@frontmcp/auth 1.3.0 → 1.4.0

package/index.js

@@ -244,6 +244,7 @@ __export(index_exports, {
   AuthorityDeniedError: () => AuthorityDeniedError,
   AuthorizationBase: () => AuthorizationBase,
   CDN: () => CDN,
+  CREDENTIALS_ACCESSOR: () => CREDENTIALS_ACCESSOR,
   CimdClientIdMismatchError: () => CimdClientIdMismatchError,
   CimdDisabledError: () => CimdDisabledError,
   CimdError: () => CimdError,
@@ -255,12 +256,16 @@ __export(index_exports, {
   CredentialCache: () => CredentialCache,
   CredentialProviderAlreadyRegisteredError: () => CredentialProviderAlreadyRegisteredError,
   CredentialStorageError: () => CredentialStorageError,
+  CredentialsAccessorImpl: () => CredentialsAccessorImpl,
+  DEFAULT_RESUME_TTL_MS: () => DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME: () => DEFAULT_THEME,
+  DcrClientRegistry: () => DcrClientRegistry,
   EagerCredentialLoader: () => EagerCredentialLoader,
   ElicitationSecretRequiredError: () => ElicitationSecretRequiredError,
   EncryptedRedisVault: () => EncryptedRedisVault,
-  EncryptedStorageError: () => import_utils16.EncryptedStorageError,
-  EncryptedTypedStorage: () => import_utils16.EncryptedTypedStorage,
+  EncryptedStorageError: () => import_utils22.EncryptedStorageError,
+  EncryptedStorageSecureStoreBackend: () => EncryptedStorageSecureStoreBackend,
+  EncryptedTypedStorage: () => import_utils22.EncryptedTypedStorage,
   EncryptionContextNotSetError: () => EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError: () => EncryptionKeyNotConfiguredError,
   FetchCredentialMiddleware: () => FetchCredentialMiddleware,
@@ -268,6 +273,7 @@ __export(index_exports, {
   InMemoryAuthorizationStore: () => InMemoryAuthorizationStore,
   InMemoryAuthorizationVault: () => InMemoryAuthorizationVault,
   InMemoryCimdCache: () => InMemoryCimdCache,
+  InMemoryConsentStore: () => InMemoryConsentStore,
   InMemoryFederatedAuthSessionStore: () => InMemoryFederatedAuthSessionStore,
   InMemoryOrchestratedTokenStore: () => InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError: () => InMemoryStoreRequiredError,
@@ -285,11 +291,18 @@ __export(index_exports, {
   RedirectUriMismatchError: () => RedirectUriMismatchError,
   RedisAuthorizationStore: () => RedisAuthorizationStore,
   RedisSessionStore: () => RedisSessionStore,
+  SECURE_STORE_ACCESSOR: () => SECURE_STORE_ACCESSOR,
   ScopeDeniedError: () => ScopeDeniedError,
+  SecureStoreAccessorImpl: () => SecureStoreAccessorImpl,
+  SessionCredentialVault: () => SessionCredentialVault,
   SessionIdEmptyError: () => SessionIdEmptyError,
   SessionRateLimiter: () => SessionRateLimiter,
   SessionSecretRequiredError: () => SessionSecretRequiredError,
+  StorageAuthorizationStore: () => StorageAuthorizationStore,
   StorageAuthorizationVault: () => StorageAuthorizationVault,
+  StorageConsentStore: () => StorageConsentStore,
+  StorageFederatedAuthSessionStore: () => StorageFederatedAuthSessionStore,
+  StorageOrchestratedTokenStore: () => StorageOrchestratedTokenStore,
   StorageTokenStore: () => StorageTokenStore,
   TinyTtlCache: () => TinyTtlCache,
   TokenLeakDetectedError: () => TokenLeakDetectedError,
@@ -298,7 +311,7 @@ __export(index_exports, {
   TokenVault: () => TokenVault,
   TransparentAuthorization: () => TransparentAuthorization,
   TransportIdGenerator: () => TransportIdGenerator,
-  TypedStorage: () => import_utils15.TypedStorage,
+  TypedStorage: () => import_utils21.TypedStorage,
   VaultEncryption: () => VaultEncryption,
   VaultLoadError: () => VaultLoadError,
   VaultNotFoundError: () => VaultNotFoundError,
@@ -321,6 +334,7 @@ __export(index_exports, {
   authProviderMappingSchema: () => authProviderMappingSchema,
   authProvidersVaultOptionsSchema: () => authProvidersVaultOptionsSchema,
   authUserSchema: () => authUserSchema,
+  authenticateFnSchema: () => authenticateFnSchema,
   authoritiesClaimsMappingSchema: () => authoritiesClaimsMappingSchema,
   authoritiesConfigSchema: () => authoritiesConfigSchema,
   authoritiesMetadataSchema: () => authoritiesMetadataSchema,
@@ -335,7 +349,11 @@ __export(index_exports, {
   bearerApplier: () => bearerApplier,
   bearerCredentialSchema: () => bearerCredentialSchema,
   buildAuthContext: () => buildAuthContext,
+  buildCodeRecord: () => buildCodeRecord,
+  buildConnectPage: () => buildConnectPage,
+  buildConnectSuccessPage: () => buildConnectSuccessPage,
   buildConsentPage: () => buildConsentPage,
+  buildCredentialResumeUrl: () => buildCredentialResumeUrl,
   buildErrorPage: () => buildErrorPage,
   buildFederatedLoginPage: () => buildFederatedLoginPage,
   buildIncrementalAuthPage: () => buildIncrementalAuthPage,
@@ -343,7 +361,9 @@ __export(index_exports, {
   buildInvalidRequestHeader: () => buildInvalidRequestHeader,
   buildInvalidTokenHeader: () => buildInvalidTokenHeader,
   buildLoginPage: () => buildLoginPage,
+  buildPendingRecord: () => buildPendingRecord,
   buildPrmUrl: () => buildPrmUrl,
+  buildRefreshTokenRecord: () => buildRefreshTokenRecord,
   buildToolConsentPage: () => buildToolConsentPage,
   buildUnauthorizedHeader: () => buildUnauthorizedHeader,
   buildWwwAuthenticate: () => buildWwwAuthenticate,
@@ -356,6 +376,7 @@ __export(index_exports, {
   clientMetadataDocumentSchema: () => clientMetadataDocumentSchema,
   completeCurrentProvider: () => completeCurrentProvider,
   consentConfigSchema: () => consentConfigSchema,
+  consentRecordKey: () => consentRecordKey,
   consentSelectionSchema: () => consentSelectionSchema,
   consentStateSchema: () => consentStateSchema,
   consentToolItemSchema: () => consentToolItemSchema,
@@ -363,15 +384,18 @@ __export(index_exports, {
   createEncryptedVault: () => createEncryptedVault,
   createFederatedAuthSession: () => createFederatedAuthSession,
   createLayout: () => createLayout,
+  createSecureStore: () => createSecureStore,
+  createSessionCredentialVault: () => createSessionCredentialVault,
+  createTokenStorageAdapter: () => createTokenStorageAdapter,
   credentialProviderConfigSchema: () => credentialProviderConfigSchema,
   credentialSchema: () => credentialSchema,
   credentialScopeSchema: () => credentialScopeSchema,
   credentialTypeSchema: () => credentialTypeSchema,
   customCredentialSchema: () => customCredentialSchema,
   decodeJwtPayloadSafe: () => decodeJwtPayloadSafe,
-  decryptAesGcm: () => import_utils23.decryptAesGcm,
+  decryptAesGcm: () => import_utils32.decryptAesGcm,
   decryptSessionJson: () => decryptSessionJson,
-  decryptValue: () => import_utils23.decryptValue,
+  decryptValue: () => import_utils32.decryptValue,
   defaultSessionRateLimiter: () => defaultSessionRateLimiter,
   deriveAuthorizationId: () => deriveAuthorizationId,
   deriveExpectedAudience: () => deriveExpectedAudience,
@@ -379,9 +403,9 @@ __export(index_exports, {
   deriveTypedUser: () => deriveTypedUser,
   detectAuthProviders: () => detectAuthProviders,
   detectedAuthProviderSchema: () => detectedAuthProviderSchema,
-  encryptAesGcm: () => import_utils23.encryptAesGcm,
+  encryptAesGcm: () => import_utils32.encryptAesGcm,
   encryptJson: () => encryptJson,
-  encryptValue: () => import_utils23.encryptValue,
+  encryptValue: () => import_utils32.encryptValue,
   encryptedBlobSchema: () => encryptedBlobSchema,
   encryptedDataSchema: () => encryptedDataSchema,
   encryptedVaultEntrySchema: () => encryptedVaultEntrySchema,
@@ -396,7 +420,9 @@ __export(index_exports, {
   federatedSelectionSchema: () => federatedSelectionSchema,
   flatRemoteProviderFields: () => flatRemoteProviderFields,
   fromSessionRecord: () => fromSessionRecord,
+  generateAuthorizationCode: () => generateAuthorizationCode,
   generatePkceChallenge: () => generatePkceChallenge,
+  generateRefreshTokenValue: () => generateRefreshTokenValue,
   getCredentialOptionsSchema: () => getCredentialOptionsSchema,
   getKey: () => getKey,
   getNextProvider: () => getNextProvider,
@@ -405,7 +431,7 @@ __export(index_exports, {
   getTokenSignatureFingerprint: () => getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris: () => hasOnlyLocalhostRedirectUris,
   headerApplier: () => headerApplier,
-  hkdfSha256: () => import_utils23.hkdfSha256,
+  hkdfSha256: () => import_utils32.hkdfSha256,
   incrementalAuthConfigSchema: () => incrementalAuthConfigSchema,
   isCimdClientId: () => isCimdClientId,
   isFrontMcpCredentials: () => isFrontMcpCredentials,
@@ -414,12 +440,15 @@ __export(index_exports, {
   isOrchestratedLocal: () => isOrchestratedLocal,
   isOrchestratedMode: () => isOrchestratedMode,
   isOrchestratedRemote: () => isOrchestratedRemote,
+  isPersistentTokenStorage: () => isPersistentTokenStorage,
   isPublicMode: () => isPublicMode,
+  isRedisTokenStorage: () => isRedisTokenStorage,
   isRemoteMode: () => isRemoteMode,
   isSessionComplete: () => isSessionComplete,
-  isSignedSession: () => import_utils8.isSignedData,
+  isSignedSession: () => import_utils14.isSignedData,
   isSoonExpiring: () => isSoonExpiring,
   isSoonExpiringProvider: () => isSoonExpiringProvider,
+  isSqliteTokenStorage: () => isSqliteTokenStorage,
   isTransparentMode: () => isTransparentMode,
   jsonWebKeySetSchema: () => jsonWebKeySetSchema,
   jwkParametersSchema: () => jwkParametersSchema,
@@ -428,7 +457,10 @@ __export(index_exports, {
   llmSafeAuthContextSchema: () => llmSafeAuthContextSchema,
   loadingStrategySchema: () => loadingStrategySchema,
   localAuthSchema: () => localAuthSchema,
+  localDcrClientSchema: () => localDcrClientSchema,
+  localDcrConfigSchema: () => localDcrConfigSchema,
   localSigningConfigSchema: () => localSigningConfigSchema,
+  loginConfigSchema: () => loginConfigSchema,
   mtlsCredentialSchema: () => mtlsCredentialSchema,
   noopLogger: () => noopLogger,
   normalizeIssuer: () => normalizeIssuer,
@@ -454,14 +486,20 @@ __export(index_exports, {
   redisVaultEntrySchema: () => redisVaultEntrySchema,
   remoteAuthSchema: () => remoteAuthSchema,
   remoteProviderConfigSchema: () => remoteProviderConfigSchema,
+  renderLocalLoginPage: () => renderLocalLoginPage,
   renderToHtml: () => renderToHtml,
   resetCachedKey: () => resetCachedKey,
   resolveRequiredScopes: () => resolveRequiredScopes,
   resourceIdRefSchema: () => resourceIdRefSchema,
   safeDecrypt: () => safeDecrypt,
+  secureStoreConfigSchema: () => secureStoreConfigSchema,
+  secureStoreCustomBackendSchema: () => secureStoreCustomBackendSchema,
+  secureStoreEncryptionSchema: () => secureStoreEncryptionSchema,
+  secureStoreScopeSchema: () => secureStoreScopeSchema,
   serviceAccountCredentialSchema: () => serviceAccountCredentialSchema,
   sessionIdPayloadSchema: () => sessionIdPayloadSchema,
   sessionJwtPayloadSchema: () => sessionJwtPayloadSchema,
+  signCredentialResumeToken: () => signCredentialResumeToken,
   signSession: () => signSession,
   skippedAppBehaviorSchema: () => skippedAppBehaviorSchema,
   sseTransportStateSchema: () => sseTransportStateSchema,
@@ -472,20 +510,24 @@ __export(index_exports, {
   storedSessionSchema: () => storedSessionSchema,
   streamableHttpTransportStateSchema: () => streamableHttpTransportStateSchema,
   toEpochSeconds: () => toEpochSeconds,
+  toLoginExtraFields: () => toLoginExtraFields,
   toSessionRecord: () => toSessionRecord,
   tokenRefreshConfigSchema: () => tokenRefreshConfigSchema,
   tokenStorageConfigSchema: () => tokenStorageConfigSchema,
+  tokenStorageSqliteSchema: () => tokenStorageSqliteSchema,
   transparentAuthOptionsSchema: () => transparentAuthOptionsSchema,
   transportProtocolSchema: () => transportProtocolSchema,
   transportSessionSchema: () => transportSessionSchema,
   transportStateSchema: () => transportStateSchema,
   trimSlash: () => trimSlash,
   tryJwtExp: () => tryJwtExp,
+  upstreamProviderSchema: () => upstreamProviderSchema,
   userClaimSchema: () => userClaimSchema,
   validateAudience: () => validateAudience,
   validateClientIdUrl: () => validateClientIdUrl,
   vaultConsentRecordSchema: () => vaultConsentRecordSchema,
   vaultFederatedRecordSchema: () => vaultFederatedRecordSchema,
+  verifyCredentialResumeToken: () => verifyCredentialResumeToken,
   verifyOrParseSession: () => verifyOrParseSession,
   verifyPkce: () => verifyPkce,
   verifySession: () => verifySession,
@@ -497,6 +539,18 @@ module.exports = __toCommonJS(index_exports);
 var import_jose = require("jose");
 var import_utils = require("@frontmcp/utils");
 
+// libs/auth/src/common/auth-logger.interface.ts
+var noopAuthLogger = {
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  },
+  debug() {
+  }
+};
+
 // libs/auth/src/jwks/jwks.utils.ts
 function trimSlash(s) {
   const str = s ?? "";
@@ -526,18 +580,6 @@ function decodeJwtPayloadSafe(token) {
   }
 }
 
