@frontmcp/sdk 0.4.0 → 0.5.0

package/src/auth/session/authorization-vault.d.ts

@@ -0,0 +1,611 @@
+/**
+ * Authorization Vault
+ *
+ * Secure storage for stateful authorization sessions.
+ * Stores provider tokens, consent selections, and session metadata.
+ *
+ * Supports multiple credential types:
+ * - OAuth tokens (access_token, refresh_token, scopes)
+ * - API Keys (key value, header name)
+ * - Basic Auth (username, password)
+ * - Private Keys (PEM/JWK format for signing)
+ * - Custom credentials (extensible)
+ *
+ * In stateful mode:
+ * - Access token is a non-rotatable key to this vault
+ * - All sensitive data stored server-side
+ * - Supports incremental authorization via links
+ *
+ * In stateless mode:
+ * - No vault used, all data in JWT claims
+ * - No incremental authorization support
+ */
+import { z } from 'zod';
+/**
+ * Supported credential types for app authentication
+ */
+export declare const credentialTypeSchema: z.ZodEnum<{
+    custom: "custom";
+    oauth: "oauth";
+    api_key: "api_key";
+    basic: "basic";
+    bearer: "bearer";
+    private_key: "private_key";
+    mtls: "mtls";
+}>;
+export type CredentialType = z.infer<typeof credentialTypeSchema>;
+/**
+ * OAuth credential - standard OAuth 2.0 tokens
+ */
+export declare const oauthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    accessToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    tokenType: z.ZodDefault<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    idToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * API Key credential - sent in header or query param
+ */
+export declare const apiKeyCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+    headerName: z.ZodDefault<z.ZodString>;
+    headerPrefix: z.ZodOptional<z.ZodString>;
+    queryParam: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Basic Auth credential - username and password
+ */
+export declare const basicAuthCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"basic">;
+    username: z.ZodString;
+    password: z.ZodString;
+    encodedValue: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Bearer token credential - static bearer token
+ */
+export declare const bearerCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    token: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * Private key credential - for JWT signing or request signing
+ */
+export declare const privateKeyCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"private_key">;
+    format: z.ZodEnum<{
+        pem: "pem";
+        jwk: "jwk";
+        pkcs8: "pkcs8";
+        pkcs12: "pkcs12";
+    }>;
+    keyData: z.ZodString;
+    keyId: z.ZodOptional<z.ZodString>;
+    algorithm: z.ZodOptional<z.ZodString>;
+    passphrase: z.ZodOptional<z.ZodString>;
+    certificate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * mTLS credential - client certificate for mutual TLS
+ */
+export declare const mtlsCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"mtls">;
+    certificate: z.ZodString;
+    privateKey: z.ZodString;
+    passphrase: z.ZodOptional<z.ZodString>;
+    caCertificate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Custom credential - extensible for app-specific auth
+ */
+export declare const customCredentialSchema: z.ZodObject<{
+    type: z.ZodLiteral<"custom">;
+    customType: z.ZodString;
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Union of all credential types
+ */
+export declare const credentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    accessToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    tokenType: z.ZodDefault<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    idToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    key: z.ZodString;
+    headerName: z.ZodDefault<z.ZodString>;
+    headerPrefix: z.ZodOptional<z.ZodString>;
+    queryParam: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"basic">;
+    username: z.ZodString;
+    password: z.ZodString;
+    encodedValue: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    token: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"private_key">;
+    format: z.ZodEnum<{
+        pem: "pem";
+        jwk: "jwk";
+        pkcs8: "pkcs8";
+        pkcs12: "pkcs12";
+    }>;
+    keyData: z.ZodString;
+    keyId: z.ZodOptional<z.ZodString>;
+    algorithm: z.ZodOptional<z.ZodString>;
+    passphrase: z.ZodOptional<z.ZodString>;
+    certificate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"mtls">;
