@frontmcp/auth 1.3.0 → 1.4.1

package/session/index.d.ts

@@ -3,10 +3,31 @@
  *
  * Provides session management, credential storage, and encryption.
  */
-export { InMemoryAuthorizationStore, RedisAuthorizationStore, verifyPkce, generatePkceChallenge, pkceChallengeSchema, authorizationCodeRecordSchema, } from './authorization.store';
-export type { AuthorizationStore, PkceChallenge, AuthorizationCodeRecord, PendingAuthorizationRecord, RefreshTokenRecord, ConsentStateRecord, FederatedLoginStateRecord, } from './authorization.store';
+export { InMemoryAuthorizationStore, RedisAuthorizationStore, verifyPkce, generatePkceChallenge, generateAuthorizationCode, generateRefreshTokenValue, buildCodeRecord, buildPendingRecord, buildRefreshTokenRecord, AUTH_CODE_TTL_MS, PENDING_AUTH_TTL_MS, REFRESH_TOKEN_TTL_MS, pkceChallengeSchema, authorizationCodeRecordSchema, } from './authorization.store';
+export type { AuthorizationStore, PkceChallenge, AuthorizationCodeRecord, PendingAuthorizationRecord, RefreshTokenRecord, ConsentStateRecord, FederatedLoginStateRecord, CreateCodeRecordParams, CreatePendingRecordParams, CreateRefreshTokenRecordParams, } from './authorization.store';
+export { StorageAuthorizationStore } from './storage-authorization.store';
+export type { StorageAuthorizationStoreOptions } from './storage-authorization.store';
 export { credentialTypeSchema, oauthCredentialSchema, apiKeyCredentialSchema, basicAuthCredentialSchema, bearerCredentialSchema, privateKeyCredentialSchema, mtlsCredentialSchema, customCredentialSchema, sshKeyCredentialSchema, serviceAccountCredentialSchema, pkceOAuthCredentialSchema, credentialSchema, appCredentialSchema, vaultConsentRecordSchema, vaultFederatedRecordSchema, pendingIncrementalAuthSchema, authorizationVaultEntrySchema, } from './authorization-vault';
 export type { CredentialType, OAuthCredential, ApiKeyCredential, BasicAuthCredential, BearerCredential, PrivateKeyCredential, MtlsCredential, CustomCredential, SshKeyCredential, ServiceAccountCredential, PkceOAuthCredential, Credential, AppCredential, VaultConsentRecord, VaultFederatedRecord, PendingIncrementalAuth, AuthorizationVaultEntry, AuthorizationVault, } from './authorization-vault';
+export { SessionCredentialVault } from './session-credential-vault';
+export type { StoredCredential, SessionCredentialVaultOptions } from './session-credential-vault';
+export { createSessionCredentialVault } from './session-credential-vault.factory';
+export type { CreateSessionCredentialVaultOptions } from './session-credential-vault.factory';
+export { signCredentialResumeToken, verifyCredentialResumeToken, buildCredentialResumeUrl, DEFAULT_RESUME_TTL_MS, } from './credential-resume-link';
+export type { CredentialResumePayload } from './credential-resume-link';
+export { CREDENTIALS_ACCESSOR } from './credentials-accessor';
+export type { CredentialsAccessor, CredentialValue, CredentialNotConnected, CredentialConnected, RequireConnectResult, RequireConnectOptions, } from './credentials-accessor';
+export { CredentialsAccessorImpl } from './credentials-accessor.impl';
+export type { CredentialsAccessorDeps } from './credentials-accessor.impl';
+export type { SecureStoreBackend, SecureStoreScope, SecureStoreScopeRef } from './secure-store';
+export { EncryptedStorageSecureStoreBackend } from './secure-store-backends';
+export type { EncryptedStorageSecureStoreBackendOptions } from './secure-store-backends';
+export { SECURE_STORE_ACCESSOR } from './secure-store-accessor';
+export type { SecureStoreAccessor, SecureStoreSetOptions } from './secure-store-accessor';
+export { SecureStoreAccessorImpl } from './secure-store-accessor.impl';
+export type { SecureStoreAccessorDeps } from './secure-store-accessor.impl';
+export { createSecureStore } from './secure-store.factory';
+export type { CreateSecureStoreOptions, ResolvedSecureStore, SecureStoreBackendKind } from './secure-store.factory';
 export { encryptedDataSchema, encryptedVaultEntrySchema, VaultEncryption } from './vault-encryption';
 export type { EncryptedData, VaultKeyDerivationClaims, VaultEncryptionConfig, EncryptedVaultEntry, VaultSensitiveData, } from './vault-encryption';
 export { TokenVault } from './token.vault';
@@ -30,8 +51,17 @@ export { VercelKvSessionStore } from './vercel-kv-session.store';
 export type { VercelKvSessionConfig } from './vercel-kv-session.store';
 export { InMemoryOrchestratedTokenStore } from './orchestrated-token.store';
 export type { InMemoryOrchestratedTokenStoreOptions } from './orchestrated-token.store';
+export { StorageOrchestratedTokenStore } from './storage-orchestrated-token.store';
+export type { StorageOrchestratedTokenStoreOptions } from './storage-orchestrated-token.store';
 export { InMemoryFederatedAuthSessionStore, toSessionRecord, fromSessionRecord, createFederatedAuthSession, isSessionComplete, getNextProvider, completeCurrentProvider, startNextProvider, } from './federated-auth.session';
 export type { ProviderPkce, ProviderTokens, ProviderUserInfo, CompletedProvider, FederatedAuthSession, FederatedAuthSessionRecord, FederatedAuthSessionStore, FederatedAuthSessionCreateParams, } from './federated-auth.session';
+export { StorageFederatedAuthSessionStore } from './storage-federated-auth.session';
+export type { StorageFederatedAuthSessionStoreOptions } from './storage-federated-auth.session';
+export { InMemoryConsentStore, consentRecordKey } from './consent.store';
+export type { ConsentStore, RememberedConsentRecord } from './consent.store';
+export { StorageConsentStore } from './storage-consent.store';
+export type { StorageConsentStoreOptions } from './storage-consent.store';
+export { createTokenStorageAdapter, isRedisTokenStorage, isSqliteTokenStorage, isPersistentTokenStorage, } from './token-storage.factory';
 export { redisVaultEntrySchema, EncryptedRedisVault, createEncryptedVault } from './encrypted-authorization-vault';
 export type { RedisVaultEntry, EncryptionContext } from './encrypted-authorization-vault';
 export { toEpochSeconds, isSoonExpiring, isSoonExpiringProvider, tryJwtExp } from './token.refresh';

