@frontmcp/auth 1.3.0 → 1.4.1

package/session/session-credential-vault.d.ts

@@ -0,0 +1,153 @@
+/**
+ * SessionCredentialVault — per-session, AES-256-GCM-encrypted credential store
+ * (Checkpoint 3b).
+ *
+ * Persists the `credentials` a local `authenticate()` verifier returns
+ * (Checkpoint 3a accepted-and-ignored them) and exposes them to tools via the
+ * `this.credentials` ToolContext accessor.
+ *
+ * Security model
+ * --------------
+ * - Credentials are keyed by the authenticated subject (`sub`) behind a
+ *   `sub → vaultId` indirection. Every fresh authorize mints a NEW random
+ *   `vaultId` ({@link SessionCredentialVault.rotateVault}); the per-record
+ *   encryption key is derived (HKDF salt) from that `vaultId`, so when a user
+ *   disconnects and reconnects the old ciphertext becomes undecryptable and the
+ *   reconnected session sees an EMPTY vault (per-session rotation).
+ * - At-rest encryption is AES-256-GCM via the shared {@link VaultEncryption}
+ *   primitive. The master pepper comes from `VAULT_SECRET ?? JWT_SECRET`; when
+ *   neither is set a random per-process pepper is used and a warning is logged
+ *   (credentials then do not survive a restart — fail-safe, never plaintext).
+ * - The plaintext `secret` and `metadata` are NEVER written unencrypted. Only
+ *   the unencrypted index (key names, vaultId pointer) is stored in the clear,
+ *   and it carries no PII.
+ *
+ * Construct via {@link createSessionCredentialVault} (CLAUDE.md storage-factory
+ * pattern) so the same `auth.tokenStorage` config backs both the token stores
+ * and this vault.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type AuthLogger } from '../common/auth-logger.interface';
+/**
+ * A stored credential value: the secret plus optional non-secret metadata.
+ */
+export interface StoredCredential {
+    /** The secret value (token, api key, …). Encrypted at rest. */
+    secret: string;
+    /** Optional non-secret metadata stored alongside the credential (encrypted). */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Options for {@link SessionCredentialVault}.
+ */
+export interface SessionCredentialVaultOptions {
+    /** Connected storage adapter backing the vault (memory / Redis / SQLite). */
+    storage: StorageAdapter;
+    /**
+     * Master pepper for key derivation. When omitted, falls back to
+     * `VAULT_SECRET ?? JWT_SECRET`, and finally a random per-process value (with a
+     * warning). Defense-in-depth: even with a stolen vaultId an attacker still
+     * needs this pepper to derive the AES key.
+     */
+    pepper?: string;
+    /** Key prefix for all stored keys. @default 'mcp:cred:' */
+    keyPrefix?: string;
+    /** TTL (ms) for credential entries. @default undefined (no expiry) */
+    ttlMs?: number;
+    /** TTL (ms) for the pending-authorize accumulator. @default 600000 (10 min) */
+    pendingTtlMs?: number;
+    /** Scoped logger. @default noop */
+    logger?: AuthLogger;
+}
+/**
+ * Per-session encrypted credential vault.
+ *
+ * @see createSessionCredentialVault for the factory entry point.
+ */
+export declare class SessionCredentialVault {
+    private readonly storage;
+    private readonly encryption;
+    private readonly keyPrefix;
+    private readonly ttlMs?;
+    private readonly pendingTtlMs;
+    private readonly logger;
+    /** Cache of derived AES keys, keyed by `${sub}:${vaultId}`. */
+    private readonly keyCache;
+    constructor(options: SessionCredentialVaultOptions);
+    /** `cred:idx:<sub>` → current vaultId (the sub → vaultId indirection). */
+    private indexKey;