+    certificate: z.ZodString;
+    privateKey: z.ZodString;
+    passphrase: z.ZodOptional<z.ZodString>;
+    caCertificate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"custom">;
+    customType: z.ZodString;
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>], "type">;
+export type OAuthCredential = z.infer<typeof oauthCredentialSchema>;
+export type ApiKeyCredential = z.infer<typeof apiKeyCredentialSchema>;
+export type BasicAuthCredential = z.infer<typeof basicAuthCredentialSchema>;
+export type BearerCredential = z.infer<typeof bearerCredentialSchema>;
+export type PrivateKeyCredential = z.infer<typeof privateKeyCredentialSchema>;
+export type MtlsCredential = z.infer<typeof mtlsCredentialSchema>;
+export type CustomCredential = z.infer<typeof customCredentialSchema>;
+export type Credential = z.infer<typeof credentialSchema>;
+/**
+ * Credential stored for an app in the vault
+ */
+export declare const appCredentialSchema: z.ZodObject<{
+    appId: z.ZodString;
+    providerId: z.ZodString;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        accessToken: z.ZodString;
+        refreshToken: z.ZodOptional<z.ZodString>;
+        tokenType: z.ZodDefault<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        idToken: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        key: z.ZodString;
+        headerName: z.ZodDefault<z.ZodString>;
+        headerPrefix: z.ZodOptional<z.ZodString>;
+        queryParam: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"basic">;
+        username: z.ZodString;
+        password: z.ZodString;
+        encodedValue: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        token: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"private_key">;
+        format: z.ZodEnum<{
+            pem: "pem";
+            jwk: "jwk";
+            pkcs8: "pkcs8";
+            pkcs12: "pkcs12";
+        }>;
+        keyData: z.ZodString;
+        keyId: z.ZodOptional<z.ZodString>;
+        algorithm: z.ZodOptional<z.ZodString>;
+        passphrase: z.ZodOptional<z.ZodString>;
+        certificate: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"mtls">;
+        certificate: z.ZodString;
+        privateKey: z.ZodString;
+        passphrase: z.ZodOptional<z.ZodString>;
+        caCertificate: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"custom">;
+        customType: z.ZodString;
+        data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>], "type">;
+    acquiredAt: z.ZodNumber;
+    lastUsedAt: z.ZodOptional<z.ZodNumber>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    isValid: z.ZodDefault<z.ZodBoolean>;
+    invalidReason: z.ZodOptional<z.ZodString>;
+    userInfo: z.ZodOptional<z.ZodObject<{
+        sub: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type AppCredential = z.infer<typeof appCredentialSchema>;
+/**
+ * Consent record stored in vault
+ */
+export declare const vaultConsentRecordSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    selectedToolIds: z.ZodArray<z.ZodString>;
+    availableToolIds: z.ZodArray<z.ZodString>;
+    consentedAt: z.ZodNumber;
+    version: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Federated login record stored in vault
+ */
+export declare const vaultFederatedRecordSchema: z.ZodObject<{
+    selectedProviderIds: z.ZodArray<z.ZodString>;
+    skippedProviderIds: z.ZodArray<z.ZodString>;
+    primaryProviderId: z.ZodOptional<z.ZodString>;
+    completedAt: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * Pending incremental authorization request
+ */
+export declare const pendingIncrementalAuthSchema: z.ZodObject<{
+    id: z.ZodString;
+    appId: z.ZodString;
+    toolId: z.ZodOptional<z.ZodString>;
+    authUrl: z.ZodString;
+    requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    elicitId: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    status: z.ZodEnum<{
+        pending: "pending";
+        completed: "completed";
+        cancelled: "cancelled";
+        expired: "expired";
+    }>;
+}, z.core.$strip>;
+/**
+ * Authorization vault entry (the full session state)
+ */
+export declare const authorizationVaultEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    userSub: z.ZodString;
+    userEmail: z.ZodOptional<z.ZodString>;
+    userName: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    createdAt: z.ZodNumber;
+    lastAccessAt: z.ZodNumber;
+    appCredentials: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        appId: z.ZodString;
