@frontmcp/auth 1.3.0 → 1.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,25 +47,25 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "ioredis": "^5.0.0",
+    "@frontmcp/lazy-zod": "1.4.1",
+    "@frontmcp/storage-sqlite": "1.4.1",
     "@vercel/kv": "^3.0.0",
-    "@frontmcp/storage-sqlite": "1.3.0",
-    "@frontmcp/lazy-zod": "1.3.0"
+    "ioredis": "^5.0.0"
   },
   "peerDependenciesMeta": {
-    "ioredis": {
+    "@frontmcp/storage-sqlite": {
       "optional": true
     },
     "@vercel/kv": {
       "optional": true
     },
-    "@frontmcp/storage-sqlite": {
+    "ioredis": {
       "optional": true
     }
   },
   "dependencies": {
-    "@frontmcp/utils": "1.3.0",
-    "@frontmcp/di": "1.3.0",
+    "@frontmcp/di": "1.4.1",
+    "@frontmcp/utils": "1.4.1",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/session/authorization.store.d.ts

@@ -55,6 +55,19 @@ export interface AuthorizationCodeRecord {
     federatedLoginUsed?: boolean;
     /** Pending auth ID for token migration (federated login) */
     pendingAuthId?: string;
+    /**
+     * Progressive/Incremental authorization: the app IDs this code grants access
+     * to. Embedded as the `authorized_apps` claim in the minted token (which
+     * turns on app-level gating). Only set when `incrementalAuth` is enabled for
+     * the scope; absent for non-incremental setups (preserving allow-all).
+     */
+    authorizedAppIds?: string[];
+    /**
+     * Custom claims returned by a local `authenticate` verifier (Checkpoint 3a).
+     * Embedded (namespaced) in the minted access token. Reserved claims
+     * (sub/iss/exp/…) are stripped when signed.
+     */
+    customClaims?: Record<string, unknown>;
 }
 /**
  * Consent state for tool selection
@@ -120,10 +133,22 @@ export interface PendingAuthorizationRecord {
     existingSessionId?: string;
     /** Existing authorization ID to expand */
     existingAuthorizationId?: string;
+    /**
+     * App IDs the client already holds a grant for (its prior `authorized_apps`
+     * claim), carried forward on an incremental authorize so the minted token's
+     * grant is the UNION of these plus `targetAppId`.
+     */
+    priorAuthorizedAppIds?: string[];
     /** Federated login state for multi-provider auth */
     federatedLogin?: FederatedLoginStateRecord;
     /** Consent state for tool selection */
     consent?: ConsentStateRecord;
+    /**
+     * Anti-CSRF token minted at SSR time for a custom `@AuthUi` page (#469).
+     * Echoed back by the client in the `csrf` field and verified on the callback /
+     * extra submit. Absent for the built-in pages (no CSRF requirement there).
+     */
+    authUiCsrf?: string;
 }
 /**
  * Refresh token record
@@ -178,7 +203,87 @@ export declare const authorizationCodeRecordSchema: import("@frontmcp/lazy-zod")
     consentEnabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
     federatedLoginUsed: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
     pendingAuthId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    authorizedAppIds: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    customClaims: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
 }, import("zod/v4/core").$strip>;
+/**
+ * Parameters for building an authorization code record.
+ */
+export interface CreateCodeRecordParams {
+    clientId: string;
+    redirectUri: string;
+    scopes: string[];
+    pkce: PkceChallenge;
+    userSub: string;
+    userEmail?: string;
+    userName?: string;
+    state?: string;
+    resource?: string;
+    selectedToolIds?: string[];
+    selectedProviderIds?: string[];
+    skippedProviderIds?: string[];
+    consentEnabled?: boolean;
+    federatedLoginUsed?: boolean;
+    pendingAuthId?: string;
+    authorizedAppIds?: string[];
+    customClaims?: Record<string, unknown>;
+}
+/**
+ * Parameters for building a pending authorization record.
