@frontmcp/sdk 0.4.1 → 0.5.1

package/README.md

@@ -1,9 +1,9 @@
 <div align="center">
 
 <picture>
-  <source width="400" media="(prefers-color-scheme: dark)" srcset="docs/assets/logo/frontmcp.dark.svg">
-  <source width="400" media="(prefers-color-scheme: light)" srcset="docs/assets/logo/frontmcp.light.svg">
-  <img width="400" alt="FrontMCP Logo" src="docs/assets/logo/frontmcp.light.svg">
+  <source width="400" media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/agentfront/frontmcp/refs/heads/main/docs/live/assets/logo/frontmcp.dark.svg">
+  <source width="400" media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/agentfront/frontmcp/refs/heads/main/docs/live/assets/logo/frontmcp.light.svg">
+  <img width="400" alt="FrontMCP Logo" src="https://raw.githubusercontent.com/agentfront/frontmcp/refs/heads/main/docs/live/assets/logo/frontmcp.light.svg">
 </picture>
 <hr>
 
@@ -84,7 +84,13 @@ export default class Server {}
 
 ## Installation
 
-**Prereqs:** Node.js ≥ 22, npm ≥ 10. ([Installation - FrontMCP][1])
+**Prerequisites:**
+
+- **Node.js**: Minimum version 22 (LTS) | Recommended version 24 (Active LTS)
+  - _This framework is developed and tested on Node.js 24_
+- **npm**: ≥ 10 (or pnpm/yarn equivalent)
+
+For detailed setup instructions, see the [Installation Guide][1].
 
 ### Option A — New project (recommended)
 
@@ -98,7 +104,7 @@ installs required dev deps. ([Installation - FrontMCP][1])
 ### Option B — Add to an existing project
 
 ```bash
-npm i -D frontmcp @types/node@^20
+npm i -D frontmcp @types/node@^22
 npx frontmcp init
 ```
 
@@ -295,31 +301,37 @@ FrontMCP][3])
 
 ### Servers
 
-`@FrontMcp({...})` defines **info**, **apps**, **http**, **logging**, **session**, and optional **auth**. Keep it
-minimal or scale up with providers and plugins. ([The FrontMCP Server - FrontMCP][5])
+The FrontMCP server is defined with a single decorator: `@FrontMcp({...})`. It configures **info**, **apps**, **http**,
+**logging**, **session**, and optional **auth**. Start minimal and scale up with providers and plugins.
+([The FrontMCP Server - FrontMCP][5])
 
 ### Apps
 
-Use `@App` to group **tools**, **resources**, **prompts**, plus **providers**, **adapters**, and **plugins**. With
-`splitByApp: true`, each app gets its own scope/base path and, if needed, its own auth surface. ([Apps - FrontMCP][6])
+Apps are the **organizational units** for capabilities. Each app groups related **tools**, **resources**, and **prompts**
+into a cohesive domain, along with **providers**, **adapters**, and **plugins**. With `splitByApp: true`, apps get
+isolated scopes and auth surfaces. ([Apps - FrontMCP][6])
 
 ### Tools
 
-Typed actions with schemas (class `@Tool` or inline `tool({...})(handler)`). Use the Zod‑field **shape** style for
-`inputSchema`. ([Tools - FrontMCP][4])
+Tools are **typed actions** that execute operations with side effects. They're the primary way to enable an AI model to
+interact with external systems—calling APIs, modifying data, performing calculations, or triggering workflows. Use the
+class `@Tool` decorator or inline `tool({...})(handler)` with Zod schemas. ([Tools - FrontMCP][4])
 
 ### Resources
 
-Readable data by URI or RFC6570 template (see `@Resource` / `@ResourceTemplate`). ([Resources - FrontMCP][7])
+Resources expose **readable data** to an AI model's context. Unlike tools that execute actions with side effects,
+resources are designed for read-only data retrieval—configuration files, user profiles, documents, or any content
+the model needs to reference. ([Resources - FrontMCP][7])
 
 ### Prompts
 
-Reusable templates returning MCP `GetPromptResult`, with typed arguments. ([Prompts - FrontMCP][8])
+Prompts provide **reusable message templates** for AI interactions. They return MCP `GetPromptResult` with typed
+arguments, enabling consistent conversation patterns. ([Prompts - FrontMCP][8])
 
 ### Providers / Adapters / Plugins
 
-Inject shared services, generate tools from OpenAPI, and add cross‑cutting behavior like caching and hooks. ([Add
-OpenAPI Adapter - FrontMCP][9])
+Inject shared services, generate tools from OpenAPI specs, and add cross‑cutting behavior like caching and hooks.
+([Add OpenAPI Adapter - FrontMCP][9])
 
 ---
 
@@ -442,7 +454,7 @@ See [LICENSE](./LICENSE).
 [7]: https://docs.agentfront.dev/docs/servers/resources 'Resources - FrontMCP'
 [8]: https://docs.agentfront.dev/docs/servers/prompts 'Prompts - FrontMCP'
 [9]: https://docs.agentfront.dev/docs/guides/add-openapi-adapter 'Add OpenAPI Adapter - FrontMCP'
-[10]: https://docs.agentfront.dev/docs/servers/authentication/overview 'Authentication - FrontMCP'
-[11]: https://docs.agentfront.dev/docs/servers/authentication/remote 'Remote OAuth - FrontMCP'
-[12]: https://docs.agentfront.dev/docs/servers/authentication/local 'Local OAuth - FrontMCP'
+[10]: https://docs.agentfront.dev/docs/authentication/overview 'Authentication - FrontMCP'
+[11]: https://docs.agentfront.dev/docs/authentication/remote 'Remote OAuth - FrontMCP'
+[12]: https://docs.agentfront.dev/docs/authentication/local 'Local OAuth - FrontMCP'
 [13]: https://docs.agentfront.dev/docs/deployment/production-build 'Production Build - FrontMCP'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/sdk",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "FrontMCP SDK",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -31,21 +31,36 @@
       "types": "./src/index.d.ts",
       "import": "./src/index.js",
       "default": "./src/index.js"
+    },
+    "./mcp-apps": {
+      "types": "./src/mcp-apps/index.d.ts",
+      "import": "./src/mcp-apps/index.js",
+      "default": "./src/mcp-apps/index.js"
     }
   },
   "peerDependencies": {
-    "zod": "^3.25.76"
+    "zod": "^4.0.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    }
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.22.0",
+    "@frontmcp/ui": "0.5.1",
+    "@modelcontextprotocol/sdk": "1.24.3",
     "axios": "^1.6.0",
     "ioredis": "^5.8.0",
     "jose": "^6.1.0",
     "openapi-mcp-generator": "^3.2.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.0",
-    "json-schema-to-zod-v3": "1.0.0",
-    "zod-to-json-schema": "^3.25.0",
+    "vectoriadb": "^2.0.1",
     "tslib": "^2.3.0"
   },
   "devDependencies": {

package/src/app/app.registry.d.ts

@@ -1,9 +1,10 @@
 import 'reflect-metadata';
-import { AppType, AppEntry, AppRecord } from '../common';
+import { AppType, AppEntry, AppRecord, EntryOwnerRef } from '../common';
 import ProviderRegistry from '../provider/provider.registry';
 import { RegistryAbstract, RegistryBuildMapResult } from '../regsitry';
 export default class AppRegistry extends RegistryAbstract<AppEntry, AppRecord, AppType[]> {
-    constructor(globalProviders: ProviderRegistry, list: AppType[]);
+    private readonly owner;
+    constructor(globalProviders: ProviderRegistry, list: AppType[], owner: EntryOwnerRef);
     protected buildMap(list: AppType[]): RegistryBuildMapResult<AppRecord>;
     protected buildGraph(): void;
     /** Instantiate adapters, run fetch/transform, and populate registries. */