package/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EAEvB,UAAU,EACV,qBAAqB,EAErB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrG,YAAY,EACV,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGvD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,aAAa,IAAI,sBAAsB,EACvC,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,OAAO,IAAI,cAAc,EACzB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACrG,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACvF,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,YAAY,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAGxF,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAG1F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EAEvB,UAAU,EACV,qBAAqB,EAErB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EAEpB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,YAAY,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAGtF,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,YAAY,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AAG9F,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAC7E,YAAY,EAAE,yCAAyC,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGpH,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrG,YAAY,EACV,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGvD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,aAAa,IAAI,sBAAsB,EACvC,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,OAAO,IAAI,cAAc,EACzB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACrG,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACvF,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EACL,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,YAAY,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;AAGxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,YAAY,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAG/F,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,YAAY,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAGhG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAG1F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/session/orchestrated-token.crypto.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Orchestrated token-record encryption helpers.
+ *
+ * Shared by {@link InMemoryOrchestratedTokenStore} and
+ * {@link StorageOrchestratedTokenStore} so both apply byte-for-byte identical
+ * AES-256-GCM encryption: a per-composite-key subkey is derived from the master
+ * `encryptionKey` via HKDF-SHA256, and the record JSON is sealed with a random
+ * 12-byte IV. The envelope is a base64url JSON `{ iv, tag, data }`.
+ */
+/**
+ * Internal token record structure (upstream provider tokens).
+ */
+export interface ProviderTokenRecord {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Derive a per-record AES key from the master key + composite key via HKDF.
+ * Results are cached in `cache` (keyed by composite key) to avoid recomputation.
+ */
+export declare function deriveKeyForRecord(masterKey: Uint8Array, compositeKey: string, cache: Map<string, Uint8Array>): Uint8Array;
+/**
+ * Encrypt a token record into a base64url JSON envelope string.
+ */
+export declare function encryptRecord(key: Uint8Array, record: ProviderTokenRecord): string;
+/**
+ * Decrypt a base64url JSON envelope string back into a token record.
+ */
+export declare function decryptRecord(key: Uint8Array, encrypted: string): ProviderTokenRecord;
+//# sourceMappingURL=orchestrated-token.crypto.d.ts.map

