@frontmcp/sdk 0.7.2 → 0.8.0

package/auth/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization/index.ts"],"names":[],"mappings":"AAGA,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,yBAAyB,EACzB,UAAU,EACV,oBAAoB,GACrB,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization/index.ts"],"names":[],"mappings":"AAGA,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,yBAAyB,EACzB,UAAU,EACV,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,gCAAgC,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC"}

package/auth/authorization/orchestrated.accessor.d.ts

@@ -0,0 +1,161 @@
+/**
+ * OrchestratedAuthAccessor - Interface for accessing orchestrated authorization
+ *
+ * This interface provides the runtime API for tools to access upstream provider
+ * tokens in orchestrated mode. It supports:
+ * - Token retrieval by provider ID
+ * - App token retrieval for progressive auth
+ * - Automatic token refresh
+ * - Authorization checks
+ */
+import { Token } from '@frontmcp/di';
+/**
+ * OrchestratedAuthAccessor - Runtime accessor for orchestrated authorization.
+ *
+ * Available in tool execution via `this.orchestration`:
+ * ```typescript
+ * @Tool({ name: 'my_tool' })
+ * class MyTool extends ToolContext {
+ *   async execute(input: Input) {
+ *     // Get upstream provider token
+ *     const githubToken = await this.orchestration.getToken('github');
+ *
+ *     // Check if provider is authorized
+ *     const hasSlack = await this.orchestration.hasProvider('slack');
+ *
+ *     // Get app-specific token (progressive auth)
+ *     const jiraToken = await this.orchestration.getAppToken('jira');
+ *   }
+ * }
+ * ```
+ */
+export interface OrchestratedAuthAccessor {
+    /**
+     * Get access token for an upstream provider.
+     *
+     * @param providerId - Provider ID (e.g., 'github', 'slack')
+     * @returns Access token string
+     * @throws Error if provider not authorized or token unavailable
+     *
+     * @example
+     * ```typescript
+     * const token = await this.orchestration.getToken('github');
+     * const response = await fetch('https://api.github.com/user', {
+     *   headers: { Authorization: `Bearer ${token}` },
+     * });
+     * ```
+     */
+    getToken(providerId?: string): Promise<string>;
+    /**
+     * Try to get access token, returning null if not available.
+     *
+     * @param providerId - Provider ID
+     * @returns Access token or null
+     */
+    tryGetToken(providerId?: string): Promise<string | null>;
+    /**
+     * Get access token for a specific app (progressive authorization).
+     *
+     * @param appId - App ID
+     * @returns Access token or null if app not authorized
+     */
+    getAppToken(appId: string): Promise<string | null>;
+    /**
+     * Check if a provider is authorized.
+     *
+     * @param providerId - Provider ID
+     * @returns true if provider has tokens stored
+     */
+    hasProvider(providerId: string): boolean;
+    /**
+     * Get all authorized provider IDs.
+     */
+    getProviderIds(): string[];
+    /**
+     * Check if an app is authorized.
+     *
+     * @param appId - App ID
+     * @returns true if app is authorized
+     */
+    isAppAuthorized(appId: string): boolean;
+    /**
+     * Get all authorized app IDs.
+     */
+    getAllAuthorizedAppIds(): string[];
+    /**
+     * Get tool IDs authorized through a specific app.
+     *
+     * @param appId - App ID
+     * @returns Tool IDs or undefined if app not authorized
+     */
+    getAppToolIds(appId: string): string[] | undefined;
+    /**
+     * Get the primary provider ID (default for getToken).
+     */
+    readonly primaryProviderId?: string;
+    /**
+     * Get the issuer (local orchestrator).
+     */
+    readonly issuer?: string;
+    /**
+     * Get authorization ID.
+     */
+    readonly authorizationId: string;
+    /**
+     * Check if user is authenticated (not anonymous).
+     */
+    readonly isAuthenticated: boolean;
+}
+/**
+ * DI Token for OrchestratedAuthAccessor
+ */
+export declare const ORCHESTRATED_AUTH_ACCESSOR: Token<OrchestratedAuthAccessor>;
+/**
+ * Null implementation for when orchestrated auth is not available.
+ */
+export declare class NullOrchestratedAuthAccessor implements OrchestratedAuthAccessor {
+    readonly primaryProviderId: undefined;
+    readonly issuer: undefined;
+    readonly authorizationId = "null";
+    readonly isAuthenticated = false;
+    getToken(providerId?: string): Promise<string>;
+    tryGetToken(providerId?: string): Promise<string | null>;
+    getAppToken(appId: string): Promise<string | null>;
+    hasProvider(providerId: string): boolean;
+    getProviderIds(): string[];
+    isAppAuthorized(appId: string): boolean;
+    getAllAuthorizedAppIds(): string[];
+    getAppToolIds(appId: string): string[] | undefined;
+}
+/**
+ * Adapter that wraps OrchestratedAuthorization as OrchestratedAuthAccessor.
+ */
+export declare class OrchestratedAuthAccessorAdapter implements OrchestratedAuthAccessor {
+    private readonly authorization;
+    constructor(authorization: {
+        readonly id: string;
+        readonly isAnonymous: boolean;
+        readonly primaryProviderId?: string;
+        readonly issuer?: string;
+        hasProvider(providerId: string): boolean;
+        getProviderIds(): string[];
+        getToken(providerId?: string): Promise<string>;
+        getAppToken(appId: string): Promise<string | null>;
+        isAppAuthorized(appId: string): boolean;
+        getAllAuthorizedAppIds(): string[];
+        getAppToolIds(appId: string): string[] | undefined;
+    });
+    get primaryProviderId(): string | undefined;
+    get issuer(): string | undefined;
+    get authorizationId(): string;
+    get isAuthenticated(): boolean;
+    getToken(providerId?: string): Promise<string>;
+    tryGetToken(providerId?: string): Promise<string | null>;
+    getAppToken(appId: string): Promise<string | null>;
+    hasProvider(providerId: string): boolean;
+    getProviderIds(): string[];
+    isAppAuthorized(appId: string): boolean;
+    getAllAuthorizedAppIds(): string[];
+    getAppToolIds(appId: string): string[] | undefined;
+}
+//# sourceMappingURL=orchestrated.accessor.d.ts.map