package/src/app/app.registry.js

@@ -7,8 +7,10 @@ const regsitry_1 = require("../regsitry");
 const token_utils_1 = require("../utils/token.utils");
 const instances_1 = require("./instances");
 class AppRegistry extends regsitry_1.RegistryAbstract {
-    constructor(globalProviders, list) {
+    owner;
+    constructor(globalProviders, list, owner) {
         super('AppRegistry', globalProviders, list);
+        this.owner = owner;
     }
     buildMap(list) {
         const tokens = new Set();

package/src/app/app.registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.registry.js","sourceRoot":"","sources":["../../../src/app/app.registry.ts"],"names":[],"mappings":";;AAAA,4BAA0B;AAC1B,sCAAyE;AACzE,2CAA6D;AAE7D,0CAAuE;AACvE,sDAAiD;AACjD,2CAAkE;AAElE,MAAqB,WAAY,SAAQ,2BAAgD;IAEvF,YACE,eAAiC,EACjC,IAAe;QAEf,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAGS,QAAQ,CAAC,IAAe;QAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAS,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAES,UAAU;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAA,4BAAgB,EAAC,GAAG,CAAC,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,IAAA,uBAAS,EAAC,KAAK,CAAC,eAAe,IAAA,uBAAS,EAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;gBAClG,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAChE,KAAK,CAAC,UAAU;QACxB,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;YAElC,IAAI,GAAa,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAO,CAAC,WAAW,EAAE,CAAC;gBACrC,GAAG,GAAG,IAAI,4BAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAO,CAAC,YAAY,EAAE,CAAC;gBAC7C,GAAG,GAAG,IAAI,6BAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,iCAAiC;gBACjC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAGD,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AA/DD,8BA+DC","sourcesContent":["import 'reflect-metadata';\nimport { AppType, Token, AppEntry, AppKind, AppRecord } from '../common';\nimport { appDiscoveryDeps, normalizeApp } from './app.utils';\nimport ProviderRegistry from '../provider/provider.registry';\nimport { RegistryAbstract, RegistryBuildMapResult } from '../regsitry';\nimport { tokenName } from '../utils/token.utils';\nimport { AppLocalInstance, AppRemoteInstance } from './instances';\n\nexport default class AppRegistry extends RegistryAbstract<AppEntry, AppRecord, AppType[]> {\n\n  constructor(\n    globalProviders: ProviderRegistry,\n    list: AppType[],\n  ) {\n    super('AppRegistry', globalProviders, list);\n  }\n\n\n  protected buildMap(list: AppType[]): RegistryBuildMapResult<AppRecord> {\n    const tokens = new Set<Token>();\n    const defs = new Map<Token, AppRecord>();\n    const graph = new Map<Token, Set<Token>>();\n    for (const raw of list) {\n      const rec = normalizeApp(raw);\n      const provide = rec.provide;\n      tokens.add(provide);\n      defs.set(provide, rec);\n      graph.set(provide, new Set());\n    }\n    return { tokens, defs, graph };\n  }\n\n  protected buildGraph() {\n    for (const token of this.tokens) {\n      const rec = this.defs.get(token)!;\n      const deps = appDiscoveryDeps(rec);\n      for (const d of deps) {\n        if (!this.providers.get(d)) {\n          throw new Error(`App ${tokenName(token)} depends on ${tokenName(d)}, which is not registered.`);\n        }\n        this.graph.get(token)!.add(d);\n      }\n    }\n  }\n\n  /** Instantiate adapters, run fetch/transform, and populate registries. */\n  protected async initialize(): Promise<void> {\n    const readyArr: Promise<void>[] = [];\n    for (const token of this.tokens) {\n      const rec = this.defs.get(token)!;\n\n      let app: AppEntry;\n      if (rec.kind === AppKind.LOCAL_CLASS) {\n        app = new AppLocalInstance(rec, this.providers);\n      } else if (rec.kind === AppKind.REMOTE_VALUE) {\n        app = new AppRemoteInstance(rec, this.providers);\n      } else {\n        // TODO: use specific error class\n        throw Error('Invalid adapter kind');\n      }\n\n      this.instances.set(token, app);\n      readyArr.push(app.ready);\n    }\n    await Promise.all(readyArr);\n  }\n\n\n  getApps(): AppEntry[] {\n    return [...this.instances.values()];\n  }\n}\n"]}
+{"version":3,"file":"app.registry.js","sourceRoot":"","sources":["../../../src/app/app.registry.ts"],"names":[],"mappings":";;AAAA,4BAA0B;AAC1B,sCAAwF;AACxF,2CAA6D;AAE7D,0CAAuE;AACvE,sDAAiD;AACjD,2CAAkE;AAElE,MAAqB,WAAY,SAAQ,2BAAgD;IACtE,KAAK,CAAgB;IAEtC,YAAY,eAAiC,EAAE,IAAe,EAAE,KAAoB;QAClF,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAES,QAAQ,CAAC,IAAe;QAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAS,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAES,UAAU;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAA,4BAAgB,EAAC,GAAG,CAAC,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,IAAA,uBAAS,EAAC,KAAK,CAAC,eAAe,IAAA,uBAAS,EAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;gBAClG,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAChE,KAAK,CAAC,UAAU;QACxB,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;YAElC,IAAI,GAAa,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAO,CAAC,WAAW,EAAE,CAAC;gBACrC,GAAG,GAAG,IAAI,4BAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAO,CAAC,YAAY,EAAE,CAAC;gBAC7C,GAAG,GAAG,IAAI,6BAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,iCAAiC;gBACjC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AA5DD,8BA4DC","sourcesContent":["import 'reflect-metadata';\nimport { AppType, Token, AppEntry, AppKind, AppRecord, EntryOwnerRef } from '../common';\nimport { appDiscoveryDeps, normalizeApp } from './app.utils';\nimport ProviderRegistry from '../provider/provider.registry';\nimport { RegistryAbstract, RegistryBuildMapResult } from '../regsitry';\nimport { tokenName } from '../utils/token.utils';\nimport { AppLocalInstance, AppRemoteInstance } from './instances';\n\nexport default class AppRegistry extends RegistryAbstract<AppEntry, AppRecord, AppType[]> {\n  private readonly owner: EntryOwnerRef;\n\n  constructor(globalProviders: ProviderRegistry, list: AppType[], owner: EntryOwnerRef) {\n    super('AppRegistry', globalProviders, list);\n    this.owner = owner;\n  }\n\n  protected buildMap(list: AppType[]): RegistryBuildMapResult<AppRecord> {\n    const tokens = new Set<Token>();\n    const defs = new Map<Token, AppRecord>();\n    const graph = new Map<Token, Set<Token>>();\n    for (const raw of list) {\n      const rec = normalizeApp(raw);\n      const provide = rec.provide;\n      tokens.add(provide);\n      defs.set(provide, rec);\n      graph.set(provide, new Set());\n    }\n    return { tokens, defs, graph };\n  }\n\n  protected buildGraph() {\n    for (const token of this.tokens) {\n      const rec = this.defs.get(token)!;\n      const deps = appDiscoveryDeps(rec);\n      for (const d of deps) {\n        if (!this.providers.get(d)) {\n          throw new Error(`App ${tokenName(token)} depends on ${tokenName(d)}, which is not registered.`);\n        }\n        this.graph.get(token)!.add(d);\n      }\n    }\n  }\n\n  /** Instantiate adapters, run fetch/transform, and populate registries. */\n  protected async initialize(): Promise<void> {\n    const readyArr: Promise<void>[] = [];\n    for (const token of this.tokens) {\n      const rec = this.defs.get(token)!;\n\n      let app: AppEntry;\n      if (rec.kind === AppKind.LOCAL_CLASS) {\n        app = new AppLocalInstance(rec, this.providers);\n      } else if (rec.kind === AppKind.REMOTE_VALUE) {\n        app = new AppRemoteInstance(rec, this.providers);\n      } else {\n        // TODO: use specific error class\n        throw Error('Invalid adapter kind');\n      }\n\n      this.instances.set(token, app);\n      readyArr.push(app.ready);\n    }\n    await Promise.all(readyArr);\n  }\n\n  getApps(): AppEntry[] {\n    return [...this.instances.values()];\n  }\n}\n"]}

