@frontmcp/sdk 0.6.1 → 0.6.3

package/src/context/request-context-storage.js

@@ -1,183 +0,0 @@
-"use strict";
-/**
- * RequestContextStorage - AsyncLocalStorage wrapper for request-scoped context
- *
- * Provides concurrent-safe request context propagation using Node.js AsyncLocalStorage.
- * Access through DI only - never use static imports to access the storage directly.
- *
- * @example
- * ```typescript
- * // In a flow or middleware
- * const storage = this.get(RequestContextStorage);
- * await storage.runFromHeaders(request.headers, {
- *   sessionId: sessionId,
- *   authInfo: authInfo,
- *   scopeId: scope.id,
- * }, async () => {
- *   // All code here can access the context via DI
- *   const ctx = this.get(REQUEST_CONTEXT);
- * });
- * ```
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RequestContextStorage = void 0;
-const tslib_1 = require("tslib");
-const node_async_hooks_1 = require("node:async_hooks");
-const decorators_1 = require("../common/decorators");
-const metadata_1 = require("../common/metadata");
-const request_context_1 = require("./request-context");
-const trace_context_1 = require("./trace-context");
-/**
- * Module-level AsyncLocalStorage instance.
- *
- * This is the ONLY place where the storage is created.
- * Access should be through DI, not through static imports.
- */
-const requestContextStorage = new node_async_hooks_1.AsyncLocalStorage();
-/**
- * RequestContextStorage provides request-scoped context via AsyncLocalStorage.
- *
- * This is a GLOBAL-scoped provider because it manages the storage itself,
- * not the per-request data. The actual RequestContext is accessed via
- * the REQUEST_CONTEXT token which is REQUEST-scoped.
- */
-let RequestContextStorage = class RequestContextStorage {
-    /**
-     * Run a callback with a new RequestContext.
-     *
-     * @param args - Arguments to create the context
-     * @param fn - Async function to run with the context
-     * @returns Result of the callback
-     */
-    run(args, fn) {
-        const context = new request_context_1.RequestContext(args);
-        return requestContextStorage.run(context, fn);
-    }
-    /**
-     * Run with context extracted from HTTP headers.
-     *
-     * Automatically parses trace context from headers using W3C Trace Context
-     * specification with fallback to x-frontmcp-trace-id.
-     *
-     * @param headers - HTTP headers
-     * @param args - Additional context args (sessionId, authInfo, scopeId)
-     * @param fn - Async function to run
-     * @returns Result of the callback
-     */
-    runFromHeaders(headers, args, fn) {
-        const traceContext = (0, trace_context_1.parseTraceContext)(headers);
-        const metadata = extractMetadata(headers);
-        const context = new request_context_1.RequestContext({
-            ...args,
-            traceContext,
-            metadata,
-        });
-        return requestContextStorage.run(context, fn);
-    }
-    /**
-     * Run with an existing RequestContext.
-     *
-     * Useful when you need to propagate an existing context to a new async scope.
-     *
-     * @param context - Existing RequestContext
-     * @param fn - Async function to run
-     * @returns Result of the callback
-     */
-    runWithContext(context, fn) {
-        return requestContextStorage.run(context, fn);
-    }
-    /**
-     * Get the current RequestContext.
-     *
-     * @returns Current context or undefined if not in a request scope
-     */
-    getStore() {
-        return requestContextStorage.getStore();
-    }
-    /**
-     * Get the current RequestContext, throwing if not available.
-     *
-     * @throws Error if not in a request scope
-     */
-    getStoreOrThrow() {
-        const ctx = this.getStore();
-        if (!ctx) {
-            throw new Error('RequestContext not available. Ensure operation runs within request scope.');
-        }
-        return ctx;
-    }
-    /**
-     * Check if currently running within a request context.
-     *
-     * @returns True if a RequestContext is available
-     */
-    hasContext() {
-        return requestContextStorage.getStore() !== undefined;
-    }
-    /**
-     * Update the authInfo in the current context.
-     *
-     * This mutates the existing context in place to preserve internal state
-     * (marks, store, sessionMetadata) while updating auth info.
-     *
-     * @param authInfo - Auth info fields to set/update (merged with existing)
-     * @param fn - Function to run after update
-     * @returns Result of the callback
-     */
-    updateAuthInfo(authInfo, fn) {
-        const current = this.getStoreOrThrow();
-        // Mutate in place to preserve marks, store, and sessionMetadata
-        current.updateAuthInfo(authInfo);
-        return fn();
-    }
-};
-exports.RequestContextStorage = RequestContextStorage;
-exports.RequestContextStorage = RequestContextStorage = tslib_1.__decorate([
-    (0, decorators_1.Provider)({
-        name: 'RequestContextStorage',
-        description: 'Manages request-scoped context via AsyncLocalStorage',
-        scope: metadata_1.ProviderScope.GLOBAL,
-    })
-], RequestContextStorage);
-/**
- * Extract request metadata from headers.