package/auth/authorization/orchestrated.accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrated.accessor.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization/orchestrated.accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C;;;;;OAKG;IACH,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAEzC;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAExC;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnD;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAElC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAErC;;GAEG;AACH,qBAAa,4BAA6B,YAAW,wBAAwB;IAC3E,QAAQ,CAAC,iBAAiB,YAAa;IACvC,QAAQ,CAAC,MAAM,YAAa;IAC5B,QAAQ,CAAC,eAAe,UAAU;IAClC,QAAQ,CAAC,eAAe,SAAS;IAE3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD;AAED;;GAEG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IAE5E,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE;QAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,cAAc,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACnD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,sBAAsB,IAAI,MAAM,EAAE,CAAC;QACnC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;KACpD;IAGH,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAE1C;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC,cAAc,IAAI,MAAM,EAAE;IAI1B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;CAGnD"}

package/auth/authorization/orchestrated.authorization.d.ts

@@ -31,6 +31,19 @@ export interface TokenStore {
      * Check if tokens exist for a provider
      */
     hasTokens(authorizationId: string, providerId: string): Promise<boolean>;
+    /**
+     * Get all provider IDs that have tokens stored for this authorization.
+     */
+    getProviderIds(authorizationId: string): Promise<string[]>;
+    /**
+     * Migrate tokens from one authorization ID to another.
+     * Used when tokens are stored with a pending ID during federated auth
+     * and need to be accessible under the real authorization ID.
+     *
+     * @param fromAuthId - Source authorization ID (e.g., "pending:abc123")
+     * @param toAuthId - Target authorization ID (e.g., "def456")
+     */
+    migrateTokens(fromAuthId: string, toAuthId: string): Promise<void>;
 }
 /**
  * Token refresh callback type
@@ -107,6 +120,12 @@ export interface OrchestratedAuthorizationCreateCtx {
     authorizedApps?: AuthorizationCreateCtx['authorizedApps'];
     authorizedAppIds?: string[];
     authorizedResources?: string[];
+    /**
+     * Provider IDs that the user has explicitly authorized during federated login.
+     * Populated from JWT claims (`federated.selectedProviders`) or token store.
+     * Controls which providers the authorization has access to for progressive auth.
+     */
+    authorizedProviderIds?: string[];
 }
 /**
  * OrchestratedAuthorization - Local auth server with secure token storage
@@ -164,10 +183,6 @@ export declare class OrchestratedAuthorization extends AuthorizationBase {
      * Refresh token and return new access token
      */
     private refreshAndGetToken;
-    /**
-     * Generate authorization ID from token
-     */
-    private static generateAuthorizationId;
     /**
      * Check if a provider has tokens stored
      */