+ */
+export interface CreatePendingRecordParams {
+    clientId: string;
+    redirectUri: string;
+    scopes: string[];
+    pkce: PkceChallenge;
+    state?: string;
+    resource?: string;
+    isIncremental?: boolean;
+    targetAppId?: string;
+    targetToolId?: string;
+    existingSessionId?: string;
+    existingAuthorizationId?: string;
+    priorAuthorizedAppIds?: string[];
+    federatedLogin?: FederatedLoginStateRecord;
+    consent?: ConsentStateRecord;
+    authUiCsrf?: string;
+}
+/**
+ * Parameters for building a refresh token record.
+ */
+export interface CreateRefreshTokenRecordParams {
+    clientId: string;
+    userSub: string;
+    scopes: string[];
+    resource?: string;
+}
+/** Default TTL for authorization codes (60 seconds). */
+export declare const AUTH_CODE_TTL_MS: number;
+/** Default TTL for pending authorizations (10 minutes). */
+export declare const PENDING_AUTH_TTL_MS: number;
+/** Default TTL for refresh tokens (30 days). */
+export declare const REFRESH_TOKEN_TTL_MS: number;
+/**
+ * Generate a cryptographically secure authorization code.
+ */
+export declare function generateAuthorizationCode(): string;
+/**
+ * Generate a refresh token string.
+ */
+export declare function generateRefreshTokenValue(): string;
+/**
+ * Build an authorization code record with defaults. Pure (no storage I/O), so
+ * it is shared by every {@link AuthorizationStore} implementation.
+ */
+export declare function buildCodeRecord(params: CreateCodeRecordParams): AuthorizationCodeRecord;
+/**
+ * Build a pending authorization record with defaults.
+ */
+export declare function buildPendingRecord(params: CreatePendingRecordParams): PendingAuthorizationRecord;
+/**
+ * Build a refresh token record with defaults.
+ */
+export declare function buildRefreshTokenRecord(params: CreateRefreshTokenRecordParams): RefreshTokenRecord;
 /**
  * Authorization Store Interface
  */
@@ -196,6 +301,9 @@ export interface AuthorizationStore {
     rotateRefreshToken(oldToken: string, newRecord: RefreshTokenRecord): Promise<void>;
     generateCode(): string;
     generateRefreshToken(): string;
+    createCodeRecord(params: CreateCodeRecordParams): AuthorizationCodeRecord;
+    createPendingRecord(params: CreatePendingRecordParams): PendingAuthorizationRecord;
+    createRefreshTokenRecord(params: CreateRefreshTokenRecordParams): RefreshTokenRecord;
     cleanup(): Promise<void>;
 }
 /**
@@ -213,12 +321,6 @@ export declare class InMemoryAuthorizationStore implements AuthorizationStore {
     private codes;
     private pending;
     private refreshTokens;
-    /** Default TTL for authorization codes (60 seconds) */
-    private readonly codeTtlMs;
-    /** Default TTL for pending authorizations (10 minutes) */
-    private readonly pendingTtlMs;
-    /** Default TTL for refresh tokens (30 days) */
-    private readonly refreshTtlMs;
     generateCode(): string;
     generateRefreshToken(): string;
     storeAuthorizationCode(record: AuthorizationCodeRecord): Promise<void>;
@@ -234,52 +336,17 @@ export declare class InMemoryAuthorizationStore implements AuthorizationStore {
     rotateRefreshToken(oldToken: string, newRecord: RefreshTokenRecord): Promise<void>;
     cleanup(): Promise<void>;
     /**
-     * Create an authorization code record with defaults
+     * Create an authorization code record with defaults.