package/session/orchestrated-token.crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrated-token.crypto.d.ts","sourceRoot":"","sources":["../../src/session/orchestrated-token.crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAC7B,UAAU,CASZ;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,GAAG,MAAM,CASlF;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAOrF"}

package/session/secure-store-accessor.d.ts

@@ -0,0 +1,77 @@
+/**
+ * SecureStoreAccessor — the `this.secureStore` ToolContext / auth-UI API (#470).
+ *
+ * A typed accessor over a {@link SecureStoreBackend} that tools (and the auth
+ * UI) read/write user-typed secrets through, scoped to the current
+ * session/subject. It owns scope resolution, JSON (de)serialization of typed
+ * values, and TTLs — so server authors never re-implement crypto, key
+ * derivation, scope, or persistence (the whole point of #470).
+ *
+ * This is the GENERAL secret store. It is distinct from `this.credentials`,
+ * which remains the OAuth-credential-centric vault (`requireConnect` resume
+ * URLs, per-authorize vault rotation). #464's `this.credentials` is unchanged.
+ */
+import { type Token } from '@frontmcp/di';
+/**
+ * Runtime accessor for session-scoped secure secrets, available on tool
+ * contexts (and the auth UI) as `this.secureStore`:
+ *
+ * ```typescript
+ * @Tool({ name: 'call_api' })
+ * class CallApiTool extends ToolContext {
+ *   async execute(input: Input): Promise<Output> {
+ *     await this.secureStore.set('stg.api-key', input.apiKey);
+ *     const key = await this.secureStore.get<string>('stg.api-key');
+ *     const all = await this.secureStore.list();
+ *     // …
+ *   }
+ * }
+ * ```
+ *
+ * Values are JSON-serialized, so any JSON-safe type round-trips. The namespace
+ * is resolved from the configured `auth.secureStore.scope` (the authenticated
+ * `sub` for `user`, the transport `sessionId` for `session`, or a fixed
+ * server-wide namespace for `global`).
+ */
+export interface SecureStoreAccessor {
+    /**
+     * Read a secret by key for the current scope, JSON-parsed into `T`. Returns
+     * `undefined` when the key is absent, when the scope cannot be resolved (e.g.
+     * an anonymous request under `user` scope), or when decryption/parse fails.
+     */
+    get<T = string>(key: string): Promise<T | undefined>;
+    /**
+     * Store a JSON-serializable `value` under `key` for the current scope.
+     * Optionally bounded by `ttlMs`. Resolves without writing (and logs at debug)
+     * when the scope cannot be resolved for the current request.
+     */
+    set<T = string>(key: string, value: T, options?: SecureStoreSetOptions): Promise<void>;
+    /**
+     * Delete a secret by key for the current scope. Returns `true` when a value
+     * existed and was removed; `false` otherwise (including when the scope cannot
+     * be resolved).
+     */
+    delete(key: string): Promise<boolean>;
+    /**
+     * List the secret keys present for the current scope. Empty when the scope
+     * cannot be resolved or when no secrets are stored.
+     */
+    list(): Promise<string[]>;
+}
+/**
+ * Options for {@link SecureStoreAccessor.set}.
+ */
+export interface SecureStoreSetOptions {
+    /**
+     * Time-to-live in milliseconds. Backends that cannot honor a TTL (e.g. an OS
+     * keychain) ignore it. Falls back to the configured `auth.secureStore.ttlMs`
+     * when omitted.
+     */
+    ttlMs?: number;
+}
+/**
+ * DI token for {@link SecureStoreAccessor}. Resolved by the `this.secureStore`
+ * context extension.
+ */
+export declare const SECURE_STORE_ACCESSOR: Token<SecureStoreAccessor>;
+//# sourceMappingURL=secure-store-accessor.d.ts.map