package/auth/authorization/orchestrated.authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrated.authorization.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization/orchestrated.authorization.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEpF;;OAEG;IACH,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAErF;;OAEG;IACH,WAAW,CACT,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;OAEG;IACH,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;OAEG;IACH,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,mCAAmC;IACnC,eAAe,CAAC,EAAE,aAAa,CAAC;IAChC,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,IAAI,EAAE,QAAQ,CAAC;IAEf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;OAEG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAEtC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAChE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;;IAC9D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAkB;IAEzC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAiBpC,OAAO;IAeP;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,kCAAkC,GAAG,yBAAyB;IAsDjF;;;;;;;;;OASG;IACG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoCpD;;OAEG;YACW,kBAAkB;IA+BhC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAMtC;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE;IAI1B;;;OAGG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAqChB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAehB;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAcxD;;;OAGG;IACM,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhD;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAQlC;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAIlD;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;CACF"}
+{"version":3,"file":"orchestrated.authorization.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization/orchestrated.authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEpF;;OAEG;IACH,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAErF;;OAEG;IACH,WAAW,CACT,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;OAEG;IACH,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE;;OAEG;IACH,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzE;;OAEG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3D;;;;;;;OAOG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,mCAAmC;IACnC,eAAe,CAAC,EAAE,aAAa,CAAC;IAChC,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,IAAI,EAAE,QAAQ,CAAC;IAEf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;OAEG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAEtC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IAChE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;;IAC9D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAkB;IAEzC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAiBpC,OAAO;IAeP;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,kCAAkC,GAAG,yBAAyB;IA2DjF;;;;;;;;;OASG;IACG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoCpD;;OAEG;YACW,kBAAkB;IA+BhC;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAIxC;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE;IAI1B;;;OAGG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAqChB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAehB;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAcxD;;;OAGG;IACM,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhD;;OAEG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAQlC;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAIlD;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;CACF"}