      */
-    createCodeRecord(params: {
-        clientId: string;
-        redirectUri: string;
-        scopes: string[];
-        pkce: PkceChallenge;
-        userSub: string;
-        userEmail?: string;
-        userName?: string;
-        state?: string;
-        resource?: string;
-        selectedToolIds?: string[];
-        selectedProviderIds?: string[];
-        skippedProviderIds?: string[];
-        consentEnabled?: boolean;
-        federatedLoginUsed?: boolean;
-        pendingAuthId?: string;
-    }): AuthorizationCodeRecord;
+    createCodeRecord(params: CreateCodeRecordParams): AuthorizationCodeRecord;
     /**
-     * Create a pending authorization record with defaults
+     * Create a pending authorization record with defaults.
      */
-    createPendingRecord(params: {
-        clientId: string;
-        redirectUri: string;
-        scopes: string[];
-        pkce: PkceChallenge;
-        state?: string;
-        resource?: string;
-        isIncremental?: boolean;
-        targetAppId?: string;
-        targetToolId?: string;
-        existingSessionId?: string;
-        existingAuthorizationId?: string;
-        federatedLogin?: FederatedLoginStateRecord;
-        consent?: ConsentStateRecord;
-    }): PendingAuthorizationRecord;
+    createPendingRecord(params: CreatePendingRecordParams): PendingAuthorizationRecord;
     /**
-     * Create a refresh token record with defaults
+     * Create a refresh token record with defaults.
      */
-    createRefreshTokenRecord(params: {
-        clientId: string;
-        userSub: string;
-        scopes: string[];
-        resource?: string;
-    }): RefreshTokenRecord;
+    createRefreshTokenRecord(params: CreateRefreshTokenRecordParams): RefreshTokenRecord;
 }
 /**
  * Redis Authorization Store (placeholder)
@@ -294,6 +361,9 @@ export declare class RedisAuthorizationStore implements AuthorizationStore {
     private key;
     generateCode(): string;
     generateRefreshToken(): string;
+    createCodeRecord(params: CreateCodeRecordParams): AuthorizationCodeRecord;
+    createPendingRecord(params: CreatePendingRecordParams): PendingAuthorizationRecord;
+    createRefreshTokenRecord(params: CreateRefreshTokenRecordParams): RefreshTokenRecord;
     storeAuthorizationCode(record: AuthorizationCodeRecord): Promise<void>;
     getAuthorizationCode(code: string): Promise<AuthorizationCodeRecord | null>;
     markCodeUsed(code: string): Promise<void>;

package/session/authorization.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.store.d.ts","sourceRoot":"","sources":["../../src/session/authorization.store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,EAAE,OAAO,CAAC;IACd,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,yCAAyC;IACzC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,6BAA6B;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAGlB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAGjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAG3C,uCAAuC;IACvC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;gCAG9B,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;gCAqBxC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAEjC,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC5E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IAChF,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnF,YAAY,IAAI,MAAM,CAAC;IACvB,oBAAoB,IAAI,MAAM,CAAC;IAC/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAQlF;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAGzE;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,OAAO,CAAiD;IAChE,OAAO,CAAC,aAAa,CAAyC;IAE9D,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkB;IAC/C,+CAA+C;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IAEzD,YAAY,IAAI,MAAM;IAKtB,oBAAoB,IAAI,MAAM;IAIxB,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAa3E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAa/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAYlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IASlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB9B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,IAAI,EAAE,aAAa,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,uBAAuB;IA2B3B;;OAEG;IACH,mBAAmB,CAAC,MAAM,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,IAAI,EAAE,aAAa,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;QAEjC,cAAc,CAAC,EAAE,yBAAyB,CAAC;QAE3C,OAAO,CAAC,EAAE,kBAAkB,CAAC;KAC9B,GAAG,0BAA0B;IAyB9B;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,kBAAkB;CAavB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAE9D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,KAAK,EAAE,GAAG,EACV,SAAS,SAAW;IAGvC,OAAO,CAAC,GAAG;IAIX,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAIxB,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAM3E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAM/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