+    /** `cred:keys:<sub>:<vaultId>` → JSON array of credential key names (the SET). */
+    private keysKey;
+    /** `cred:data:<sub>:<vaultId>:<key>` → encrypted credential record. */
+    private dataKey;
+    /** `cred:pending:<pendingId>` → encrypted pending-authorize accumulator. */
+    private pendingKey;
+    /** Convert the configured `ttlMs` into `SetOptions` (storage uses `ttlSeconds`). */
+    private get credentialSetOpts();
+    /**
+     * Derive (and cache) the AES-256 key for a `(sub, vaultId)` pair. The vaultId
+     * acts as the HKDF salt, so rotating it makes prior ciphertext undecryptable.
+     */
+    private deriveKey;
+    /**
+     * Read the current vaultId for a subject, or undefined when the subject has no
+     * live vault (never authorized, or rotated away).
+     */
+    getVaultId(sub: string): Promise<string | undefined>;
+    /**
+     * Mint a FRESH vaultId for a subject and point the indirection at it. Called
+     * at the start of each authorize so reconnect = empty vault. Returns the new
+     * vaultId. The old vaultId's ciphertext is left in storage but is
+     * unreachable (no index pointer) and undecryptable (different derived key);
+     * it expires via TTL when configured.
+     */
+    rotateVault(sub: string): Promise<string>;
+    /**
+     * Encrypt + store a single credential into the vault identified by
+     * `(sub, vaultId)` and add its key to the key set. Used both to commit
+     * authorize-time credentials and to additively add a credential mid-session.
+     */
+    store(sub: string, vaultId: string, key: string, value: StoredCredential): Promise<void>;
+    /**
+     * Decrypt and return a credential by key for a subject's CURRENT vault.
+     * Returns undefined when there is no live vault or no such key, or when
+     * decryption fails (e.g. a stale pointer to rotated-away ciphertext).
+     */
+    get(sub: string, key: string): Promise<StoredCredential | undefined>;
+    /**
+     * List the credential keys available in a subject's current vault. Returns an
+     * empty array when there is no live vault (e.g. after rotation on reconnect).
+     */
+    list(sub: string): Promise<string[]>;
+    /**
+     * Remove a credential by key from a subject's current vault (deletes the
+     * ciphertext and drops the key from the set). No-op when absent.
+     */
+    remove(sub: string, key: string): Promise<void>;
+    /**
+     * Stage credentials returned by `authenticate()` under a pending id, encrypted
+     * against a freshly-rotated vaultId for `sub`. They are NOT visible to tools
+     * until {@link commit} flushes them — this lets the authorize flow accumulate
+     * credentials before the subject's identity is final.
+     *
+     * @returns the vaultId the credentials were staged against.
+     */
+    stage(pendingId: string, sub: string, credentials: Array<{
+        key: string;
+    } & StoredCredential>): Promise<string>;
+    /**
+     * Flush a staged batch into the live vault, binding it to `sub`. The staged
+     * batch's `sub` must equal the supplied `sub` (the one baked into the minted
+     * token) — a mismatch is refused so credentials can never be committed under a
+     * different identity than the one that will read them.
+     *
+     * @returns true when a batch was committed, false when none was staged.
+     */
+    commit(pendingId: string, sub: string): Promise<boolean>;
+    private readKeySet;
+    private writeKeySet;
+    private addKeyToSet;
+    /** Strip undefined metadata so the encrypted JSON stays minimal. */
+    private normalize;
+}
+//# sourceMappingURL=session-credential-vault.d.ts.map