-// libs/auth/src/common/auth-logger.interface.ts
-var noopAuthLogger = {
-  info() {
-  },
-  warn() {
-  },
-  error() {
-  },
-  debug() {
-  }
-};
-
 // libs/auth/src/jwks/jwks.service.ts
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
@@ -596,28 +638,6 @@ var JwksService = class {
   // ===========================================================================
   // Scope-aware verification API
   // ===========================================================================
-  /** Verify a token issued by the gateway itself (orchestrated mode). */
-  async verifyGatewayToken(token, expectedIssuer) {
-    try {
-      const payload = decodeJwtPayloadSafe(token);
-      if (!payload) {
-        return {
-          ok: false,
-          error: "invalid bearer token"
-        };
-      }
-      return {
-        ok: true,
-        issuer: expectedIssuer,
-        sub: payload["sub"],
-        payload,
-        header: (0, import_jose.decodeProtectedHeader)(token)
-      };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : "verification_failed";
-      return { ok: false, error: message };
-    }
-  }
   /**
    * Verify a token against candidate transparent providers.
    * Ensures JWKS are available (cached/TTL/AS discovery) per provider.
@@ -1262,32 +1282,52 @@ function buildFederatedLoginPage(params) {
   return wideLayout(content, { title: "Select Providers" });
 }
 function buildToolConsentPage(params) {
-  const { tools, clientName, pendingAuthId, csrfToken, callbackPath, userName, userEmail } = params;
-  const toolsByApp = {};
-  for (const tool of tools) {
-    if (!toolsByApp[tool.appId]) {
-      toolsByApp[tool.appId] = { appName: tool.appName, tools: [] };
-    }
-    toolsByApp[tool.appId].tools.push(tool);
-  }
-  const userInfo = userName || userEmail ? `<div class="p-3 bg-gray-50 rounded-lg mb-6 text-sm">
-        <span class="text-gray-500">Signed in as: </span>
-        <span class="font-medium text-gray-900">${escapeHtml3(userName || userEmail || "")}</span>
-      </div>` : "";
-  const appGroups = Object.entries(toolsByApp).map(([appId, { appName, tools: appTools }]) => {
-    const toolItems = appTools.map((tool) => {
-      const desc = tool.description ? `<p class="text-sm text-gray-500 mt-0.5">${escapeHtml3(tool.description)}</p>` : "";
-      return `<label class="flex items-start gap-3 p-3 bg-white rounded-lg cursor-pointer hover:bg-gray-50">
-        <input type="checkbox" name="tools" value="${escapeHtml3(
-        tool.toolId
-      )}" class="mt-0.5 w-5 h-5 rounded border-gray-300" checked>
+  const {
+    tools,
+    clientName,
+    pendingAuthId,
+    csrfToken,
+    callbackPath,
+    userName,
+    userEmail,
+    groupByApp = true,
+    showDescriptions = true,
+    customMessage,
+    allowSelectAll = true,
+    requireSelection = true,
+    defaultSelectedTools,
+    error,
+    hiddenFields = []
+  } = params;
+  const defaultSet = defaultSelectedTools ? new Set(defaultSelectedTools) : void 0;
+  const isChecked = (toolId) => defaultSet ? defaultSet.has(toolId) : true;
+  const checkedCount = tools.filter((t) => isChecked(t.toolId)).length;
+  const renderTool = (tool) => {
+    const desc = showDescriptions && tool.description ? `<p class="text-sm text-gray-500 mt-0.5">${escapeHtml3(tool.description)}</p>` : "";
+    return `<label class="flex items-start gap-3 p-3 bg-white rounded-lg cursor-pointer hover:bg-gray-50">
+        <input type="checkbox" name="tools" value="${escapeHtml3(tool.toolId)}" class="mt-0.5 w-5 h-5 rounded border-gray-300"${isChecked(tool.toolId) ? " checked" : ""}>
         <div>
           <span class="font-medium text-gray-900">${escapeHtml3(tool.toolName)}</span>
           ${desc}
         </div>
       </label>`;
-    }).join("\n");
-    return `<div class="bg-gray-50 rounded-xl overflow-hidden">
+  };
+  let toolSection;
+  if (groupByApp) {
+    const toolsByApp = {};
+    for (const tool of tools) {
+      if (!toolsByApp[tool.appId]) {
+        toolsByApp[tool.appId] = { appName: tool.appName, tools: [] };
+      }
+      toolsByApp[tool.appId].tools.push(tool);
+    }
+    const toggleAllButton = allowSelectAll ? `<button type="button" class="text-sm text-blue-600 hover:text-blue-800"
+          onclick="const container = this.closest('.bg-gray-50').querySelector('[data-app]'); const cbs = container.querySelectorAll('input[name=tools]'); const allChecked = [...cbs].every(cb => cb.checked); cbs.forEach(cb => cb.checked = !allChecked); updateCount();">
+          Toggle All
+        </button>` : "";
+    toolSection = Object.entries(toolsByApp).map(([appId, { appName, tools: appTools }]) => {
+      const toolItems = appTools.map(renderTool).join("\n");
+      return `<div class="bg-gray-50 rounded-xl overflow-hidden">
       <div class="flex items-center justify-between px-4 py-3 bg-gray-100">
         <div class="flex items-center gap-3">
           <div class="w-8 h-8 rounded-lg bg-gradient-to-br from-blue-500 to-purple-600 flex items-center justify-center text-white font-bold text-sm">
@@ -1295,51 +1335,70 @@ function buildToolConsentPage(params) {
           </div>
           <span class="font-semibold text-gray-900">${escapeHtml3(appName)}</span>
         </div>
-        <button type="button" class="text-sm text-blue-600 hover:text-blue-800"
-          onclick="const container = this.closest('.bg-gray-50').querySelector('[data-app]'); const cbs = container.querySelectorAll('input[name=tools]'); const allChecked = [...cbs].every(cb => cb.checked); cbs.forEach(cb => cb.checked = !allChecked); updateCount();">
-          Toggle All
-        </button>
+        ${toggleAllButton}
       </div>
       <div class="p-4 space-y-2" data-app="${escapeHtml3(appId)}">
         ${toolItems}
       </div>
     </div>`;
-  }).join("\n");
+    }).join("\n");
+  } else {
+    toolSection = `<div class="bg-gray-50 rounded-xl p-4 space-y-2" data-app="__all__">
+      ${tools.map(renderTool).join("\n")}
+    </div>`;
+  }
+  const userInfo = userName || userEmail ? `<div class="p-3 bg-gray-50 rounded-lg mb-6 text-sm">
+        <span class="text-gray-500">Signed in as: </span>
+        <span class="font-medium text-gray-900">${escapeHtml3(userName || userEmail || "")}</span>
+      </div>` : "";
+  const errorBanner = error ? `<div class="mb-6 p-4 bg-red-50 border border-red-200 rounded-lg text-sm text-red-800">${escapeHtml3(error)}</div>` : "";
+  const hiddenInputs = hiddenFields.map((f) => `<input type="hidden" name="${escapeHtml3(f.name)}" value="${escapeHtml3(f.value)}">`).join("\n      ");
+  const selectAllControl = allowSelectAll ? `<label class="flex items-center gap-3 cursor-pointer">
+          <input type="checkbox" id="select-all" class="w-5 h-5 rounded border-gray-300"${checkedCount === tools.length && tools.length > 0 ? " checked" : ""}
+            onchange="document.querySelectorAll('input[name=tools]').forEach(cb => cb.checked = this.checked); updateCount();">
+          <span class="text-gray-700">Select all tools</span>
+        </label>` : "<span></span>";
+  const requireSelectionScript = requireSelection ? `
+      const submitBtn = document.getElementById('consent-submit');
+      if (submitBtn) submitBtn.disabled = checked.length === 0;` : "";
   const updateCountScript = `
   <script>
     function updateCount() {
       const all = document.querySelectorAll('input[name="tools"]');
       const checked = document.querySelectorAll('input[name="tools"]:checked');
-      document.getElementById('selection-count').textContent = checked.length + ' of ' + all.length + ' selected';
-      document.getElementById('select-all').checked = all.length > 0 && all.length === checked.length;
+      const countEl = document.getElementById('selection-count');
+      if (countEl) countEl.textContent = checked.length + ' of ' + all.length + ' selected';
+      const selectAll = document.getElementById('select-all');
+      if (selectAll) selectAll.checked = all.length > 0 && all.length === checked.length;${requireSelectionScript}
     }
     document.querySelectorAll('input[name="tools"]').forEach(cb => cb.addEventListener('change', updateCount));
+    updateCount();
   </script>`;
+  const subtitle = customMessage ? escapeHtml3(customMessage) : `Choose which tools ${escapeHtml3(clientName)} can access. You can change this later.`;
   const content = `
     <h1 class="text-3xl font-bold text-gray-900 mb-4">Select Tools to Enable</h1>
     <p class="text-gray-600 mb-6">
-      Choose which tools ${escapeHtml3(clientName)} can access. You can change this later.
+      ${subtitle}
     </p>
 
+    ${errorBanner}
     ${userInfo}
 
-    <form method="POST" action="${escapeHtml3(callbackPath)}" id="consent-form">
+    <form method="GET" action="${escapeHtml3(callbackPath)}" id="consent-form">
       <input type="hidden" name="csrf" value="${escapeHtml3(csrfToken)}">
       <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
+      <input type="hidden" name="consent_submitted" value="1">
+      ${hiddenInputs}
 
       <!-- Select all toggle -->
       <div class="flex items-center justify-between mb-6">
-        <label class="flex items-center gap-3 cursor-pointer">
-          <input type="checkbox" id="select-all" class="w-5 h-5 rounded border-gray-300" checked
-            onchange="document.querySelectorAll('input[name=tools]').forEach(cb => cb.checked = this.checked); updateCount();">
-          <span class="text-gray-700">Select all tools</span>
-        </label>
-        <span id="selection-count" class="text-sm text-gray-500">${tools.length} of ${tools.length} selected</span>
+        ${selectAllControl}
+        <span id="selection-count" class="text-sm text-gray-500">${checkedCount} of ${tools.length} selected</span>
       </div>
 
-      <!-- Tool groups by app -->
+      <!-- Tool groups -->
       <div class="space-y-6 mb-8">
-        ${appGroups}
+        ${toolSection}
       </div>
 
       <!-- Buttons -->
@@ -1348,8 +1407,8 @@ function buildToolConsentPage(params) {
           class="flex-1 px-6 py-3 text-gray-700 bg-gray-100 hover:bg-gray-200 font-medium rounded-lg transition-colors">
           Cancel
         </button>
-        <button type="submit"
-          class="flex-1 px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors">
+        <button type="submit" id="consent-submit"
+          class="flex-1 px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors disabled:opacity-50 disabled:cursor-not-allowed">
           Confirm Selection
         </button>
       </div>
@@ -1357,22 +1416,42 @@ function buildToolConsentPage(params) {
     ${updateCountScript}`;
   return extraWideLayout(content, { title: "Select Tools" });
 }
+function buildLoginFieldHtml(field) {
+  const id = `field-${field.name}`;
+  const safeName = escapeHtml3(field.name);
+  const requiredAttr = field.required ? " required" : "";
+  const labelText = escapeHtml3(field.label ?? field.name);
+  const safeValue = field.value !== void 0 ? escapeHtml3(field.value) : "";
+  if (field.type === "hidden") {
+    return `<input type="hidden" name="${safeName}" value="${safeValue}">`;
+  }
+  const inputClass = "w-full px-4 py-3 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-blue-500";
+  let control;
+  if (field.type === "select") {
+    const opts = (field.options ?? []).map(
+      (o) => `<option value="${escapeHtml3(o.value)}"${o.value === field.value ? " selected" : ""}>${escapeHtml3(
+        o.label
+      )}</option>`
+    ).join("");
+    control = `<select id="${escapeHtml3(id)}" name="${safeName}"${requiredAttr} class="${inputClass}">${opts}</select>`;
+  } else {
+    const placeholder = field.placeholder ? ` placeholder="${escapeHtml3(field.placeholder)}"` : "";
+    control = `<input type="${escapeHtml3(field.type)}" id="${escapeHtml3(
+      id
+    )}" name="${safeName}"${requiredAttr}${placeholder} value="${safeValue}" class="${inputClass}">`;
+  }
+  return `<div class="mb-4">
+          <label for="${escapeHtml3(id)}" class="block text-sm font-medium text-gray-700 mb-2">${labelText}</label>
+          ${control}
+        </div>`;
+}
 function buildLoginPage(params) {
-  const { clientName, scope, pendingAuthId, callbackPath } = params;
+  const { clientName, scope, pendingAuthId, callbackPath, title, subtitle, logoUri, error, extraFields } = params;
   const scopesHtml = scope ? `<div class="p-4 bg-gray-50 rounded-lg mb-6">
         <p class="text-xs font-medium text-gray-500 uppercase tracking-wide mb-2">Requested permissions</p>
         <p class="text-gray-700">${scope.split(" ").map((s) => escapeHtml3(s)).join(", ") || "Default access"}</p>
       </div>` : "";
-  const content = `
-    <div class="bg-white rounded-2xl shadow-xl p-8">
-      <h1 class="text-3xl font-bold text-gray-900 mb-2 text-center">Sign In</h1>
-      <p class="text-gray-600 mb-8 text-center">Authorize access to ${escapeHtml3(clientName)}</p>
-
-      ${scopesHtml}
-
-      <form method="GET" action="${escapeHtml3(callbackPath)}">
-        <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
-
+  const defaultFieldsHtml = `
         <!-- Email -->
         <div class="mb-4">
           <label for="email" class="block text-sm font-medium text-gray-700 mb-2">Email</label>
@@ -1385,7 +1464,27 @@ function buildLoginPage(params) {
           <label for="name" class="block text-sm font-medium text-gray-700 mb-2">Name (optional)</label>
           <input type="text" id="name" name="name" placeholder="Your name"
             class="w-full px-4 py-3 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-blue-500">
-        </div>
+        </div>`;
+  const fieldsHtml = extraFields && extraFields.length > 0 ? extraFields.map((f) => buildLoginFieldHtml(f)).join("\n") : defaultFieldsHtml;
+  const logoHtml = logoUri ? `<div class="flex justify-center mb-4"><img src="${escapeHtml3(
+    logoUri
+  )}" alt="${escapeHtml3(clientName)}" class="h-12 w-12 rounded-lg object-cover"></div>` : "";
+  const errorHtml = error ? `<div class="p-3 mb-6 bg-red-50 border border-red-200 rounded-lg text-sm text-red-700">${escapeHtml3(error)}</div>` : "";
+  const headingText = escapeHtml3(title ?? "Sign In");
+  const subtitleText = subtitle ? escapeHtml3(subtitle) : `Authorize access to ${escapeHtml3(clientName)}`;
+  const content = `
+    <div class="bg-white rounded-2xl shadow-xl p-8">
+      ${logoHtml}
+      <h1 class="text-3xl font-bold text-gray-900 mb-2 text-center">${headingText}</h1>
+      <p class="text-gray-600 mb-8 text-center">${subtitleText}</p>
+
+      ${errorHtml}
+
+      ${scopesHtml}
+
+      <form method="GET" action="${escapeHtml3(callbackPath)}">
+        <input type="hidden" name="pending_auth_id" value="${escapeHtml3(pendingAuthId)}">
+${fieldsHtml}
 
         <!-- Submit -->
         <button type="submit"
@@ -1396,7 +1495,51 @@ function buildLoginPage(params) {
 
       <p class="text-center text-sm text-gray-500 mt-6">Client: ${escapeHtml3(clientName)}</p>
     </div>`;
-  return centeredCardLayout(content, { title: "Sign In" });
+  return centeredCardLayout(content, { title: title ?? "Sign In" });
+}
+function buildConnectPage(params) {
+  const { token, field, action, title, subtitle, logoUri, error } = params;
+  const logoHtml = logoUri ? `<div class="flex justify-center mb-4"><img src="${escapeHtml3(
+    logoUri
+  )}" alt="Connect" class="h-12 w-12 rounded-lg object-cover"></div>` : "";
+  const errorHtml = error ? `<div class="p-3 mb-6 bg-red-50 border border-red-200 rounded-lg text-sm text-red-700">${escapeHtml3(error)}</div>` : "";
+  const headingText = escapeHtml3(title ?? "Connect credential");
+  const subtitleText = subtitle ? escapeHtml3(subtitle) : `Connect "${escapeHtml3(field.name)}" to continue`;
+  const content = `
+    <div class="bg-white rounded-2xl shadow-xl p-8">
+      ${logoHtml}
+      <h1 class="text-3xl font-bold text-gray-900 mb-2 text-center">${headingText}</h1>
+      <p class="text-gray-600 mb-8 text-center">${subtitleText}</p>
+
+      ${errorHtml}
+
+      <form method="POST" action="${escapeHtml3(action)}">
+        <input type="hidden" name="token" value="${escapeHtml3(token)}">
+${buildLoginFieldHtml(field)}
+
+        <button type="submit"
+          class="w-full px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors">
+          Connect
+        </button>
+      </form>
+    </div>`;
+  return centeredCardLayout(content, { title: title ?? "Connect credential" });
+}
+function buildConnectSuccessPage(params) {
+  const { key, message } = params;
+  const content = `
+    <div class="bg-white rounded-2xl shadow-xl p-8 text-center">
+      <div class="flex justify-center mb-6">
+        <div class="w-16 h-16 rounded-full bg-green-100 flex items-center justify-center">
+          <svg class="w-8 h-8 text-green-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
+          </svg>
+        </div>
+      </div>
+      <h1 class="text-2xl font-bold text-gray-900 mb-4">Credential connected</h1>
+      <p class="text-gray-600">${escapeHtml3(message ?? `"${key}" is now connected. You can return to your session.`)}</p>
+    </div>`;
+  return centeredCardLayout(content, { title: "Connected" });
 }
 function buildErrorPage(params) {
   const { error, description } = params;
@@ -1423,6 +1566,37 @@ function renderToHtml(html, _options) {
   return html;
 }
 