package/session/secure-store-accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store-accessor.d.ts","sourceRoot":"","sources":["../../src/session/secure-store-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAErD;;;;OAIG;IACH,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvF;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtC;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAmD,KAAK,CAAC,mBAAmB,CAAC,CAAC"}

package/session/secure-store-accessor.impl.d.ts

@@ -0,0 +1,61 @@
+/**
+ * SecureStoreAccessorImpl — request-scoped implementation of the
+ * `this.secureStore` accessor (#470).
+ *
+ * Binds a {@link SecureStoreBackend} to the current request's resolved scope
+ * namespace and handles JSON (de)serialization of typed values. The namespace
+ * is derived from the configured {@link SecureStoreScope}:
+ * - `user`: the authenticated `sub` (resolved lazily via `resolveSub`),
+ * - `session`: the transport `sessionId` (resolved via `resolveSessionId`),
+ * - `global`: a single fixed server-wide namespace.
+ *
+ * Identities are hashed into the namespace (never stored raw) so storage keys
+ * carry no PII, and so the backend cannot correlate the raw subject/session.
+ */
+import { type AuthLogger } from '../common/auth-logger.interface';
+import { type SecureStoreBackend, type SecureStoreScope } from './secure-store';
+import { type SecureStoreAccessor, type SecureStoreSetOptions } from './secure-store-accessor';
+/**
+ * Dependencies for {@link SecureStoreAccessorImpl}.
+ */
+export interface SecureStoreAccessorDeps {
+    /** The secure-store backing (built-in encrypted-storage, or a custom one). */
+    backend: SecureStoreBackend;
+    /** Configured scope strategy. @default 'user' */
+    scope?: SecureStoreScope;
+    /**
+     * Resolve the current request's authenticated subject. Returns undefined for
+     * anonymous/unauthenticated requests (so `user` scope is unavailable then).
+     */
+    resolveSub: () => string | undefined;
+    /**
+     * Resolve the current request's transport session id. Returns undefined when
+     * there is no session (so `session` scope is unavailable then).
+     */
+    resolveSessionId: () => string | undefined;
+    /** Default TTL (ms) applied to writes when `set` omits one. */
+    ttlMs?: number;
+    /** Scoped logger. */
+    logger?: AuthLogger;
+}
+export declare class SecureStoreAccessorImpl implements SecureStoreAccessor {
+    private readonly backend;
+    private readonly scope;
+    private readonly resolveSub;
+    private readonly resolveSessionId;
+    private readonly ttlMs?;
+    private readonly logger;
+    constructor(deps: SecureStoreAccessorDeps);
+    /**
+     * Resolve the namespace for the current request from the configured scope.
+     * Returns undefined when the scope's identity is unavailable (anonymous user
+     * under `user` scope, or no session under `session` scope), in which case
+     * reads return empty and writes are skipped.
+     */
+    private resolveNamespace;
+    get<T = string>(key: string): Promise<T | undefined>;
+    set<T = string>(key: string, value: T, options?: SecureStoreSetOptions): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list(): Promise<string[]>;
+}
+//# sourceMappingURL=secure-store-accessor.impl.d.ts.map

package/session/secure-store-accessor.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store-accessor.impl.d.ts","sourceRoot":"","sources":["../../src/session/secure-store-accessor.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAK/F;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,OAAO,EAAE,kBAAkB,CAAC;IAC5B,iDAAiD;IACjD,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,gBAAgB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC3C,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA2B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,EAAE,uBAAuB;IASzC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAgBlB,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAapD,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUtF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAKhC"}