- */
-function extractMetadata(headers) {
-    const customHeaders = {};
-    for (const [key, value] of Object.entries(headers)) {
-        if (key.toLowerCase().startsWith('x-frontmcp-') && typeof value === 'string') {
-            customHeaders[key.toLowerCase()] = value;
-        }
-    }
-    return {
-        userAgent: typeof headers['user-agent'] === 'string' ? headers['user-agent'] : undefined,
-        contentType: typeof headers['content-type'] === 'string' ? headers['content-type'] : undefined,
-        accept: typeof headers['accept'] === 'string' ? headers['accept'] : undefined,
-        clientIp: extractClientIp(headers),
-        customHeaders,
-    };
-}
-/**
- * Extract client IP from headers.
- * Handles both string and array header values (some adapters pass arrays).
- */
-function extractClientIp(headers) {
-    // x-forwarded-for can be comma-separated list; first is client IP
-    const xff = headers['x-forwarded-for'];
-    if (typeof xff === 'string') {
-        return xff.split(',')[0]?.trim();
-    }
-    // Some adapters pass arrays for multi-value headers
-    if (Array.isArray(xff) && typeof xff[0] === 'string') {
-        return xff[0].split(',')[0]?.trim();
-    }
-    const realIp = headers['x-real-ip'];
-    if (typeof realIp === 'string') {
-        return realIp;
-    }
-    if (Array.isArray(realIp) && typeof realIp[0] === 'string') {
-        return realIp[0];
-    }
-    return undefined;
-}
-//# sourceMappingURL=request-context-storage.js.map

package/src/context/request-context-storage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-context-storage.js","sourceRoot":"","sources":["../../../src/context/request-context-storage.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;AAEH,uDAAqD;AACrD,qDAAgD;AAChD,iDAAmD;AACnD,uDAAwF;AACxF,mDAAoD;AAEpD;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,oCAAiB,EAAkB,CAAC;AAEtE;;;;;;GAMG;AAMI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC;;;;;;OAMG;IACH,GAAG,CAAI,IAAwB,EAAE,EAAwB;QACvD,MAAM,OAAO,GAAG,IAAI,gCAAc,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;OAUG;IACH,cAAc,CACZ,OAAgC,EAChC,IAA2D,EAC3D,EAAwB;QAExB,MAAM,YAAY,GAAG,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,gCAAc,CAAC;YACjC,GAAG,IAAI;YACP,YAAY;YACZ,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAI,OAAuB,EAAE,EAAwB;QACjE,OAAO,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,OAAO,qBAAqB,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;IACxD,CAAC;IAED;;;;;;;;;OASG;IACH,cAAc,CAAI,QAAwC,EAAE,EAAwB;QAClF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,gEAAgE;QAChE,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAA;AAnGY,sDAAqB;gCAArB,qBAAqB;IALjC,IAAA,qBAAQ,EAAC;QACR,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,sDAAsD;QACnE,KAAK,EAAE,wBAAa,CAAC,MAAM;KAC5B,CAAC;GACW,qBAAqB,CAmGjC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,aAAa,GAA2B,EAAE,CAAC;IAEjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7E,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;QACxF,WAAW,EAAE,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9F,MAAM,EAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC;QAClC,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAgC;IACvD,kEAAkE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * RequestContextStorage - AsyncLocalStorage wrapper for request-scoped context\n *\n * Provides concurrent-safe request context propagation using Node.js AsyncLocalStorage.\n * Access through DI only - never use static imports to access the storage directly.\n *\n * @example\n * ```typescript\n * // In a flow or middleware\n * const storage = this.get(RequestContextStorage);\n * await storage.runFromHeaders(request.headers, {\n *   sessionId: sessionId,\n *   authInfo: authInfo,\n *   scopeId: scope.id,\n * }, async () => {\n *   // All code here can access the context via DI\n *   const ctx = this.get(REQUEST_CONTEXT);\n * });\n * ```\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { Provider } from '../common/decorators';\nimport { ProviderScope } from '../common/metadata';\nimport { RequestContext, RequestContextArgs, RequestMetadata } from './request-context';\nimport { parseTraceContext } from './trace-context';\n\n/**\n * Module-level AsyncLocalStorage instance.\n *\n * This is the ONLY place where the storage is created.\n * Access should be through DI, not through static imports.\n */\nconst requestContextStorage = new AsyncLocalStorage<RequestContext>();\n\n/**\n * RequestContextStorage provides request-scoped context via AsyncLocalStorage.\n *\n * This is a GLOBAL-scoped provider because it manages the storage itself,\n * not the per-request data. The actual RequestContext is accessed via\n * the REQUEST_CONTEXT token which is REQUEST-scoped.\n */\n@Provider({\n  name: 'RequestContextStorage',\n  description: 'Manages request-scoped context via AsyncLocalStorage',\n  scope: ProviderScope.GLOBAL,\n})\nexport class RequestContextStorage {\n  /**\n   * Run a callback with a new RequestContext.\n   *\n   * @param args - Arguments to create the context\n   * @param fn - Async function to run with the context\n   * @returns Result of the callback\n   */\n  run<T>(args: RequestContextArgs, fn: () => T | Promise<T>): T | Promise<T> {\n    const context = new RequestContext(args);\n    return requestContextStorage.run(context, fn);\n  }\n\n  /**\n   * Run with context extracted from HTTP headers.\n   *\n   * Automatically parses trace context from headers using W3C Trace Context\n   * specification with fallback to x-frontmcp-trace-id.