+// libs/auth/src/ui/local-login.helper.ts
+function toLoginExtraFields(fields, values) {
+  if (!fields) return [];
+  return Object.entries(fields).map(([name, def]) => ({
+    name,
+    type: def.type,
+    label: def.label,
+    required: def.required,
+    placeholder: def.placeholder,
+    options: def.options,
+    value: values?.[name]
+  }));
+}
+function renderLocalLoginPage(login, ctx, values) {
+  if (login?.render) {
+    return login.render({ ...ctx, values });
+  }
+  const extraFields = login?.fields ? toLoginExtraFields(login.fields, values) : void 0;
+  return buildLoginPage({
+    clientName: ctx.clientName,
+    scope: ctx.scopes.join(" "),
+    pendingAuthId: ctx.pendingAuthId,
+    callbackPath: ctx.callbackPath,
+    title: login?.title,
+    subtitle: login?.subtitle,
+    logoUri: login?.logoUri ?? ctx.logoUri,
+    error: ctx.error,
+    extraFields
+  });
+}
+
 // libs/auth/src/session/authorization.store.ts
 var import_lazy_zod = require("@frontmcp/lazy-zod");
 var import_utils4 = require("@frontmcp/utils");
@@ -1450,8 +1624,83 @@ var authorizationCodeRecordSchema = import_lazy_zod.z.object({
   skippedProviderIds: import_lazy_zod.z.array(import_lazy_zod.z.string()).optional(),
   consentEnabled: import_lazy_zod.z.boolean().optional(),
   federatedLoginUsed: import_lazy_zod.z.boolean().optional(),
-  pendingAuthId: import_lazy_zod.z.string().optional()
+  pendingAuthId: import_lazy_zod.z.string().optional(),
+  // Progressive/Incremental authorization: granted app-id set.
+  authorizedAppIds: import_lazy_zod.z.array(import_lazy_zod.z.string()).optional(),
+  // Custom claims from a local authenticate() verifier (Checkpoint 3a).
+  customClaims: import_lazy_zod.z.record(import_lazy_zod.z.string(), import_lazy_zod.z.unknown()).optional()
 });
+var AUTH_CODE_TTL_MS = 60 * 1e3;
+var PENDING_AUTH_TTL_MS = 10 * 60 * 1e3;
+var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+function generateAuthorizationCode() {
+  return (0, import_utils4.randomUUID)().replace(/-/g, "") + (0, import_utils4.randomUUID)().replace(/-/g, "");
+}
+function generateRefreshTokenValue() {
+  return (0, import_utils4.randomUUID)() + "-" + (0, import_utils4.randomUUID)();
+}
+function buildCodeRecord(params) {
+  const now = Date.now();
+  return {
+    code: generateAuthorizationCode(),
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    pkce: params.pkce,
+    userSub: params.userSub,
+    userEmail: params.userEmail,
+    userName: params.userName,
+    state: params.state,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + AUTH_CODE_TTL_MS,
+    used: false,
+    selectedToolIds: params.selectedToolIds,
+    selectedProviderIds: params.selectedProviderIds,
+    skippedProviderIds: params.skippedProviderIds,
+    consentEnabled: params.consentEnabled,
+    federatedLoginUsed: params.federatedLoginUsed,
+    pendingAuthId: params.pendingAuthId,
+    authorizedAppIds: params.authorizedAppIds,
+    customClaims: params.customClaims
+  };
+}
+function buildPendingRecord(params) {
+  const now = Date.now();
+  return {
+    id: (0, import_utils4.randomUUID)(),
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scopes: params.scopes,
+    pkce: params.pkce,
+    state: params.state,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + PENDING_AUTH_TTL_MS,
+    isIncremental: params.isIncremental,
+    targetAppId: params.targetAppId,
+    targetToolId: params.targetToolId,
+    existingSessionId: params.existingSessionId,
+    existingAuthorizationId: params.existingAuthorizationId,
+    priorAuthorizedAppIds: params.priorAuthorizedAppIds,
+    federatedLogin: params.federatedLogin,
+    consent: params.consent,
+    authUiCsrf: params.authUiCsrf
+  };
+}
+function buildRefreshTokenRecord(params) {
+  const now = Date.now();
+  return {
+    token: generateRefreshTokenValue(),
+    clientId: params.clientId,
+    userSub: params.userSub,
+    scopes: params.scopes,
+    resource: params.resource,
+    createdAt: now,
+    expiresAt: now + REFRESH_TOKEN_TTL_MS,
+    revoked: false
+  };
+}
 function verifyPkce(codeVerifier, challenge) {
   if (challenge.method !== "S256") {
     return false;
@@ -1467,17 +1716,11 @@ var InMemoryAuthorizationStore = class {
   codes = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   refreshTokens = /* @__PURE__ */ new Map();
-  /** Default TTL for authorization codes (60 seconds) */
-  codeTtlMs = 60 * 1e3;
-  /** Default TTL for pending authorizations (10 minutes) */
-  pendingTtlMs = 10 * 60 * 1e3;
-  /** Default TTL for refresh tokens (30 days) */
-  refreshTtlMs = 30 * 24 * 60 * 60 * 1e3;
   generateCode() {
-    return (0, import_utils4.randomUUID)().replace(/-/g, "") + (0, import_utils4.randomUUID)().replace(/-/g, "");
+    return generateAuthorizationCode();
   }
   generateRefreshToken() {
-    return (0, import_utils4.randomUUID)() + "-" + (0, import_utils4.randomUUID)();
+    return generateRefreshTokenValue();
   }
   async storeAuthorizationCode(record) {
     this.codes.set(record.code, record);
@@ -1556,76 +1799,22 @@ var InMemoryAuthorizationStore = class {
     }
   }
   /**
-   * Create an authorization code record with defaults
+   * Create an authorization code record with defaults.
    */
   createCodeRecord(params) {
-    const now = Date.now();
-    return {
-      code: this.generateCode(),
-      clientId: params.clientId,
-      redirectUri: params.redirectUri,
-      scopes: params.scopes,
-      pkce: params.pkce,
-      userSub: params.userSub,
-      userEmail: params.userEmail,
-      userName: params.userName,
-      state: params.state,
-      resource: params.resource,
-      createdAt: now,
-      expiresAt: now + this.codeTtlMs,
-      used: false,
-      // Consent and Federated Login Data
-      selectedToolIds: params.selectedToolIds,
-      selectedProviderIds: params.selectedProviderIds,
-      skippedProviderIds: params.skippedProviderIds,
-      consentEnabled: params.consentEnabled,
-      federatedLoginUsed: params.federatedLoginUsed,
-      // Token migration ID (for federated auth)
-      pendingAuthId: params.pendingAuthId
-    };
+    return buildCodeRecord(params);
   }
   /**
-   * Create a pending authorization record with defaults
+   * Create a pending authorization record with defaults.
    */
   createPendingRecord(params) {
-    const now = Date.now();
-    return {
-      id: (0, import_utils4.randomUUID)(),
-      clientId: params.clientId,
-      redirectUri: params.redirectUri,
-      scopes: params.scopes,
-      pkce: params.pkce,
-      state: params.state,
-      resource: params.resource,
-      createdAt: now,
-      expiresAt: now + this.pendingTtlMs,
-      // Progressive/Incremental Authorization Fields
-      isIncremental: params.isIncremental,
-      targetAppId: params.targetAppId,
-      targetToolId: params.targetToolId,
-      existingSessionId: params.existingSessionId,
-      existingAuthorizationId: params.existingAuthorizationId,
-      // Federated Login State
-      federatedLogin: params.federatedLogin,
-      // Consent State
-      consent: params.consent
-    };
+    return buildPendingRecord(params);
   }
   /**
-   * Create a refresh token record with defaults
+   * Create a refresh token record with defaults.
    */
   createRefreshTokenRecord(params) {
-    const now = Date.now();
-    return {
-      token: this.generateRefreshToken(),
-      clientId: params.clientId,
-      userSub: params.userSub,
-      scopes: params.scopes,
-      resource: params.resource,
-      createdAt: now,
-      expiresAt: now + this.refreshTtlMs,
-      revoked: false
-    };
+    return buildRefreshTokenRecord(params);
   }
 };
 var RedisAuthorizationStore = class {
@@ -1637,10 +1826,19 @@ var RedisAuthorizationStore = class {
     return `${this.namespace}${type}:${id}`;
   }
   generateCode() {
-    return (0, import_utils4.randomUUID)().replace(/-/g, "") + (0, import_utils4.randomUUID)().replace(/-/g, "");
+    return generateAuthorizationCode();
   }
   generateRefreshToken() {
-    return (0, import_utils4.randomUUID)() + "-" + (0, import_utils4.randomUUID)();
+    return generateRefreshTokenValue();
+  }
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
   }
   async storeAuthorizationCode(record) {
     const ttl = Math.max(Math.ceil((record.expiresAt - Date.now()) / 1e3), 1);
@@ -1702,6 +1900,130 @@ var RedisAuthorizationStore = class {
   }
 };
 
+// libs/auth/src/session/storage-authorization.store.ts
+var import_utils5 = require("@frontmcp/utils");
+var StorageAuthorizationStore = class {
+  codeStore;
+  pendingStore;
+  refreshStore;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "oauth";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const base = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.codeStore = new import_utils5.TypedStorage(base);
+    this.pendingStore = new import_utils5.TypedStorage(base);
+    this.refreshStore = new import_utils5.TypedStorage(base);
+  }
+  // ============================================
+  // Record builders (pure; shared with in-memory store)
+  // ============================================
+  generateCode() {
+    return generateAuthorizationCode();
+  }
+  generateRefreshToken() {
+    return generateRefreshTokenValue();
+  }
+  createCodeRecord(params) {
+    return buildCodeRecord(params);
+  }
+  createPendingRecord(params) {
+    return buildPendingRecord(params);
+  }
+  createRefreshTokenRecord(params) {
+    return buildRefreshTokenRecord(params);
+  }
+  // ============================================
+  // Authorization code operations
+  // ============================================
+  async storeAuthorizationCode(record) {
+    await this.codeStore.set(this.key("code", record.code), record, this.ttl(record.expiresAt));
+  }
+  async getAuthorizationCode(code) {
+    const record = await this.codeStore.get(this.key("code", code));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      await this.codeStore.delete(this.key("code", code));
+      return null;
+    }
+    return record;
+  }
+  async markCodeUsed(code) {
+    const record = await this.getAuthorizationCode(code);
+    if (record) {
+      record.used = true;
+      await this.codeStore.set(this.key("code", code), record, this.ttl(record.expiresAt));
+    }
+  }
+  async deleteAuthorizationCode(code) {
+    await this.codeStore.delete(this.key("code", code));
+  }
+  // ============================================
+  // Pending authorization operations
+  // ============================================
+  async storePendingAuthorization(record) {
+    await this.pendingStore.set(this.key("pending", record.id), record, this.ttl(record.expiresAt));
+  }
+  async getPendingAuthorization(id) {
+    const record = await this.pendingStore.get(this.key("pending", id));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt) {
+      await this.pendingStore.delete(this.key("pending", id));
+      return null;
+    }
+    return record;
+  }
+  async deletePendingAuthorization(id) {
+    await this.pendingStore.delete(this.key("pending", id));
+  }
+  // ============================================
+  // Refresh token operations
+  // ============================================
+  async storeRefreshToken(record) {
+    await this.refreshStore.set(this.key("refresh", record.token), record, this.ttl(record.expiresAt));
+  }
+  async getRefreshToken(token) {
+    const record = await this.refreshStore.get(this.key("refresh", token));
+    if (!record) return null;
+    if (Date.now() > record.expiresAt || record.revoked) {
+      return null;
+    }
+    return record;
+  }
+  async revokeRefreshToken(token) {
+    const record = await this.refreshStore.get(this.key("refresh", token));
+    if (record) {
+      record.revoked = true;
+      await this.refreshStore.set(this.key("refresh", token), record, this.ttl(record.expiresAt));
+    }
+  }
+  async rotateRefreshToken(oldToken, newRecord) {
+    await this.revokeRefreshToken(oldToken);
+    newRecord.previousToken = oldToken;
+    await this.storeRefreshToken(newRecord);
+  }
+  // ============================================
+  // Utility
+  // ============================================
+  async cleanup() {
+  }
+  // ============================================
+  // Internals
+  // ============================================
+  ttl(expiresAtMs) {
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return { ttlSeconds: ttl > 0 ? ttl : 1 };
+  }
+  key(type, id) {
+    const composite = `${type}:${id}`;
+    return this.storageIsNamespaced ? composite : `${this.namespace}:${composite}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
 // libs/auth/src/session/authorization-vault.ts
 var import_lazy_zod2 = require("@frontmcp/lazy-zod");
 var credentialTypeSchema = import_lazy_zod2.z.enum([
@@ -1963,9 +2285,12 @@ var authorizationVaultEntrySchema = import_lazy_zod2.z.object({
   skippedAppIds: import_lazy_zod2.z.array(import_lazy_zod2.z.string())
 });
 