+        providerId: z.ZodString;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            accessToken: z.ZodString;
+            refreshToken: z.ZodOptional<z.ZodString>;
+            tokenType: z.ZodDefault<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+            scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            idToken: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            key: z.ZodString;
+            headerName: z.ZodDefault<z.ZodString>;
+            headerPrefix: z.ZodOptional<z.ZodString>;
+            queryParam: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"basic">;
+            username: z.ZodString;
+            password: z.ZodString;
+            encodedValue: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"bearer">;
+            token: z.ZodString;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"private_key">;
+            format: z.ZodEnum<{
+                pem: "pem";
+                jwk: "jwk";
+                pkcs8: "pkcs8";
+                pkcs12: "pkcs12";
+            }>;
+            keyData: z.ZodString;
+            keyId: z.ZodOptional<z.ZodString>;
+            algorithm: z.ZodOptional<z.ZodString>;
+            passphrase: z.ZodOptional<z.ZodString>;
+            certificate: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"mtls">;
+            certificate: z.ZodString;
+            privateKey: z.ZodString;
+            passphrase: z.ZodOptional<z.ZodString>;
+            caCertificate: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"custom">;
+            customType: z.ZodString;
+            data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>], "type">;
+        acquiredAt: z.ZodNumber;
+        lastUsedAt: z.ZodOptional<z.ZodNumber>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        isValid: z.ZodDefault<z.ZodBoolean>;
+        invalidReason: z.ZodOptional<z.ZodString>;
+        userInfo: z.ZodOptional<z.ZodObject<{
+            sub: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    consent: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        selectedToolIds: z.ZodArray<z.ZodString>;
+        availableToolIds: z.ZodArray<z.ZodString>;
+        consentedAt: z.ZodNumber;
+        version: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+    federated: z.ZodOptional<z.ZodObject<{
+        selectedProviderIds: z.ZodArray<z.ZodString>;
+        skippedProviderIds: z.ZodArray<z.ZodString>;
+        primaryProviderId: z.ZodOptional<z.ZodString>;
+        completedAt: z.ZodNumber;
+    }, z.core.$strip>>;
+    pendingAuths: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        appId: z.ZodString;
+        toolId: z.ZodOptional<z.ZodString>;
+        authUrl: z.ZodString;
+        requiredScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        elicitId: z.ZodOptional<z.ZodString>;
+        createdAt: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        status: z.ZodEnum<{
+            pending: "pending";
+            completed: "completed";
+            cancelled: "cancelled";
+            expired: "expired";
+        }>;
+    }, z.core.$strip>>;
+    authorizedAppIds: z.ZodArray<z.ZodString>;
+    skippedAppIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type VaultConsentRecord = z.infer<typeof vaultConsentRecordSchema>;
+export type VaultFederatedRecord = z.infer<typeof vaultFederatedRecordSchema>;
+export type PendingIncrementalAuth = z.infer<typeof pendingIncrementalAuthSchema>;
+export type AuthorizationVaultEntry = z.infer<typeof authorizationVaultEntrySchema>;
+export interface AuthorizationVault {
+    /**
+     * Create a new vault entry
+     */
+    create(params: {
+        userSub: string;
+        userEmail?: string;
+        userName?: string;
+        clientId: string;
+        consent?: VaultConsentRecord;
+        federated?: VaultFederatedRecord;
+        authorizedAppIds?: string[];
+        skippedAppIds?: string[];
+    }): Promise<AuthorizationVaultEntry>;
+    /**
+     * Get vault entry by ID
+     */
+    get(id: string): Promise<AuthorizationVaultEntry | null>;
+    /**
+     * Update vault entry
+     */
+    update(id: string, updates: Partial<AuthorizationVaultEntry>): Promise<void>;
+    /**
+     * Delete vault entry
+     */
+    delete(id: string): Promise<void>;
+    /**
+     * Update consent in the vault
+     */
+    updateConsent(vaultId: string, consent: VaultConsentRecord): Promise<void>;