\n   *\n   * @param headers - HTTP headers\n   * @param args - Additional context args (sessionId, authInfo, scopeId)\n   * @param fn - Async function to run\n   * @returns Result of the callback\n   */\n  runFromHeaders<T>(\n    headers: Record<string, unknown>,\n    args: Omit<RequestContextArgs, 'traceContext' | 'metadata'>,\n    fn: () => T | Promise<T>,\n  ): T | Promise<T> {\n    const traceContext = parseTraceContext(headers);\n    const metadata = extractMetadata(headers);\n    const context = new RequestContext({\n      ...args,\n      traceContext,\n      metadata,\n    });\n    return requestContextStorage.run(context, fn);\n  }\n\n  /**\n   * Run with an existing RequestContext.\n   *\n   * Useful when you need to propagate an existing context to a new async scope.\n   *\n   * @param context - Existing RequestContext\n   * @param fn - Async function to run\n   * @returns Result of the callback\n   */\n  runWithContext<T>(context: RequestContext, fn: () => T | Promise<T>): T | Promise<T> {\n    return requestContextStorage.run(context, fn);\n  }\n\n  /**\n   * Get the current RequestContext.\n   *\n   * @returns Current context or undefined if not in a request scope\n   */\n  getStore(): RequestContext | undefined {\n    return requestContextStorage.getStore();\n  }\n\n  /**\n   * Get the current RequestContext, throwing if not available.\n   *\n   * @throws Error if not in a request scope\n   */\n  getStoreOrThrow(): RequestContext {\n    const ctx = this.getStore();\n    if (!ctx) {\n      throw new Error('RequestContext not available. Ensure operation runs within request scope.');\n    }\n    return ctx;\n  }\n\n  /**\n   * Check if currently running within a request context.\n   *\n   * @returns True if a RequestContext is available\n   */\n  hasContext(): boolean {\n    return requestContextStorage.getStore() !== undefined;\n  }\n\n  /**\n   * Update the authInfo in the current context.\n   *\n   * This mutates the existing context in place to preserve internal state\n   * (marks, store, sessionMetadata) while updating auth info.\n   *\n   * @param authInfo - Auth info fields to set/update (merged with existing)\n   * @param fn - Function to run after update\n   * @returns Result of the callback\n   */\n  updateAuthInfo<T>(authInfo: RequestContextArgs['authInfo'], fn: () => T | Promise<T>): T | Promise<T> {\n    const current = this.getStoreOrThrow();\n    // Mutate in place to preserve marks, store, and sessionMetadata\n    current.updateAuthInfo(authInfo);\n    return fn();\n  }\n}\n\n/**\n * Extract request metadata from headers.\n */\nfunction extractMetadata(headers: Record<string, unknown>): RequestMetadata {\n  const customHeaders: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase().startsWith('x-frontmcp-') && typeof value === 'string') {\n      customHeaders[key.toLowerCase()] = value;\n    }\n  }\n\n  return {\n    userAgent: typeof headers['user-agent'] === 'string' ? headers['user-agent'] : undefined,\n    contentType: typeof headers['content-type'] === 'string' ? headers['content-type'] : undefined,\n    accept: typeof headers['accept'] === 'string' ? headers['accept'] : undefined,\n    clientIp: extractClientIp(headers),\n    customHeaders,\n  };\n}\n\n/**\n * Extract client IP from headers.\n * Handles both string and array header values (some adapters pass arrays).\n */\nfunction extractClientIp(headers: Record<string, unknown>): string | undefined {\n  // x-forwarded-for can be comma-separated list; first is client IP\n  const xff = headers['x-forwarded-for'];\n  if (typeof xff === 'string') {\n    return xff.split(',')[0]?.trim();\n  }\n  // Some adapters pass arrays for multi-value headers\n  if (Array.isArray(xff) && typeof xff[0] === 'string') {\n    return xff[0].split(',')[0]?.trim();\n  }\n\n  const realIp = headers['x-real-ip'];\n  if (typeof realIp === 'string') {\n    return realIp;\n  }\n  if (Array.isArray(realIp) && typeof realIp[0] === 'string') {\n    return realIp[0];\n  }\n\n  return undefined;\n}\n"]}

package/src/context/request-context.js

@@ -1,209 +0,0 @@
-"use strict";
-/**
- * RequestContext - Production-ready request context for FrontMCP
- *
- * Provides request-scoped state that flows through the entire async execution
- * chain via AsyncLocalStorage. Access via DI only using the REQUEST_CONTEXT token.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RequestContext = void 0;
-const node_crypto_1 = require("node:crypto");
-const trace_context_1 = require("./trace-context");
-/**
- * RequestContext provides per-request state that flows through
- * the entire async execution chain via AsyncLocalStorage.
- *
- * Access via DI only using the REQUEST_CONTEXT token:
- * ```typescript
- * const ctx = this.get(REQUEST_CONTEXT);
- * console.log(ctx.requestId, ctx.traceContext.traceId);
- * ```
- */
-class RequestContext {
-    /** Unique request identifier (UUID v4) */
-    requestId;
-    /** W3C Trace Context or generated trace ID */
-    traceContext;
-    /** Session identifier (from mcp-session-id header or authorization) */
-    sessionId;
-    /**
-     * Authentication information.
-     * Note: This is mutable to allow updating after authorization is verified.
-     * It's Partial<AuthInfo> because auth info is progressively populated
-     * throughout the request lifecycle (some fields like transport are only
-     * available after the transport is established).