+// libs/auth/src/session/session-credential-vault.ts
+var import_utils7 = require("@frontmcp/utils");
+
 // libs/auth/src/session/vault-encryption.ts
 var import_lazy_zod3 = require("@frontmcp/lazy-zod");
-var import_utils5 = require("@frontmcp/utils");
+var import_utils6 = require("@frontmcp/utils");
 var encryptedDataSchema = import_lazy_zod3.z.object({
   /** Version for future algorithm changes */
   v: import_lazy_zod3.z.literal(1),
@@ -2005,7 +2330,7 @@ var VaultEncryption = class {
     ];
     const ikm = new TextEncoder().encode(ikmParts.join(""));
     const infoBytes = new TextEncoder().encode(this.hkdfInfo);
-    const key = await (0, import_utils5.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
+    const key = await (0, import_utils6.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
     return key;
   }
   /**
@@ -2032,7 +2357,7 @@ var VaultEncryption = class {
     ];
     const ikm = new TextEncoder().encode(ikmParts.join(""));
     const infoBytes = new TextEncoder().encode(this.hkdfInfo);
-    const key = await (0, import_utils5.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
+    const key = await (0, import_utils6.hkdfSha256)(ikm, new Uint8Array(0), infoBytes, 32);
     return key;
   }
   /**
@@ -2046,14 +2371,14 @@ var VaultEncryption = class {
     if (key.length !== 32) {
       throw new Error("Encryption key must be 32 bytes");
     }
-    const iv = (0, import_utils5.randomBytes)(12);
-    const { ciphertext, tag } = await (0, import_utils5.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils6.randomBytes)(12);
+    const { ciphertext, tag } = await (0, import_utils6.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
     return {
       v: 1,
       alg: "aes-256-gcm",
-      iv: (0, import_utils5.base64urlEncode)(iv),
-      ct: (0, import_utils5.base64urlEncode)(ciphertext),
-      tag: (0, import_utils5.base64urlEncode)(tag)
+      iv: (0, import_utils6.base64urlEncode)(iv),
+      ct: (0, import_utils6.base64urlEncode)(ciphertext),
+      tag: (0, import_utils6.base64urlEncode)(tag)
     };
   }
   /**
@@ -2073,74 +2398,707 @@ var VaultEncryption = class {
       throw new Error("Invalid encrypted data format");
     }
     const { iv, ct, tag } = parsed.data;
-    const ivBuffer = (0, import_utils5.base64urlDecode)(iv);
-    const ciphertext = (0, import_utils5.base64urlDecode)(ct);
-    const tagBuffer = (0, import_utils5.base64urlDecode)(tag);
+    const ivBuffer = (0, import_utils6.base64urlDecode)(iv);
+    const ciphertext = (0, import_utils6.base64urlDecode)(ct);
+    const tagBuffer = (0, import_utils6.base64urlDecode)(tag);
     try {
-      const plaintext = await (0, import_utils5.decryptAesGcm)(key, ciphertext, ivBuffer, tagBuffer);
+      const plaintext = await (0, import_utils6.decryptAesGcm)(key, ciphertext, ivBuffer, tagBuffer);
       return new TextDecoder().decode(plaintext);
     } catch (_error) {
       throw new Error("Decryption failed: invalid key or corrupted data");
     }
   }
-  /**
-   * Encrypt a JavaScript object (serializes to JSON first)
-   *
-   * @param data - Object to encrypt
-   * @param key - Encryption key
-   * @returns Encrypted data
-   */
-  async encryptObject(data, key) {
-    return this.encrypt(JSON.stringify(data), key);
+  /**
+   * Encrypt a JavaScript object (serializes to JSON first)
+   *
+   * @param data - Object to encrypt
+   * @param key - Encryption key
+   * @returns Encrypted data
+   */
+  async encryptObject(data, key) {
+    return this.encrypt(JSON.stringify(data), key);
+  }
+  /**
+   * Decrypt and parse a JavaScript object
+   *
+   * @param encrypted - Encrypted data
+   * @param key - Encryption key
+   * @returns Decrypted and parsed object
+   */
+  async decryptObject(encrypted, key) {
+    const plaintext = await this.decrypt(encrypted, key);
+    return JSON.parse(plaintext);
+  }
+  /**
+   * Check if data is in encrypted format
+   *
+   * @param data - Data to check
+   * @returns True if data appears to be encrypted
+   */
+  isEncrypted(data) {
+    return encryptedDataSchema.safeParse(data).success;
+  }
+};
+var encryptedVaultEntrySchema = import_lazy_zod3.z.object({
+  /** Vault ID (maps to JWT jti claim) */
+  id: import_lazy_zod3.z.string(),
+  /** User subject identifier */
+  userSub: import_lazy_zod3.z.string(),
+  /** User email (unencrypted for display) */
+  userEmail: import_lazy_zod3.z.string().optional(),
+  /** User name (unencrypted for display) */
+  userName: import_lazy_zod3.z.string().optional(),
+  /** Client ID that created this session */
+  clientId: import_lazy_zod3.z.string(),
+  /** Creation timestamp */
+  createdAt: import_lazy_zod3.z.number(),
+  /** Last access timestamp */
+  lastAccessAt: import_lazy_zod3.z.number(),
+  /** Encrypted sensitive data (provider tokens, credentials, consent) */
+  encryptedData: encryptedDataSchema,
+  /** Apps that are fully authorized (unencrypted for quick lookup) */
+  authorizedAppIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()),
+  /** Apps that were skipped (unencrypted for quick lookup) */
+  skippedAppIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()),
+  /** Pending auth IDs (unencrypted for lookup, actual URLs encrypted) */
+  pendingAuthIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).default([])
+});
+
+// libs/auth/src/session/session-credential-vault.ts
+var DEFAULT_KEY_PREFIX = "mcp:cred:";
+var DEFAULT_PENDING_TTL_MS = 6e5;
+var SessionCredentialVault = class {
+  storage;
+  encryption;
+  keyPrefix;
+  ttlMs;
+  pendingTtlMs;
+  logger;
+  /** Cache of derived AES keys, keyed by `${sub}:${vaultId}`. */
+  keyCache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.storage = options.storage;
+    this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
+    this.ttlMs = options.ttlMs;
+    this.pendingTtlMs = options.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.logger = options.logger ?? noopAuthLogger;
+    const pepper = options.pepper ?? resolveVaultPepper(this.logger);
+    this.encryption = new VaultEncryption({ pepper, hkdfInfo: "frontmcp-session-credential-vault-v1" });
+  }
+  // ============================================
+  // Storage-key helpers
+  // ============================================
+  /** `cred:idx:<sub>` → current vaultId (the sub → vaultId indirection). */
+  indexKey(sub) {
+    return `${this.keyPrefix}idx:${sub}`;
+  }
+  /** `cred:keys:<sub>:<vaultId>` → JSON array of credential key names (the SET). */
+  keysKey(sub, vaultId) {
+    return `${this.keyPrefix}keys:${sub}:${vaultId}`;
+  }
+  /** `cred:data:<sub>:<vaultId>:<key>` → encrypted credential record. */
+  dataKey(sub, vaultId, key) {
+    return `${this.keyPrefix}data:${sub}:${vaultId}:${key}`;
+  }
+  /** `cred:pending:<pendingId>` → encrypted pending-authorize accumulator. */
+  pendingKey(pendingId) {
+    return `${this.keyPrefix}pending:${pendingId}`;
+  }
+  /** Convert the configured `ttlMs` into `SetOptions` (storage uses `ttlSeconds`). */
+  get credentialSetOpts() {
+    return this.ttlMs ? { ttlSeconds: Math.ceil(this.ttlMs / 1e3) } : void 0;
+  }
+  // ============================================
+  // Key derivation
+  // ============================================
+  /**
+   * Derive (and cache) the AES-256 key for a `(sub, vaultId)` pair. The vaultId
+   * acts as the HKDF salt, so rotating it makes prior ciphertext undecryptable.
+   */
+  deriveKey(sub, vaultId) {
+    const cacheKey = `${sub}:${vaultId}`;
+    const cached = this.keyCache.get(cacheKey);
+    if (cached) return cached;
+    const promise = this.encryption.deriveKey({ jti: vaultId, vaultKey: vaultId, sub, iat: 0 });
+    this.keyCache.set(cacheKey, promise);
+    return promise;
+  }
+  // ============================================
+  // vaultId indirection
+  // ============================================
+  /**
+   * Read the current vaultId for a subject, or undefined when the subject has no
+   * live vault (never authorized, or rotated away).
+   */
+  async getVaultId(sub) {
+    const raw = await this.storage.get(this.indexKey(sub));
+    return raw ?? void 0;
+  }
+  /**
+   * Mint a FRESH vaultId for a subject and point the indirection at it. Called
+   * at the start of each authorize so reconnect = empty vault. Returns the new
+   * vaultId. The old vaultId's ciphertext is left in storage but is
+   * unreachable (no index pointer) and undecryptable (different derived key);
+   * it expires via TTL when configured.
+   */
+  async rotateVault(sub) {
+    const vaultId = (0, import_utils7.randomUUID)();
+    await this.storage.set(this.indexKey(sub), vaultId, this.credentialSetOpts);
+    return vaultId;
+  }
+  // ============================================
+  // Credential CRUD (committed vault)
+  // ============================================
+  /**
+   * Encrypt + store a single credential into the vault identified by
+   * `(sub, vaultId)` and add its key to the key set. Used both to commit
+   * authorize-time credentials and to additively add a credential mid-session.
+   */
+  async store(sub, vaultId, key, value) {
+    const aesKey = await this.deriveKey(sub, vaultId);
+    const enc = await this.encryption.encryptObject(this.normalize(value), aesKey);
+    const record = { enc };
+    await this.storage.set(this.dataKey(sub, vaultId, key), JSON.stringify(record), this.credentialSetOpts);
+    await this.addKeyToSet(sub, vaultId, key);
+  }
+  /**
+   * Decrypt and return a credential by key for a subject's CURRENT vault.
+   * Returns undefined when there is no live vault or no such key, or when
+   * decryption fails (e.g. a stale pointer to rotated-away ciphertext).
+   */
+  async get(sub, key) {
+    const vaultId = await this.getVaultId(sub);
+    if (!vaultId) return void 0;
+    const raw = await this.storage.get(this.dataKey(sub, vaultId, key));
+    if (!raw) return void 0;
+    try {
+      const record = JSON.parse(raw);
+      const aesKey = await this.deriveKey(sub, vaultId);
+      return await this.encryption.decryptObject(record.enc, aesKey);
+    } catch (err) {
+      this.logger.warn(`SessionCredentialVault: failed to read credential "${key}": ${errMsg(err)}`);
+      return void 0;
+    }
+  }
+  /**
+   * List the credential keys available in a subject's current vault. Returns an
+   * empty array when there is no live vault (e.g. after rotation on reconnect).
+   */
+  async list(sub) {
+    const vaultId = await this.getVaultId(sub);
+    if (!vaultId) return [];
+    return this.readKeySet(sub, vaultId);
+  }
+  /**
+   * Remove a credential by key from a subject's current vault (deletes the
+   * ciphertext and drops the key from the set). No-op when absent.
+   */
+  async remove(sub, key) {
+    const vaultId = await this.getVaultId(sub);
+    if (!vaultId) return;
+    await this.storage.delete(this.dataKey(sub, vaultId, key));
+    const keys = await this.readKeySet(sub, vaultId);
+    const next = keys.filter((k) => k !== key);
+    if (next.length !== keys.length) {
+      await this.writeKeySet(sub, vaultId, next);
+    }
+  }
+  // ============================================
+  // Authorize-time accumulation + commit
+  // ============================================
+  /**
+   * Stage credentials returned by `authenticate()` under a pending id, encrypted
+   * against a freshly-rotated vaultId for `sub`. They are NOT visible to tools
+   * until {@link commit} flushes them — this lets the authorize flow accumulate
+   * credentials before the subject's identity is final.
+   *
+   * @returns the vaultId the credentials were staged against.
+   */
+  async stage(pendingId, sub, credentials) {
+    const vaultId = await this.rotateVault(sub);
+    const creds = {};
+    for (const cred of credentials) {
+      const aesKey = await this.deriveKey(sub, vaultId);
+      const { key, ...value } = cred;
+      creds[key] = { enc: await this.encryption.encryptObject(this.normalize(value), aesKey) };
+    }
+    const batch = { sub, vaultId, creds };
+    await this.storage.set(this.pendingKey(pendingId), JSON.stringify(batch), {
+      ttlSeconds: Math.ceil(this.pendingTtlMs / 1e3)
+    });
+    return vaultId;
+  }
+  /**
+   * Flush a staged batch into the live vault, binding it to `sub`. The staged
+   * batch's `sub` must equal the supplied `sub` (the one baked into the minted
+   * token) — a mismatch is refused so credentials can never be committed under a
+   * different identity than the one that will read them.
+   *
+   * @returns true when a batch was committed, false when none was staged.
+   */
+  async commit(pendingId, sub) {
+    const raw = await this.storage.get(this.pendingKey(pendingId));
+    if (!raw) return false;
+    let batch;
+    try {
+      batch = JSON.parse(raw);
+    } catch {
+      await this.storage.delete(this.pendingKey(pendingId));
+      return false;
+    }
+    if (batch.sub !== sub) {
+      this.logger.warn("SessionCredentialVault: pending batch subject mismatch on commit; discarding");
+      await this.storage.delete(this.pendingKey(pendingId));
+      return false;
+    }
+    await this.storage.set(this.indexKey(sub), batch.vaultId, this.credentialSetOpts);
+    const keys = [];
+    for (const [key, record] of Object.entries(batch.creds)) {
+      await this.storage.set(this.dataKey(sub, batch.vaultId, key), JSON.stringify(record), this.credentialSetOpts);
+      keys.push(key);
+    }
+    await this.writeKeySet(sub, batch.vaultId, keys);
+    await this.storage.delete(this.pendingKey(pendingId));
+    return true;
+  }
+  // ============================================
+  // Key-set helpers
+  // ============================================
+  async readKeySet(sub, vaultId) {
+    const raw = await this.storage.get(this.keysKey(sub, vaultId));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.filter((k) => typeof k === "string") : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeKeySet(sub, vaultId, keys) {
+    const unique = [...new Set(keys)];
+    await this.storage.set(this.keysKey(sub, vaultId), JSON.stringify(unique), this.credentialSetOpts);
+  }
+  async addKeyToSet(sub, vaultId, key) {
+    const keys = await this.readKeySet(sub, vaultId);
+    if (!keys.includes(key)) {
+      keys.push(key);
+      await this.writeKeySet(sub, vaultId, keys);
+    }
+  }
+  /** Strip undefined metadata so the encrypted JSON stays minimal. */
+  normalize(value) {
+    return value.metadata === void 0 ? { secret: value.secret } : { secret: value.secret, metadata: value.metadata };
+  }
+};
+function resolveVaultPepper(logger) {
+  const fromEnv = (0, import_utils7.getEnv)("VAULT_SECRET") ?? (0, import_utils7.getEnv)("JWT_SECRET");
+  if (fromEnv && fromEnv.trim().length > 0) return fromEnv;
+  logger.warn(
+    "SessionCredentialVault: neither VAULT_SECRET nor JWT_SECRET is set; using a random per-process pepper. Stored credentials will NOT survive a restart and cannot be shared across instances. Set VAULT_SECRET (or JWT_SECRET) for persistent, multi-instance credential storage."
+  );
+  return (0, import_utils7.randomUUID)() + (0, import_utils7.randomUUID)();
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// libs/auth/src/session/token-storage.factory.ts
+var import_utils8 = require("@frontmcp/utils");
+function isRedisTokenStorage(config) {
+  return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
+}
+function isSqliteTokenStorage(config) {
+  return typeof config === "object" && config !== null && "sqlite" in config && !!config.sqlite;
+}
+function isPersistentTokenStorage(config) {
+  return config !== void 0 && config !== "memory";
+}
+async function createTokenStorageAdapter(config) {
+  if (config === void 0 || config === "memory") {
+    const adapter = new import_utils8.MemoryStorageAdapter();
+    await adapter.connect();
+    return adapter;
+  }
+  if (isSqliteTokenStorage(config)) {
+    const { SqliteStorageAdapter } = require("@frontmcp/storage-sqlite");
+    const adapter = new SqliteStorageAdapter({
+      path: config.sqlite.path,
+      encryption: config.sqlite.encryption,
+      ttlCleanupIntervalMs: config.sqlite.ttlCleanupIntervalMs ?? 6e4,
+      walMode: config.sqlite.walMode ?? true
+    });
+    await adapter.connect();
+    return adapter;
+  }
+  if (isRedisTokenStorage(config)) {
+    const { host, port, password, db, tls, keyPrefix } = config.redis;
+    const adapter = new import_utils8.RedisStorageAdapter({
+      config: { host, port, password, db, tls },
+      keyPrefix: keyPrefix ?? ""
+    });
+    await adapter.connect();
+    return adapter;
+  }
+  const fallback = new import_utils8.MemoryStorageAdapter();
+  await fallback.connect();
+  return fallback;
+}
+
+// libs/auth/src/session/session-credential-vault.factory.ts
+async function createSessionCredentialVault(options) {
+  const storage = options.storage ?? await createTokenStorageAdapter(options.tokenStorage);
+  const vault = new SessionCredentialVault({
+    storage,
+    pepper: options.pepper,
+    keyPrefix: options.keyPrefix,
+    ttlMs: options.ttlMs,
+    logger: options.logger
+  });
+  const type = options.tokenStorage === void 0 || options.tokenStorage === "memory" ? "memory" : "sqlite" in options.tokenStorage ? "sqlite" : "redis";
+  return { vault, type };
+}
+
+// libs/auth/src/session/credential-resume-link.ts
+var import_utils9 = require("@frontmcp/utils");
+var DEFAULT_RESUME_TTL_MS = 6e5;
+function signCredentialResumeToken(input, secret) {
+  const payload = {
+    sub: input.sub,
+    key: input.key,
+    ...input.context !== void 0 ? { context: input.context } : {},
+    exp: Date.now() + (input.ttlMs ?? DEFAULT_RESUME_TTL_MS)
+  };
+  const signedJson = (0, import_utils9.signData)(payload, { secret });
+  return Buffer.from(signedJson, "utf8").toString("base64url");
+}
+function verifyCredentialResumeToken(token, secret, now = Date.now()) {
+  let signedJson;
+  try {
+    signedJson = Buffer.from(token, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  const payload = (0, import_utils9.verifyData)(signedJson, { secret });
+  if (!payload) return null;
+  if (typeof payload.sub !== "string" || typeof payload.key !== "string" || !Number.isFinite(payload.exp)) {
+    return null;
+  }
+  if (payload.context !== void 0 && typeof payload.context !== "string") {
+    return null;
+  }
+  if (now >= payload.exp) {
+    return null;
+  }
+  return payload;
+}
+function buildCredentialResumeUrl(basePath, token) {
+  const trimmed = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+  return `${trimmed}/oauth/connect?token=${encodeURIComponent(token)}`;
+}
+
+// libs/auth/src/session/credentials-accessor.ts
+var CREDENTIALS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:CREDENTIALS_ACCESSOR");
+
+// libs/auth/src/session/credentials-accessor.impl.ts
+var CredentialsAccessorImpl = class {
+  vault;
+  resolveSub;
+  signingSecret;
+  basePath;
+  resumeTtlMs;
+  logger;
+  constructor(deps) {
+    this.vault = deps.vault;
+    this.resolveSub = deps.resolveSub;
+    this.signingSecret = deps.signingSecret;
+    this.basePath = deps.basePath;
+    this.resumeTtlMs = deps.resumeTtlMs;
+    this.logger = deps.logger ?? noopAuthLogger;
+  }
+  async get(key) {
+    const sub = this.resolveSub();
+    if (!sub) return void 0;
+    return this.vault.get(sub, key);
+  }
+  async list() {
+    const sub = this.resolveSub();
+    if (!sub) return [];
+    return this.vault.list(sub);
+  }
+  async requireConnect(options) {
+    const { key, context } = options;
+    const sub = this.resolveSub();
+    if (sub) {
+      const existing = await this.vault.get(sub, key);
+      if (existing) {
+        return { connected: true, key, credential: existing };
+      }
+    }
+    const token = signCredentialResumeToken(
+      { sub: sub ?? "", key, context, ttlMs: this.resumeTtlMs },
+      this.signingSecret
+    );
+    const resumeUrl = buildCredentialResumeUrl(this.basePath, token);
+    this.logger.debug(`CredentialsAccessor: credential "${key}" not connected; issued resume link`);
+    return {
+      connected: false,
+      key,
+      resumeUrl,
+      message: `Credential "${key}" is not connected. Open the resume URL to connect it.`
+    };
+  }
+};
+
+// libs/auth/src/session/secure-store-backends.ts
+var DEFAULT_KEY_PREFIX2 = "mcp:secret:";
+var EncryptedStorageSecureStoreBackend = class {
+  storage;
+  encryption;
+  keyPrefix;
+  logger;
+  /** Cache of derived AES keys, keyed by namespace. */
+  keyCache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.storage = options.storage;
+    this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX2;
+    this.logger = options.logger ?? noopAuthLogger;
+    this.encryption = new VaultEncryption({
+      pepper: options.pepper,
+      hkdfInfo: "frontmcp-secure-store-v1"
+    });
+  }
+  // ============================================
+  // Storage-key helpers
+  // ============================================
+  /** `secret:keys:<namespace>` → JSON array of key names. */
+  keysKey(namespace) {
+    return `${this.keyPrefix}keys:${namespace}`;
+  }
+  /** `secret:data:<namespace>:<key>` → encrypted record. */
+  dataKey(namespace, key) {
+    return `${this.keyPrefix}data:${namespace}:${key}`;
+  }
+  /**
+   * Derive (and cache) the AES-256 key for a namespace. The namespace acts as
+   * the HKDF salt material, so values are cryptographically isolated per scope.
+   */
+  deriveKey(namespace) {
+    const cached = this.keyCache.get(namespace);
+    if (cached) return cached;
+    const promise = this.encryption.deriveKey({ jti: namespace, vaultKey: namespace, sub: namespace, iat: 0 });
+    this.keyCache.set(namespace, promise);
+    return promise;
+  }
+  setOpts(ttlMs) {
+    return ttlMs && ttlMs > 0 ? { ttlSeconds: Math.ceil(ttlMs / 1e3) } : void 0;
+  }
+  // ============================================
+  // SecureStoreBackend
+  // ============================================
+  async get(namespace, key) {
+    const raw = await this.storage.get(this.dataKey(namespace, key));
+    if (!raw) return null;
+    try {
+      const record = JSON.parse(raw);
+      const aesKey = await this.deriveKey(namespace);
+      return await this.encryption.decrypt(record.enc, aesKey);
+    } catch (err) {
+      this.logger.warn(`SecureStore: failed to read secret "${key}": ${errMsg2(err)}`);
+      return null;
+    }
+  }
+  async set(namespace, key, value, ttlMs) {
+    const aesKey = await this.deriveKey(namespace);
+    const enc = await this.encryption.encrypt(value, aesKey);
+    const record = { enc };
+    const opts = this.setOpts(ttlMs);
+    await this.storage.set(this.dataKey(namespace, key), JSON.stringify(record), opts);
+    await this.addKeyToSet(namespace, key, opts);
+  }
+  async delete(namespace, key) {
+    const existed = await this.storage.delete(this.dataKey(namespace, key));
+    const keys = await this.readKeySet(namespace);
+    const next = keys.filter((k) => k !== key);
+    if (next.length !== keys.length) {
+      await this.writeKeySet(namespace, next);
+    }
+    return existed;
+  }
+  async list(namespace) {
+    return this.readKeySet(namespace);
+  }
+  // ============================================
+  // Key-set helpers (the namespace's key SET)
+  // ============================================
+  async readKeySet(namespace) {
+    const raw = await this.storage.get(this.keysKey(namespace));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.filter((k) => typeof k === "string") : [];
+    } catch {
+      return [];
+    }
+  }
+  async writeKeySet(namespace, keys, opts) {
+    const unique = [...new Set(keys)];
+    await this.storage.set(this.keysKey(namespace), JSON.stringify(unique), opts);
+  }
+  async addKeyToSet(namespace, key, opts) {
+    const keys = await this.readKeySet(namespace);
+    if (!keys.includes(key)) {
+      keys.push(key);
+      await this.writeKeySet(namespace, keys, opts);
+    }
+  }
+};
+function errMsg2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// libs/auth/src/session/secure-store-accessor.ts
+var SECURE_STORE_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_ACCESSOR");
+
+// libs/auth/src/session/secure-store-accessor.impl.ts
+var import_utils10 = require("@frontmcp/utils");
+var GLOBAL_NAMESPACE = "global";
+var SecureStoreAccessorImpl = class {
+  backend;
+  scope;
+  resolveSub;
+  resolveSessionId;
+  ttlMs;
+  logger;
+  constructor(deps) {
+    this.backend = deps.backend;
+    this.scope = deps.scope ?? "user";
+    this.resolveSub = deps.resolveSub;
+    this.resolveSessionId = deps.resolveSessionId;
+    this.ttlMs = deps.ttlMs;
+    this.logger = deps.logger ?? noopAuthLogger;
+  }
+  /**
+   * Resolve the namespace for the current request from the configured scope.
+   * Returns undefined when the scope's identity is unavailable (anonymous user
+   * under `user` scope, or no session under `session` scope), in which case
+   * reads return empty and writes are skipped.
+   */
+  resolveNamespace() {
+    switch (this.scope) {
+      case "global":
+        return GLOBAL_NAMESPACE;
+      case "session": {
+        const sid = this.resolveSessionId();
+        return sid ? `s:${(0, import_utils10.sha256Hex)(sid).slice(0, 32)}` : void 0;
+      }
+      case "user":
+      default: {
+        const sub = this.resolveSub();
+        return sub ? `u:${(0, import_utils10.sha256Hex)(sub).slice(0, 32)}` : void 0;
+      }
+    }
+  }
+  async get(key) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return void 0;
+    const raw = await this.backend.get(namespace, key);
+    if (raw === null) return void 0;
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      this.logger.warn(`SecureStore: failed to parse secret "${key}": ${errMsg3(err)}`);
+      return void 0;
+    }
+  }
+  async set(key, value, options) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) {
+      this.logger.debug(`SecureStore: no ${this.scope} scope for request; skipping set("${key}")`);
+      return;
+    }
+    const ttlMs = options?.ttlMs ?? this.ttlMs;
+    await this.backend.set(namespace, key, JSON.stringify(value), ttlMs);
   }
-  /**
-   * Decrypt and parse a JavaScript object
-   *
-   * @param encrypted - Encrypted data
-   * @param key - Encryption key
-   * @returns Decrypted and parsed object
-   */
-  async decryptObject(encrypted, key) {
-    const plaintext = await this.decrypt(encrypted, key);
-    return JSON.parse(plaintext);
+  async delete(key) {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return false;
+    return this.backend.delete(namespace, key);
   }
-  /**
-   * Check if data is in encrypted format
-   *
-   * @param data - Data to check
-   * @returns True if data appears to be encrypted
-   */
-  isEncrypted(data) {
-    return encryptedDataSchema.safeParse(data).success;
+  async list() {
+    const namespace = this.resolveNamespace();
+    if (!namespace) return [];
+    return this.backend.list(namespace);
   }
 };
-var encryptedVaultEntrySchema = import_lazy_zod3.z.object({
-  /** Vault ID (maps to JWT jti claim) */
-  id: import_lazy_zod3.z.string(),
-  /** User subject identifier */
-  userSub: import_lazy_zod3.z.string(),
-  /** User email (unencrypted for display) */
-  userEmail: import_lazy_zod3.z.string().optional(),
-  /** User name (unencrypted for display) */
-  userName: import_lazy_zod3.z.string().optional(),
-  /** Client ID that created this session */
-  clientId: import_lazy_zod3.z.string(),
-  /** Creation timestamp */
-  createdAt: import_lazy_zod3.z.number(),
-  /** Last access timestamp */
-  lastAccessAt: import_lazy_zod3.z.number(),
-  /** Encrypted sensitive data (provider tokens, credentials, consent) */
-  encryptedData: encryptedDataSchema,
-  /** Apps that are fully authorized (unencrypted for quick lookup) */
-  authorizedAppIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()),
-  /** Apps that were skipped (unencrypted for quick lookup) */
-  skippedAppIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()),
-  /** Pending auth IDs (unencrypted for lookup, actual URLs encrypted) */
-  pendingAuthIds: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).default([])
-});
+function errMsg3(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// libs/auth/src/session/secure-store.factory.ts
+var import_utils11 = require("@frontmcp/utils");
+function isCustomBackendConfig(config) {
+  return typeof config === "object" && config !== null && "backend" in config && !!config.backend;
+}
+function isSqliteConfig(config) {
+  return typeof config === "object" && config !== null && "sqlite" in config && !!config.sqlite;
+}
+function isRedisConfig(config) {
+  return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
+}
+function readScope(config) {
+  if (typeof config === "object" && config !== null && "scope" in config && config.scope) {
+    return config.scope;
+  }
+  return "user";
+}
+function readTtlMs(config) {
+  if (typeof config === "object" && config !== null && "ttlMs" in config) {
+    return config.ttlMs;
+  }
+  return void 0;
+}
+function readPepper(config) {
+  if (typeof config === "object" && config !== null && "encryption" in config && config.encryption) {
+    return config.encryption.pepper;
+  }
+  return void 0;
+}
+function toTokenStorageConfig(config) {
+  if (isSqliteConfig(config)) {
+    return { sqlite: config.sqlite };
+  }
+  if (isRedisConfig(config)) {
+    return { redis: config.redis };
+  }
+  return "memory";
+}
+async function createSecureStore(options) {
+  const { config, pepper, storage, logger } = options;
+  const scope = readScope(config);
+  const ttlMs = readTtlMs(config);
+  if (isCustomBackendConfig(config)) {
+    return { backend: config.backend, scope, ttlMs, kind: "custom" };
+  }
+  const kind = isSqliteConfig(config) ? "sqlite" : isRedisConfig(config) ? "redis" : "memory";
+  let adapter;
+  if (storage) {
+    adapter = storage;
+  } else if (kind === "memory") {
+    adapter = new import_utils11.MemoryStorageAdapter();
+    await adapter.connect();
+  } else {
+    adapter = await createTokenStorageAdapter(toTokenStorageConfig(config));
+  }
+  const backend = new EncryptedStorageSecureStoreBackend({
+    storage: adapter,
+    pepper: readPepper(config) ?? pepper,
+    logger
+  });
+  return { backend, scope, ttlMs, kind };
+}
 