package/session/secure-store-backends.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Built-in {@link SecureStoreBackend} implementations for the session-scoped
+ * secure-secret store (#470).
+ *
+ * Both built-ins REUSE existing infra rather than re-implementing crypto:
+ * - {@link EncryptedStorageSecureStoreBackend} wraps any `StorageAdapter`
+ *   (memory / sqlite / redis — built via {@link createTokenStorageAdapter}) and
+ *   encrypts every value at rest with the shared {@link VaultEncryption}
+ *   primitive (AES-256-GCM, HKDF-SHA256). The in-memory backing is simply this
+ *   backend over a `MemoryStorageAdapter`, so even the `'memory'` backing keeps
+ *   secrets encrypted in the process heap (closing the in-memory side of #464).
+ *
+ * A backend keys solely on the `(namespace, key)` pair it is handed; the
+ * accessor resolves `namespace` from the request scope before calling in.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type AuthLogger } from '../common/auth-logger.interface';
+import { type SecureStoreBackend } from './secure-store';
+/**
+ * Options for {@link EncryptedStorageSecureStoreBackend}.
+ */
+export interface EncryptedStorageSecureStoreBackendOptions {
+    /** Connected storage adapter backing the store (memory / sqlite / redis). */
+    storage: StorageAdapter;
+    /**
+     * Master pepper for key derivation. Defense-in-depth: even with the stored
+     * ciphertext an attacker still needs this pepper to derive the AES key. When
+     * omitted, an empty pepper is used (the caller — LocalPrimaryAuth — passes the
+     * server JWT/VAULT secret).
+     */
+    pepper?: string;
+    /** Key prefix for all stored keys. @default 'mcp:secret:' */
+    keyPrefix?: string;
+    /** Scoped logger. @default noop */
+    logger?: AuthLogger;
+}
+/**
+ * `StorageAdapter`-backed secure-store backend with AES-256-GCM at-rest
+ * encryption via {@link VaultEncryption}.
+ *
+ * Storage key layout (no PII; the namespace is an opaque hash/identity handed in
+ * by the accessor):
+ * - `secret:keys:<namespace>` → JSON array of key names (the key SET).
+ * - `secret:data:<namespace>:<key>` → encrypted {@link EncryptedSecretRecord}.
+ *
+ * The per-namespace AES key is derived (and cached) from the namespace + pepper,
+ * so a value written under one namespace cannot be decrypted under another.
+ */
+export declare class EncryptedStorageSecureStoreBackend implements SecureStoreBackend {
+    private readonly storage;
+    private readonly encryption;
+    private readonly keyPrefix;
+    private readonly logger;
+    /** Cache of derived AES keys, keyed by namespace. */
+    private readonly keyCache;
+    constructor(options: EncryptedStorageSecureStoreBackendOptions);
+    /** `secret:keys:<namespace>` → JSON array of key names. */
+    private keysKey;
+    /** `secret:data:<namespace>:<key>` → encrypted record. */
+    private dataKey;
+    /**
+     * Derive (and cache) the AES-256 key for a namespace. The namespace acts as
+     * the HKDF salt material, so values are cryptographically isolated per scope.
+     */
+    private deriveKey;
+    private setOpts;
+    get(namespace: string, key: string): Promise<string | null>;
+    set(namespace: string, key: string, value: string, ttlMs?: number): Promise<void>;
+    delete(namespace: string, key: string): Promise<boolean>;
+    list(namespace: string): Promise<string[]>;
+    private readKeySet;
+    private writeKeySet;
+    private addKeyToSet;
+}
+//# sourceMappingURL=secure-store-backends.d.ts.map

package/session/secure-store-backends.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store-backends.d.ts","sourceRoot":"","sources":["../../src/session/secure-store-backends.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAYzD;;GAEG;AACH,MAAM,WAAW,yCAAyC;IACxD,6EAA6E;IAC7E,OAAO,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,kCAAmC,YAAW,kBAAkB;IAC3E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;gBAEvD,OAAO,EAAE,yCAAyC;IAc9D,2DAA2D;IAC3D,OAAO,CAAC,OAAO;IAIf,0DAA0D;IAC1D,OAAO,CAAC,OAAO;IAIf;;;OAGG;IACH,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,OAAO;IAQT,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc3D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAQlC,UAAU;YAWV,WAAW;YAKX,WAAW;CAO1B"}