+    /**
+     * Add app to authorized list (for incremental auth)
+     */
+    authorizeApp(vaultId: string, appId: string): Promise<void>;
+    /**
+     * Create a pending incremental auth request
+     */
+    createPendingAuth(vaultId: string, params: {
+        appId: string;
+        toolId?: string;
+        authUrl: string;
+        requiredScopes?: string[];
+        elicitId?: string;
+        ttlMs?: number;
+    }): Promise<PendingIncrementalAuth>;
+    /**
+     * Get pending auth by ID
+     */
+    getPendingAuth(vaultId: string, pendingAuthId: string): Promise<PendingIncrementalAuth | null>;
+    /**
+     * Complete a pending incremental auth
+     */
+    completePendingAuth(vaultId: string, pendingAuthId: string): Promise<void>;
+    /**
+     * Cancel a pending incremental auth
+     */
+    cancelPendingAuth(vaultId: string, pendingAuthId: string): Promise<void>;
+    /**
+     * Check if app is authorized
+     */
+    isAppAuthorized(vaultId: string, appId: string): Promise<boolean>;
+    /**
+     * Get all pending auths for a vault
+     */
+    getPendingAuths(vaultId: string): Promise<PendingIncrementalAuth[]>;
+    /**
+     * Add an app credential to the vault
+     * Only stores if app is authorized AND (consent disabled OR app tools in consent)
+     */
+    addAppCredential(vaultId: string, credential: AppCredential): Promise<void>;
+    /**
+     * Remove an app credential from the vault
+     */
+    removeAppCredential(vaultId: string, appId: string, providerId: string): Promise<void>;
+    /**
+     * Get all credentials for a specific app
+     */
+    getAppCredentials(vaultId: string, appId: string): Promise<AppCredential[]>;
+    /**
+     * Get a specific credential for an app and provider
+     */
+    getCredential(vaultId: string, appId: string, providerId: string): Promise<AppCredential | null>;
+    /**
+     * Get all credentials in the vault (filtered by consent if enabled)
+     * @param filterByConsent If true, only returns credentials for apps with consented tools
+     */
+    getAllCredentials(vaultId: string, filterByConsent?: boolean): Promise<AppCredential[]>;
+    /**
+     * Update credential metadata (last used, validity, etc.)
+     */
+    updateCredential(vaultId: string, appId: string, providerId: string, updates: Partial<Pick<AppCredential, 'lastUsedAt' | 'isValid' | 'invalidReason' | 'expiresAt' | 'metadata'>>): Promise<void>;
+    /**
+     * Check if a credential should be stored based on consent
+     * Returns true if:
+     * - Consent is disabled, OR
+     * - The app has at least one tool in the consent selection
+     */
+    shouldStoreCredential(vaultId: string, appId: string, toolIds?: string[]): Promise<boolean>;
+    /**
+     * Invalidate a credential (mark as invalid without removing)
+     */
+    invalidateCredential(vaultId: string, appId: string, providerId: string, reason: string): Promise<void>;
+    /**
+     * Refresh an OAuth credential (update tokens)
+     */
+    refreshOAuthCredential(vaultId: string, appId: string, providerId: string, tokens: {
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }): Promise<void>;
+    /**
+     * Cleanup expired entries and pending auths
+     */
+    cleanup(): Promise<void>;
+}
+/**
+ * In-Memory Authorization Vault
+ *
+ * Development/testing implementation. Data is lost on restart.
+ * For production, use RedisAuthorizationVault.
+ */
+export declare class InMemoryAuthorizationVault implements AuthorizationVault {
+    private vaults;
+    /** Default TTL for pending auth requests (10 minutes) */
+    private readonly pendingAuthTtlMs;
+    create(params: {
+        userSub: string;
+        userEmail?: string;
+        userName?: string;
+        clientId: string;
+        consent?: VaultConsentRecord;
+        federated?: VaultFederatedRecord;
+        authorizedAppIds?: string[];
+        skippedAppIds?: string[];
+    }): Promise<AuthorizationVaultEntry>;
+    get(id: string): Promise<AuthorizationVaultEntry | null>;
+    update(id: string, updates: Partial<AuthorizationVaultEntry>): Promise<void>;
+    delete(id: string): Promise<void>;
+    updateConsent(vaultId: string, consent: VaultConsentRecord): Promise<void>;
+    authorizeApp(vaultId: string, appId: string): Promise<void>;
+    createPendingAuth(vaultId: string, params: {
+        appId: string;
+        toolId?: string;
+        authUrl: string;
+        requiredScopes?: string[];
+        elicitId?: string;