 // libs/auth/src/session/token.vault.ts
-var import_utils6 = require("@frontmcp/utils");
+var import_utils12 = require("@frontmcp/utils");
 var TokenVault = class {
   /** Active key used for new encryptions */
   active;
@@ -2169,14 +3127,14 @@ var TokenVault = class {
     this.keys.set(k.kid, k.key);
   }
   async encrypt(plaintext, opts) {
-    const iv = (0, import_utils6.randomBytes)(12);
-    const { ciphertext, tag } = await (0, import_utils6.encryptAesGcm)(this.active.key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils12.randomBytes)(12);
+    const { ciphertext, tag } = await (0, import_utils12.encryptAesGcm)(this.active.key, new TextEncoder().encode(plaintext), iv);
     return {
       alg: "A256GCM",
       kid: this.active.kid,
-      iv: (0, import_utils6.base64urlEncode)(iv),
-      tag: (0, import_utils6.base64urlEncode)(tag),
-      data: (0, import_utils6.base64urlEncode)(ciphertext),
+      iv: (0, import_utils12.base64urlEncode)(iv),
+      tag: (0, import_utils12.base64urlEncode)(tag),
+      data: (0, import_utils12.base64urlEncode)(ciphertext),
       exp: opts?.exp,
       meta: opts?.meta
     };
@@ -2190,16 +3148,16 @@ var TokenVault = class {
     }
     const key = this.keys.get(blob.kid);
     if (!key) throw new Error(`vault_unknown_kid:${blob.kid}`);
-    const iv = (0, import_utils6.base64urlDecode)(blob.iv);
-    const tag = (0, import_utils6.base64urlDecode)(blob.tag);
-    const data = (0, import_utils6.base64urlDecode)(blob.data);
-    const plaintext = await (0, import_utils6.decryptAesGcm)(key, data, iv, tag);
+    const iv = (0, import_utils12.base64urlDecode)(blob.iv);
+    const tag = (0, import_utils12.base64urlDecode)(blob.tag);
+    const data = (0, import_utils12.base64urlDecode)(blob.data);
+    const plaintext = await (0, import_utils12.decryptAesGcm)(key, data, iv, tag);
     return new TextDecoder().decode(plaintext);
   }
 };
 
 // libs/auth/src/session/index.ts
-var import_utils23 = require("@frontmcp/utils");
+var import_utils32 = require("@frontmcp/utils");
 
 // libs/auth/src/session/transport-session.types.ts
 var import_lazy_zod4 = require("@frontmcp/lazy-zod");
@@ -2295,10 +3253,10 @@ var redisConfigSchema = import_lazy_zod4.z.object({
 });
 
 // libs/auth/src/session/session-crypto.ts
-var import_utils8 = require("@frontmcp/utils");
+var import_utils14 = require("@frontmcp/utils");
 
 // libs/auth/src/errors/auth-internal.error.ts
-var import_utils7 = require("@frontmcp/utils");
+var import_utils13 = require("@frontmcp/utils");
 var AuthInternalError = class extends Error {
   /**
    * Unique error ID for tracking in logs.
@@ -2320,7 +3278,7 @@ var AuthInternalError = class extends Error {
     super(message);
     this.name = this.constructor.name;
     this.code = code;
-    this.errorId = `err_${(0, import_utils7.bytesToHex)((0, import_utils7.randomBytes)(8))}`;
+    this.errorId = `err_${(0, import_utils13.bytesToHex)((0, import_utils13.randomBytes)(8))}`;
     Error.captureStackTrace(this, this.constructor);
   }
   /**
@@ -2443,9 +3401,9 @@ var AuthFlowError = class extends AuthInternalError {
 
 // libs/auth/src/session/session-crypto.ts
 function getSigningSecret(config) {
-  const secret = config?.secret || (0, import_utils8.getEnv)("MCP_SESSION_SECRET");
+  const secret = config?.secret || (0, import_utils14.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils8.isProduction)()) {
+    if ((0, import_utils14.isProduction)()) {
       throw new SessionSecretRequiredError("session signing");
     }
     console.warn("[SessionCrypto] MCP_SESSION_SECRET not set. Using insecure default for development only.");
@@ -2457,13 +3415,13 @@ function resolveConfig(config) {
   return { secret: getSigningSecret(config) };
 }
 function signSession(session, config) {
-  return (0, import_utils8.signData)(session, resolveConfig(config));
+  return (0, import_utils14.signData)(session, resolveConfig(config));
 }
 function verifySession(signedData, config) {
-  return (0, import_utils8.verifyData)(signedData, resolveConfig(config));
+  return (0, import_utils14.verifyData)(signedData, resolveConfig(config));
 }
 function verifyOrParseSession(data, config) {
-  return (0, import_utils8.verifyOrParseData)(data, resolveConfig(config));
+  return (0, import_utils14.verifyOrParseData)(data, resolveConfig(config));
 }
 
 // libs/auth/src/session/session-rate-limiter.ts
@@ -2582,7 +3540,7 @@ var SessionRateLimiter = class {
 var defaultSessionRateLimiter = new SessionRateLimiter();
 
 // libs/auth/src/session/session.transport.ts
-var import_utils9 = require("@frontmcp/utils");
+var import_utils15 = require("@frontmcp/utils");
 var TransportIdGenerator = class {
   /**
    * Create a transport session ID.
@@ -2591,7 +3549,7 @@ var TransportIdGenerator = class {
    * @returns A transport session ID (UUID without dashes)
    */
   static createId() {
-    return (0, import_utils9.randomUUID)().replace(/-/g, "");
+    return (0, import_utils15.randomUUID)().replace(/-/g, "");
   }
 };
 
@@ -2639,7 +3597,7 @@ var TinyTtlCache = class {
 };
 
 // libs/auth/src/session/utils/auth-token.utils.ts
-var import_utils10 = require("@frontmcp/utils");
+var import_utils16 = require("@frontmcp/utils");
 function isJwt(token) {
   if (!token) return false;
   return token.split(".").length === 3;
@@ -2649,7 +3607,7 @@ function getTokenSignatureFingerprint(token) {
     const sig = token.split(".")[2];
     if (sig) return sig;
   }
-  return (0, import_utils10.sha256Base64url)(token);
+  return (0, import_utils16.sha256Base64url)(token);
 }
 function extractClaimValue(claims, key, validator) {
   const value = claims[key];
@@ -2681,26 +3639,26 @@ function extractBearerToken(header) {
 }
 
 // libs/auth/src/session/utils/session-crypto.utils.ts
-var import_utils11 = require("@frontmcp/utils");
+var import_utils17 = require("@frontmcp/utils");
 var cachedKey = null;
 function getKey() {
   if (cachedKey) return cachedKey;
-  const secret = (0, import_utils11.getEnv)("MCP_SESSION_SECRET");
+  const secret = (0, import_utils17.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils11.isProduction)()) {
+    if ((0, import_utils17.isProduction)()) {
       throw new SessionSecretRequiredError("session ID encryption");
     }
     console.warn(
       "[SessionIdUtils] Using machine ID as session encryption secret - NOT SECURE FOR PRODUCTION. Set MCP_SESSION_SECRET environment variable for secure session encryption."
     );
   }
-  const base = secret || (0, import_utils11.getMachineId)();
-  cachedKey = (0, import_utils11.sha256)(new TextEncoder().encode(base));
+  const base = secret || (0, import_utils17.getMachineId)();
+  cachedKey = (0, import_utils17.sha256)(new TextEncoder().encode(base));
   return cachedKey;
 }
 function encryptJson(obj) {
   const key = getKey();
-  const encrypted = (0, import_utils11.encryptValue)(obj, key);
+  const encrypted = (0, import_utils17.encryptValue)(obj, key);
   return `${encrypted.iv}.${encrypted.tag}.${encrypted.data}`;
 }
 function decryptSessionJson(sessionId) {
@@ -2709,7 +3667,7 @@ function decryptSessionJson(sessionId) {
   const [ivB64, tagB64, ctB64] = parts;
   if (!ivB64 || !tagB64 || !ctB64) return null;
   const key = getKey();
-  return (0, import_utils11.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
+  return (0, import_utils17.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
 }
 function safeDecrypt(sessionId) {
   try {
@@ -2723,11 +3681,11 @@ function resetCachedKey() {
 }
 
 // libs/auth/src/session/storage/index.ts
-var import_utils15 = require("@frontmcp/utils");
-var import_utils16 = require("@frontmcp/utils");
+var import_utils21 = require("@frontmcp/utils");
+var import_utils22 = require("@frontmcp/utils");
 
 // libs/auth/src/session/storage/storage-token-store.ts
-var import_utils12 = require("@frontmcp/utils");
+var import_utils18 = require("@frontmcp/utils");
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -2739,13 +3697,13 @@ var StorageTokenStore = class {
     this.defaultTtlSeconds = options.defaultTtlSeconds;
     this.storageIsNamespaced = "namespace" in storage && typeof storage.namespace === "function";
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils12.TypedStorage(namespacedStorage);
+    this.storage = new import_utils18.TypedStorage(namespacedStorage);
   }
   /**
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return (0, import_utils12.randomUUID)();
+    return (0, import_utils18.randomUUID)();
   }
   /**
    * Store an encrypted token blob.
@@ -2808,7 +3766,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-var import_utils13 = require("@frontmcp/utils");
+var import_utils19 = require("@frontmcp/utils");
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -2817,7 +3775,7 @@ var StorageAuthorizationVault = class {
     this.namespace = options.namespace ?? "vault";
     this.pendingAuthTtlMs = options.pendingAuthTtlMs ?? 10 * 60 * 1e3;
     const namespacedStorage = this.isNamespacedStorage(storage) ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils13.TypedStorage(namespacedStorage, {
+    this.storage = new import_utils19.TypedStorage(namespacedStorage, {
       schema: options.validateOnRead ? authorizationVaultEntrySchema : void 0,
       throwOnInvalid: false
     });
@@ -2828,7 +3786,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils13.randomUUID)(),
+      id: (0, import_utils19.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -2902,7 +3860,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils13.randomUUID)(),
+      id: (0, import_utils19.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -3106,11 +4064,11 @@ var StorageAuthorizationVault = class {
 };
 