+{"version":3,"file":"authorization.store.d.ts","sourceRoot":"","sources":["../../src/session/authorization.store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,EAAE,OAAO,CAAC;IACd,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,yCAAyC;IACzC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,6BAA6B;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qBAAqB;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAGlB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAG3C,uCAAuC;IACvC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAE7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;gCAG9B,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;gCAyBxC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAE3C,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAI7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAC1C,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAClD,gDAAgD;AAChD,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAE7D;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB,CAyBvF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B,CAsBhG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB,CAYlG;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAEjC,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC5E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IAChF,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAInF,YAAY,IAAI,MAAM,CAAC;IACvB,oBAAoB,IAAI,MAAM,CAAC;IAC/B,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB,CAAC;IAC1E,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B,CAAC;IACnF,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB,CAAC;IAGrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAQlF;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAGzE;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,OAAO,CAAiD;IAChE,OAAO,CAAC,aAAa,CAAyC;IAE9D,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAIxB,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAa3E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAa/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAYlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IASlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB9B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB;IAIzE;;OAEG;IACH,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B;IAIlF;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;CAGrF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAE9D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,KAAK,EAAE,GAAG,EACV,SAAS,SAAW;IAGvC,OAAO,CAAC,GAAG;IAIX,YAAY,IAAI,MAAM;IAItB,oBAAoB,IAAI,MAAM;IAI9B,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,uBAAuB;IAIzE,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B;IAIlF,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,kBAAkB;IAI9E,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAM3E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,yBAAyB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5E,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAM/E,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQlE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}

package/session/consent.store.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Remembered Consent Store
+ *
+ * Persists a user's per-client tool-consent selection so that consent mode
+ * (`auth.consent.rememberConsent`) can reuse it on a subsequent login instead
+ * of re-prompting every time.
+ *
+ * Semantics (see {@link RememberedConsentRecord}):
+ * - Keyed by `consent:{userSub}:{clientId}` — one record per (user, client).
+ * - `selectedToolIds` is what the user last consented to (NOT including
+ *   `excludedTools`, which are always available regardless of consent).
+ * - `seenToolIds` is the full set of tool ids that were OFFERED the last time
+ *   consent was collected. On a later login the consent screen is SKIPPED only
+ *   when every currently-available tool id is already in `seenToolIds` (i.e. no
+ *   NEW tool appeared). If a new tool appeared, the screen is re-rendered
+ *   pre-filled with `selectedToolIds` so the user decides about the new one —
+ *   a newly-added tool is NEVER silently granted.
+ *
+ * No PII is stored: only the opaque subject identifier, the client id, and tool
+ * ids. The minted token's `consent.selectedTools` claim still drives call-time
+ * enforcement; this store only changes which selection is collected/reused at
+ * authorize time.
+ *
+ * Parallels {@link FederatedAuthSessionStore}: an {@link InMemoryConsentStore}
+ * for the default (memory) path and a `StorageConsentStore` (adapter-backed) for
+ * Redis/SQLite, swapped in when a persistent token-storage backend is
+ * configured.
+ */
+/**
+ * A remembered per-(user, client) consent selection.
+ */
+export interface RememberedConsentRecord {
+    /** Opaque subject identifier of the consenting user. */
+    userSub: string;
+    /** OAuth client id the consent was granted to. */
+    clientId: string;
+    /**
+     * Tool ids the user last consented to. Does NOT include `excludedTools`
+     * (those are always available and are merged in at mint time).
+     */
+    selectedToolIds: string[];
+    /**
+     * Full set of tool ids that were OFFERED when consent was last collected.
+     * Used to detect newly-added tools (available ids not in this set) so the
+     * screen is re-shown rather than silently granting a new tool.
+     */
+    seenToolIds: string[];
+    /** Last-updated timestamp (epoch ms). */
+    updatedAt: number;
+}
+/**
+ * Store interface for remembered consent selections.