package/src/app/instances/app.local.instance.js

@@ -40,8 +40,8 @@ class AppLocalInstance extends common_1.AppEntry {
         this.appAdapters = new adapter_regsitry_1.default(this.appProviders, this.metadata.adapters ?? []);
         await this.appAdapters.ready;
         this.appTools = new tool_registry_1.default(this.appProviders, this.metadata.tools ?? [], appOwner);
-        this.appResources = new resource_registry_1.default(this.appProviders, this.metadata.resources ?? []);
-        this.appPrompts = new prompt_registry_1.default(this.appProviders, this.metadata.prompts ?? []);
+        this.appResources = new resource_registry_1.default(this.appProviders, this.metadata.resources ?? [], appOwner);
+        this.appPrompts = new prompt_registry_1.default(this.appProviders, this.metadata.prompts ?? [], appOwner);
         await Promise.all([this.appTools.ready, this.appResources.ready, this.appPrompts.ready]);
     }
     get providers() {

package/src/app/instances/app.local.instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.local.instance.js","sourceRoot":"","sources":["../../../../src/app/instances/app.local.instance.ts"],"names":[],"mappings":";;;;AAAA,yCAAqE;AACrE,2DAAwD;AACxD,iGAAgE;AAChE,qFAAoD;AACpD,iGAAgE;AAChE,2FAA0D;AAC1D,8FAA6D;AAC7D,2FAA0D;AAE1D,MAAa,gBAAiB,SAAQ,iBAA0B;IAC5C,EAAE,CAAS;IAErB,cAAc,CAAmB;IACjC,YAAY,CAAmB;IAC/B,UAAU,CAAiB;IAC3B,WAAW,CAAkB;IAC7B,QAAQ,CAAe;IACvB,YAAY,CAAmB;IAC/B,UAAU,CAAiB;IAEnC,YAAY,MAAiB,EAAE,cAAgC;QAC7D,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAA,2BAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,IAAI,CAAC,YAAY,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,iCAAiC;QAChE,4FAA4F;QAC5F,oEAAoE;QAEpE,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,KAAc;YACpB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,EAAE,IAAI,CAAC,KAAK;SAChB,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,kFAAkF;QAE/G,IAAI,CAAC,WAAW,GAAG,IAAI,0BAAe,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAE7B,IAAI,CAAC,QAAQ,GAAG,IAAI,uBAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAErF,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF;AAlED,4CAkEC","sourcesContent":["import { AppEntry, AppRecord, LocalAppMetadata } from '../../common';\nimport { idFromString } from '../../utils/string.utils';\nimport ProviderRegistry from '../../provider/provider.registry';\nimport ToolRegistry from '../../tool/tool.registry';\nimport ResourceRegistry from '../../resource/resource.registry';\nimport PromptRegistry from '../../prompt/prompt.registry';\nimport AdapterRegistry from '../../adapter/adapter.regsitry';\nimport PluginRegistry from '../../plugin/plugin.registry';\n\nexport class AppLocalInstance extends AppEntry<LocalAppMetadata> {\n  override readonly id: string;\n\n  private scopeProviders: ProviderRegistry;\n  private appProviders: ProviderRegistry;\n  private appPlugins: PluginRegistry;\n  private appAdapters: AdapterRegistry;\n  private appTools: ToolRegistry;\n  private appResources: ResourceRegistry;\n  private appPrompts: PromptRegistry;\n\n  constructor(record: AppRecord, scopeProviders: ProviderRegistry) {\n    super(record);\n    this.scopeProviders = scopeProviders;\n    this.id = this.metadata.id ?? idFromString(this.metadata.name);\n    this.ready = this.initialize();\n  }\n\n  protected async initialize() {\n    this.appProviders = new ProviderRegistry(this.metadata.providers ?? [], this.scopeProviders);\n    await this.appProviders.ready; // wait for providers to be ready\n    // this.authProviders = new AuthRegistry(this.providers, this.metadata.authProviders ?? []);\n    // await this.authProviders.ready; // wait for providers to be ready\n\n    const appOwner = {\n      kind: 'app' as const,\n      id: this.id,\n      ref: this.token,\n    };\n\n    this.appPlugins = new PluginRegistry(this.appProviders, this.metadata.plugins ?? [], appOwner);\n    await this.appPlugins.ready; // wait for plugins and it's providers/adapters/tools/resource/prompts to be ready\n\n    this.appAdapters = new AdapterRegistry(this.appProviders, this.metadata.adapters ?? []);\n    await this.appAdapters.ready;\n\n    this.appTools = new ToolRegistry(this.appProviders, this.metadata.tools ?? [], appOwner);\n    this.appResources = new ResourceRegistry(this.appProviders, this.metadata.resources ?? []);\n    this.appPrompts = new PromptRegistry(this.appProviders, this.metadata.prompts ?? []);\n\n    await Promise.all([this.appTools.ready, this.appResources.ready, this.appPrompts.ready]);\n  }\n\n  get providers(): Readonly<ProviderRegistry> {\n    return this.appProviders;\n  }\n\n  get adapters(): Readonly<AdapterRegistry> {\n    return this.appAdapters;\n  }\n\n  get plugins(): Readonly<PluginRegistry> {\n    return this.appPlugins;\n  }\n\n  get tools(): Readonly<ToolRegistry> {\n    return this.appTools;\n  }\n\n  get resources(): Readonly<ResourceRegistry> {\n    return this.appResources;\n  }\n\n  get prompts(): Readonly<PromptRegistry> {\n    return this.appPrompts;\n  }\n}\n"]}
+{"version":3,"file":"app.local.instance.js","sourceRoot":"","sources":["../../../../src/app/instances/app.local.instance.ts"],"names":[],"mappings":";;;;AAAA,yCAAqE;AACrE,2DAAwD;AACxD,iGAAgE;AAChE,qFAAoD;AACpD,iGAAgE;AAChE,2FAA0D;AAC1D,8FAA6D;AAC7D,2FAA0D;AAE1D,MAAa,gBAAiB,SAAQ,iBAA0B;IAC5C,EAAE,CAAS;IAErB,cAAc,CAAmB;IACjC,YAAY,CAAmB;IAC/B,UAAU,CAAiB;IAC3B,WAAW,CAAkB;IAC7B,QAAQ,CAAe;IACvB,YAAY,CAAmB;IAC/B,UAAU,CAAiB;IAEnC,YAAY,MAAiB,EAAE,cAAgC;QAC7D,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAA,2BAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,IAAI,CAAC,YAAY,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,iCAAiC;QAChE,4FAA4F;QAC5F,oEAAoE;QAEpE,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,KAAc;YACpB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,EAAE,IAAI,CAAC,KAAK;SAChB,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,kFAAkF;QAE/G,IAAI,CAAC,WAAW,GAAG,IAAI,0BAAe,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAE7B,IAAI,CAAC,QAAQ,GAAG,IAAI,uBAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrG,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE/F,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF;AAlED,4CAkEC","sourcesContent":["import { AppEntry, AppRecord, LocalAppMetadata } from '../../common';\nimport { idFromString } from '../../utils/string.utils';\nimport ProviderRegistry from '../../provider/provider.registry';\nimport ToolRegistry from '../../tool/tool.registry';\nimport ResourceRegistry from '../../resource/resource.registry';\nimport PromptRegistry from '../../prompt/prompt.registry';\nimport AdapterRegistry from '../../adapter/adapter.regsitry';\nimport PluginRegistry from '../../plugin/plugin.registry';\n\nexport class AppLocalInstance extends AppEntry<LocalAppMetadata> {\n  override readonly id: string;\n\n  private scopeProviders: ProviderRegistry;\n  private appProviders: ProviderRegistry;\n  private appPlugins: PluginRegistry;\n  private appAdapters: AdapterRegistry;\n  private appTools: ToolRegistry;\n  private appResources: ResourceRegistry;\n  private appPrompts: PromptRegistry;\n\n  constructor(record: AppRecord, scopeProviders: ProviderRegistry) {\n    super(record);\n    this.scopeProviders = scopeProviders;\n    this.id = this.metadata.id ?? idFromString(this.metadata.name);\n    this.ready = this.initialize();\n  }\n\n  protected async initialize() {\n    this.appProviders = new ProviderRegistry(this.metadata.providers ?? [], this.scopeProviders);\n    await this.appProviders.ready; // wait for providers to be ready\n    // this.authProviders = new AuthRegistry(this.providers, this.metadata.authProviders ?? []);\n    // await this.authProviders.ready; // wait for providers to be ready\n\n    const appOwner = {\n      kind: 'app' as const,\n      id: this.id,\n      ref: this.token,\n    };\n\n    this.appPlugins = new PluginRegistry(this.appProviders, this.metadata.plugins ?? [], appOwner);\n    await this.appPlugins.ready; // wait for plugins and it's providers/adapters/tools/resource/prompts to be ready\n\n    this.appAdapters = new AdapterRegistry(this.appProviders, this.metadata.adapters ?? []);\n    await this.appAdapters.ready;\n\n    this.appTools = new ToolRegistry(this.appProviders, this.metadata.tools ?? [], appOwner);\n    this.appResources = new ResourceRegistry(this.appProviders, this.metadata.resources ?? [], appOwner);\n    this.appPrompts = new PromptRegistry(this.appProviders, this.metadata.prompts ?? [], appOwner);\n\n    await Promise.all([this.appTools.ready, this.appResources.ready, this.appPrompts.ready]);\n  }\n\n  get providers(): Readonly<ProviderRegistry> {\n    return this.appProviders;\n  }\n\n  get adapters(): Readonly<AdapterRegistry> {\n    return this.appAdapters;\n  }\n\n  get plugins(): Readonly<PluginRegistry> {\n    return this.appPlugins;\n  }\n\n  get tools(): Readonly<ToolRegistry> {\n    return this.appTools;\n  }\n\n  get resources(): Readonly<ResourceRegistry> {\n    return this.appResources;\n  }\n\n  get prompts(): Readonly<PromptRegistry> {\n    return this.appPrompts;\n  }\n}\n"]}