 // libs/auth/src/session/storage/in-memory-authorization-vault.ts
-var import_utils14 = require("@frontmcp/utils");
+var import_utils20 = require("@frontmcp/utils");
 var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
   memoryAdapter;
   constructor(options = {}) {
-    const memoryAdapter = new import_utils14.MemoryStorageAdapter();
+    const memoryAdapter = new import_utils20.MemoryStorageAdapter();
     super(memoryAdapter, {
       namespace: options.namespace ?? "vault",
       pendingAuthTtlMs: options.pendingAuthTtlMs
@@ -3131,7 +4089,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-var import_utils17 = require("@frontmcp/utils");
+var import_utils23 = require("@frontmcp/utils");
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -3153,14 +4111,14 @@ var RedisSessionStore = class {
       });
     }
     if ("redis" in config && config.redis) {
-      this.storage = new import_utils17.RedisStorageAdapter({
+      this.storage = new import_utils23.RedisStorageAdapter({
         client: config.redis,
         keyPrefix: this.keyPrefix
       });
       this.externalInstance = true;
     } else {
       const redisConfig = config;
-      this.storage = new import_utils17.RedisStorageAdapter({
+      this.storage = new import_utils23.RedisStorageAdapter({
         config: {
           host: redisConfig.host,
           port: redisConfig.port ?? 6379,
@@ -3342,7 +4300,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils17.randomUUID)();
+    return (0, import_utils23.randomUUID)();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -3378,7 +4336,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-var import_utils18 = require("@frontmcp/utils");
+var import_utils24 = require("@frontmcp/utils");
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -3398,7 +4356,7 @@ var VercelKvSessionStore = class {
         maxRequests: this.security.rateLimiting?.maxRequests
       });
     }
-    this.storage = new import_utils18.VercelKvStorageAdapter({
+    this.storage = new import_utils24.VercelKvStorageAdapter({
       url: config.url,
       token: config.token,
       keyPrefix: this.keyPrefix
@@ -3572,7 +4530,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils18.randomUUID)();
+    return (0, import_utils24.randomUUID)();
   }
   /**
    * Disconnect from Vercel KV
@@ -3601,7 +4559,7 @@ var VercelKvSessionStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.store.ts
-var import_utils19 = require("@frontmcp/utils");
+var import_utils25 = require("@frontmcp/utils");
 var InMemoryOrchestratedTokenStore = class {
   /** Token storage: Map<compositeKey, ProviderTokenRecord> */
   tokens = /* @__PURE__ */ new Map();
@@ -3643,7 +4601,7 @@ var InMemoryOrchestratedTokenStore = class {
     }
     const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
     const salt = new TextEncoder().encode("frontmcp-token-store");
-    const derivedKey = (0, import_utils19.hkdfSha256)(this.encryptionKey, salt, info, 32);
+    const derivedKey = (0, import_utils25.hkdfSha256)(this.encryptionKey, salt, info, 32);
     this.derivedKeys.set(compositeKey, derivedKey);
     return derivedKey;
   }
@@ -3653,8 +4611,8 @@ var InMemoryOrchestratedTokenStore = class {
   async encryptRecord(compositeKey, record) {
     const key = await this.deriveKeyForRecord(compositeKey);
     const plaintext = JSON.stringify(record);
-    const iv = (0, import_utils19.randomBytes)(12);
-    const { ciphertext, tag } = (0, import_utils19.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils25.randomBytes)(12);
+    const { ciphertext, tag } = (0, import_utils25.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
     return JSON.stringify({
       iv: Buffer.from(iv).toString("base64url"),
       tag: Buffer.from(tag).toString("base64url"),
@@ -3670,7 +4628,7 @@ var InMemoryOrchestratedTokenStore = class {
     const ivBytes = Buffer.from(iv, "base64url");
     const tagBytes = Buffer.from(tag, "base64url");
     const ciphertextBytes = Buffer.from(data, "base64url");
-    const plaintext = (0, import_utils19.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+    const plaintext = (0, import_utils25.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
     return JSON.parse(new TextDecoder().decode(plaintext));
   }
   /**
@@ -3778,101 +4736,307 @@ var InMemoryOrchestratedTokenStore = class {
         }
       }
     }
-    return providerIds;
+    return providerIds;
+  }
+  /**
+   * Clean up expired tokens
+   */
+  async cleanup() {
+    const now = Date.now();
+    const keysToDelete = [];
+    for (const [key, stored] of this.tokens.entries()) {
+      let record = null;
+      if (this.encryptionKey) {
+        if (typeof stored === "string") {
+          try {
+            record = await this.decryptRecord(key, stored);
+          } catch {
+            keysToDelete.push(key);
+            continue;
+          }
+        }
+      } else {
+        record = stored;
+      }
+      if (record?.expiresAt && record.expiresAt < now) {
+        keysToDelete.push(key);
+      }
+    }
+    for (const key of keysToDelete) {
+      this.tokens.delete(key);
+      this.derivedKeys.delete(key);
+    }
+  }
+  /**
+   * Stop the cleanup timer
+   */
+  dispose() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = void 0;
+    }
+  }
+  /**
+   * Get total number of stored token records (for testing/monitoring)
+   */
+  get size() {
+    return this.tokens.size;
+  }
+  /**
+   * Clear all tokens (for testing)
+   */
+  clear() {
+    this.tokens.clear();
+    this.derivedKeys.clear();
+  }
+  /**
+   * Migrate tokens from one authorization ID to another.
+   * Used when tokens are stored with a pending ID during federated auth
+   * and need to be accessible under the real authorization ID.
+   *
+   * @param fromAuthId - Source authorization ID (e.g., "pending:abc123")
+   * @param toAuthId - Target authorization ID (e.g., "def456")
+   */
+  async migrateTokens(fromAuthId, toAuthId) {
+    const prefix = `${fromAuthId}:`;
+    const keysToMigrate = [];
+    for (const key of this.tokens.keys()) {
+      if (key.startsWith(prefix)) {
+        keysToMigrate.push(key);
+      }
+    }
+    for (const oldKey of keysToMigrate) {
+      const providerId = oldKey.slice(prefix.length);
+      const newKey = this.buildKey(toAuthId, providerId);
+      const stored = this.tokens.get(oldKey);
+      if (!stored) {
+        continue;
+      }
+      if (this.encryptionKey) {
+        try {
+          const record = await this.decryptRecord(oldKey, stored);
+          const encrypted = await this.encryptRecord(newKey, record);
+          this.tokens.set(newKey, encrypted);
+        } catch {
+          continue;
+        }
+      } else {
+        this.tokens.set(newKey, stored);
+      }
+      this.tokens.delete(oldKey);
+      this.derivedKeys.delete(oldKey);
+    }
+  }
+};
+
+// libs/auth/src/session/orchestrated-token.crypto.ts
+var import_utils26 = require("@frontmcp/utils");
+var HKDF_SALT = new TextEncoder().encode("frontmcp-token-store");
+function deriveKeyForRecord(masterKey, compositeKey, cache) {
+  const cached = cache.get(compositeKey);
+  if (cached) {
+    return cached;
+  }
+  const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
+  const derived = (0, import_utils26.hkdfSha256)(masterKey, HKDF_SALT, info, 32);
+  cache.set(compositeKey, derived);
+  return derived;
+}
+function encryptRecord(key, record) {
+  const plaintext = JSON.stringify(record);
+  const iv = (0, import_utils26.randomBytes)(12);
+  const { ciphertext, tag } = (0, import_utils26.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+  return JSON.stringify({
+    iv: Buffer.from(iv).toString("base64url"),
+    tag: Buffer.from(tag).toString("base64url"),
+    data: Buffer.from(ciphertext).toString("base64url")
+  });
+}
+function decryptRecord(key, encrypted) {
+  const { iv, tag, data } = JSON.parse(encrypted);
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag, "base64url");
+  const ciphertextBytes = Buffer.from(data, "base64url");
+  const plaintext = (0, import_utils26.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+
+// libs/auth/src/session/storage-orchestrated-token.store.ts
+var StorageOrchestratedTokenStore = class {
+  storage;
+  encryptionKey;
+  defaultTtlMs;
+  namespace;
+  storageIsNamespaced;
+  /** HKDF-derived subkey cache, keyed by composite key. */
+  derivedKeys = /* @__PURE__ */ new Map();
+  constructor(storage, options = {}) {
+    this.encryptionKey = options.encryptionKey;
+    this.defaultTtlMs = options.defaultTtlMs;
+    this.namespace = options.namespace ?? "otok";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    this.storage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+  }
+  // ============================================
+  // TokenStore interface
+  // ============================================
+  async getAccessToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record?.accessToken ?? null;
+  }
+  async getRefreshToken(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record?.refreshToken ?? null;
+  }
+  async storeTokens(authorizationId, providerId, tokens) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    const now = Date.now();
+    const record = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt ?? (this.defaultTtlMs ? now + this.defaultTtlMs : void 0),
+      createdAt: now,
+      updatedAt: now
+    };
+    const value = this.encryptionKey ? encryptRecord(this.keyFor(compositeKey), record) : JSON.stringify(record);
+    await this.storage.set(this.storageKey(compositeKey), value, this.ttlOptions(record.expiresAt));
+  }
+  async deleteTokens(authorizationId, providerId) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    await this.storage.delete(this.storageKey(compositeKey));
+    this.derivedKeys.delete(compositeKey);
+  }
+  async hasTokens(authorizationId, providerId) {
+    const record = await this.getRecord(authorizationId, providerId);
+    return record !== null;
+  }
+  async getProviderIds(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    const providerIds = [];
+    for (const compositeKey of compositeKeys) {
+      if (!compositeKey.startsWith(prefix)) continue;
+      const providerId = compositeKey.slice(prefix.length);
+      const record = await this.getRecord(authorizationId, providerId);
+      if (record) {
+        providerIds.push(providerId);
+      }
+    }
+    return providerIds;
+  }
+  async migrateTokens(fromAuthId, toAuthId) {
+    const prefix = `${fromAuthId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    for (const oldComposite of compositeKeys) {
+      if (!oldComposite.startsWith(prefix)) continue;
+      const providerId = oldComposite.slice(prefix.length);
+      const newComposite = this.compositeKey(toAuthId, providerId);
+      const stored = await this.storage.get(this.storageKey(oldComposite));
+      if (stored === null) continue;
+      if (this.encryptionKey) {
+        let record;
+        try {
+          record = decryptRecord(this.keyFor(oldComposite), stored);
+        } catch {
+          continue;
+        }
+        const value = encryptRecord(this.keyFor(newComposite), record);
+        await this.storage.set(this.storageKey(newComposite), value, this.ttlOptions(record.expiresAt));
+      } else {
+        let expiresAt;
+        try {
+          expiresAt = JSON.parse(stored).expiresAt;
+        } catch {
+          expiresAt = void 0;
+        }
+        await this.storage.set(this.storageKey(newComposite), stored, this.ttlOptions(expiresAt));
+      }
+      await this.storage.delete(this.storageKey(oldComposite));
+      this.derivedKeys.delete(oldComposite);
+    }
   }
   /**
-   * Clean up expired tokens
+   * Delete all tokens for an authorization id.
    */
-  async cleanup() {
-    const now = Date.now();
-    const keysToDelete = [];
-    for (const [key, stored] of this.tokens.entries()) {
-      let record = null;
-      if (this.encryptionKey) {
-        if (typeof stored === "string") {
-          try {
-            record = await this.decryptRecord(key, stored);
-          } catch {
-            keysToDelete.push(key);
-            continue;
-          }
-        }
-      } else {
-        record = stored;
+  async deleteAllForAuthorization(authorizationId) {
+    const prefix = `${authorizationId}:`;
+    const compositeKeys = await this.listCompositeKeys(`${prefix}*`);
+    for (const compositeKey of compositeKeys) {
+      if (!compositeKey.startsWith(prefix)) continue;
+      await this.storage.delete(this.storageKey(compositeKey));
+      this.derivedKeys.delete(compositeKey);
+    }
+  }
+  // ============================================
+  // Internals
+  // ============================================
+  async getRecord(authorizationId, providerId) {
+    const compositeKey = this.compositeKey(authorizationId, providerId);
+    const stored = await this.storage.get(this.storageKey(compositeKey));
+    if (stored === null) {
+      return null;
+    }
+    let record;
+    if (this.encryptionKey) {
+      try {
+        record = decryptRecord(this.keyFor(compositeKey), stored);
+      } catch {
+        await this.storage.delete(this.storageKey(compositeKey));
+        return null;
       }
-      if (record?.expiresAt && record.expiresAt < now) {
-        keysToDelete.push(key);
+    } else {
+      try {
+        record = JSON.parse(stored);
+      } catch {
+        await this.storage.delete(this.storageKey(compositeKey));
+        return null;
       }
     }
-    for (const key of keysToDelete) {
-      this.tokens.delete(key);
-      this.derivedKeys.delete(key);
+    if (record.expiresAt && record.expiresAt < Date.now()) {
+      await this.storage.delete(this.storageKey(compositeKey));
+      return null;
     }
+    return record;
   }
-  /**
-   * Stop the cleanup timer
-   */
-  dispose() {
-    if (this.cleanupTimer) {
-      clearInterval(this.cleanupTimer);
-      this.cleanupTimer = void 0;
+  keyFor(compositeKey) {
+    if (!this.encryptionKey) {
+      throw new EncryptionKeyNotConfiguredError();
     }
+    return deriveKeyForRecord(this.encryptionKey, compositeKey, this.derivedKeys);
   }
-  /**
-   * Get total number of stored token records (for testing/monitoring)
-   */
-  get size() {
-    return this.tokens.size;
+  compositeKey(authorizationId, providerId) {
+    return `${authorizationId}:${providerId}`;
   }
-  /**
-   * Clear all tokens (for testing)
-   */
-  clear() {
-    this.tokens.clear();
-    this.derivedKeys.clear();
+  storageKey(compositeKey) {
+    return this.storageIsNamespaced ? compositeKey : `${this.namespace}:${compositeKey}`;
   }
   /**
-   * Migrate tokens from one authorization ID to another.
-   * Used when tokens are stored with a pending ID during federated auth
-   * and need to be accessible under the real authorization ID.
-   *
-   * @param fromAuthId - Source authorization ID (e.g., "pending:abc123")
-   * @param toAuthId - Target authorization ID (e.g., "def456")
+   * List composite keys (authorizationId:providerId) matching a glob over the
+   * composite-key space, stripping any non-namespaced prefix we added.
    */
-  async migrateTokens(fromAuthId, toAuthId) {
-    const prefix = `${fromAuthId}:`;
-    const keysToMigrate = [];
-    for (const key of this.tokens.keys()) {
-      if (key.startsWith(prefix)) {
-        keysToMigrate.push(key);
-      }
+  async listCompositeKeys(compositeGlob) {
+    const pattern = this.storageIsNamespaced ? compositeGlob : `${this.namespace}:${compositeGlob}`;
+    const raw = await this.storage.keys(pattern);
+    if (this.storageIsNamespaced) {
+      return raw;
     }
-    for (const oldKey of keysToMigrate) {
-      const providerId = oldKey.slice(prefix.length);
-      const newKey = this.buildKey(toAuthId, providerId);
-      const stored = this.tokens.get(oldKey);
-      if (!stored) {
-        continue;
-      }
-      if (this.encryptionKey) {
-        try {
-          const record = await this.decryptRecord(oldKey, stored);
-          const encrypted = await this.encryptRecord(newKey, record);
-          this.tokens.set(newKey, encrypted);
-        } catch {
-          continue;
-        }
-      } else {
-        this.tokens.set(newKey, stored);
-      }
-      this.tokens.delete(oldKey);
-      this.derivedKeys.delete(oldKey);
+    const stripPrefix = `${this.namespace}:`;
+    return raw.map((k) => k.startsWith(stripPrefix) ? k.slice(stripPrefix.length) : k);
+  }
+  ttlOptions(expiresAtMs) {
+    if (!expiresAtMs) {
+      return void 0;
     }
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return { ttlSeconds: ttl > 0 ? ttl : 1 };
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
   }
 };
 
 // libs/auth/src/session/federated-auth.session.ts
-var import_utils20 = require("@frontmcp/utils");
+var import_utils27 = require("@frontmcp/utils");
 function toSessionRecord(session) {
   return {
     ...session,
@@ -3947,7 +5111,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: (0, import_utils20.randomUUID)(),
+      id: (0, import_utils27.randomUUID)(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -3979,7 +5143,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: (0, import_utils20.randomUUID)(),
+    id: (0, import_utils27.randomUUID)(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -4035,9 +5199,119 @@ function startNextProvider(session, pkce, state) {
   return providerId;
 }
 