package/auth/authorization/orchestrated.context-extension.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Orchestrated Auth Context Extension
+ *
+ * Provides module augmentation and context extension configuration
+ * for adding `this.orchestration` to ExecutionContextBase.
+ *
+ * This extension allows tools to access upstream provider tokens
+ * in orchestrated authentication mode.
+ */
+import type { ContextExtension } from '../../common/metadata/plugin.metadata';
+import { OrchestratedAuthAccessor } from './orchestrated.accessor';
+/**
+ * Module augmentation to add type safety for this.orchestration
+ */
+declare module '../../common/interfaces/execution-context.interface' {
+    interface ExecutionContextBase {
+        /**
+         * Access orchestrated authorization for upstream provider tokens.
+         *
+         * Only available in orchestrated authentication mode when the user
+         * has completed multi-provider authentication.
+         *
+         * @example
+         * ```typescript
+         * @Tool({ name: 'github_repos' })
+         * class GitHubReposTool extends ToolContext {
+         *   async execute(input: Input): Promise<Output> {
+         *     // Get upstream GitHub token
+         *     const token = await this.orchestration.getToken('github');
+         *
+         *     // Use token to call GitHub API
+         *     const response = await fetch('https://api.github.com/user/repos', {
+         *       headers: { Authorization: `Bearer ${token}` },
+         *     });
+         *
+         *     return { repos: await response.json() };
+         *   }
+         * }
+         * ```
+         *
+         * @example Multiple providers
+         * ```typescript
+         * @Tool({ name: 'sync_issues' })
+         * class SyncIssuesTool extends ToolContext {
+         *   async execute(input: Input): Promise<Output> {
+         *     // Check which providers are authorized
+         *     if (this.orchestration.hasProvider('github') &&
+         *         this.orchestration.hasProvider('jira')) {
+         *       const githubToken = await this.orchestration.getToken('github');
+         *       const jiraToken = await this.orchestration.getToken('jira');
+         *
+         *       // Sync issues between GitHub and Jira
+         *     }
+         *   }
+         * }
+         * ```
+         *
+         * @example Progressive authorization
+         * ```typescript
+         * @Tool({ name: 'slack_send' })
+         * class SlackSendTool extends ToolContext {
+         *   async execute(input: Input): Promise<Output> {
+         *     // Check if Slack app is authorized
+         *     if (!this.orchestration.isAppAuthorized('slack')) {
+         *       // Trigger progressive auth
+         *       throw new AuthorizationRequiredError('slack');
+         *     }
+         *
+         *     const token = await this.orchestration.getAppToken('slack');
+         *     // Send message to Slack
+         *   }
+         * }
+         * ```
+         */
+        readonly orchestration: OrchestratedAuthAccessor;
+    }
+}
+/**
+ * Context extension configuration for orchestration.
+ * Used to register the lazy getter on ExecutionContextBase.prototype.
+ *
+ * When the accessor is not available (not orchestrated mode, or
+ * user not authenticated), the property will throw an error with
+ * the specified errorMessage. Use getOrchestration() helper for
+ * graceful fallback to NullOrchestratedAuthAccessor.
+ */
+export declare const orchestratedAuthContextExtension: ContextExtension;
+/**
+ * Get OrchestratedAuthAccessor from context.
+ * Returns null accessor if not available (graceful degradation).
+ *
+ * @param ctx - Execution context
+ * @returns OrchestratedAuthAccessor (may be NullOrchestratedAuthAccessor)
+ */
+export declare function getOrchestration(ctx: {
+    get: <T>(token: unknown) => T;
+    tryGet: <T>(token: unknown) => T | undefined;
+}): OrchestratedAuthAccessor;
+/**
+ * Check if orchestrated auth is available and user is authenticated.
+ *
+ * @param ctx - Execution context
+ * @returns true if orchestrated auth is available with authenticated user
+ */
+export declare function hasOrchestration(ctx: {
+    tryGet: <T>(token: unknown) => T | undefined;
+}): boolean;
+//# sourceMappingURL=orchestrated.context-extension.d.ts.map

package/auth/authorization/orchestrated.context-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrated.context-extension.d.ts","sourceRoot":"","sources":["../../../src/auth/authorization/orchestrated.context-extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAEL,wBAAwB,EAEzB,MAAM,yBAAyB,CAAC;AAMjC;;GAEG;AACH,OAAO,QAAQ,qDAAqD,CAAC;IACnE,UAAU,oBAAoB;QAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAyDG;QACH,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;KAClD;CACF;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,gBAM9C,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,SAAS,CAAC;CAC9C,GAAG,wBAAwB,CAG3B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,CAG/F"}

package/auth/cimd/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * CIMD (Client ID Metadata Documents) Module
+ *
+ * Re-exports from @frontmcp/auth for backward compatibility.
+ *
+ * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00
+ */
+export { type CimdLogger, noopLogger, clientMetadataDocumentSchema, cimdCacheConfigSchema, cimdSecurityConfigSchema, cimdNetworkConfigSchema, cimdConfigSchema, type ClientMetadataDocument, type ClientMetadataDocumentInput, type CimdCacheConfig, type CimdSecurityConfig, type CimdNetworkConfig, type CimdConfig, type CimdConfigInput, type CimdResolutionResult, CimdError, InvalidClientIdUrlError, CimdFetchError, CimdValidationError, CimdClientIdMismatchError, CimdSecurityError, RedirectUriMismatchError, CimdResponseTooLargeError, CimdDisabledError, isCimdClientId, validateClientIdUrl, checkSsrfProtection, hasOnlyLocalhostRedirectUris, CimdCache, extractCacheHeaders, parseCacheHeaders, type CimdCacheEntry, type CacheableHeaders, CimdService, } from '@frontmcp/auth';
+/**
+ * Provider token for dependency injection.
+ * This is SDK-specific and not included in @frontmcp/auth.
+ */
+export declare const CimdServiceToken: unique symbol;
+//# sourceMappingURL=index.d.ts.map

package/auth/cimd/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/cimd/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,SAAS,EACT,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,eAAwB,CAAC"}