package/session/session-credential-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-credential-vault.d.ts","sourceRoot":"","sources":["../../src/session/session-credential-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAuC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAGlF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,6EAA6E;IAC7E,OAAO,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAmBD;;;;GAIG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;gBAEvD,OAAO,EAAE,6BAA6B;IAelD,0EAA0E;IAC1E,OAAO,CAAC,QAAQ;IAIhB,kFAAkF;IAClF,OAAO,CAAC,OAAO;IAIf,uEAAuE;IACvE,OAAO,CAAC,OAAO;IAIf,4EAA4E;IAC5E,OAAO,CAAC,UAAU;IAIlB,oFAAoF;IACpF,OAAO,KAAK,iBAAiB,GAE5B;IAMD;;;OAGG;IACH,OAAO,CAAC,SAAS;IAiBjB;;;OAGG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK1D;;;;;;OAMG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU/C;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9F;;;;OAIG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAgB1E;;;OAGG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAM1C;;;OAGG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAerD;;;;;;;OAOG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAepH;;;;;;;OAOG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAiChD,UAAU;YAWV,WAAW;YAMX,WAAW;IAQzB,oEAAoE;IACpE,OAAO,CAAC,SAAS;CAGlB"}

package/session/session-credential-vault.factory.d.ts

@@ -0,0 +1,50 @@
+/**
+ * SessionCredentialVault factory.
+ *
+ * Follows the CLAUDE.md storage-factory pattern: builds a connected
+ * {@link StorageAdapter} from the SAME `auth.tokenStorage` config that backs the
+ * authorization-code / token stores, then wraps it in a
+ * {@link SessionCredentialVault}. Keeping one config source means a credential
+ * vault is automatically persistent (Redis/SQLite) whenever the rest of the auth
+ * layer is, and in-memory by default otherwise.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type AuthLogger } from '../common/auth-logger.interface';
+import { type TokenStorageConfig } from '../options/interfaces';
+import { SessionCredentialVault } from './session-credential-vault';
+/**
+ * Options for {@link createSessionCredentialVault}.
+ */
+export interface CreateSessionCredentialVaultOptions {
+    /**
+     * Token-storage config — the SAME `auth.tokenStorage` selection used by the
+     * token stores. `'memory'` (or undefined) yields an in-memory vault;
+     * `{ redis }` / `{ sqlite }` a persistent one.
+     */
+    tokenStorage?: TokenStorageConfig;
+    /**
+     * Optionally reuse an already-connected adapter instead of creating one from
+     * `tokenStorage`. When provided, `tokenStorage` is ignored for adapter
+     * construction (used to share the LocalPrimaryAuth adapter).
+     */
+    storage?: StorageAdapter;
+    /** Master pepper override (defaults to `VAULT_SECRET ?? JWT_SECRET`). */
+    pepper?: string;
+    /** Key prefix for all stored keys. @default 'mcp:cred:' */
+    keyPrefix?: string;
+    /** TTL (ms) for credential entries. @default undefined (no expiry) */
+    ttlMs?: number;
+    /** Scoped logger. */
+    logger?: AuthLogger;
+}
+/**
+ * Create a {@link SessionCredentialVault} backed by the configured token storage.
+ *
+ * @returns the vault plus the backing adapter type, mirroring the SDK store
+ *   factories (`{ store, type }`).
+ */
+export declare function createSessionCredentialVault(options: CreateSessionCredentialVaultOptions): Promise<{
+    vault: SessionCredentialVault;
+    type: 'memory' | 'redis' | 'sqlite';
+}>;
+//# sourceMappingURL=session-credential-vault.factory.d.ts.map

package/session/session-credential-vault.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-credential-vault.factory.d.ts","sourceRoot":"","sources":["../../src/session/session-credential-vault.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC,CAmBjF"}

package/session/storage-authorization.store.d.ts

@@ -0,0 +1,51 @@
+/**
+ * StorageAuthorizationStore
+ *
+ * `AuthorizationStore` backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). This is the adapter-backed counterpart to
+ * {@link InMemoryAuthorizationStore}, giving local-mode auth persistent
+ * authorization codes, pending authorizations, and refresh tokens.
+ *
+ * Records are stored as JSON blobs keyed by type, with TTL derived from each
+ * record's `expiresAt`. The pure record-builder helpers (`createCodeRecord`,
+ * etc.) are inherited from the shared `authorization.store` functions, so the
+ * minted records are byte-for-byte identical to the in-memory store's.
+ */
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
+import { type AuthorizationCodeRecord, type AuthorizationStore, type CreateCodeRecordParams, type CreatePendingRecordParams, type CreateRefreshTokenRecordParams, type PendingAuthorizationRecord, type RefreshTokenRecord } from './authorization.store';
+export interface StorageAuthorizationStoreOptions {
+    /**
+     * Namespace prefix for all keys.
+     * @default 'oauth'
+     */
+    namespace?: string;
+}
+export declare class StorageAuthorizationStore implements AuthorizationStore {
+    private readonly codeStore;
+    private readonly pendingStore;
+    private readonly refreshStore;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageAuthorizationStoreOptions);
+    generateCode(): string;
+    generateRefreshToken(): string;
+    createCodeRecord(params: CreateCodeRecordParams): AuthorizationCodeRecord;
+    createPendingRecord(params: CreatePendingRecordParams): PendingAuthorizationRecord;
+    createRefreshTokenRecord(params: CreateRefreshTokenRecordParams): RefreshTokenRecord;
+    storeAuthorizationCode(record: AuthorizationCodeRecord): Promise<void>;
+    getAuthorizationCode(code: string): Promise<AuthorizationCodeRecord | null>;
+    markCodeUsed(code: string): Promise<void>;
+    deleteAuthorizationCode(code: string): Promise<void>;
+    storePendingAuthorization(record: PendingAuthorizationRecord): Promise<void>;
+    getPendingAuthorization(id: string): Promise<PendingAuthorizationRecord | null>;
+    deletePendingAuthorization(id: string): Promise<void>;
+    storeRefreshToken(record: RefreshTokenRecord): Promise<void>;
+    getRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
+    revokeRefreshToken(token: string): Promise<void>;
+    rotateRefreshToken(oldToken: string, newRecord: RefreshTokenRecord): Promise<void>;
+    cleanup(): Promise<void>;
+    private ttl;
+    private key;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-authorization.store.d.ts.map