package/src/auth/auth.registry.d.ts

@@ -1,10 +1,42 @@
 import 'reflect-metadata';
 import { RegistryAbstract, RegistryBuildMapResult } from '../regsitry';
 import ProviderRegistry from '../provider/provider.registry';
-import { AuthOptions, FrontMcpAuth, AuthProviderType, AuthProviderEntry, AuthRegistryInterface, AuthProviderRecord, EntryOwnerRef, ScopeEntry } from '../common';
+import { FrontMcpAuth, AuthProviderType, AuthProviderEntry, AuthRegistryInterface, AuthProviderRecord, EntryOwnerRef, ScopeEntry, AuthOptionsInput } from '../common';
+import { AuthProviderDetectionResult } from './detection';
 export declare class AuthRegistry extends RegistryAbstract<AuthProviderEntry, AuthProviderRecord, AuthProviderType[]> implements AuthRegistryInterface {
     private readonly primary?;
-    constructor(scope: ScopeEntry, providers: ProviderRegistry, metadata: AuthProviderType[], owner: EntryOwnerRef, primary?: AuthOptions);
+    private readonly parsedOptions;
+    private readonly logger;
+    private readonly owner;
+    /**
+     * Detection result for auth providers across the scope hierarchy
+     */
+    readonly detection: AuthProviderDetectionResult;
+    /**
+     * Whether this scope requires orchestrated mode
+     */
+    readonly requiresOrchestration: boolean;
+    constructor(scope: ScopeEntry, providers: ProviderRegistry, metadata: AuthProviderType[], owner: EntryOwnerRef, primaryInput?: AuthOptionsInput);
+    /**
+     * Extract AppAuthInfo from scope metadata
+     */
+    private extractAppAuthInfo;
+    /**
+     * Get app metadata from AppType (handles both class and value types)
+     */
+    private getAppMetadata;
+    /**
+     * Log detection results for debugging
+     */
+    private logDetectionResults;
+    /**
+     * Validate configuration and throw if invalid
+     */
+    private validateConfiguration;
+    /**
+     * Create the appropriate primary auth provider based on parsed options
+     */
+    private createPrimaryAuth;
     protected buildMap(list: AuthProviderType[]): RegistryBuildMapResult<AuthProviderRecord>;
     protected buildGraph(): void;
     protected initialize(): Promise<void>;