-     */
-    _authInfo;
-    /** Scope identifier */
-    scopeId;
-    /** Request start timestamp */
-    timestamp;
-    /** Request metadata (headers, user-agent, etc.) */
-    metadata;
-    /** Timing marks for performance tracking */
-    marks = new Map();
-    /** Request-scoped data store */
-    store = new Map();
-    constructor(args) {
-        this.requestId = args.requestId ?? (0, node_crypto_1.randomUUID)();
-        this.traceContext = args.traceContext ?? (0, trace_context_1.generateTraceContext)();
-        this.sessionId = args.sessionId;
-        this._authInfo = args.authInfo;
-        this.scopeId = args.scopeId;
-        this.timestamp = args.timestamp ?? Date.now();
-        // Defensive normalization: ensure customHeaders is always an object
-        // even if args.metadata is partially defined at runtime (TS can't enforce this)
-        const metadata = args.metadata;
-        this.metadata = {
-            ...metadata,
-            customHeaders: metadata?.customHeaders ?? {},
-        };
-        // Initial mark
-        this.marks.set('init', this.timestamp);
-    }
-    /**
-     * Get authentication information.
-     * Returns Partial<AuthInfo> because auth info is progressively populated.
-     */
-    get authInfo() {
-        return this._authInfo;
-    }
-    /**
-     * Update auth info after authorization is verified.
-     * Called by checkAuthorization stage after session verification.
-     * Can be called multiple times to progressively add fields.
-     *
-     * @param authInfo - The auth info fields to set/update
-     * @internal
-     */
-    updateAuthInfo(authInfo) {
-        // Merge with existing auth info to support progressive updates
-        this._authInfo = { ...this._authInfo, ...authInfo };
-    }
-    /**
-     * Session metadata including protocol, platform type, and node info.
-     * Only available after session verification in authenticated flows.
-     */
-    _sessionMetadata;
-    /**
-     * Get session metadata.
-     *
-     * Contains protocol type, platform type, nodeId, and authSignature.
-     * Only available after session verification completes.
-     *
-     * @returns Session metadata or undefined if not yet verified
-     */
-    get sessionMetadata() {
-        return this._sessionMetadata;
-    }
-    /**
-     * Update session metadata after session verification.
-     * Called by checkAuthorization stage after session verification.
-     *
-     * @param metadata - Session metadata from verified session
-     * @internal
-     */
-    updateSessionMetadata(metadata) {
-        this._sessionMetadata = metadata;
-    }
-    /**
-     * Get a child logger with request context attached.
-     *
-     * Creates a child logger with a prefix containing the request ID and trace ID
-     * for easy request tracing in logs.
-     *
-     * @param parentLogger - The parent logger to create a child from
-     * @returns A logger with requestId and traceId in the prefix
-     */
-    getLogger(parentLogger) {
-        // FrontMcpLogger.child() takes a string prefix
-        const prefix = `[${this.requestId.slice(0, 8)}:${this.traceContext.traceId.slice(0, 8)}]`;
-        return parentLogger.child(prefix);
-    }
-    /**
-     * Mark a timing point for performance tracking.
-     *
-     * @param name - Name of the timing mark
-     */
-    mark(name) {
-        this.marks.set(name, Date.now());
-    }
-    /**
-     * Get elapsed time in milliseconds between two marks.
-     *
-     * @param from - Start mark name (defaults to 'init')
-     * @param to - End mark name (defaults to current time)
-     * @returns Elapsed time in milliseconds
-     */
-    elapsed(from, to) {
-        const fromTime = this.marks.get(from ?? 'init') ?? this.timestamp;
-        const toTime = to ? this.marks.get(to) ?? Date.now() : Date.now();
-        return toTime - fromTime;
-    }
-    /**
-     * Get all timing marks.
-     *
-     * @returns Read-only map of mark names to timestamps
-     */
-    getMarks() {
-        return this.marks;
-    }
-    /**
-     * Store request-scoped data.
-     *
-     * @param key - Storage key
-     * @param value - Value to store
-     */
-    set(key, value) {
-        this.store.set(key, value);
-    }
-    /**
-     * Retrieve request-scoped data.
-     *
-     * @param key - Storage key
-     * @returns Stored value or undefined
-     */
-    get(key) {
-        return this.store.get(key);
-    }
-    /**
-     * Check if a key exists in the request-scoped store.
-     *
-     * @param key - Storage key
-     * @returns True if key exists
-     */
-    has(key) {
-        return this.store.has(key);
-    }
-    /**
-     * Delete a key from the request-scoped store.
-     *
-     * @param key - Storage key
-     * @returns True if key was deleted
-     */
-    delete(key) {
-        return this.store.delete(key);
-    }
-    /**
-     * Get a summary of the context for logging.
-     *
-     * Note: sessionId is hashed to prevent accidental exposure of user-identifying
-     * session identifiers in logs while still allowing correlation.