package/session/storage-authorization.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-authorization.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-authorization.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5F,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,qBAAa,yBAA0B,YAAW,kBAAkB;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2C;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;gBAElC,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,gCAAqC;IAevG,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAI9B,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB;IAIzE,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B;IAIlF,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;IAQ9E,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAU3E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzC,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAU/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/storage-consent.store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * StorageConsentStore
+ *
+ * {@link ConsentStore} backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). Parallel to {@link StorageFederatedAuthSessionStore}:
+ * it stores the {@link RememberedConsentRecord} as a JSON blob keyed by
+ * `consent:{userSub}:{clientId}`.
+ *
+ * Unlike federated sessions (short-lived flow state), a remembered consent
+ * selection is intentionally long-lived — it survives restarts so a returning
+ * user keeps their prior tool selection — so no TTL is applied here.
+ */
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
+import { type ConsentStore, type RememberedConsentRecord } from './consent.store';
+export interface StorageConsentStoreOptions {
+    /**
+     * Namespace prefix for all keys.
+     * @default 'remembered-consent'
+     */
+    namespace?: string;
+}
+export declare class StorageConsentStore implements ConsentStore {
+    private readonly storage;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageConsentStoreOptions);
+    get(userSub: string, clientId: string): Promise<RememberedConsentRecord | null>;
+    set(record: RememberedConsentRecord): Promise<void>;
+    delete(userSub: string, clientId: string): Promise<void>;
+    private key;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-consent.store.d.ts.map

package/session/storage-consent.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-consent.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-consent.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5F,OAAO,EAAoB,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEpG,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,mBAAoB,YAAW,YAAY;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;gBAElC,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,0BAA+B;IAW3F,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI/E,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/storage-federated-auth.session.d.ts

@@ -0,0 +1,36 @@
+/**
+ * StorageFederatedAuthSessionStore
+ *
+ * `FederatedAuthSessionStore` backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). Parallel to {@link StorageTokenStore}: it stores
+ * the serializable {@link FederatedAuthSessionRecord} as a JSON blob keyed by
+ * session id, with a TTL derived from the session's `expiresAt`.
+ *
+ * Federated sessions are short-lived multi-provider OAuth flow state. Persisting
+ * them (Redis/SQLite) lets an in-progress federated login survive a server
+ * restart instead of being silently dropped.
+ */
+import { type NamespacedStorage, type StorageAdapter } from '@frontmcp/utils';
+import { type FederatedAuthSession, type FederatedAuthSessionStore } from './federated-auth.session';
+export interface StorageFederatedAuthSessionStoreOptions {
+    /**
+     * Namespace prefix for all keys.
+     * @default 'fed'
+     */
+    namespace?: string;
+}
+export declare class StorageFederatedAuthSessionStore implements FederatedAuthSessionStore {
+    private readonly storage;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageFederatedAuthSessionStoreOptions);
+    store(session: FederatedAuthSession): Promise<void>;
+    update(session: FederatedAuthSession): Promise<void>;
+    get(id: string): Promise<FederatedAuthSession | null>;
+    delete(id: string): Promise<void>;
+    private put;
+    private calculateTtl;
+    private key;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-federated-auth.session.d.ts.map

package/session/storage-federated-auth.session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-federated-auth.session.d.ts","sourceRoot":"","sources":["../../src/session/storage-federated-auth.session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5F,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,yBAAyB,EAC/B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,uCAAuC;IACtD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,gCAAiC,YAAW,yBAAyB;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;gBAElC,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,uCAA4C;IAWxG,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAgBrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIzB,GAAG;IAMjB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/storage-orchestrated-token.store.d.ts