package/src/auth/auth.registry.js

@@ -6,39 +6,167 @@ require("reflect-metadata");
 const regsitry_1 = require("../regsitry");
 const common_1 = require("../common");
 const auth_utils_1 = require("./auth.utils");
-const token_utils_1 = require("../utils/token.utils");
+const utils_1 = require("../utils");
 const instance_remote_primary_auth_1 = require("./instances/instance.remote-primary-auth");
 const instance_local_primary_auth_1 = require("./instances/instance.local-primary-auth");
+const detection_1 = require("./detection");
+const errors_1 = require("../errors");
+/**
+ * Default auth options when none provided - public mode with all tools open
+ */
+const DEFAULT_AUTH_OPTIONS = {
+    mode: 'orchestrated',
+    type: 'local',
+    allowDefaultPublic: true,
+};
 class AuthRegistry extends regsitry_1.RegistryAbstract {
     primary;
-    constructor(scope, providers, metadata, owner, primary) {
+    parsedOptions;
+    logger;
+    owner;
+    /**
+     * Detection result for auth providers across the scope hierarchy
+     */
+    detection;
+    /**
+     * Whether this scope requires orchestrated mode
+     */
+    requiresOrchestration;
+    constructor(scope, providers, metadata, owner, primaryInput) {
         super('AuthRegistry', providers, metadata, false);
-        let primaryRecord;
-        if (primary) {
-            this.primary = primary.type === 'remote' ? new instance_remote_primary_auth_1.RemotePrimaryAuth(scope, providers, primary) : new instance_local_primary_auth_1.LocalPrimaryAuth(scope, providers, primary);
-            primaryRecord = {
-                kind: common_1.AuthProviderKind.PRIMARY,
-                provide: common_1.FrontMcpAuth,
-                useValue: this.primary,
-                metadata: primary,
-            };
-        }
-        else {
-            const defaultMetadata = { type: 'local', id: 'local', name: 'default-auth', allowAnonymous: true };
-            this.primary = new instance_local_primary_auth_1.LocalPrimaryAuth(scope, providers, defaultMetadata);
-            primaryRecord = {
-                kind: common_1.AuthProviderKind.PRIMARY,
-                provide: common_1.FrontMcpAuth,
-                useValue: this.primary,
-                metadata: defaultMetadata,
-            };
-        }
+        this.owner = owner;
+        this.logger = providers.get(common_1.FrontMcpLogger).child('AuthRegistry');
+        // Parse input with defaults applied
+        this.parsedOptions = (0, common_1.parseAuthOptions)(primaryInput ?? DEFAULT_AUTH_OPTIONS);
+        // Detect auth providers across all apps in this scope
+        const appAuthInfos = this.extractAppAuthInfo(scope);
+        this.detection = (0, detection_1.detectAuthProviders)(this.parsedOptions, appAuthInfos);
+        this.requiresOrchestration = this.detection.requiresOrchestration;
+        // Log detection results
+        this.logDetectionResults();
+        // Validate configuration and throw if invalid
+        this.validateConfiguration();
+        // Create the appropriate primary auth provider based on mode
+        this.primary = this.createPrimaryAuth(scope, providers, this.parsedOptions);
+        const primaryRecord = {
+            kind: common_1.AuthProviderKind.PRIMARY,
+            provide: common_1.FrontMcpAuth,
+            useValue: this.primary,
+            metadata: this.parsedOptions,
+        };
         this.tokens.add(common_1.FrontMcpAuth);
         this.defs.set(common_1.FrontMcpAuth, primaryRecord);
         this.graph.set(common_1.FrontMcpAuth, new Set());
         this.buildGraph();
         this.ready = this.initialize();
     }
+    /**
+     * Extract AppAuthInfo from scope metadata
+     */
+    extractAppAuthInfo(scope) {
+        const apps = scope.metadata.apps || [];
+        const result = [];
+        for (const app of apps) {
+            // Handle both class-based and value-based app definitions
+            const appMeta = this.getAppMetadata(app);
+            if (appMeta) {
+                result.push({
+                    id: appMeta.id || appMeta.name,
+                    name: appMeta.name,
+                    auth: appMeta.auth,
+                });
+            }
+        }
+        return result;
+    }
+    /**
+     * Get app metadata from AppType (handles both class and value types)
+     */
+    getAppMetadata(app) {
+        // Value type: has metadata directly
+        if (typeof app === 'object' && 'name' in app) {
+            const appValue = app;
+            return {
+                id: appValue.id,
+                name: appValue.name,
+                auth: appValue.auth,
+            };
+        }
+        // Class type: check for metadata decorator
+        if (typeof app === 'function') {
+            const metadata = Reflect.getMetadata('frontmcp:app', app);
+            if (metadata) {
+                return {
+                    id: metadata.id,
+                    name: metadata.name,
+                    auth: metadata.auth,
+                };
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Log detection results for debugging
+     */
+    logDetectionResults() {
+        const { providers, uniqueProviderCount, requiresOrchestration, warnings } = this.detection;
+        if (uniqueProviderCount > 1) {
+            this.logger.info(`Detected ${uniqueProviderCount} unique auth providers: ${[...providers.keys()].join(', ')}`);
+        }
+        if (requiresOrchestration) {
+            this.logger.info(`Orchestration required: Multiple auth providers detected across apps`);
+        }
+        // Log warnings
+        for (const warning of warnings) {
+            this.logger.warn(warning);
+        }
+    }
+    /**
+     * Validate configuration and throw if invalid
+     */
+    validateConfiguration() {
+        const { validationErrors } = this.detection;
+        if (validationErrors.length > 0) {
+            // Log all errors
+            for (const error of validationErrors) {
+                this.logger.error(`[AuthRegistry] ${error}`);
+            }
+            // Throw with first error (most important)
+            throw new errors_1.AuthConfigurationError(`Invalid auth configuration: ${validationErrors[0]}`, {
+                errors: validationErrors,
+                suggestion: `1. Change your parent auth mode from 'transparent' to 'orchestrated'\n` +
+                    `2. Example:\n` +
+                    `   auth: {\n` +
+                    `     mode: 'orchestrated',\n` +
+                    `     type: 'local', // or 'remote' with your provider config\n` +
+                    `   }`,
+            });
+        }
+    }
+    /**
+     * Create the appropriate primary auth provider based on parsed options
+     */
+    createPrimaryAuth(scope, providers, options) {
+        if ((0, common_1.isPublicMode)(options)) {
+            return new instance_local_primary_auth_1.LocalPrimaryAuth(scope, providers, options);
+        }
+        if ((0, common_1.isTransparentMode)(options)) {
+            return new instance_remote_primary_auth_1.RemotePrimaryAuth(scope, providers, options);
+        }
+        if ((0, common_1.isOrchestratedMode)(options)) {
+            if ((0, common_1.isOrchestratedLocal)(options)) {
+                return new instance_local_primary_auth_1.LocalPrimaryAuth(scope, providers, options);
+            }
+            else {
+                // Orchestrated remote: local auth server proxying to remote provider
+                // TODO: Store remote config for upstream OAuth flows
+                return new instance_local_primary_auth_1.LocalPrimaryAuth(scope, providers, options);
+            }
+        }
+        // Fallback (should never reach here) - create public mode with defaults
+        const defaultOptions = (0, common_1.parseAuthOptions)({ mode: 'public' });
+        return new instance_local_primary_auth_1.LocalPrimaryAuth(scope, providers, defaultOptions);
+    }
     buildMap(list) {
         const tokens = new Set();
         const defs = new Map();
@@ -55,12 +183,19 @@ class AuthRegistry extends regsitry_1.RegistryAbstract {
     buildGraph() {
         for (const token of this.tokens) {
             const rec = this.defs.get(token);
+            if (!rec) {
+                throw new errors_1.DependencyNotFoundError('AuthRegistry', (0, utils_1.tokenName)(token));
+            }
             const deps = (0, auth_utils_1.authDiscoveryDeps)(rec);
             for (const d of deps) {
                 if (!this.providers.get(d)) {
-                    throw new Error(`AuthProvider ${(0, token_utils_1.tokenName)(token)} depends on ${(0, token_utils_1.tokenName)(d)}, which is not registered.`);
+                    throw new errors_1.DependencyNotFoundError('AuthRegistry', `${(0, utils_1.tokenName)(d)} (required by ${(0, utils_1.tokenName)(token)})`);
+                }
+                const graphEntry = this.graph.get(token);
+                if (!graphEntry) {
+                    throw new errors_1.DependencyNotFoundError('AuthRegistry', `graph entry for ${(0, utils_1.tokenName)(token)}`);
                 }
-                this.graph.get(token).add(d);
+                graphEntry.add(d);
             }
         }
     }
@@ -71,6 +206,9 @@ class AuthRegistry extends regsitry_1.RegistryAbstract {
         return Promise.resolve();
     }
     getPrimary() {
+        if (!this.primary) {
+            throw new errors_1.DependencyNotFoundError('AuthRegistry', 'primary auth provider');
+        }
         return this.primary;
     }
     getAuthProviders() {