package/session/secure-store.d.ts

@@ -0,0 +1,89 @@
+/**
+ * SecureStoreBackend — the pluggable backing contract for the general
+ * session-scoped secure-secret store (#470).
+ *
+ * Unlike {@link SessionCredentialVault} (which is OAuth-credential-centric:
+ * `sub`-keyed, vault-rotation on every authorize, resume-URL `requireConnect`),
+ * this is a GENERAL key→secret store for arbitrary user-typed secrets that a
+ * tool or auth-UI reads/writes through `this.secureStore`. The backing is
+ * selectable per deployment (memory / sqlite / redis / a custom — e.g.
+ * OS-keychain — backend) WITHOUT the framework bundling any native dependency.
+ *
+ * Security model
+ * --------------
+ * - Every value is namespaced by a `ScopeRef` ({@link SecureStoreScopeRef}) so a
+ *   `user`-scoped secret keys by the authenticated `sub`, a `session`-scoped one
+ *   by the transport `sessionId`, and a `global`-scoped one by a fixed
+ *   namespace. The accessor (`this.secureStore`) resolves the namespace from the
+ *   request before calling a backend, so a backend NEVER sees raw identities it
+ *   has not been handed.
+ * - Built-in backends encrypt values at rest with the shared
+ *   {@link VaultEncryption} primitive (AES-256-GCM, HKDF-SHA256 keyed by the
+ *   namespace + a server pepper). A CUSTOM backend (e.g. an OS keychain) owns
+ *   its own at-rest protection — the OS keychain is encrypted by the OS, so the
+ *   keychain backend stores the plaintext value and relies on the OS for
+ *   confidentiality.
+ *
+ * A backend deals ONLY in `(namespace, key) → string` — JSON serialization of
+ * typed values is handled one layer up by the accessor.
+ */
+/**
+ * The resolved namespace a {@link SecureStoreBackend} operates within. Produced
+ * by the accessor from the current request + configured scope, NEVER by the
+ * backend itself. Carries the scope kind purely for diagnostics/logging; a
+ * backend keys solely on {@link namespace}.
+ */
+export interface SecureStoreScopeRef {
+    /** The resolved namespace (already incorporates the scope + identity). */
+    namespace: string;
+    /** Which scope produced this namespace (for diagnostics only). */
+    scope: SecureStoreScope;
+}
+/**
+ * How a secure-store namespace is derived from the current request:
+ * - `user` (default): keyed by the authenticated subject (`sub`). Survives a
+ *   reconnect for the same user.
+ * - `session`: keyed by the transport `sessionId`. Disappears when the session
+ *   ends.
+ * - `global`: a single shared namespace (server-wide). Use for operator-level
+ *   secrets that are not tied to any one user/session.
+ */
+export type SecureStoreScope = 'user' | 'session' | 'global';
+/**
+ * Pluggable backing for the session-scoped secure-secret store.
+ *
+ * Implement this to provide a custom backing (e.g. an OS keychain) and wire it
+ * via `auth.secureStore: { backend: myBackend }`. All four methods operate
+ * within an explicit, already-resolved `namespace` so the same backend instance
+ * can safely serve every scope/identity.
+ */
+export interface SecureStoreBackend {
+    /**
+     * Read a stored value by key within `namespace`. Returns `null` when the key
+     * is absent (mirrors `StorageAdapter.get`).
+     */
+    get(namespace: string, key: string): Promise<string | null>;
+    /**
+     * Store `value` under `key` within `namespace`. `ttlMs` (when supported by
+     * the backend) bounds the lifetime; backends that cannot honor a TTL (e.g. an
+     * OS keychain) MUST ignore it rather than reject the write.
+     */
+    set(namespace: string, key: string, value: string, ttlMs?: number): Promise<void>;
+    /**
+     * Delete `key` within `namespace`. Returns `true` when a value existed and was
+     * removed, `false` otherwise. Idempotent.
+     */
+    delete(namespace: string, key: string): Promise<boolean>;
+    /**
+     * List the keys present within `namespace`. Returns an empty array when the
+     * namespace is empty.
+     */
+    list(namespace: string): Promise<string[]>;
+    /**
+     * Optional lifecycle hook. Backends that own a connection/handle (e.g. a
+     * keychain session) may close it here. The built-in adapter-backed backend
+     * does NOT dispose the shared adapter (it is owned by the auth layer).
+     */
+    dispose?(): Promise<void>;
+}
+//# sourceMappingURL=secure-store.d.ts.map