package/auth/flows/auth.verify.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/auth.verify.flow.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,QAAQ,EACR,cAAc,EAQf,MAAM,cAAc,CAAC;AACtB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAIL,aAAa,EAEd,MAAM,kBAAkB,CAAC;AAI1B,QAAA,MAAM,WAAW;;iBAAyB,CAAC;AAG3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;iBAUf,CAAC;AAmBH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;mBAAkD,CAAC;AAEtF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAGtE,QAAA,MAAM,IAAI;;;CAU2B,CAAC;AAGtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,sBAAsB,EAC7B,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAGpC;;;;;;;;;GASG;AAQH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAE3D;;OAEG;IAEG,UAAU;IA6BhB;;OAEG;IAEG,iBAAiB;IAcvB;;OAEG;IAIG,gBAAgB;IAqBtB;;;OAGG;IAQG,uBAAuB;IAsB7B;;OAEG;IAWG,0BAA0B;IAShC;;OAEG;IAIG,WAAW;IAwGjB;;OAEG;IAEG,kBAAkB;IA2DxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IA0BhB;;OAEG;IACH,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"auth.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/auth.verify.flow.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,QAAQ,EACR,cAAc,EAQf,MAAM,cAAc,CAAC;AACtB,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,OAAO,EAKL,aAAa,EAGd,MAAM,kBAAkB,CAAC;AAK1B,QAAA,MAAM,WAAW;;iBAAyB,CAAC;AAG3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;iBAUf,CAAC;AAmBH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;mBAAkD,CAAC;AAEtF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAGtE,QAAA,MAAM,IAAI;;;CAU2B,CAAC;AAGtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,sBAAsB,EAC7B,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAGpC;;;;;;;;;GASG;AAQH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAE3D;;OAEG;IAEG,UAAU;IA6BhB;;OAEG;IAEG,iBAAiB;IAcvB;;OAEG;IAIG,gBAAgB;IAqBtB;;;OAGG;IAQG,uBAAuB;IAsB7B;;OAEG;IAWG,0BAA0B;IAShC;;OAEG;IAIG,WAAW;IAwGjB;;OAEG;IAEG,kBAAkB;IA8FxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IA0BhB;;OAEG;IACH,OAAO,CAAC,WAAW;CAMpB"}

package/auth/flows/oauth.authorize.flow.d.ts

@@ -69,6 +69,33 @@ declare const stateSchema: z.ZodObject<{
     existingSessionId: z.ZodOptional<z.ZodString>;
     requiresFederatedLogin: z.ZodDefault<z.ZodBoolean>;
     requiresConsent: z.ZodDefault<z.ZodBoolean>;
+    isCimdClient: z.ZodDefault<z.ZodBoolean>;
+    cimdMetadata: z.ZodOptional<z.ZodObject<{
+        client_id: z.ZodString;
+        client_name: z.ZodString;
+        redirect_uris: z.ZodArray<z.ZodString>;
+        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            client_secret_basic: "client_secret_basic";
+            client_secret_post: "client_secret_post";
+            private_key_jwt: "private_key_jwt";
+        }>>;
+        grant_types: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        client_uri: z.ZodOptional<z.ZodString>;
+        logo_uri: z.ZodOptional<z.ZodString>;
+        jwks_uri: z.ZodOptional<z.ZodString>;
+        jwks: z.ZodOptional<z.ZodObject<{
+            keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>;
+        tos_uri: z.ZodOptional<z.ZodString>;
+        policy_uri: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+        contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        software_statement: z.ZodOptional<z.ZodString>;
+        software_id: z.ZodOptional<z.ZodString>;
+        software_version: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"redirect">;
@@ -83,8 +110,8 @@ declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
@@ -104,8 +131,8 @@ declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
@@ -123,8 +150,8 @@ declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;