package/src/auth/auth.registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.registry.js","sourceRoot":"","sources":["../../../src/auth/auth.registry.ts"],"names":[],"mappings":";;;AAAA,wBAAwB;AACxB,4BAA0B;AAC1B,0CAAqE;AAErE,sCAMmB;AACnB,6CAA8D;AAC9D,sDAA+C;AAC/C,2FAA2E;AAC3E,yFAAyE;AAEzE,MAAa,YAAa,SAAQ,2BAA2E;IAC1F,OAAO,CAAgB;IAExC,YAAY,KAAiB,EAAE,SAA2B,EAAE,QAA4B,EAAE,KAAoB,EAAE,OAAqB;QACnI,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,aAAgC,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,gDAAiB,CAAC,KAAK,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,8CAAgB,CAAC,KAAK,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5I,aAAa,GAAG;gBACd,IAAI,EAAE,yBAAgB,CAAC,OAAO;gBAC9B,OAAO,EAAE,qBAAY;gBACrB,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,QAAQ,EAAE,OAAO;aAClB,CAAA;QACH,CAAC;aAAM,CAAC;YACN,MAAM,eAAe,GAAgB,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAC,CAAA;YAC7G,IAAI,CAAC,OAAO,GAAG,IAAI,8CAAgB,CAAC,KAAK,EAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACtE,aAAa,GAAG;gBACd,IAAI,EAAE,yBAAgB,CAAC,OAAO;gBAC9B,OAAO,EAAE,qBAAY;gBACrB,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,QAAQ,EAAE,eAAe;aAC1B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAY,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAY,EAAE,aAAa,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QAEvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAEkB,QAAQ,CAAC,IAAwB;QAClD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAS,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAA,0BAAa,EAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,EAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAC,CAAC;IAC/B,CAAC;IAES,UAAU;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC;YAEpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAA,uBAAS,EAAC,KAAK,CAAC,eAAe,IAAA,uBAAS,EAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;gBAC3G,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAGD,UAAU;QACR,OAAO,IAAI,CAAC,OAAQ,CAAC;IACvB,CAAC;IAED,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AA9ED,oCA8EC","sourcesContent":["// auth/auth.registry.ts\nimport 'reflect-metadata';\nimport {RegistryAbstract, RegistryBuildMapResult} from '../regsitry';\nimport ProviderRegistry from '../provider/provider.registry';\nimport {\n  AuthOptions,\n  FrontMcpAuth,\n  AuthProviderType,\n  Token, AuthProviderEntry, AuthRegistryInterface, AuthProviderRecord, AuthProviderKind, EntryOwnerRef,\n  PrimaryAuthRecord, ScopeEntry,\n} from '../common';\nimport {authDiscoveryDeps, normalizeAuth} from './auth.utils';\nimport {tokenName} from '../utils/token.utils';\nimport {RemotePrimaryAuth} from './instances/instance.remote-primary-auth';\nimport {LocalPrimaryAuth} from './instances/instance.local-primary-auth';\n\nexport class AuthRegistry extends RegistryAbstract<AuthProviderEntry, AuthProviderRecord, AuthProviderType[]> implements AuthRegistryInterface {\n  private readonly primary?: FrontMcpAuth;\n\n  constructor(scope: ScopeEntry, providers: ProviderRegistry, metadata: AuthProviderType[], owner: EntryOwnerRef, primary?: AuthOptions) {\n    super('AuthRegistry', providers, metadata, false);\n\n    let primaryRecord: PrimaryAuthRecord;\n    if (primary) {\n      this.primary = primary.type === 'remote' ? new RemotePrimaryAuth(scope,providers, primary) : new LocalPrimaryAuth(scope,providers, primary);\n      primaryRecord = {\n        kind: AuthProviderKind.PRIMARY,\n        provide: FrontMcpAuth,\n        useValue: this.primary,\n        metadata: primary,\n      }\n    } else {\n      const defaultMetadata: AuthOptions = {type: 'local', id: 'local', name: 'default-auth', allowAnonymous: true}\n      this.primary = new LocalPrimaryAuth(scope,providers, defaultMetadata);\n      primaryRecord = {\n        kind: AuthProviderKind.PRIMARY,\n        provide: FrontMcpAuth,\n        useValue: this.primary,\n        metadata: defaultMetadata,\n      }\n    }\n    this.tokens.add(FrontMcpAuth);\n    this.defs.set(FrontMcpAuth, primaryRecord)\n    this.graph.set(FrontMcpAuth, new Set())\n\n    this.buildGraph();\n    this.ready = this.initialize();\n  }\n\n  protected override buildMap(list: AuthProviderType[]): RegistryBuildMapResult<AuthProviderRecord> {\n    const tokens = new Set<Token>();\n    const defs = new Map<Token, AuthProviderRecord>();\n    const graph = new Map<Token, Set<Token>>();\n\n    for (const raw of list) {\n      const rec = normalizeAuth(raw);\n      const provide = rec.provide;\n      tokens.add(provide);\n      defs.set(provide, rec);\n      graph.set(provide, new Set());\n    }\n\n    return {tokens, defs, graph};\n  }\n\n  protected buildGraph() {\n    for (const token of this.tokens) {\n      const rec = this.defs.get(token)!;\n      const deps = authDiscoveryDeps(rec);\n\n      for (const d of deps) {\n        if (!this.providers.get(d)) {\n          throw new Error(`AuthProvider ${tokenName(token)} depends on ${tokenName(d)}, which is not registered.`);\n        }\n        this.graph.get(token)!.add(d);\n      }\n    }\n  }\n\n  protected async initialize(): Promise<void> {\n    if (this.primary) {\n      await this.primary.ready;\n    }\n    return Promise.resolve();\n  }\n\n\n  getPrimary(): FrontMcpAuth {\n    return this.primary!;\n  }\n\n  getAuthProviders(): AuthProviderEntry[] {\n    return [...this.instances.values()];\n  }\n}\n"]}
+{"version":3,"file":"auth.registry.js","sourceRoot":"","sources":["../../../src/auth/auth.registry.ts"],"names":[],"mappings":";;;AAAA,wBAAwB;AACxB,4BAA0B;AAC1B,0CAAuE;AAEvE,sCAqBmB;AACnB,6CAAgE;AAChE,oCAAqC;AACrC,2FAA6E;AAC7E,yFAA2E;AAC3E,2CAA4F;AAC5F,sCAA4E;AAE5E;;GAEG;AACH,MAAM,oBAAoB,GAAqB;IAC7C,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,OAAO;IACb,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,MAAa,YACX,SAAQ,2BAA2E;IAGlE,OAAO,CAAgB;IACvB,aAAa,CAAc;IAC3B,MAAM,CAAiB;IACvB,KAAK,CAAgB;IAEtC;;OAEG;IACM,SAAS,CAA8B;IAEhD;;OAEG;IACM,qBAAqB,CAAU;IAExC,YACE,KAAiB,EACjB,SAA2B,EAC3B,QAA4B,EAC5B,KAAoB,EACpB,YAA+B;QAE/B,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,uBAAc,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAElE,oCAAoC;QACpC,IAAI,CAAC,aAAa,GAAG,IAAA,yBAAgB,EAAC,YAAY,IAAI,oBAAoB,CAAC,CAAC;QAE5E,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAA,+BAAmB,EAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;QAElE,wBAAwB;QACxB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE3B,8CAA8C;QAC9C,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE7B,6DAA6D;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAE5E,MAAM,aAAa,GAAsB;YACvC,IAAI,EAAE,yBAAgB,CAAC,OAAO;YAC9B,OAAO,EAAE,qBAAY;YACrB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,aAAa;SAC7B,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAY,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAY,EAAE,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,KAAiB;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,0DAA0D;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI;oBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAY;QACjC,oCAAoC;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,GAAwD,CAAC;YAC1E,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAE3F,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,mBAAmB,2BAA2B,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;QAED,IAAI,qBAAqB,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QAC3F,CAAC;QAED,eAAe;QACf,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAE5C,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,iBAAiB;YACjB,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,0CAA0C;YAC1C,MAAM,IAAI,+BAAsB,CAAC,+BAA+B,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrF,MAAM,EAAE,gBAAgB;gBACxB,UAAU,EACR,wEAAwE;oBACxE,eAAe;oBACf,cAAc;oBACd,8BAA8B;oBAC9B,gEAAgE;oBAChE,MAAM;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,KAAiB,EAAE,SAA2B,EAAE,OAAoB;QAC5F,IAAI,IAAA,qBAAY,EAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,8CAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,IAAA,0BAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,gDAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAA,2BAAkB,EAAC,OAAO,CAAC,EAAE,CAAC;YAChC,IAAI,IAAA,4BAAmB,EAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,8CAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,qDAAqD;gBACrD,OAAO,IAAI,8CAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,MAAM,cAAc,GAAG,IAAA,yBAAgB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAsB,CAAC;QACjF,OAAO,IAAI,8CAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IAEkB,QAAQ,CAAC,IAAwB;QAClD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAS,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAA,0BAAa,EAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAES,UAAU;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,gCAAuB,CAAC,cAAc,EAAE,IAAA,iBAAS,EAAC,KAAK,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,GAAG,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC;YAEpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,gCAAuB,CAAC,cAAc,EAAE,GAAG,IAAA,iBAAS,EAAC,CAAC,CAAC,iBAAiB,IAAA,iBAAS,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzG,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,gCAAuB,CAAC,cAAc,EAAE,mBAAmB,IAAA,iBAAS,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,gCAAuB,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AAjPD,oCAiPC","sourcesContent":["// auth/auth.registry.ts\nimport 