package/session/secure-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store.d.ts","sourceRoot":"","sources":["../../src/session/secure-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5D;;;;OAIG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD;;;OAGG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C;;;;OAIG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B"}

package/session/secure-store.factory.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Secure-store backend factory (#470).
+ *
+ * Builds a {@link SecureStoreBackend} from an `auth.secureStore`
+ * {@link SecureStoreConfig}, mirroring {@link createTokenStorageAdapter}'s
+ * selection pattern:
+ *
+ * - `'memory'` / object-without-backing → in-memory `StorageAdapter` wrapped in
+ *   the AES-256-GCM-encrypted {@link EncryptedStorageSecureStoreBackend}.
+ * - `{ sqlite }` / `{ redis }` → persistent `StorageAdapter` (via
+ *   {@link createTokenStorageAdapter}) wrapped in the same encrypted backend.
+ * - `{ backend }` → the user-supplied custom backing is used AS-IS (e.g. an OS
+ *   keychain). The framework bundles NO native dependency for this path.
+ *
+ * The dependency direction matches the CLAUDE.md storage-factory pattern: SQLite
+ * is reached lazily through `createTokenStorageAdapter`, so `better-sqlite3` /
+ * `ioredis` stay out of bundles that don't use them.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type AuthLogger } from '../common/auth-logger.interface';
+import { type SecureStoreConfig } from '../options/interfaces';
+import { type SecureStoreBackend, type SecureStoreScope } from './secure-store';
+/** The backing kind a {@link SecureStoreConfig} resolves to. */
+export type SecureStoreBackendKind = 'memory' | 'sqlite' | 'redis' | 'custom';
+/**
+ * Resolved view of a {@link SecureStoreConfig}: the constructed backend, the
+ * namespace scope, the default TTL, and the backing kind (for diagnostics).
+ */
+export interface ResolvedSecureStore {
+    backend: SecureStoreBackend;
+    scope: SecureStoreScope;
+    ttlMs?: number;
+    kind: SecureStoreBackendKind;
+}
+/**
+ * Options for {@link createSecureStore}.
+ */
+export interface CreateSecureStoreOptions {
+    /** The `auth.secureStore` config. `undefined` → in-memory default. */
+    config: SecureStoreConfig | undefined;
+    /**
+     * Master pepper for the built-in encrypted backings. Used when the config
+     * does not carry an explicit `encryption.pepper`. Typically the server
+     * JWT/VAULT secret.
+     */
+    pepper?: string;
+    /**
+     * Optionally reuse an already-connected adapter for the built-in encrypted
+     * backing instead of building one from the config. When provided, the
+     * sqlite/redis selection is NOT used to build an adapter (it still informs the
+     * reported `kind`). Ignored for the `{ backend }` (custom) path.
+     */
+    storage?: StorageAdapter;
+    /** Scoped logger. */
+    logger?: AuthLogger;
+}
+/**
+ * Create a {@link SecureStoreBackend} (plus resolved scope/ttl/kind) for the
+ * given `auth.secureStore` config.
+ */
+export declare function createSecureStore(options: CreateSecureStoreOptions): Promise<ResolvedSecureStore>;
+//# sourceMappingURL=secure-store.factory.d.ts.map

package/session/secure-store.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store.factory.d.ts","sourceRoot":"","sources":["../../src/session/secure-store.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,KAAK,iBAAiB,EAA0D,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKhF,gEAAgE;AAChE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,sBAAsB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,qBAAqB;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AA8DD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8BvG"}