */
+    subtitle?: string;
+    /** Optional logo image URL shown above the form. */
+    logoUri?: string;
+    /** Optional error banner shown above the form (re-render after failed authenticate()). */
+    error?: string;
+    /**
+     * Optional custom fields. When provided, these REPLACE the default
+     * email/name inputs and are submitted to the callback as form values.
+     */
+    extraFields?: LoginExtraField[];
+}): string;
+/**
+ * Build the mid-session "connect credential" page (Checkpoint 3b).
+ *
+ * Renders a single-field form (reusing the {@link LoginExtraField} renderer) that
+ * POSTs the framework-signed `token` plus the credential field value back to the
+ * `/oauth/connect` handler. Mirrors the login page chrome so the experience is
+ * consistent with the initial sign-in.
+ *
+ * @param params.token  The framework-signed resume token (round-tripped as a hidden field).
+ * @param params.field  The single credential field to render (e.g. an API key / password input).
+ * @param params.action The connect endpoint path the form submits to.
+ */
+export declare function buildConnectPage(params: {
+    token: string;
+    field: LoginExtraField;
+    action: string;
+    title?: string;
+    subtitle?: string;
+    logoUri?: string;
+    error?: string;
+}): string;
+/**
+ * Build the success page shown after a credential is connected mid-session
+ * (Checkpoint 3b). No secrets are rendered — only a confirmation message.
+ */
+export declare function buildConnectSuccessPage(params: {
+    key: string;
+    message?: string;
 }): string;
 /**
  * Build error page

package/ui/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/ui/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAmD,UAAU,IAAI,cAAc,EAAE,MAAM,eAAe,CAAC;AAM9G;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,uBAAiB,CAAC;AAMzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AA6DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAwDT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkFT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAgHT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkDT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAsBrF;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/ui/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAmD,MAAM,eAAe,CAAC;AAM9G;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,uBAAiB,CAAC;AAMzC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAoBT;AA6DD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAwDT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAkFT;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC,GAAG,MAAM,CAmLT;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,GAAG,MAAM,CA2ET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAoCT;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAsBrF;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhF"}

package/vault/auth-providers.types.d.ts

@@ -14,8 +14,8 @@ import type { AuthorizationVault, Credential } from '../session';
  */
 export type CredentialScope = 'global' | 'user' | 'session';
 export declare const credentialScopeSchema: import("@frontmcp/lazy-zod").ZodEnum<{
-    session: "session";
     user: "user";
+    session: "session";
     global: "global";
 }>;
 /**
@@ -140,8 +140,8 @@ export declare const credentialProviderConfigSchema: import("@frontmcp/lazy-zod"
     name: import("@frontmcp/lazy-zod").ZodString;
     description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     scope: import("@frontmcp/lazy-zod").ZodEnum<{
-        session: "session";
         user: "user";
+        session: "session";
         global: "global";
     }>;
     loading: import("@frontmcp/lazy-zod").ZodEnum<{
@@ -226,8 +226,8 @@ export declare const authProvidersVaultOptionsSchema: import("@frontmcp/lazy-zod
         name: import("@frontmcp/lazy-zod").ZodString;
         description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
         scope: import("@frontmcp/lazy-zod").ZodEnum<{
-            session: "session";
             user: "user";
+            session: "session";
             global: "global";
         }>;
         loading: import("@frontmcp/lazy-zod").ZodEnum<{