-     *
-     * @returns Object with key context fields
-     */
-    toLogContext() {
-        return {
-            requestId: this.requestId,
-            traceId: this.traceContext.traceId,
-            parentId: this.traceContext.parentId,
-            // Hash sessionId to prevent logging user-identifying information
-            // while preserving ability to correlate logs for the same session
-            sessionIdHash: (0, node_crypto_1.createHash)('sha256').update(this.sessionId).digest('hex').slice(0, 12),
-            scopeId: this.scopeId,
-            elapsed: this.elapsed(),
-        };
-    }
-}
-exports.RequestContext = RequestContext;
-//# sourceMappingURL=request-context.js.map

package/src/context/request-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/context/request-context.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,6CAAqD;AAGrD,mDAAqE;AAuCrE;;;;;;;;;GASG;AACH,MAAa,cAAc;IACzB,0CAA0C;IACjC,SAAS,CAAS;IAE3B,8CAA8C;IACrC,YAAY,CAAe;IAEpC,uEAAuE;IAC9D,SAAS,CAAS;IAE3B;;;;;;OAMG;IACK,SAAS,CAAoB;IAErC,uBAAuB;IACd,OAAO,CAAS;IAEzB,8BAA8B;IACrB,SAAS,CAAS;IAE3B,mDAAmD;IAC1C,QAAQ,CAAkB;IAEnC,4CAA4C;IAC3B,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAExD,gCAAgC;IACf,KAAK,GAAkC,IAAI,GAAG,EAAE,CAAC;IAElE,YAAY,IAAwB;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,wBAAU,GAAE,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,oCAAoB,GAAE,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9C,oEAAoE;QACpE,gFAAgF;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,QAAQ;YACX,aAAa,EAAE,QAAQ,EAAE,aAAa,IAAI,EAAE;SAC7C,CAAC;QAEF,eAAe;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,QAA2B;QACxC,+DAA+D;QAC/D,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtD,CAAC;IAED;;;OAGG;IACK,gBAAgB,CAAoB;IAE5C;;;;;;;OAOG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CAAC,QAA0B;QAC9C,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,YAA4B;QACpC,+CAA+C;QAC/C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;QAC1F,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,IAAY;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAa,EAAE,EAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClE,OAAO,MAAM,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAI,GAAoB,EAAE,KAAQ;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAI,GAAoB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAkB,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,GAAoB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAoB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,YAAY;QACV,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO;YAClC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ;YACpC,iEAAiE;YACjE,kEAAkE;YAClE,aAAa,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACrF,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC;IACJ,CAAC;CACF;AAjND,wCAiNC","sourcesContent":["/**\n * RequestContext - Production-ready request context for FrontMCP\n *\n * Provides request-scoped state that flows through the entire async execution\n * chain via AsyncLocalStorage. Access via DI only using the REQUEST_CONTEXT token.\n */\n\nimport { randomUUID, createHash } from 'node:crypto';\nimport { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';\nimport { FrontMcpLogger } from '../common/interfaces/logger.interface';\nimport { TraceContext, generateTraceContext } from './trace-context';\nimport type { SessionIdPayload } from '../common/types';\n\n/**\n * Request metadata extracted from HTTP headers.\n */\nexport interface RequestMetadata {\n  /** User-Agent header */\n  userAgent?: string;\n  /** Content-Type header */\n  contentType?: string;\n  /** Accept header */\n  accept?: string;\n  /** Client IP address (from x-forwarded-for or socket) */\n  clientIp?: string;\n  /** Custom headers matching x-frontmcp-* pattern */\n  customHeaders: Record<string, string>;\n}\n\n/**\n * Arguments for creating a RequestContext.\n */\nexport interface RequestContextArgs {\n  /** Optional request ID (generated if not provided) */\n  requestId?: string;\n  /** Optional trace context (generated if not provided) */\n  traceContext?: TraceContext;\n  /** Session identifier (required) */\n  sessionId: string;\n  /** Authentication information (can be partial, progressively populated) */\n  authInfo: Partial<AuthInfo>;\n  /** Scope identifier (required) */\n  scopeId: string;\n  /** Optional timestamp (defaults to Date.now()) */\n  timestamp?: number;\n  /** Optional request metadata */\n  metadata?: RequestMetadata;\n}\n\n/**\n * RequestContext provides per-request state that flows through\n * the entire async execution chain via AsyncLocalStorage.\n *\n * Access via DI only using the REQUEST_CONTEXT token:\n * ```typescript\n * const ctx = this.get(REQUEST_CONTEXT);\n * console.log(ctx.requestId, ctx.traceContext.traceId);\n * ```\n */\nexport class RequestContext {\n  /** Unique request identifier (UUID v4) */\n  readonly requestId: string;\n\n  /** W3C Trace Context or generated trace ID */\n  readonly traceContext: TraceContext;\n\n  /** Session identifier (from mcp-session-id header or authorization) */\n  readonly sessionId: string;\n\n  /**\n   * Authentication information.\n   * Note: This is mutable to allow updating after authorization is verified.\n   * It's Partial<AuthInfo> because auth info is progressively populated\n   * throughout the request lifecycle (some fields like transport are only\n   * available after the transport is established).