@@ -0,0 +1,72 @@
+/**
+ * StorageOrchestratedTokenStore
+ *
+ * Orchestrated-mode `TokenStore` backed by a `@frontmcp/utils` `StorageAdapter`
+ * (memory / Redis / SQLite). Parallel to {@link InMemoryOrchestratedTokenStore}:
+ * stores upstream provider access/refresh tokens keyed by
+ * `authorizationId:providerId`, with the SAME AES-256-GCM + HKDF encryption at
+ * rest (see `orchestrated-token.crypto.ts`).
+ *
+ * Persisting these (Redis/SQLite) means a user's connected upstream providers
+ * survive a server restart instead of forcing re-authorization.
+ *
+ * Values are stored as raw strings on the adapter so we can choose, per record,
+ * between an encrypted envelope (when `encryptionKey` is set) and plaintext JSON
+ * (dev only) — matching the in-memory store's behavior exactly.
+ */
+import type { NamespacedStorage, StorageAdapter } from '@frontmcp/utils';
+import type { TokenStore } from '../authorization/orchestrated.authorization';
+export interface StorageOrchestratedTokenStoreOptions {
+    /**
+     * Encryption key for token storage. If not provided, tokens are stored in
+     * plain text (dev only). For production always provide a key.
+     */
+    encryptionKey?: Uint8Array;
+    /**
+     * Default TTL in milliseconds applied when a stored token has no `expiresAt`.
+     * @default undefined (no automatic expiration)
+     */
+    defaultTtlMs?: number;
+    /**
+     * Namespace prefix for all keys.
+     * @default 'otok'
+     */
+    namespace?: string;
+}
+export declare class StorageOrchestratedTokenStore implements TokenStore {
+    private readonly storage;
+    private readonly encryptionKey?;
+    private readonly defaultTtlMs?;
+    private readonly namespace;
+    private readonly storageIsNamespaced;
+    /** HKDF-derived subkey cache, keyed by composite key. */
+    private readonly derivedKeys;
+    constructor(storage: StorageAdapter | NamespacedStorage, options?: StorageOrchestratedTokenStoreOptions);
+    getAccessToken(authorizationId: string, providerId: string): Promise<string | null>;
+    getRefreshToken(authorizationId: string, providerId: string): Promise<string | null>;
+    storeTokens(authorizationId: string, providerId: string, tokens: {
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }): Promise<void>;
+    deleteTokens(authorizationId: string, providerId: string): Promise<void>;
+    hasTokens(authorizationId: string, providerId: string): Promise<boolean>;
+    getProviderIds(authorizationId: string): Promise<string[]>;
+    migrateTokens(fromAuthId: string, toAuthId: string): Promise<void>;
+    /**
+     * Delete all tokens for an authorization id.
+     */
+    deleteAllForAuthorization(authorizationId: string): Promise<void>;
+    private getRecord;
+    private keyFor;
+    private compositeKey;
+    private storageKey;
+    /**
+     * List composite keys (authorizationId:providerId) matching a glob over the
+     * composite-key space, stripping any non-namespaced prefix we added.
+     */
+    private listCompositeKeys;
+    private ttlOptions;
+    private isNamespacedStorage;
+}
+//# sourceMappingURL=storage-orchestrated-token.store.d.ts.map

package/session/storage-orchestrated-token.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-orchestrated-token.store.d.ts","sourceRoot":"","sources":["../../src/session/storage-orchestrated-token.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAS9E,MAAM,WAAW,oCAAoC;IACnD;;;OAGG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA8B,YAAW,UAAU;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAa;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAE9C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;gBAEjD,OAAO,EAAE,cAAc,GAAG,iBAAiB,EAAE,OAAO,GAAE,oCAAyC;IAYrG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnF,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKpF,WAAW,CACf,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAgBV,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxE,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB1D,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCxE;;OAEG;IACG,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAczD,SAAS;IAkCvB,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,UAAU;IAIlB;;;OAGG;YACW,iBAAiB;IAU/B,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,mBAAmB;CAG5B"}