+// libs/auth/src/session/storage-federated-auth.session.ts
+var import_utils28 = require("@frontmcp/utils");
+var StorageFederatedAuthSessionStore = class {
+  storage;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "fed";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new import_utils28.TypedStorage(namespacedStorage);
+  }
+  async store(session) {
+    await this.put(session);
+  }
+  async update(session) {
+    await this.put(session);
+  }
+  async get(id) {
+    const record = await this.storage.get(this.key(id));
+    if (!record) {
+      return null;
+    }
+    if (Date.now() > record.expiresAt) {
+      await this.storage.delete(this.key(id));
+      return null;
+    }
+    return fromSessionRecord(record);
+  }
+  async delete(id) {
+    await this.storage.delete(this.key(id));
+  }
+  async put(session) {
+    const record = toSessionRecord(session);
+    const ttlSeconds = this.calculateTtl(record.expiresAt);
+    await this.storage.set(this.key(session.id), record, ttlSeconds ? { ttlSeconds } : void 0);
+  }
+  calculateTtl(expiresAtMs) {
+    const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
+    return ttl > 0 ? ttl : 1;
+  }
+  key(id) {
+    return this.storageIsNamespaced ? id : `${this.namespace}:${id}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
+// libs/auth/src/session/consent.store.ts
+function consentRecordKey(userSub, clientId) {
+  return `consent:${userSub}:${clientId}`;
+}
+var InMemoryConsentStore = class {
+  records = /* @__PURE__ */ new Map();
+  async get(userSub, clientId) {
+    const record = this.records.get(consentRecordKey(userSub, clientId));
+    if (!record) return null;
+    return { ...record, selectedToolIds: [...record.selectedToolIds], seenToolIds: [...record.seenToolIds] };
+  }
+  async set(record) {
+    this.records.set(consentRecordKey(record.userSub, record.clientId), {
+      ...record,
+      selectedToolIds: [...record.selectedToolIds],
+      seenToolIds: [...record.seenToolIds]
+    });
+  }
+  async delete(userSub, clientId) {
+    this.records.delete(consentRecordKey(userSub, clientId));
+  }
+  /** Number of remembered records (for testing/monitoring). */
+  get size() {
+    return this.records.size;
+  }
+  /** Clear all remembered records (for testing). */
+  clear() {
+    this.records.clear();
+  }
+};
+
+// libs/auth/src/session/storage-consent.store.ts
+var import_utils29 = require("@frontmcp/utils");
+var StorageConsentStore = class {
+  storage;
+  namespace;
+  storageIsNamespaced;
+  constructor(storage, options = {}) {
+    this.namespace = options.namespace ?? "remembered-consent";
+    this.storageIsNamespaced = this.isNamespacedStorage(storage);
+    const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.storage = new import_utils29.TypedStorage(namespacedStorage);
+  }
+  async get(userSub, clientId) {
+    return this.storage.get(this.key(userSub, clientId));
+  }
+  async set(record) {
+    await this.storage.set(this.key(record.userSub, record.clientId), record);
+  }
+  async delete(userSub, clientId) {
+    await this.storage.delete(this.key(userSub, clientId));
+  }
+  key(userSub, clientId) {
+    const base = consentRecordKey(userSub, clientId);
+    return this.storageIsNamespaced ? base : `${this.namespace}:${base}`;
+  }
+  isNamespacedStorage(storage) {
+    return "namespace" in storage && typeof storage.namespace === "function";
+  }
+};
+
 // libs/auth/src/session/encrypted-authorization-vault.ts
 var import_lazy_zod5 = require("@frontmcp/lazy-zod");
-var import_utils21 = require("@frontmcp/utils");
+var import_utils30 = require("@frontmcp/utils");
 var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Vault ID */
   id: import_lazy_zod5.z.string(),
@@ -4062,7 +5336,7 @@ var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Encrypted sensitive data blob */
   encrypted: encryptedDataSchema
 });
-var encryptionContextStorage = new import_utils21.AsyncLocalStorage();
+var encryptionContextStorage = new import_utils30.AsyncLocalStorage();
 var EncryptedRedisVault = class {
   constructor(redis, encryption, namespace = "vault:") {
     this.redis = redis;
@@ -4195,7 +5469,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils21.randomUUID)(),
+      id: (0, import_utils30.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -4254,7 +5528,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils21.randomUUID)(),
+      id: (0, import_utils30.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4432,7 +5706,7 @@ function createEncryptedVault(redis, config = {}) {
 }
 
 // libs/auth/src/session/token.refresh.ts
-var import_utils22 = require("@frontmcp/utils");
+var import_utils31 = require("@frontmcp/utils");
 function toEpochSeconds(exp) {
   if (exp == null) return void 0;
   if (exp instanceof Date) return Math.floor(exp.getTime() / 1e3);
@@ -4454,7 +5728,7 @@ function tryJwtExp(token) {
   const parts = token.split(".");
   if (parts.length < 2) return void 0;
   try {
-    const json = JSON.parse(new TextDecoder().decode((0, import_utils22.base64urlDecode)(parts[1])));
+    const json = JSON.parse(new TextDecoder().decode((0, import_utils31.base64urlDecode)(parts[1])));
     const e = json?.exp;
     return typeof e === "number" ? toEpochSeconds(e) : void 0;
   } catch {
@@ -4517,7 +5791,7 @@ var progressiveAuthStateSchema = import_lazy_zod6.z.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-var import_utils25 = require("@frontmcp/utils");
+var import_utils34 = require("@frontmcp/utils");
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -4565,14 +5839,14 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = (0, import_utils25.randomUUID)();
+    const sessionId = (0, import_utils34.randomUUID)();
     const session = {
       id: sessionId,
       authorizationId: this.id,
       protocol,
       createdAt: Date.now(),
       expiresAt: this.expiresAt,
-      nodeId: (0, import_utils25.getMachineId)(),
+      nodeId: (0, import_utils34.getMachineId)(),
       clientFingerprint: fingerprint
     };
     this.#sessions.set(session.id, session);
@@ -4702,7 +5976,7 @@ var AuthorizationBase = class _AuthorizationBase {
    */
   static isJwtHeader(segment) {
     try {
-      const bytes = (0, import_utils25.base64urlDecode)(segment);
+      const bytes = (0, import_utils34.base64urlDecode)(segment);
       const text = new TextDecoder().decode(bytes);
       const parsed = JSON.parse(text);
       return typeof parsed === "object" && parsed !== null && typeof parsed.alg === "string";
@@ -4754,7 +6028,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-var import_utils26 = require("@frontmcp/utils");
+var import_utils35 = require("@frontmcp/utils");
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -4790,7 +6064,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = (0, import_utils26.randomUUID)();
+    const uuid = (0, import_utils35.randomUUID)();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -4874,7 +6148,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
 };
 
 // libs/auth/src/authorization/transparent.authorization.ts
-var import_utils27 = require("@frontmcp/utils");
+var import_utils36 = require("@frontmcp/utils");
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**
@@ -4974,7 +6248,7 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
   static generateAuthorizationId(token) {
     const parts = token.split(".");
     const signature = parts[2] || token;
-    return (0, import_utils27.sha256Hex)(signature).substring(0, 16);
+    return (0, import_utils36.sha256Hex)(signature).substring(0, 16);
   }
   /**
    * Get the issuer from the token claims
@@ -5000,11 +6274,11 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
 };
 
 // libs/auth/src/utils/authorization-id.utils.ts
-var import_utils28 = require("@frontmcp/utils");
+var import_utils37 = require("@frontmcp/utils");
 function deriveAuthorizationId(token) {
   const parts = token.split(".");
   const signature = parts[2] || token;
-  return (0, import_utils28.sha256Hex)(signature).substring(0, 16);
+  return (0, import_utils37.sha256Hex)(signature).substring(0, 16);
 }
 
 // libs/auth/src/authorization/orchestrated.authorization.ts
@@ -5371,6 +6645,103 @@ var OrchestratedAuthAccessorAdapter = class {
   }
 };
 
+// libs/auth/src/authorization/dcr-client.registry.ts
+var import_utils38 = require("@frontmcp/utils");
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, (ch) => ch === "*" ? "\0" : `\\${ch}`);
+  const withWildcards = escaped.split("\0").join(".*");
+  return new RegExp(`^${withWildcards}$`);
+}
+var DcrClientRegistry = class {
+  constructor(config = {}) {
+    this.config = config;
+    this.redirectMatchers = config.allowedRedirectUris?.map(globToRegExp);
+    this.seedPreRegisteredClients();
+  }
+  clients = /* @__PURE__ */ new Map();
+  redirectMatchers;
+  /** Seed `dcr.clients` so the authorize/token flows accept them without DCR. */
+  seedPreRegisteredClients() {
+    const clients = this.config.clients ?? [];
+    const now = Math.floor(Date.now() / 1e3);
+    for (const c of clients) {
+      this.clients.set(c.clientId, {
+        client_id: c.clientId,
+        client_secret: c.clientSecret,
+        token_endpoint_auth_method: c.tokenEndpointAuthMethod ?? "none",
+        grant_types: c.grantTypes ?? ["authorization_code"],
+        response_types: c.responseTypes ?? ["code"],
+        redirect_uris: c.redirectUris,
+        client_name: c.clientName,
+        scope: c.scope,
+        created_at: now,
+        dev: false,
+        preRegistered: true
+      });
+    }
+  }
+  /** Look up a client by id (pre-registered or dynamically registered). */
+  get(clientId) {
+    return this.clients.get(clientId);
+  }
+  /** Whether a client id is known to the registry. */
+  has(clientId) {
+    return this.clients.has(clientId);
+  }
+  /** Add a dynamically-registered client (called by the register flow). */
+  register(client) {
+    this.clients.set(client.client_id, client);
+  }
+  /** Whether a redirect_uri allowlist is configured. */
+  hasRedirectAllowlist() {
+    return !!this.redirectMatchers && this.redirectMatchers.length > 0;
+  }
+  /**
+   * Whether `redirectUri` is permitted by the configured allowlist. Always
+   * `true` when no allowlist is configured (preserves default behavior).
+   */
+  isRedirectUriAllowed(redirectUri) {
+    if (!this.redirectMatchers || this.redirectMatchers.length === 0) {
+      return true;
+    }
+    return this.redirectMatchers.some((re) => re.test(redirectUri));
+  }
+  /** Whether a client-id allowlist is configured. */
+  hasClientIdAllowlist() {
+    return !!this.config.allowedClientIds && this.config.allowedClientIds.length > 0;
+  }
+  /**
+   * Whether `clientId` is permitted by the configured client-id allowlist.
+   * Always `true` when no allowlist is configured (preserves default behavior).
+   */
+  isClientIdAllowed(clientId) {
+    const allow = this.config.allowedClientIds;
+    if (!allow || allow.length === 0) {
+      return true;
+    }
+    return allow.includes(clientId);
+  }
+  /** Whether an initial access token is required for DCR registration. */
+  requiresInitialAccessToken() {
+    return typeof this.config.initialAccessToken === "string" && this.config.initialAccessToken.length > 0;
+  }
+  /**
+   * Constant-time check of a presented bearer token against the configured
+   * initial access token. Returns `false` when none is configured (callers
+   * should gate on {@link requiresInitialAccessToken} first).
+   */
+  verifyInitialAccessToken(presented) {
+    const expected = this.config.initialAccessToken;
+    if (!expected) {
+      return false;
+    }
+    if (typeof presented !== "string" || presented.length === 0) {
+      return false;
+    }
+    return (0, import_utils38.timingSafeEqual)((0, import_utils38.sha256)(presented), (0, import_utils38.sha256)(expected));
+  }
+};
+
 // libs/auth/src/common/jwt.types.ts
 var import_lazy_zod7 = require("@frontmcp/lazy-zod");
 var jwkParametersSchema = import_lazy_zod7.z.object({
@@ -6318,10 +7689,15 @@ var CimdService = class {
     }
   }
 };
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "[::1]", "localhost"]);
+function isLoopbackHostname(hostname) {
+  return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
+}
 function normalizeRedirectUri(uri) {
   try {
     const url = new URL(uri);
-    let normalized = `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}`;
+    const host = isLoopbackHostname(url.hostname) ? url.hostname.toLowerCase() : url.host.toLowerCase();
+    let normalized = `${url.protocol.toLowerCase()}//${host}`;
     normalized += url.pathname.replace(/\/+$/, "") || "/";
     if (url.search) normalized += url.search;
     return normalized;
@@ -6452,6 +7828,105 @@ var remoteProviderConfigSchema = import_lazy_zod10.z.object({
    */
   userInfoEndpoint: import_lazy_zod10.z.string().url().optional()
 });
+var upstreamProviderSchema = import_lazy_zod10.z.object({
+  /** Stable provider id (e.g. `'github'`). Used in `this.orchestration.getToken(id)`. */
+  id: import_lazy_zod10.z.string().min(1),
+  /** Human-readable display name. Defaults to `id` when omitted. */
+  name: import_lazy_zod10.z.string().optional(),
+  /** Authorization endpoint (canonical name). */
+  authorizationEndpoint: import_lazy_zod10.z.string().url().optional(),
+  /** Authorization endpoint (alias for {@link authorizationEndpoint}). */
+  authorizeUrl: import_lazy_zod10.z.string().url().optional(),
+  /** Token endpoint (canonical name). */
+  tokenEndpoint: import_lazy_zod10.z.string().url().optional(),
+  /** Token endpoint (alias for {@link tokenEndpoint}). */
+  tokenUrl: import_lazy_zod10.z.string().url().optional(),
+  /** OAuth client id issued by the upstream provider. */
+  clientId: import_lazy_zod10.z.string().min(1),
+  /** OAuth client secret (confidential clients). */
+  clientSecret: import_lazy_zod10.z.string().optional(),
+  /** Scopes to request from the upstream provider. */
+  scopes: import_lazy_zod10.z.array(import_lazy_zod10.z.string()).optional(),
+  /** User info endpoint (optional, used to enrich the session identity). */
+  userInfoEndpoint: import_lazy_zod10.z.string().url().optional(),
+  /** JWKS URI for upstream id_token validation (optional). */
+  jwksUri: import_lazy_zod10.z.string().url().optional()
+}).refine((p) => !!(p.authorizationEndpoint ?? p.authorizeUrl), {
+  message: "authorizationEndpoint (or authorizeUrl) is required",
+  path: ["authorizationEndpoint"]
+}).refine((p) => !!(p.tokenEndpoint ?? p.tokenUrl), {
+  message: "tokenEndpoint (or tokenUrl) is required",
+  path: ["tokenEndpoint"]
+}).refine((p) => !(p.authorizationEndpoint && p.authorizeUrl), {
+  message: "provide only one of authorizationEndpoint or authorizeUrl",
+  path: ["authorizationEndpoint"]
+}).refine((p) => !(p.tokenEndpoint && p.tokenUrl), {
+  message: "provide only one of tokenEndpoint or tokenUrl",
+  path: ["tokenEndpoint"]
+});
+var localDcrClientSchema = import_lazy_zod10.z.object({
+  /** Stable, pre-assigned client identifier the client authenticates with. */
+  clientId: import_lazy_zod10.z.string().min(1),
+  /**
+   * Confidential-client secret. Omit for public clients
+   * (`token_endpoint_auth_method: 'none'`, the default).
+   */
+  clientSecret: import_lazy_zod10.z.string().min(1).optional(),
+  /** Exact redirect URIs this client is allowed to use (at least one). */
+  redirectUris: import_lazy_zod10.z.array(import_lazy_zod10.z.string().url()).min(1, "At least one redirect_uri is required"),
+  /** Human-readable name shown on consent/login screens. */
+  clientName: import_lazy_zod10.z.string().optional(),
+  /**
+   * Token-endpoint auth method. Defaults to `'none'` (public PKCE client).
+   */
+  tokenEndpointAuthMethod: import_lazy_zod10.z.enum(["none", "client_secret_basic", "client_secret_post"]).default("none"),
+  /** Allowed grant types. Defaults to `['authorization_code']`. */
+  grantTypes: import_lazy_zod10.z.array(import_lazy_zod10.z.enum(["authorization_code", "refresh_token"])).default(["authorization_code"]),
+  /** Allowed response types. Defaults to `['code']`. */
+  responseTypes: import_lazy_zod10.z.array(import_lazy_zod10.z.enum(["code"])).default(["code"]),
+  /** Optional space-delimited default scope string. */
+  scope: import_lazy_zod10.z.string().optional()
+});
+var localDcrConfigSchema = import_lazy_zod10.z.object({
+  /**
+   * Whether `POST /oauth/register` is mounted/active and whether
+   * `registration_endpoint` is advertised in AS metadata.
+   *
+   * When unset (default), the historical guard applies: enabled in
+   * development, disabled in production. Set explicitly to force it on or off
+   * regardless of `NODE_ENV`.
+   */
+  enabled: import_lazy_zod10.z.boolean().optional(),
+  /**
+   * Allowlist of redirect URIs. Each entry is matched EXACTLY or as a simple
+   * glob (`*` matches any run of characters). When set, both DCR registrations
+   * and `/oauth/authorize` requests are rejected unless their `redirect_uri`
+   * matches an entry. When unset, no redirect_uri allowlist is enforced.
+   */
+  allowedRedirectUris: import_lazy_zod10.z.array(import_lazy_zod10.z.string().min(1)).optional(),
+  /**
+   * Allowlist of client ids. When set, only these `client_id`s may register
+   * (DCR registrations are forced to one of these ids) or be used at
+   * `/oauth/authorize`. When unset, any client id is accepted (subject to the
+   * other checks). CIMD URL client ids are validated by the CIMD layer and are
+   * exempt from this allowlist.
+   */
+  allowedClientIds: import_lazy_zod10.z.array(import_lazy_zod10.z.string().min(1)).optional(),
+  /**
+   * Initial Access Token (RFC 7591 §3). When set, `POST /oauth/register`
+   * requires an `Authorization: Bearer <token>` header that matches this value
+   * (constant-time compared); requests without it (or with a wrong value) are
+   * rejected `401 invalid_token`. When unset, registration is unauthenticated
+   * (the historical behavior).
+   */
+  initialAccessToken: import_lazy_zod10.z.string().min(1).optional(),
+  /**
+   * Pre-registered trusted clients seeded into the registry at startup. These
+   * are accepted by the authorize/token flows WITHOUT a DCR round-trip, which
+   * lets you disable DCR entirely while still shipping known clients.
+   */
+  clients: import_lazy_zod10.z.array(localDcrClientSchema).optional()
+});
 var flatRemoteProviderFields = {
   /**
    * OAuth provider base URL (required)
@@ -6467,7 +7942,64 @@ var flatRemoteProviderFields = {
   /** Advanced provider configuration */
   providerConfig: providerConfigSchema.optional()
 };
-var tokenStorageConfigSchema = import_lazy_zod10.z.union([import_lazy_zod10.z.literal("memory"), import_lazy_zod10.z.object({ redis: redisConfigSchema })]);
+var tokenStorageSqliteSchema = import_lazy_zod10.z.object({
+  /** Path to the `.sqlite` database file used for auth persistence. */
+  path: import_lazy_zod10.z.string().min(1),
+  /**
+   * Encryption configuration for at-rest encryption of stored values.
+   * Independent of the AES-GCM blob encryption already applied to upstream
+   * provider tokens by the orchestrated-token store.
+   */
+  encryption: import_lazy_zod10.z.object({
+    secret: import_lazy_zod10.z.string().min(1)
+  }).optional(),
+  /**
+   * Interval in milliseconds for purging expired keys.
+   * @default 60000
+   */
+  ttlCleanupIntervalMs: import_lazy_zod10.z.number().int().nonnegative().optional(),
+  /**
+   * Enable WAL mode for better read concurrency.
+   * @default true
+   */
+  walMode: import_lazy_zod10.z.boolean().optional()
+});
+var tokenStorageConfigSchema = import_lazy_zod10.z.union([
+  import_lazy_zod10.z.literal("memory"),
+  import_lazy_zod10.z.object({ redis: redisConfigSchema }),
+  import_lazy_zod10.z.object({ sqlite: tokenStorageSqliteSchema })
+]);
+var secureStoreScopeSchema = import_lazy_zod10.z.enum(["user", "session", "global"]);
+var secureStoreEncryptionSchema = import_lazy_zod10.z.object({
+  /**
+   * Server pepper mixed into HKDF key derivation (defense-in-depth). Defaults to
+   * `VAULT_SECRET ?? JWT_SECRET` at runtime when omitted.
+   */
+  pepper: import_lazy_zod10.z.string().min(1).optional()
+});
+var secureStoreCustomBackendSchema = import_lazy_zod10.z.custom(
+  (v) => typeof v === "object" && v !== null && typeof v.get === "function" && typeof v.set === "function" && typeof v.delete === "function" && typeof v.list === "function",
+  { message: "secureStore.backend must implement get/set/delete/list (SecureStoreBackend)" }
+);
+var secureStoreCommonFields = {
+  /** Namespace scope. @default 'user' */
+  scope: secureStoreScopeSchema.optional(),
+  /** Default TTL (ms) for stored secrets. @default undefined (no expiry) */
+  ttlMs: import_lazy_zod10.z.number().int().positive().optional(),
+  /** At-rest encryption settings (built-in backings only). */
+  encryption: secureStoreEncryptionSchema.optional()
+};
+var secureStoreConfigSchema = import_lazy_zod10.z.union([
+  import_lazy_zod10.z.literal("memory"),
+  // Backing-bearing variants MUST precede the bare-object variant: Zod object
+  // schemas are non-strict (extra keys allowed), so a bare `z.object({ scope })`
+  // would otherwise match `{ sqlite, scope }` first and silently strip the
+  // backing. Ordering most-specific-first keeps sqlite/redis/custom intact.
+  import_lazy_zod10.z.object({ sqlite: tokenStorageSqliteSchema, ...secureStoreCommonFields }),
+  import_lazy_zod10.z.object({ redis: redisConfigSchema, ...secureStoreCommonFields }),
+  import_lazy_zod10.z.object({ backend: secureStoreCustomBackendSchema, ...secureStoreCommonFields }),
+  import_lazy_zod10.z.object({ ...secureStoreCommonFields })
+]);
 var tokenRefreshConfigSchema = import_lazy_zod10.z.object({
   /**
    * Enable automatic token refresh
@@ -6534,7 +8066,22 @@ var federatedAuthConfigSchema = import_lazy_zod10.z.object({
    * - 'format': validate only "federated:{sessionId}:{nonce}" format
    * @default 'strict'
    */
-  stateValidation: import_lazy_zod10.z.enum(["strict", "format"]).default("strict")
+  stateValidation: import_lazy_zod10.z.enum(["strict", "format"]).default("strict"),
+  /**
+   * Minimum number of upstream providers a user must link before a FrontMCP JWT
+   * is minted. The federated callback refuses to issue a token until at least
+   * this many providers have been authorized. Defaults to `1` at runtime when
+   * `providers` are configured (i.e. "no JWT until ≥1 linked"). Left optional
+   * here so existing configs without `providers` are completely unaffected.
+   */
+  minProviders: import_lazy_zod10.z.number().int().positive().optional(),
+  /**
+   * Provider ids that MUST be among the linked providers before a JWT is minted.
+   * The federated callback rejects the login unless every id listed here is in
+   * the user's selected providers. Optional — omit to allow any combination that
+   * satisfies {@link minProviders}.
+   */
+  requiredProviders: import_lazy_zod10.z.array(import_lazy_zod10.z.string()).optional()
 });
 var incrementalAuthConfigSchema = import_lazy_zod10.z.object({
   /**
@@ -6635,9 +8182,19 @@ var transparentAuthOptionsSchema = import_lazy_zod12.z.object({
 