\n   */\n  private _authInfo: Partial<AuthInfo>;\n\n  /** Scope identifier */\n  readonly scopeId: string;\n\n  /** Request start timestamp */\n  readonly timestamp: number;\n\n  /** Request metadata (headers, user-agent, etc.) */\n  readonly metadata: RequestMetadata;\n\n  /** Timing marks for performance tracking */\n  private readonly marks: Map<string, number> = new Map();\n\n  /** Request-scoped data store */\n  private readonly store: Map<string | symbol, unknown> = new Map();\n\n  constructor(args: RequestContextArgs) {\n    this.requestId = args.requestId ?? randomUUID();\n    this.traceContext = args.traceContext ?? generateTraceContext();\n    this.sessionId = args.sessionId;\n    this._authInfo = args.authInfo;\n    this.scopeId = args.scopeId;\n    this.timestamp = args.timestamp ?? Date.now();\n    // Defensive normalization: ensure customHeaders is always an object\n    // even if args.metadata is partially defined at runtime (TS can't enforce this)\n    const metadata = args.metadata;\n    this.metadata = {\n      ...metadata,\n      customHeaders: metadata?.customHeaders ?? {},\n    };\n\n    // Initial mark\n    this.marks.set('init', this.timestamp);\n  }\n\n  /**\n   * Get authentication information.\n   * Returns Partial<AuthInfo> because auth info is progressively populated.\n   */\n  get authInfo(): Partial<AuthInfo> {\n    return this._authInfo;\n  }\n\n  /**\n   * Update auth info after authorization is verified.\n   * Called by checkAuthorization stage after session verification.\n   * Can be called multiple times to progressively add fields.\n   *\n   * @param authInfo - The auth info fields to set/update\n   * @internal\n   */\n  updateAuthInfo(authInfo: Partial<AuthInfo>): void {\n    // Merge with existing auth info to support progressive updates\n    this._authInfo = { ...this._authInfo, ...authInfo };\n  }\n\n  /**\n   * Session metadata including protocol, platform type, and node info.\n   * Only available after session verification in authenticated flows.\n   */\n  private _sessionMetadata?: SessionIdPayload;\n\n  /**\n   * Get session metadata.\n   *\n   * Contains protocol type, platform type, nodeId, and authSignature.\n   * Only available after session verification completes.\n   *\n   * @returns Session metadata or undefined if not yet verified\n   */\n  get sessionMetadata(): SessionIdPayload | undefined {\n    return this._sessionMetadata;\n  }\n\n  /**\n   * Update session metadata after session verification.\n   * Called by checkAuthorization stage after session verification.\n   *\n   * @param metadata - Session metadata from verified session\n   * @internal\n   */\n  updateSessionMetadata(metadata: SessionIdPayload): void {\n    this._sessionMetadata = metadata;\n  }\n\n  /**\n   * Get a child logger with request context attached.\n   *\n   * Creates a child logger with a prefix containing the request ID and trace ID\n   * for easy request tracing in logs.\n   *\n   * @param parentLogger - The parent logger to create a child from\n   * @returns A logger with requestId and traceId in the prefix\n   */\n  getLogger(parentLogger: FrontMcpLogger): FrontMcpLogger {\n    // FrontMcpLogger.child() takes a string prefix\n    const prefix = `[${this.requestId.slice(0, 8)}:${this.traceContext.traceId.slice(0, 8)}]`;\n    return parentLogger.child(prefix);\n  }\n\n  /**\n   * Mark a timing point for performance tracking.\n   *\n   * @param name - Name of the timing mark\n   */\n  mark(name: string): void {\n    this.marks.set(name, Date.now());\n  }\n\n  /**\n   * Get elapsed time in milliseconds between two marks.\n   *\n   * @param from - Start mark name (defaults to 'init')\n   * @param to - End mark name (defaults to current time)\n   * @returns Elapsed time in milliseconds\n   */\n  elapsed(from?: string, to?: string): number {\n    const fromTime = this.marks.get(from ?? 'init') ?? this.timestamp;\n    const toTime = to ? this.marks.get(to) ?? Date.now() : Date.now();\n    return toTime - fromTime;\n  }\n\n  /**\n   * Get all timing marks.\n   *\n   * @returns Read-only map of mark names to timestamps\n   */\n  getMarks(): ReadonlyMap<string, number> {\n    return this.marks;\n  }\n\n  /**\n   * Store request-scoped data.\n   *\n   * @param key - Storage key\n   * @param value - Value to store\n   */\n  set<T>(key: string | symbol, value: T): void {\n    this.store.set(key, value);\n  }\n\n  /**\n   * Retrieve request-scoped data.\n   *\n   * @param key - Storage key\n   * @returns Stored value or undefined\n   */\n  get<T>(key: string | symbol): T | undefined {\n    return this.store.get(key) as T | undefined;\n  }\n\n  /**\n   * Check if a key exists in the request-scoped store.\n   *\n   * @param key - Storage key\n   * @returns True if key exists\n   */\n  has(key: string | symbol): boolean {\n    return this.store.has(key);\n  }\n\n  /**\n   * Delete a key from the request-scoped store.\n   *\n   * @param key - Storage key\n   * @returns True if key was deleted\n   */\n  delete(key: string | symbol): boolean {\n    return this.store.delete(key);\n  }\n\n  /**\n   * Get a summary of the context for logging.\n   *\n   * Note: sessionId is hashed to prevent accidental exposure of user-identifying\n   * session identifiers in logs while still allowing correlation.\n   *\n   * @returns Object with key context fields\n   */\n  toLogContext(): Record<string, unknown> {\n    return {\n      requestId: this.requestId,\n      traceId: this.traceContext.traceId,\n      parentId: this.traceContext.parentId,\n      // Hash sessionId to prevent logging user-identifying information\n      // while preserving ability to correlate logs for the same session\n      sessionIdHash: createHash('sha256').update(this.sessionId).digest('hex').slice(0, 12),\n      scopeId: this.scopeId,\n      elapsed: this.elapsed(),\n    };\n  }\n}\n"]}

package/src/context/request-context.provider.js

@@ -1,51 +0,0 @@
-"use strict";
-/**
- * REQUEST_CONTEXT Provider
- *
- * Defines the DI token and factory provider for accessing RequestContext.