+ */
+export interface ConsentStore {
+    /** Get the remembered consent record for a (user, client), or null. */
+    get(userSub: string, clientId: string): Promise<RememberedConsentRecord | null>;
+    /** Persist (insert or overwrite) a remembered consent record. */
+    set(record: RememberedConsentRecord): Promise<void>;
+    /** Delete the remembered consent record for a (user, client). */
+    delete(userSub: string, clientId: string): Promise<void>;
+}
+/**
+ * Build the storage key for a remembered consent record.
+ *
+ * Shared by both store implementations so the in-memory and adapter-backed
+ * variants can never drift on key shape.
+ */
+export declare function consentRecordKey(userSub: string, clientId: string): string;
+/**
+ * In-Memory Remembered Consent Store.
+ *
+ * Default (memory) implementation; the remembered selection is lost on restart,
+ * matching the rest of the in-memory auth stores. Use a persistent backend
+ * (Redis/SQLite via `tokenStorage`) to survive restarts.
+ */
+export declare class InMemoryConsentStore implements ConsentStore {
+    private readonly records;
+    get(userSub: string, clientId: string): Promise<RememberedConsentRecord | null>;
+    set(record: RememberedConsentRecord): Promise<void>;
+    delete(userSub: string, clientId: string): Promise<void>;
+    /** Number of remembered records (for testing/monitoring). */
+    get size(): number;
+    /** Clear all remembered records (for testing). */
+    clear(): void;
+}
+//# sourceMappingURL=consent.store.d.ts.map

package/session/consent.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.store.d.ts","sourceRoot":"","sources":["../../src/session/consent.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEhF,iEAAiE;IACjE,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAEhE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAO/E,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,6DAA6D;IAC7D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,kDAAkD;IAClD,KAAK,IAAI,IAAI;CAGd"}

package/session/credential-resume-link.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Credential resume-link signing (Checkpoint 3b).
+ *
+ * When a tool asks for a credential that is not connected
+ * (`this.credentials.requireConnect({ key })`), the framework returns a
+ * structured "credential not connected" result carrying a FRAMEWORK-SIGNED
+ * resume URL. The URL embeds an HMAC-SHA256 token over `{ sub, key, context?,
+ * exp }`, signed with the server secret. The mid-session add-credential handler
+ * verifies the token (constant-time, via {@link verifyData}) and refuses expired
+ * or tampered tokens, so a browser cannot be redirected into adding a credential
+ * for an arbitrary subject/key.
+ *
+ * Reuses `@frontmcp/utils` HMAC signing (`signData`/`verifyData`) — no new
+ * crypto. The signed payload contains NO secret material; it only authorizes
+ * *which* `(sub, key)` slot the resume page may write to.
+ */
+/**
+ * The payload signed into a credential resume token.
+ */
+export interface CredentialResumePayload {
+    /** Subject the credential will be stored under (the request's authenticated sub). */
+    sub: string;
+    /** Credential key being connected (e.g. provider id). */
+    key: string;
+    /** Optional opaque context forwarded back to `authenticate()` as `resume.context`. */
+    context?: string;
+    /** Absolute expiry, epoch milliseconds. */
+    exp: number;
+}
+/** Default resume-token TTL: 10 minutes (short-lived). */
+export declare const DEFAULT_RESUME_TTL_MS = 600000;
+/**
+ * Sign a credential resume token (HMAC-SHA256 over the payload).
+ *
+ * @param input - subject, key, optional context, and TTL.
+ * @param secret - the server signing secret (HMAC key).
+ * @returns a compact base64url token string suitable for a URL query param.
+ */
+export declare function signCredentialResumeToken(input: {
+    sub: string;
+    key: string;
+    context?: string;
+    ttlMs?: number;
+}, secret: string): string;
+/**
+ * Verify a credential resume token: constant-time signature check (via
+ * {@link verifyData}) AND expiry enforcement.
+ *
+ * @param token - the base64url token from {@link signCredentialResumeToken}.
+ * @param secret - the server signing secret (must match the signing secret).
+ * @param now - current time (epoch ms), injectable for tests. @default Date.now()
+ * @returns the verified payload, or null when the signature is invalid,
+ *   the token is malformed, or it has expired.