'reflect-metadata';\nimport { RegistryAbstract, RegistryBuildMapResult } from '../regsitry';\nimport ProviderRegistry from '../provider/provider.registry';\nimport {\n  FrontMcpAuth,\n  FrontMcpLogger,\n  AuthProviderType,\n  Token,\n  AuthProviderEntry,\n  AuthRegistryInterface,\n  AuthProviderRecord,\n  AuthProviderKind,\n  EntryOwnerRef,\n  PrimaryAuthRecord,\n  ScopeEntry,\n  AuthOptions,\n  AuthOptionsInput,\n  parseAuthOptions,\n  isPublicMode,\n  isTransparentMode,\n  isOrchestratedMode,\n  isOrchestratedLocal,\n  PublicAuthOptions,\n  AppType,\n} from '../common';\nimport { authDiscoveryDeps, normalizeAuth } from './auth.utils';\nimport { tokenName } from '../utils';\nimport { RemotePrimaryAuth } from './instances/instance.remote-primary-auth';\nimport { LocalPrimaryAuth } from './instances/instance.local-primary-auth';\nimport { detectAuthProviders, AuthProviderDetectionResult, AppAuthInfo } from './detection';\nimport { DependencyNotFoundError, AuthConfigurationError } from '../errors';\n\n/**\n * Default auth options when none provided - public mode with all tools open\n */\nconst DEFAULT_AUTH_OPTIONS: AuthOptionsInput = {\n  mode: 'orchestrated',\n  type: 'local',\n  allowDefaultPublic: true,\n};\n\nexport class AuthRegistry\n  extends RegistryAbstract<AuthProviderEntry, AuthProviderRecord, AuthProviderType[]>\n  implements AuthRegistryInterface\n{\n  private readonly primary?: FrontMcpAuth;\n  private readonly parsedOptions: AuthOptions;\n  private readonly logger: FrontMcpLogger;\n  private readonly owner: EntryOwnerRef;\n\n  /**\n   * Detection result for auth providers across the scope hierarchy\n   */\n  readonly detection: AuthProviderDetectionResult;\n\n  /**\n   * Whether this scope requires orchestrated mode\n   */\n  readonly requiresOrchestration: boolean;\n\n  constructor(\n    scope: ScopeEntry,\n    providers: ProviderRegistry,\n    metadata: AuthProviderType[],\n    owner: EntryOwnerRef,\n    primaryInput?: AuthOptionsInput,\n  ) {\n    super('AuthRegistry', providers, metadata, false);\n\n    this.owner = owner;\n    this.logger = providers.get(FrontMcpLogger).child('AuthRegistry');\n\n    // Parse input with defaults applied\n    this.parsedOptions = parseAuthOptions(primaryInput ?? DEFAULT_AUTH_OPTIONS);\n\n    // Detect auth providers across all apps in this scope\n    const appAuthInfos = this.extractAppAuthInfo(scope);\n    this.detection = detectAuthProviders(this.parsedOptions, appAuthInfos);\n    this.requiresOrchestration = this.detection.requiresOrchestration;\n\n    // Log detection results\n    this.logDetectionResults();\n\n    // Validate configuration and throw if invalid\n    this.validateConfiguration();\n\n    // Create the appropriate primary auth provider based on mode\n    this.primary = this.createPrimaryAuth(scope, providers, this.parsedOptions);\n\n    const primaryRecord: PrimaryAuthRecord = {\n      kind: AuthProviderKind.PRIMARY,\n      provide: FrontMcpAuth,\n      useValue: this.primary,\n      metadata: this.parsedOptions,\n    };\n\n    this.tokens.add(FrontMcpAuth);\n    this.defs.set(FrontMcpAuth, primaryRecord);\n    this.graph.set(FrontMcpAuth, new Set());\n\n    this.buildGraph();\n    this.ready = this.initialize();\n  }\n\n  /**\n   * Extract AppAuthInfo from scope metadata\n   */\n  private extractAppAuthInfo(scope: ScopeEntry): AppAuthInfo[] {\n    const apps = scope.metadata.apps || [];\n    const result: AppAuthInfo[] = [];\n\n    for (const app of apps) {\n      // Handle both class-based and value-based app definitions\n      const appMeta = this.getAppMetadata(app);\n      if (appMeta) {\n        result.push({\n          id: appMeta.id || appMeta.name,\n          name: appMeta.name,\n          auth: appMeta.auth,\n        });\n      }\n    }\n\n    return result;\n  }\n\n  /**\n   * Get app metadata from AppType (handles both class and value types)\n   */\n  private getAppMetadata(app: AppType): { id?: string; name: string; auth?: AuthOptions } | undefined {\n    // Value type: has metadata directly\n    if (typeof app === 'object' && 'name' in app) {\n      const appValue = app as { id?: string; name: string; auth?: AuthOptions };\n      return {\n        id: appValue.id,\n        name: appValue.name,\n        auth: appValue.auth,\n      };\n    }\n\n    // Class type: check for metadata decorator\n    if (typeof app === 'function') {\n      const metadata = Reflect.getMetadata('frontmcp:app', app);\n      if (metadata) {\n        return {\n          id: metadata.id,\n          name: metadata.name,\n          auth: metadata.auth,\n        };\n      }\n    }\n\n    return undefined;\n  }\n\n  /**\n   * Log detection results for debugging\n   */\n  private logDetectionResults(): void {\n    const { providers, uniqueProviderCount, requiresOrchestration, warnings } = this.detection;\n\n    if (uniqueProviderCount > 1) {\n      this.logger.info(`Detected ${uniqueProviderCount} unique auth providers: ${[...providers.keys()].join(', ')}`);\n    }\n\n    if (requiresOrchestration) {\n      this.logger.info(`Orchestration required: Multiple auth providers detected across apps`);\n    }\n\n    // Log warnings\n    for (const warning of warnings) {\n      this.logger.warn(warning);\n    }\n  }\n\n  /**\n   * Validate configuration and throw if invalid\n   */\n  private validateConfiguration(): void {\n    const { validationErrors } = this.detection;\n\n    if (validationErrors.length > 0) {\n      // Log all errors\n      for (const error of validationErrors) {\n        this.logger.error(`[AuthRegistry] ${error}`);\n      }\n\n      // Throw with first error (most important)\n      throw new AuthConfigurationError(`Invalid auth configuration: ${validationErrors[0]}`, {\n        errors: validationErrors,\n        suggestion:\n          `1. Change your parent auth mode from 'transparent' to 'orchestrated'\\n` +\n          `2. Example:\\n` +\n          `   auth: {\\n` +\n          `     mode: 'orchestrated',\\n` +\n          `     type: 'local', // or 'remote' with your provider config\\n` +\n          `   }`,\n      });\n    }\n  }\n\n  /**\n   * Create the appropriate primary auth provider based on parsed options\n   */\n  private createPrimaryAuth(scope: ScopeEntry, providers: ProviderRegistry, options: AuthOptions): FrontMcpAuth {\n    if (isPublicMode(options)) {\n      return new LocalPrimaryAuth(scope, providers, options);\n    }\n\n    if (isTransparentMode(options)) {\n      return new RemotePrimaryAuth(scope, providers, options);\n    }\n\n    if (isOrchestratedMode(options)) {\n      if (isOrchestratedLocal(options)) {\n        return new LocalPrimaryAuth(scope, providers, options);\n      } else {\n        // Orchestrated remote: local auth server proxying to remote provider\n        // TODO: Store remote config for upstream OAuth flows\n        return new LocalPrimaryAuth(scope, providers, options);\n      }\n    }\n\n    // Fallback (should never reach here) - create public mode with defaults\n    const defaultOptions = parseAuthOptions({ mode: 'public' }) as PublicAuthOptions;\n    return new LocalPrimaryAuth(scope, providers, defaultOptions);\n  }\n\n  protected override buildMap(list: AuthProviderType[]): RegistryBuildMapResult<AuthProviderRecord> {\n    const tokens = new Set<Token>();\n    const defs = new Map<Token, AuthProviderRecord>();\n    const graph = new Map<Token, Set<Token>>();\n\n    for (const raw of list) {\n      const rec = normalizeAuth(raw);\n      const provide = rec.provide;\n      tokens.add(provide);\n      defs.set(provide, rec);\n      graph.set(provide, new Set());\n    }\n\n    return { tokens, defs, graph };\n  }\n\n  protected buildGraph() {\n    for (const token of this.tokens) {\n      const rec = this.defs.get(token);\n      if (!rec) {\n        throw new DependencyNotFoundError('AuthRegistry', tokenName(token));\n      }\n      const deps = authDiscoveryDeps(rec);\n\n      for (const d of deps) {\n        if (!this.providers.get(d)) {\n          throw new DependencyNotFoundError('AuthRegistry', `${tokenName(d)} (required by ${tokenName(token)})`);\n        }\n        const graphEntry = this.graph.get(token);\n        if (!graphEntry) {\n          throw new DependencyNotFoundError('AuthRegistry', `graph entry for ${tokenName(token)}`);\n        }\n        graphEntry.add(d);\n      }\n    }\n  }\n\n  protected async initialize(): Promise<void> {\n    if (this.primary) {\n      await this.primary.ready;\n    }\n    return Promise.resolve();\n  }\n\n  getPrimary(): FrontMcpAuth {\n    if (!this.primary) {\n      throw new DependencyNotFoundError('AuthRegistry', 'primary auth provider');\n    }\n    return this.primary;\n  }\n\n  getAuthProviders(): AuthProviderEntry[] {\n    return [...this.instances.values()];\n  }\n}\n"]}