- * The context is retrieved from AsyncLocalStorage via RequestContextStorage.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RequestContextProvider = exports.REQUEST_CONTEXT = void 0;
-const metadata_1 = require("../common/metadata");
-const request_context_storage_1 = require("./request-context-storage");
-/**
- * DI token for accessing the current RequestContext.
- *
- * Use this token to inject the current request context in any provider or context:
- *
- * @example
- * ```typescript
- * // In a tool/resource/prompt
- * const ctx = this.get(REQUEST_CONTEXT);
- * console.log(ctx.requestId, ctx.traceContext.traceId);
- *
- * // In a provider with constructor injection
- * constructor(
- *   @Inject(REQUEST_CONTEXT) private ctx: RequestContext
- * ) {}
- * ```
- */
-exports.REQUEST_CONTEXT = Symbol.for('frontmcp:REQUEST_CONTEXT');
-/**
- * Factory provider for RequestContext.
- *
- * This provider is marked as REQUEST scope and retrieves the current
- * RequestContext from AsyncLocalStorage via RequestContextStorage.
- *
- * Note: This provider will throw if called outside of a request scope
- * (i.e., without first calling RequestContextStorage.run or runFromHeaders).
- */
-exports.RequestContextProvider = {
-    provide: exports.REQUEST_CONTEXT,
-    inject: () => [request_context_storage_1.RequestContextStorage],
-    useFactory: (storage) => {
-        return storage.getStoreOrThrow();
-    },
-    metadata: {
-        name: 'RequestContext',
-        description: 'Current request context from AsyncLocalStorage',
-        scope: metadata_1.ProviderScope.REQUEST,
-    },
-};
-//# sourceMappingURL=request-context.provider.js.map

package/src/context/request-context.provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-context.provider.js","sourceRoot":"","sources":["../../../src/context/request-context.provider.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,iDAAmD;AAGnD,uEAAkE;AAElE;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACU,QAAA,sBAAsB,GAAiF;IAClH,OAAO,EAAE,uBAAe;IACxB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,+CAAqB,CAAU;IAC9C,UAAU,EAAE,CAAC,OAA8B,EAAkB,EAAE;QAC7D,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC;IACnC,CAAC;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,gDAAgD;QAC7D,KAAK,EAAE,wBAAa,CAAC,OAAO;KAC7B;CACK,CAAC","sourcesContent":["/**\n * REQUEST_CONTEXT Provider\n *\n * Defines the DI token and factory provider for accessing RequestContext.\n * The context is retrieved from AsyncLocalStorage via RequestContextStorage.\n */\n\nimport { ProviderScope } from '../common/metadata';\nimport { ProviderFactoryType } from '../common/interfaces/provider.interface';\nimport { RequestContext } from './request-context';\nimport { RequestContextStorage } from './request-context-storage';\n\n/**\n * DI token for accessing the current RequestContext.\n *\n * Use this token to inject the current request context in any provider or context:\n *\n * @example\n * ```typescript\n * // In a tool/resource/prompt\n * const ctx = this.get(REQUEST_CONTEXT);\n * console.log(ctx.requestId, ctx.traceContext.traceId);\n *\n * // In a provider with constructor injection\n * constructor(\n *   @Inject(REQUEST_CONTEXT) private ctx: RequestContext\n * ) {}\n * ```\n */\nexport const REQUEST_CONTEXT = Symbol.for('frontmcp:REQUEST_CONTEXT');\n\n/**\n * Factory provider for RequestContext.\n *\n * This provider is marked as REQUEST scope and retrieves the current\n * RequestContext from AsyncLocalStorage via RequestContextStorage.\n *\n * Note: This provider will throw if called outside of a request scope\n * (i.e., without first calling RequestContextStorage.run or runFromHeaders).\n */\nexport const RequestContextProvider: ProviderFactoryType<RequestContext, readonly [typeof RequestContextStorage]> = {\n  provide: REQUEST_CONTEXT,\n  inject: () => [RequestContextStorage] as const,\n  useFactory: (storage: RequestContextStorage): RequestContext => {\n    return storage.getStoreOrThrow();\n  },\n  metadata: {\n    name: 'RequestContext',\n    description: 'Current request context from AsyncLocalStorage',\n    scope: ProviderScope.REQUEST,\n  },\n} as any;\n"]}

package/src/context/session-key.provider.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionKey = void 0;
-const mcp_error_1 = require("../errors/mcp.error");
-/**
- * Session key wrapper for DI injection in SESSION-scoped providers.
- *
- * FrontMCP's DI system uses class tokens (reads `design:paramtypes` from constructors).
- * This class wraps the session ID so it can be injected via constructor parameters.