+ */
+export declare function verifyCredentialResumeToken(token: string, secret: string, now?: number): CredentialResumePayload | null;
+/**
+ * Build the absolute resume URL a "credential not connected" result hands back.
+ *
+ * @param basePath - the auth scope's full base path (e.g. `https://host/mcp`).
+ * @param token - a token from {@link signCredentialResumeToken}.
+ * @returns `${basePath}/oauth/connect?token=...`
+ */
+export declare function buildCredentialResumeUrl(basePath: string, token: string): string;
+//# sourceMappingURL=credential-resume-link.d.ts.map

package/session/credential-resume-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resume-link.d.ts","sourceRoot":"","sources":["../../src/session/credential-resume-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;CACb;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACrE,MAAM,EAAE,MAAM,GACb,MAAM,CAWR;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAmB,GACvB,uBAAuB,GAAG,IAAI,CAuBhC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhF"}

package/session/credentials-accessor.d.ts

@@ -0,0 +1,102 @@
+/**
+ * CredentialsAccessor — the `this.credentials` ToolContext API (Checkpoint 3b).
+ *
+ * Runtime accessor tools use to read per-session credentials persisted by a
+ * local `authenticate()` verifier, and to ask the agent to connect a missing
+ * credential mid-session via a framework-signed resume URL.
+ *
+ * Resolution of the request's authenticated `sub` and the server signing secret
+ * is handled by the implementation ({@link CredentialsAccessorImpl}); tools only
+ * see the small API below.
+ */
+import { type Token } from '@frontmcp/di';
+import { type StoredCredential } from './session-credential-vault';
+/**
+ * A credential as returned to a tool: the secret plus optional non-secret
+ * metadata. Identical in shape to {@link StoredCredential}.
+ */
+export type CredentialValue = StoredCredential;
+/**
+ * Structured "credential not connected" result returned by
+ * {@link CredentialsAccessor.requireConnect} when the requested credential is
+ * absent. Carries a framework-signed resume URL the agent/client can open to
+ * have the user connect the credential mid-session.
+ */
+export interface CredentialNotConnected {
+    /** Discriminator. Always `false` — the credential is not available. */
+    connected: false;
+    /** The credential key that is missing. */
+    key: string;
+    /** Framework-signed, short-lived URL that opens the add-credential page. */
+    resumeUrl: string;
+    /** Human-readable hint for the agent/user. */
+    message: string;
+}
+/**
+ * Successful resolution returned by {@link CredentialsAccessor.requireConnect}
+ * when the credential IS present.
+ */
+export interface CredentialConnected {
+    /** Discriminator. Always `true` — the credential is available. */
+    connected: true;
+    /** The credential key. */
+    key: string;
+    /** The resolved credential value. */
+    credential: CredentialValue;
+}
+/** Discriminated union returned by {@link CredentialsAccessor.requireConnect}. */
+export type RequireConnectResult = CredentialConnected | CredentialNotConnected;
+/**
+ * Options for {@link CredentialsAccessor.requireConnect}.
+ */
+export interface RequireConnectOptions {
+    /** Credential key to require (e.g. provider id). */
+    key: string;
+    /**
+     * Optional opaque context forwarded to `authenticate()` as `resume.context`
+     * when the user connects the credential (e.g. which resource triggered it).
+     */
+    context?: string;
+}
+/**
+ * Runtime accessor for per-session credentials, available on tool contexts as
+ * `this.credentials`:
+ *
+ * ```typescript
+ * @Tool({ name: 'call_api' })
+ * class CallApiTool extends ToolContext {
+ *   async execute(input: Input): Promise<Output> {
+ *     const cred = await this.credentials.get('acme');
+ *     if (!cred) {
+ *       const res = await this.credentials.requireConnect({ key: 'acme' });
+ *       if (!res.connected) return { connectUrl: res.resumeUrl };
+ *     }
+ *     // use cred.secret …
+ *   }
+ * }
+ * ```
+ */
+export interface CredentialsAccessor {
+    /**
+     * Get a credential by key for the current request's subject. Returns
+     * undefined when the subject is anonymous, has no live vault, or has no such
+     * credential (or when decryption fails after a vault rotation).