package/src/auth/auth.utils.js

@@ -4,18 +4,17 @@ exports.collectAuthMetadata = collectAuthMetadata;
 exports.normalizeAuth = normalizeAuth;
 exports.authDiscoveryDeps = authDiscoveryDeps;
 // auth/auth.utils.ts
-const token_utils_1 = require("../utils/token.utils");
+const utils_1 = require("../utils");
 const common_1 = require("../common");
-const metadata_utils_1 = require("../utils/metadata.utils");
 function collectAuthMetadata(cls) {
     return Object.entries(common_1.FrontMcpAuthProviderTokens).reduce((metadata, [key, token]) => {
         return Object.assign(metadata, {
-            [key]: (0, metadata_utils_1.getMetadata)(token, cls),
+            [key]: (0, utils_1.getMetadata)(token, cls),
         });
     }, {});
 }
 function normalizeAuth(item) {
-    if ((0, token_utils_1.isClass)(item)) {
+    if ((0, utils_1.isClass)(item)) {
         // read McpAuthMetadata from class
         const metadata = collectAuthMetadata(item);
         return { kind: common_1.AuthProviderKind.CLASS_TOKEN, provide: item, metadata };
@@ -27,8 +26,8 @@ function normalizeAuth(item) {
             throw new Error(`Auth '${name}' is missing 'provide'.`);
         }
         if (useClass) {
-            if (!(0, token_utils_1.isClass)(useClass)) {
-                throw new Error(`'useClass' on auth '${(0, token_utils_1.tokenName)(provide)}' must be a class.`);
+            if (!(0, utils_1.isClass)(useClass)) {
+                throw new Error(`'useClass' on auth '${(0, utils_1.tokenName)(provide)}' must be a class.`);
             }
             return {
                 kind: common_1.AuthProviderKind.CLASS,
@@ -39,7 +38,7 @@ function normalizeAuth(item) {
         }
         if (useFactory) {
             if (typeof useFactory !== 'function') {
-                throw new Error(`'useFactory' on auth '${(0, token_utils_1.tokenName)(provide)}' must be a function.`);
+                throw new Error(`'useFactory' on auth '${(0, utils_1.tokenName)(provide)}' must be a function.`);
             }
             const inj = typeof inject === 'function' ? inject : () => [];
             return {
@@ -77,9 +76,9 @@ function authDiscoveryDeps(rec) {
             return [...rec.inject()];
         }
         case common_1.AuthProviderKind.CLASS:
-            return (0, token_utils_1.depsOfClass)(rec.useClass, 'discovery');
+            return (0, utils_1.depsOfClass)(rec.useClass, 'discovery');
         case common_1.AuthProviderKind.CLASS_TOKEN:
-            return (0, token_utils_1.depsOfClass)(rec.provide, 'discovery');
+            return (0, utils_1.depsOfClass)(rec.provide, 'discovery');
     }
 }
 //# sourceMappingURL=auth.utils.js.map