@frontmcp/auth 1.4.1 → 1.5.0

package/esm/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire as __frontmcpCreateRequire } from 'module';
-const require = __frontmcpCreateRequire(import.meta.url);
+const require = __frontmcpCreateRequire(import.meta.url || 'file:///');
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
@@ -7,8 +7,13 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 
 // libs/auth/src/cimd/cimd.cache.ts
@@ -1507,6 +1512,8 @@ var RedisAuthorizationStore = class {
     this.redis = redis;
     this.namespace = namespace;
   }
+  redis;
+  namespace;
   key(type, id) {
     return `${this.namespace}${type}:${id}`;
   }
@@ -3134,15 +3141,22 @@ var SessionRateLimiter = class {
   windowMs;
   maxRequests;
   requests = /* @__PURE__ */ new Map();
+  cleanupIntervalMs;
   cleanupTimer = null;
   constructor(config = {}) {
     this.windowMs = config.windowMs ?? 6e4;
     this.maxRequests = config.maxRequests ?? 100;
-    const cleanupIntervalMs = config.cleanupIntervalMs ?? 6e4;
-    if (cleanupIntervalMs > 0) {
-      this.cleanupTimer = setInterval(() => this.cleanup(), cleanupIntervalMs);
-      if (typeof this.cleanupTimer.unref === "function") this.cleanupTimer.unref();
-    }
+    this.cleanupIntervalMs = config.cleanupIntervalMs ?? 6e4;
+  }
+  /**
+   * Start the periodic cleanup timer on first use (idempotent). Deferred out of
+   * the constructor so constructing an instance at module scope has no side
+   * effects — see the constructor note on V8-isolate global-scope restrictions.
+   */
+  ensureCleanupTimer() {
+    if (this.cleanupTimer || this.cleanupIntervalMs <= 0) return;
+    this.cleanupTimer = setInterval(() => this.cleanup(), this.cleanupIntervalMs);
+    if (typeof this.cleanupTimer.unref === "function") this.cleanupTimer.unref();
   }
   /**
    * Check if a request is allowed for the given key.
@@ -3151,6 +3165,7 @@ var SessionRateLimiter = class {
    * @returns Rate limit result with allowed status and metadata
    */
   check(key) {
+    this.ensureCleanupTimer();
     const now = Date.now();
     const windowStart = now - this.windowMs;
     let timestamps = this.requests.get(key);
@@ -3263,6 +3278,7 @@ var TinyTtlCache = class {
   constructor(ttlMs) {
     this.ttlMs = ttlMs;
   }
+  ttlMs;
   map = /* @__PURE__ */ new Map();
   get(k) {
     const hit = this.map.get(k);
@@ -5048,6 +5064,9 @@ var EncryptedRedisVault = class {
     this.encryption = encryption;
     this.namespace = namespace;
   }
+  redis;
+  encryption;
+  namespace;
   /**
    * Run a callback with encryption context set for the current async scope.
    * This is the recommended way to set encryption context as it is safe for
@@ -6308,6 +6327,7 @@ var OrchestratedAuthAccessorAdapter = class {
   constructor(authorization) {
     this.authorization = authorization;
   }
+  authorization;
   get primaryProviderId() {
     return this.authorization.primaryProviderId;
   }
@@ -6363,6 +6383,7 @@ var DcrClientRegistry = class {
     this.redirectMatchers = config.allowedRedirectUris?.map(globToRegExp);
     this.seedPreRegisteredClients();
   }
+  config;
   clients = /* @__PURE__ */ new Map();
   redirectMatchers;
   /** Seed `dcr.clients` so the authorize/token flows accept them without DCR. */
@@ -8767,6 +8788,12 @@ var AuthProvidersAccessorImpl = class {
     this.context = context;
     this.logger = logger;
   }
+  registry;
+  vault;
+  cache;
+  loader;
+  context;
+  logger;
   async get(providerName, options) {
     const config = this.registry.get(providerName);
     if (!config) {
@@ -9126,6 +9153,9 @@ var AuthProvidersVault = class {
     this.namespace = namespace;
     this.logger = logger;
   }
+  baseVault;
+  namespace;
+  logger;
   /**
    * Store a credential in the vault
    *
@@ -9324,6 +9354,9 @@ var EagerCredentialLoader = class {
     this.cache = cache;
     this.logger = logger;
   }
+  registry;
+  cache;
+  logger;
   /**
    * Load all eager credentials for a session.
    * Called during session initialization.
@@ -9407,6 +9440,7 @@ var LazyCredentialLoader = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   /** In-flight loading promises for deduplication */
   loading = /* @__PURE__ */ new Map();
   /**
@@ -10059,6 +10093,8 @@ var AuthoritiesEngine = class {
     this.profiles = profiles;
     this.evaluators = evaluators;
   }
+  profiles;
+  evaluators;
   /**
    * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
    */
@@ -10458,6 +10494,7 @@ var FetchCredentialMiddleware = class {
     this.tokenAccessor = tokenAccessor;
     this.appliers = new Map(Object.entries(appliers ?? {}));
   }
+  tokenAccessor;
   appliers;
   /**
    * Inspect the `credentials` field. If it references a named provider,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.4.1",
-    "@frontmcp/storage-sqlite": "1.4.1",
+    "@frontmcp/lazy-zod": "1.5.0",
+    "@frontmcp/storage-sqlite": "1.5.0",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.4.1",
-    "@frontmcp/utils": "1.4.1",
+    "@frontmcp/di": "1.5.0",
+    "@frontmcp/utils": "1.5.0",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/index.js