+     */
+    get(key: string): Promise<CredentialValue | undefined>;
+    /**
+     * List the credential keys available to the current request's subject.
+     * Empty when anonymous or when there is no live vault.
+     */
+    list(): Promise<string[]>;
+    /**
+     * Resolve a credential, returning a framework-signed resume URL when it is not
+     * connected so the caller can prompt the user to connect it mid-session.
+     */
+    requireConnect(options: RequireConnectOptions): Promise<RequireConnectResult>;
+}
+/**
+ * DI token for {@link CredentialsAccessor}. Resolved by the `this.credentials`
+ * context extension.
+ */
+export declare const CREDENTIALS_ACCESSOR: Token<CredentialsAccessor>;
+//# sourceMappingURL=credentials-accessor.d.ts.map

package/session/credentials-accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-accessor.d.ts","sourceRoot":"","sources":["../../src/session/credentials-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,SAAS,EAAE,KAAK,CAAC;IACjB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,SAAS,EAAE,IAAI,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAEvD;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC/E;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,mBAAmB,CAAC,CAAC"}

package/session/credentials-accessor.impl.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CredentialsAccessorImpl — request-scoped implementation of the
+ * `this.credentials` accessor (Checkpoint 3b).
+ *
+ * Binds a {@link SessionCredentialVault} to the current request's authenticated
+ * subject and signing secret. The subject is resolved lazily via the injected
+ * `resolveSub` callback (so an anonymous/unauthenticated request yields no
+ * credentials), and `requireConnect` mints a framework-signed resume URL using
+ * {@link signCredentialResumeToken}.
+ */
+import { type AuthLogger } from '../common/auth-logger.interface';
+import { type CredentialsAccessor, type CredentialValue, type RequireConnectOptions, type RequireConnectResult } from './credentials-accessor';
+import { type SessionCredentialVault } from './session-credential-vault';
+/**
+ * Dependencies for {@link CredentialsAccessorImpl}.
+ */
+export interface CredentialsAccessorDeps {
+    /** The per-session credential vault. */
+    vault: SessionCredentialVault;
+    /**
+     * Resolve the current request's authenticated subject. Returns undefined for
+     * anonymous/unauthenticated requests (no credentials are exposed then).
+     */
+    resolveSub: () => string | undefined;
+    /** Server HMAC signing secret used for resume tokens. */
+    signingSecret: string;
+    /** Auth scope base path used to build the resume URL (e.g. `https://host/mcp`). */
+    basePath: string;
+    /** Resume-token TTL in ms (short-lived). */
+    resumeTtlMs?: number;
+    /** Scoped logger. */
+    logger?: AuthLogger;
+}
+export declare class CredentialsAccessorImpl implements CredentialsAccessor {
+    private readonly vault;
+    private readonly resolveSub;
+    private readonly signingSecret;
+    private readonly basePath;
+    private readonly resumeTtlMs?;
+    private readonly logger;
+    constructor(deps: CredentialsAccessorDeps);
+    get(key: string): Promise<CredentialValue | undefined>;
+    list(): Promise<string[]>;
+    requireConnect(options: RequireConnectOptions): Promise<RequireConnectResult>;
+}
+//# sourceMappingURL=credentials-accessor.impl.d.ts.map

package/session/credentials-accessor.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-accessor.impl.d.ts","sourceRoot":"","sources":["../../src/session/credentials-accessor.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElF,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,KAAK,EAAE,sBAAsB,CAAC;IAC9B;;;OAGG;IACH,UAAU,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACrC,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,EAAE,uBAAuB;IASnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAMtD,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAMzB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CA2BpF"}