+        ttlMs?: number;
+    }): Promise<PendingIncrementalAuth>;
+    getPendingAuth(vaultId: string, pendingAuthId: string): Promise<PendingIncrementalAuth | null>;
+    completePendingAuth(vaultId: string, pendingAuthId: string): Promise<void>;
+    cancelPendingAuth(vaultId: string, pendingAuthId: string): Promise<void>;
+    isAppAuthorized(vaultId: string, appId: string): Promise<boolean>;
+    getPendingAuths(vaultId: string): Promise<PendingIncrementalAuth[]>;
+    cleanup(): Promise<void>;
+    /** Create a credential key from appId and providerId */
+    private credentialKey;
+    addAppCredential(vaultId: string, credential: AppCredential): Promise<void>;
+    removeAppCredential(vaultId: string, appId: string, providerId: string): Promise<void>;
+    getAppCredentials(vaultId: string, appId: string): Promise<AppCredential[]>;
+    getCredential(vaultId: string, appId: string, providerId: string): Promise<AppCredential | null>;
+    getAllCredentials(vaultId: string, filterByConsent?: boolean): Promise<AppCredential[]>;
+    updateCredential(vaultId: string, appId: string, providerId: string, updates: Partial<Pick<AppCredential, 'lastUsedAt' | 'isValid' | 'invalidReason' | 'expiresAt' | 'metadata'>>): Promise<void>;
+    shouldStoreCredential(vaultId: string, appId: string, toolIds?: string[]): Promise<boolean>;
+    invalidateCredential(vaultId: string, appId: string, providerId: string, reason: string): Promise<void>;
+    refreshOAuthCredential(vaultId: string, appId: string, providerId: string, tokens: {
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }): Promise<void>;
+}
+/**
+ * Redis Authorization Vault (placeholder)
+ *
+ * Production implementation using Redis for distributed storage.
+ * TODO: Implement after in-memory vault is validated.
+ */
+export declare class RedisAuthorizationVault implements AuthorizationVault {
+    private readonly redis;
+    private readonly namespace;
+    constructor(redis: any, namespace?: string);
+    private key;
+    /** Create a credential key from appId and providerId */
+    private credentialKey;
+    create(params: {
+        userSub: string;
+        userEmail?: string;
+        userName?: string;
+        clientId: string;
+        consent?: VaultConsentRecord;
+        federated?: VaultFederatedRecord;
+        authorizedAppIds?: string[];
+        skippedAppIds?: string[];
+    }): Promise<AuthorizationVaultEntry>;
+    get(id: string): Promise<AuthorizationVaultEntry | null>;
+    update(id: string, updates: Partial<AuthorizationVaultEntry>): Promise<void>;
+    delete(id: string): Promise<void>;
+    updateConsent(vaultId: string, consent: VaultConsentRecord): Promise<void>;
+    authorizeApp(vaultId: string, appId: string): Promise<void>;
+    createPendingAuth(vaultId: string, params: {
+        appId: string;
+        toolId?: string;
+        authUrl: string;
+        requiredScopes?: string[];
+        elicitId?: string;
+        ttlMs?: number;
+    }): Promise<PendingIncrementalAuth>;
+    getPendingAuth(vaultId: string, pendingAuthId: string): Promise<PendingIncrementalAuth | null>;
+    completePendingAuth(vaultId: string, pendingAuthId: string): Promise<void>;
+    cancelPendingAuth(vaultId: string, pendingAuthId: string): Promise<void>;
+    isAppAuthorized(vaultId: string, appId: string): Promise<boolean>;
+    getPendingAuths(vaultId: string): Promise<PendingIncrementalAuth[]>;
+    cleanup(): Promise<void>;
+    addAppCredential(vaultId: string, credential: AppCredential): Promise<void>;
+    removeAppCredential(vaultId: string, appId: string, providerId: string): Promise<void>;
+    getAppCredentials(vaultId: string, appId: string): Promise<AppCredential[]>;
+    getCredential(vaultId: string, appId: string, providerId: string): Promise<AppCredential | null>;
+    getAllCredentials(vaultId: string, filterByConsent?: boolean): Promise<AppCredential[]>;
+    updateCredential(vaultId: string, appId: string, providerId: string, updates: Partial<Pick<AppCredential, 'lastUsedAt' | 'isValid' | 'invalidReason' | 'expiresAt' | 'metadata'>>): Promise<void>;
+    shouldStoreCredential(vaultId: string, appId: string, toolIds?: string[]): Promise<boolean>;
+    invalidateCredential(vaultId: string, appId: string, providerId: string, reason: string): Promise<void>;
+    refreshOAuthCredential(vaultId: string, appId: string, providerId: string, tokens: {
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }): Promise<void>;
+}