@@ -3,8 +3,13 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -1822,6 +1827,8 @@ var RedisAuthorizationStore = class {
     this.redis = redis;
     this.namespace = namespace;
   }
+  redis;
+  namespace;
   key(type, id) {
     return `${this.namespace}${type}:${id}`;
   }
@@ -3429,15 +3436,22 @@ var SessionRateLimiter = class {
   windowMs;
   maxRequests;
   requests = /* @__PURE__ */ new Map();
+  cleanupIntervalMs;
   cleanupTimer = null;
   constructor(config = {}) {
     this.windowMs = config.windowMs ?? 6e4;
     this.maxRequests = config.maxRequests ?? 100;
-    const cleanupIntervalMs = config.cleanupIntervalMs ?? 6e4;
-    if (cleanupIntervalMs > 0) {
-      this.cleanupTimer = setInterval(() => this.cleanup(), cleanupIntervalMs);
-      if (typeof this.cleanupTimer.unref === "function") this.cleanupTimer.unref();
-    }
+    this.cleanupIntervalMs = config.cleanupIntervalMs ?? 6e4;
+  }
+  /**
+   * Start the periodic cleanup timer on first use (idempotent). Deferred out of
+   * the constructor so constructing an instance at module scope has no side
+   * effects — see the constructor note on V8-isolate global-scope restrictions.
+   */
+  ensureCleanupTimer() {
+    if (this.cleanupTimer || this.cleanupIntervalMs <= 0) return;
+    this.cleanupTimer = setInterval(() => this.cleanup(), this.cleanupIntervalMs);
+    if (typeof this.cleanupTimer.unref === "function") this.cleanupTimer.unref();
   }
   /**
    * Check if a request is allowed for the given key.
@@ -3446,6 +3460,7 @@ var SessionRateLimiter = class {
    * @returns Rate limit result with allowed status and metadata
    */
   check(key) {
+    this.ensureCleanupTimer();
     const now = Date.now();
     const windowStart = now - this.windowMs;
     let timestamps = this.requests.get(key);
@@ -3558,6 +3573,7 @@ var TinyTtlCache = class {
   constructor(ttlMs) {
     this.ttlMs = ttlMs;
   }
+  ttlMs;
   map = /* @__PURE__ */ new Map();
   get(k) {
     const hit = this.map.get(k);
@@ -5343,6 +5359,9 @@ var EncryptedRedisVault = class {
     this.encryption = encryption;
     this.namespace = namespace;
   }
+  redis;
+  encryption;
+  namespace;
   /**
    * Run a callback with encryption context set for the current async scope.
    * This is the recommended way to set encryption context as it is safe for
@@ -6603,6 +6622,7 @@ var OrchestratedAuthAccessorAdapter = class {
   constructor(authorization) {
     this.authorization = authorization;
   }
+  authorization;
   get primaryProviderId() {
     return this.authorization.primaryProviderId;
   }
@@ -6658,6 +6678,7 @@ var DcrClientRegistry = class {
     this.redirectMatchers = config.allowedRedirectUris?.map(globToRegExp);
     this.seedPreRegisteredClients();
   }
+  config;
   clients = /* @__PURE__ */ new Map();
   redirectMatchers;
   /** Seed `dcr.clients` so the authorize/token flows accept them without DCR. */
@@ -9062,6 +9083,12 @@ var AuthProvidersAccessorImpl = class {
     this.context = context;
     this.logger = logger;
   }
+  registry;
+  vault;
+  cache;
+  loader;
+  context;
+  logger;
   async get(providerName, options) {
     const config = this.registry.get(providerName);
     if (!config) {
@@ -9421,6 +9448,9 @@ var AuthProvidersVault = class {
     this.namespace = namespace;
     this.logger = logger;
   }
+  baseVault;
+  namespace;
+  logger;
   /**
    * Store a credential in the vault
    *
@@ -9619,6 +9649,9 @@ var EagerCredentialLoader = class {
     this.cache = cache;
     this.logger = logger;
   }
+  registry;
+  cache;
+  logger;
   /**
    * Load all eager credentials for a session.
    * Called during session initialization.
@@ -9702,6 +9735,7 @@ var LazyCredentialLoader = class {
   constructor(logger) {
     this.logger = logger;
   }
+  logger;
   /** In-flight loading promises for deduplication */
   loading = /* @__PURE__ */ new Map();
   /**
@@ -10354,6 +10388,8 @@ var AuthoritiesEngine = class {
     this.profiles = profiles;
     this.evaluators = evaluators;
   }
+  profiles;
+  evaluators;
   /**
    * Evaluate an AuthoritiesMetadata value (string, string[], or policy object).
    */
@@ -10753,6 +10789,7 @@ var FetchCredentialMiddleware = class {
     this.tokenAccessor = tokenAccessor;
     this.appliers = new Map(Object.entries(appliers ?? {}));
   }
+  tokenAccessor;
   appliers;
   /**
    * Inspect the `credentials` field. If it references a named provider,