- *
- * The SessionKey is validated at construction to prevent:
- * - Memory bombs (very long session IDs)
- * - Log injection attacks (special characters)
- * - Cache exhaustion (unique massive IDs)
- *
- * @example
- * ```typescript
- * import { Provider, ProviderScope, SessionKey } from '@frontmcp/sdk';
- *
- * @Provider({ scope: ProviderScope.SESSION })
- * class SessionScopedCache {
- *   constructor(private readonly sessionKey: SessionKey) {
- *     // sessionKey.value available at construction time
- *     const sessionId = sessionKey.value;
- *   }
- * }
- * ```
- */
-class SessionKey {
-    value;
-    /** Maximum allowed length for session keys */
-    static MAX_LENGTH = 2048;
-    /**
-     * Valid characters for session keys:
-     * - Alphanumeric (a-z, A-Z, 0-9)
-     * - Hyphen, underscore, period
-     * - Colon (for namespaced IDs like "anon:uuid")
-     */
-    static VALID_PATTERN = /^[a-zA-Z0-9\-_.:]+$/;
-    /**
-     * Validate a session key string without constructing.
-     * Use this for early validation before cache operations.
-     *
-     * @param value - The session key string to validate
-     * @throws InvalidInputError if validation fails (empty, too long, invalid characters)
-     */
-    static validate(value) {
-        if (!value || value.length === 0) {
-            throw new mcp_error_1.InvalidInputError('SessionKey cannot be empty');
-        }
-        if (value.length > SessionKey.MAX_LENGTH) {
-            throw new mcp_error_1.InvalidInputError(`SessionKey exceeds maximum length of ${SessionKey.MAX_LENGTH} characters`);
-        }
-        if (!SessionKey.VALID_PATTERN.test(value)) {
-            throw new mcp_error_1.InvalidInputError('SessionKey contains invalid characters. Allowed: alphanumeric, hyphen, underscore, period, colon');
-        }
-    }
-    constructor(value) {
-        this.value = value;
-        // Delegate to static method to avoid code duplication
-        SessionKey.validate(value);
-    }
-}
-exports.SessionKey = SessionKey;
-//# sourceMappingURL=session-key.provider.js.map

package/src/context/session-key.provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-key.provider.js","sourceRoot":"","sources":["../../../src/context/session-key.provider.ts"],"names":[],"mappings":";;;AAAA,mDAAwD;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAa,UAAU;IAiCO;IAhC5B,8CAA8C;IAC9C,MAAM,CAAU,UAAU,GAAG,IAAI,CAAC;IAElC;;;;;OAKG;IACH,MAAM,CAAU,aAAa,GAAG,qBAAqB,CAAC;IAEtD;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,CAAC,KAAa;QAC3B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,6BAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,6BAAiB,CAAC,wCAAwC,UAAU,CAAC,UAAU,aAAa,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,6BAAiB,CACzB,kGAAkG,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAA4B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;QACvC,sDAAsD;QACtD,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;;AApCH,gCAqCC","sourcesContent":["import { InvalidInputError } from '../errors/mcp.error';\n\n/**\n * Session key wrapper for DI injection in SESSION-scoped providers.\n *\n * FrontMCP's DI system uses class tokens (reads `design:paramtypes` from constructors).\n * This class wraps the session ID so it can be injected via constructor parameters.\n *\n * The SessionKey is validated at construction to prevent:\n * - Memory bombs (very long session IDs)\n * - Log injection attacks (special characters)\n * - Cache exhaustion (unique massive IDs)\n *\n * @example\n * ```typescript\n * import { Provider, ProviderScope, SessionKey } from '@frontmcp/sdk';\n *\n * @Provider({ scope: ProviderScope.SESSION })\n * class SessionScopedCache {\n *   constructor(private readonly sessionKey: SessionKey) {\n *     // sessionKey.value available at construction time\n *     const sessionId = sessionKey.value;\n *   }\n * }\n * ```\n */\nexport class SessionKey {\n  /** Maximum allowed length for session keys */\n  static readonly MAX_LENGTH = 2048;\n\n  /**\n   * Valid characters for session keys:\n   * - Alphanumeric (a-z, A-Z, 0-9)\n   * - Hyphen, underscore, period\n   * - Colon (for namespaced IDs like \"anon:uuid\")\n   */\n  static readonly VALID_PATTERN = /^[a-zA-Z0-9\\-_.:]+$/;\n\n  /**\n   * Validate a session key string without constructing.\n   * Use this for early validation before cache operations.\n   *\n   * @param value - The session key string to validate\n   * @throws InvalidInputError if validation fails (empty, too long, invalid characters)\n   */\n  static validate(value: string): void {\n    if (!value || value.length === 0) {\n      throw new InvalidInputError('SessionKey cannot be empty');\n    }\n    if (value.length > SessionKey.MAX_LENGTH) {\n      throw new InvalidInputError(`SessionKey exceeds maximum length of ${SessionKey.MAX_LENGTH} characters`);\n    }\n    if (!SessionKey.VALID_PATTERN.test(value)) {\n      throw new InvalidInputError(\n        'SessionKey contains invalid characters. Allowed: alphanumeric, hyphen, underscore, period, colon',\n      );\n    }\n  }\n\n  constructor(public readonly value: string) {\n    // Delegate to static method to avoid code duplication\n    SessionKey.validate(value);\n  }\n}\n"]}