package/session/token-storage.factory.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Token-storage adapter factory
+ *
+ * Builds a `StorageAdapter` (from `@frontmcp/utils`) from an auth
+ * {@link TokenStorageConfig}, so the local-mode auth stores (authorization
+ * codes/tokens, federated-auth sessions, orchestrated provider tokens) can be
+ * backed by memory, Redis, or local SQLite using one consistent adapter.
+ *
+ * Dependency direction (per CLAUDE.md):
+ * - `@frontmcp/utils` stays storage-backend-agnostic and MUST NOT depend on
+ *   `@frontmcp/storage-sqlite`.
+ * - The SQLite knowledge lives here, in the auth layer, via a lazy
+ *   `require('@frontmcp/storage-sqlite')` — mirroring how the SDK's
+ *   `session-store.factory.ts` lazy-loads the SQLite session store. This keeps
+ *   `ioredis`/`better-sqlite3` out of bundles that don't use them.
+ */
+import { type StorageAdapter } from '@frontmcp/utils';
+import { type TokenStorageConfig, type TokenStorageSqliteConfig } from '../options/interfaces';
+import { type RedisConfig } from './transport-session.types';
+/**
+ * Narrow a {@link TokenStorageConfig} to its Redis variant.
+ */
+export declare function isRedisTokenStorage(config: TokenStorageConfig | undefined): config is {
+    redis: RedisConfig;
+};
+/**
+ * Narrow a {@link TokenStorageConfig} to its SQLite variant.
+ */
+export declare function isSqliteTokenStorage(config: TokenStorageConfig | undefined): config is {
+    sqlite: TokenStorageSqliteConfig;
+};
+/**
+ * Whether a token-storage config persists across process restarts.
+ * `'memory'` (and the undefined default) do not; Redis and SQLite do.
+ */
+export declare function isPersistentTokenStorage(config: TokenStorageConfig | undefined): boolean;
+/**
+ * Create and connect a `StorageAdapter` for the given token-storage config.
+ *
+ * @param config - Token storage configuration. `'memory'` (or `undefined`)
+ *   yields an in-memory adapter; `{ redis }` a Redis adapter; `{ sqlite }` a
+ *   SQLite-file adapter.
+ * @returns A connected `StorageAdapter`.
+ */
+export declare function createTokenStorageAdapter(config: TokenStorageConfig | undefined): Promise<StorageAdapter>;
+//# sourceMappingURL=token-storage.factory.d.ts.map

package/session/token-storage.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.factory.d.ts","sourceRoot":"","sources":["../../src/session/token-storage.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,MAAM,IAAI;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAE5G;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GACrC,MAAM,IAAI;IAAE,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAEhD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAExF;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAoC/G"}

package/ui/index.d.ts

@@ -5,6 +5,7 @@
  */
 export { CDN, DEFAULT_THEME, baseLayout, createLayout, authLayout, centeredCardLayout, wideLayout, extraWideLayout, escapeHtml, } from './base-layout';
 export type { ThemeColors, ThemeFonts, ThemeConfig, BaseLayoutOptions } from './base-layout';
-export { buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildErrorPage, renderToHtml, } from './templates';
-export type { AppAuthCard, ProviderCard, ToolCard } from './templates';
+export { buildConsentPage, buildIncrementalAuthPage, buildFederatedLoginPage, buildToolConsentPage, buildLoginPage, buildConnectPage, buildConnectSuccessPage, buildErrorPage, renderToHtml, } from './templates';
+export type { AppAuthCard, ProviderCard, ToolCard, LoginExtraField, ConsentHiddenField } from './templates';
+export { renderLocalLoginPage, toLoginExtraFields } from './local-login.helper';
 //# sourceMappingURL=index.d.ts.map

package/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/ui/local-login.helper.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Local-login page rendering helper (Checkpoint 3a).
+ *
+ * Single source of truth for turning a {@link LoginConfig} + {@link LoginRenderContext}
+ * into HTML, shared by the authorize flow (initial render) and the callback flow
+ * (error re-render). Keeps the flows lean and the precedence rules in one place:
+ *
+ *   1. `login.render`  → full HTML override (caller owns the markup).
+ *   2. `login.fields`  → built-in page with the custom fields REPLACING email/name.
+ *   3. otherwise       → the unchanged default email/name login page.
+ */
+import type { LoginConfig, LoginRenderContext } from '../options/interfaces';
+import { type LoginExtraField } from './templates';
+/**
+ * Map a {@link LoginConfig.fields} record (+ optional pre-filled values) into the
+ * ordered {@link LoginExtraField} array consumed by {@link buildLoginPage}.
+ */
+export declare function toLoginExtraFields(fields: LoginConfig['fields'] | undefined, values?: Record<string, string>): LoginExtraField[];
+/**
+ * Render the local login page for the given config + context.
+ *
+ * When `login` is undefined (and no values/error to pre-fill) this returns the
+ * byte-for-byte default login page via {@link buildLoginPage}, preserving the
+ * zero-config behavior.
+ *
+ * @param login  The `auth.login` config (may be undefined).
+ * @param ctx    Render context (client identity, scopes, pendingAuthId, callbackPath, error).
+ * @param values Optional submitted values to pre-fill on re-render (after a failed authenticate()).
+ */
+export declare function renderLocalLoginPage(login: LoginConfig | undefined, ctx: LoginRenderContext, values?: Record<string, string>): string;
+//# sourceMappingURL=local-login.helper.d.ts.map

package/ui/local-login.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-login.helper.d.ts","sourceRoot":"","sources":["../../src/ui/local-login.helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,EACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,eAAe,EAAE,CAWnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,GAAG,EAAE,kBAAkB,EACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAsBR"}