 // libs/auth/src/options/orchestrated.schema.ts
 var import_lazy_zod13 = require("@frontmcp/lazy-zod");
+var authSlotSchema = import_lazy_zod13.z.enum(["login", "consent", "incremental", "federated", "error"]);
+var authUiMapSchema = import_lazy_zod13.z.partialRecord(authSlotSchema, import_lazy_zod13.z.string().min(1));
+var authExtraHandlerSchema = import_lazy_zod13.z.custom((v) => typeof v === "function", {
+  message: "auth.extras entries must be handler functions (input, ctx) => AuthExtraResult."
+});
+var authExtrasMapSchema = import_lazy_zod13.z.record(import_lazy_zod13.z.string().min(1), authExtraHandlerSchema);
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
+  // #470 — backing for the general session secure-secret store (`this.secureStore`).
+  // Optional (no default) so an unset value resolves to the in-memory encrypted
+  // default at runtime; existing configs are unaffected.
+  secureStore: secureStoreConfigSchema.optional(),
   allowDefaultPublic: import_lazy_zod13.z.boolean().default(false),
   anonymousScopes: import_lazy_zod13.z.array(import_lazy_zod13.z.string()).default(["anonymous"]),
   publicAccess: publicAccessConfigSchema.optional(),
@@ -6646,11 +8203,59 @@ var sharedAuthFields = {
   refresh: tokenRefreshConfigSchema.optional(),
   expectedAudience: import_lazy_zod13.z.union([import_lazy_zod13.z.string(), import_lazy_zod13.z.array(import_lazy_zod13.z.string())]).optional(),
   incrementalAuth: incrementalAuthConfigSchema.optional(),
-  cimd: cimdConfigSchema.optional()
+  cimd: cimdConfigSchema.optional(),
+  // #469 — custom auth UI as a slot→file map + extras name→handler map (per-app
+  // under splitByApp). Both optional; omitting them serves the built-in pages.
+  ui: authUiMapSchema.optional(),
+  extras: authExtrasMapSchema.optional()
 };
+var loginFieldSchema = import_lazy_zod13.z.object({
+  type: import_lazy_zod13.z.enum(["text", "password", "email", "select", "hidden"]),
+  label: import_lazy_zod13.z.string().optional(),
+  required: import_lazy_zod13.z.boolean().optional(),
+  placeholder: import_lazy_zod13.z.string().optional(),
+  options: import_lazy_zod13.z.array(import_lazy_zod13.z.object({ value: import_lazy_zod13.z.string(), label: import_lazy_zod13.z.string() })).optional()
+});
+var loginConfigSchema = import_lazy_zod13.z.object({
+  title: import_lazy_zod13.z.string().optional(),
+  subtitle: import_lazy_zod13.z.string().optional(),
+  logoUri: import_lazy_zod13.z.string().optional(),
+  fields: import_lazy_zod13.z.record(import_lazy_zod13.z.string(), loginFieldSchema).optional(),
+  // Full HTML override — a function, validated structurally like other callbacks
+  // in the codebase (see http/cors handlers using z.custom<…>).
+  render: import_lazy_zod13.z.custom((v) => typeof v === "function", {
+    message: "login.render must be a function"
+  }).optional(),
+  subject: import_lazy_zod13.z.object({
+    fromField: import_lazy_zod13.z.string().optional(),
+    strategy: import_lazy_zod13.z.enum(["per-session", "per-account"]).optional()
+  }).optional()
+});
+var authenticateFnSchema = import_lazy_zod13.z.custom((v) => typeof v === "function", {
+  message: "authenticate must be a function"
+});
 var localAuthSchema = import_lazy_zod13.z.object({
   mode: import_lazy_zod13.z.literal("local"),
-  ...sharedAuthFields
+  ...sharedAuthFields,
+  // #468 — opt-out of the email requirement at /oauth/callback for
+  // single-operator local setups. Defaults preserve the historical behavior
+  // (email required) so existing configs are unaffected.
+  requireEmail: import_lazy_zod13.z.boolean().default(true),
+  anonymousSubject: import_lazy_zod13.z.string().min(1).default("local-operator"),
+  // Checkpoint 3a — declarative login customization + custom verification.
+  // Both optional; omitting them preserves the default login path exactly.
+  login: loginConfigSchema.optional(),
+  authenticate: authenticateFnSchema.optional(),
+  // Multi-OAuth-provider orchestration — declare upstream providers (GitHub,
+  // Slack, Jira, …) to federate at /oauth/authorize. Optional; omitting it
+  // preserves the default single-operator local login exactly.
+  providers: import_lazy_zod13.z.array(upstreamProviderSchema).optional(),
+  // Local-AS Dynamic Client Registration control surface (#462) — gate
+  // `POST /oauth/register`, allowlist redirect_uris/client_ids, require an
+  // initial access token, and seed pre-registered trusted clients. Optional;
+  // omitting it preserves today's behavior exactly (DCR on in dev, off in prod;
+  // no allowlist; no initial access token).
+  dcr: localDcrConfigSchema.optional()
 });
 var remoteAuthSchema = import_lazy_zod13.z.object({
   mode: import_lazy_zod13.z.literal("remote"),
@@ -7447,7 +9052,7 @@ var CredentialCache = class {
 var AUTH_PROVIDERS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_ACCESSOR");
 
 // libs/auth/src/vault/auth-providers.accessor.impl.ts
-var import_utils31 = require("@frontmcp/utils");
+var import_utils41 = require("@frontmcp/utils");
 var AuthProvidersAccessorImpl = class {
   constructor(registry, vault, cache, loader, context, logger) {
     this.registry = registry;
@@ -7656,7 +9261,7 @@ var AuthProvidersAccessorImpl = class {
         return { [credential.headerName]: credential.key };
       case "basic": {
         const value = `${credential.username}:${credential.password}`;
-        const encoded = credential.encodedValue ?? (0, import_utils31.base64Encode)(new TextEncoder().encode(value));
+        const encoded = credential.encodedValue ?? (0, import_utils41.base64Encode)(new TextEncoder().encode(value));
         return { Authorization: `Basic ${encoded}` };
       }
       case "custom":
@@ -9192,6 +10797,7 @@ var FetchCredentialMiddleware = class {
   AuthorityDeniedError,
   AuthorizationBase,
   CDN,
+  CREDENTIALS_ACCESSOR,
   CimdClientIdMismatchError,
   CimdDisabledError,
   CimdError,
@@ -9203,11 +10809,15 @@ var FetchCredentialMiddleware = class {
   CredentialCache,
   CredentialProviderAlreadyRegisteredError,
   CredentialStorageError,
+  CredentialsAccessorImpl,
+  DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME,
+  DcrClientRegistry,
   EagerCredentialLoader,
   ElicitationSecretRequiredError,
   EncryptedRedisVault,
   EncryptedStorageError,
+  EncryptedStorageSecureStoreBackend,
   EncryptedTypedStorage,
   EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError,
@@ -9216,6 +10826,7 @@ var FetchCredentialMiddleware = class {
   InMemoryAuthorizationStore,
   InMemoryAuthorizationVault,
   InMemoryCimdCache,
+  InMemoryConsentStore,
   InMemoryFederatedAuthSessionStore,
   InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError,
@@ -9233,11 +10844,18 @@ var FetchCredentialMiddleware = class {
   RedirectUriMismatchError,
   RedisAuthorizationStore,
   RedisSessionStore,
+  SECURE_STORE_ACCESSOR,
   ScopeDeniedError,
+  SecureStoreAccessorImpl,
+  SessionCredentialVault,
   SessionIdEmptyError,
   SessionRateLimiter,
   SessionSecretRequiredError,
+  StorageAuthorizationStore,
   StorageAuthorizationVault,
+  StorageConsentStore,
+  StorageFederatedAuthSessionStore,
+  StorageOrchestratedTokenStore,
   StorageTokenStore,
   TinyTtlCache,
   TokenLeakDetectedError,
@@ -9269,6 +10887,7 @@ var FetchCredentialMiddleware = class {
   authProviderMappingSchema,
   authProvidersVaultOptionsSchema,
   authUserSchema,
+  authenticateFnSchema,
   authoritiesClaimsMappingSchema,
   authoritiesConfigSchema,
   authoritiesMetadataSchema,
@@ -9283,7 +10902,11 @@ var FetchCredentialMiddleware = class {
   bearerApplier,
   bearerCredentialSchema,
   buildAuthContext,
+  buildCodeRecord,
+  buildConnectPage,
+  buildConnectSuccessPage,
   buildConsentPage,
+  buildCredentialResumeUrl,
   buildErrorPage,
   buildFederatedLoginPage,
   buildIncrementalAuthPage,
@@ -9291,7 +10914,9 @@ var FetchCredentialMiddleware = class {
   buildInvalidRequestHeader,
   buildInvalidTokenHeader,
   buildLoginPage,
+  buildPendingRecord,
   buildPrmUrl,
+  buildRefreshTokenRecord,
   buildToolConsentPage,
   buildUnauthorizedHeader,
   buildWwwAuthenticate,
@@ -9304,6 +10929,7 @@ var FetchCredentialMiddleware = class {
   clientMetadataDocumentSchema,
   completeCurrentProvider,
   consentConfigSchema,
+  consentRecordKey,
   consentSelectionSchema,
   consentStateSchema,
   consentToolItemSchema,
@@ -9311,6 +10937,9 @@ var FetchCredentialMiddleware = class {
   createEncryptedVault,
   createFederatedAuthSession,
   createLayout,
+  createSecureStore,
+  createSessionCredentialVault,
+  createTokenStorageAdapter,
   credentialProviderConfigSchema,
   credentialSchema,
   credentialScopeSchema,
@@ -9344,7 +10973,9 @@ var FetchCredentialMiddleware = class {
   federatedSelectionSchema,
   flatRemoteProviderFields,
   fromSessionRecord,
+  generateAuthorizationCode,
   generatePkceChallenge,
+  generateRefreshTokenValue,
   getCredentialOptionsSchema,
   getKey,
   getNextProvider,
@@ -9362,12 +10993,15 @@ var FetchCredentialMiddleware = class {
   isOrchestratedLocal,
   isOrchestratedMode,
   isOrchestratedRemote,
+  isPersistentTokenStorage,
   isPublicMode,
+  isRedisTokenStorage,
   isRemoteMode,
   isSessionComplete,
   isSignedSession,
   isSoonExpiring,
   isSoonExpiringProvider,
+  isSqliteTokenStorage,
   isTransparentMode,
   jsonWebKeySetSchema,
   jwkParametersSchema,
@@ -9376,7 +11010,10 @@ var FetchCredentialMiddleware = class {
   llmSafeAuthContextSchema,
   loadingStrategySchema,
   localAuthSchema,
+  localDcrClientSchema,
+  localDcrConfigSchema,
   localSigningConfigSchema,
+  loginConfigSchema,
   mtlsCredentialSchema,
   noopLogger,
   normalizeIssuer,
@@ -9402,14 +11039,20 @@ var FetchCredentialMiddleware = class {
   redisVaultEntrySchema,
   remoteAuthSchema,
   remoteProviderConfigSchema,
+  renderLocalLoginPage,
   renderToHtml,
   resetCachedKey,
   resolveRequiredScopes,
   resourceIdRefSchema,
   safeDecrypt,
+  secureStoreConfigSchema,
+  secureStoreCustomBackendSchema,
+  secureStoreEncryptionSchema,
+  secureStoreScopeSchema,
   serviceAccountCredentialSchema,
   sessionIdPayloadSchema,
   sessionJwtPayloadSchema,
+  signCredentialResumeToken,
   signSession,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,
@@ -9420,20 +11063,24 @@ var FetchCredentialMiddleware = class {
   storedSessionSchema,
   streamableHttpTransportStateSchema,
   toEpochSeconds,
+  toLoginExtraFields,
   toSessionRecord,
   tokenRefreshConfigSchema,
   tokenStorageConfigSchema,
+  tokenStorageSqliteSchema,
   transparentAuthOptionsSchema,
   transportProtocolSchema,
   transportSessionSchema,
   transportStateSchema,
   trimSlash,
   tryJwtExp,
+  upstreamProviderSchema,
   userClaimSchema,
   validateAudience,
   validateClientIdUrl,
   vaultConsentRecordSchema,
   vaultFederatedRecordSchema,
+  verifyCredentialResumeToken,
   verifyOrParseSession,
   verifyPkce,
   verifySession,