package/machine-id/machine-id.d.ts

@@ -14,7 +14,8 @@
  */
 /**
  * Get the current machine ID.
- * Returns the override (if set via `setMachineIdOverride`) or the computed value.
+ * Returns the override (if set via `setMachineIdOverride`) or the lazily
+ * computed-and-memoized value.
  */
 export declare function getMachineId(): string;
 /**

package/machine-id/machine-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-id.d.ts","sourceRoot":"","sources":["../../src/machine-id/machine-id.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;GAaG;AAqHH;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjE"}
+{"version":3,"file":"machine-id.d.ts","sourceRoot":"","sources":["../../src/machine-id/machine-id.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;GAaG;AA8HH;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAMrC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEjE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.4.1",
-    "@frontmcp/storage-sqlite": "1.4.1",
+    "@frontmcp/lazy-zod": "1.5.0",
+    "@frontmcp/storage-sqlite": "1.5.0",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.4.1",
-    "@frontmcp/utils": "1.4.1",
+    "@frontmcp/di": "1.5.0",
+    "@frontmcp/utils": "1.5.0",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/session/session-rate-limiter.d.ts

@@ -55,8 +55,15 @@ export declare class SessionRateLimiter {
     private readonly windowMs;
     private readonly maxRequests;
     private readonly requests;
+    private readonly cleanupIntervalMs;
     private cleanupTimer;
     constructor(config?: SessionRateLimiterConfig);
+    /**
+     * Start the periodic cleanup timer on first use (idempotent). Deferred out of
+     * the constructor so constructing an instance at module scope has no side
+     * effects — see the constructor note on V8-isolate global-scope restrictions.
+     */
+    private ensureCleanupTimer;
     /**
      * Check if a request is allowed for the given key.
      *

package/session/session-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/session/session-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,YAAY,CAA+B;gBAEvC,MAAM,GAAE,wBAA6B;IAajD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAuCnC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWhC;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB;;;OAGG;IACH,OAAO,IAAI,IAAI;IAcf;;OAEG;IACH,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAWxD;;;OAGG;IACH,OAAO,IAAI,IAAI;CAOhB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,oBAA2B,CAAC"}
+{"version":3,"file":"session-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/session/session-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,YAAY,CAA+B;gBAEvC,MAAM,GAAE,wBAA6B;IAUjD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAwCnC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWhC;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB;;;OAGG;IACH,OAAO,IAAI,IAAI;IAcf;;OAEG;IACH,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAWxD;;;OAGG;IACH,OAAO,IAAI,IAAI;CAOhB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,oBAA2B,CAAC"}