package/auth/flows/oauth.authorize.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.authorize.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,OAAO,EAEL,QAAQ,EAER,cAAc,EAQf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAY,MAAM,KAAK,CAAC;AAsDlC;;GAEG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;iBAS/B,CAAC;AAEH;;GAEG;AACH,QAAA,MAAM,+BAA+B;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF,QAAA,MAAM,WAAW;;;;iBAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;iBAsBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAIhB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAQ2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,iBAAiB,EAAE,cAAc,CAC/B,kBAAkB,EAClB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,iBAA0B,CAAC;AAcxC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACnE,OAAO,CAAC,MAAM,CAAiD;IAGzD,UAAU;IAiEV,aAAa;IAoDb,iBAAiB;IAOjB,2BAA2B;IAmG3B,oBAAoB;IA6FpB,cAAc;IAIpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAsBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA4BhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IA+QzB;;OAEG;IACH,OAAO,CAAC,eAAe;CAyCxB"}
+{"version":3,"file":"oauth.authorize.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,OAAO,EAEL,QAAQ,EAER,cAAc,EAQf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAY,MAAM,KAAK,CAAC;AAuDlC;;GAEG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;iBAS/B,CAAC;AAEH;;GAEG;AACH,QAAA,MAAM,+BAA+B;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF,QAAA,MAAM,WAAW;;;;iBAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAIhB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAQ2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,iBAAiB,EAAE,cAAc,CAC/B,kBAAkB,EAClB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,iBAA0B,CAAC;AAcxC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACnE,OAAO,CAAC,MAAM,CAAiD;IAGzD,UAAU;IAiEV,aAAa;IAmFb,iBAAiB;IAOjB,2BAA2B;IAmG3B,oBAAoB;IA0GpB,cAAc;IAIpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAsBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmBvB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA4BhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAkRzB;;OAEG;IACH,OAAO,CAAC,eAAe;CAyCxB"}

package/auth/flows/oauth.callback.flow.d.ts

@@ -53,8 +53,8 @@ declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
@@ -72,8 +72,8 @@ declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
@@ -84,7 +84,7 @@ declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strip>]>;
 declare const plan: {
     readonly pre: ["parseInput", "validatePendingAuth"];
-    readonly execute: ["handleIncrementalAuth", "createAuthorizationCode", "redirectToClient"];
+    readonly execute: ["handleIncrementalAuth", "handleFederatedAuth", "createAuthorizationCode", "redirectToClient"];
 };
 declare global {
     interface ExtendFlows {
@@ -102,6 +102,14 @@ export default class OauthCallbackFlow extends FlowBase<typeof name> {
      * requiring full re-authentication
      */
     handleIncrementalAuth(): Promise<void>;
+    /**
+     * Handle federated authentication - start provider chain
+     * When user selects providers on federated login page, we need to:
+     * 1. Create a federated session to track progress
+     * 2. Start OAuth flow with the first selected provider
+     * 3. Chain through remaining providers
+     */
+    handleFederatedAuth(): Promise<void>;
     createAuthorizationCode(): Promise<void>;
     redirectToClient(): Promise<void>;
     /**

package/auth/flows/oauth.callback.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,QAAQ,EAER,cAAc,EAMf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,QAAA,MAAM,WAAW;;;;iBAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;iBA4Bf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAcvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAGxD,UAAU;IAsDV,mBAAmB;IA2EzB;;;;OAIG;IAEG,qBAAqB;IA0BrB,uBAAuB;IAmEvB,gBAAgB;IAqCtB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAqDxB"}
+{"version":3,"file":"oauth.callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,QAAQ,EAER,cAAc,EAMf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,QAAA,MAAM,WAAW;;;;iBAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;iBA4Bf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAcvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAGxD,UAAU;IAsDV,mBAAmB;IAqHzB;;;;OAIG;IAEG,qBAAqB;IAyB3B;;;;;;OAMG;IAEG,mBAAmB;IAiInB,uBAAuB;IAmEvB,gBAAgB;IAqCtB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAqDxB"}

package/auth/flows/oauth.provider-callback.flow.d.ts

@@ -0,0 +1,118 @@
+/**
+ * OAuth Provider Callback Endpoint — GET /oauth/provider/:providerId/callback
+ *
+ * Who calls: Browser after user completes OAuth with an upstream provider
+ *
+ * When: During multi-provider (federated) authentication flow
+ *
+ * Purpose: Exchange upstream provider's authorization code for tokens,
+ *          store tokens securely, then redirect to next provider or complete auth
+ *
+ * Flow:
+ * 1. User selects providers on federated login page
+ * 2. System redirects to first provider's /authorize
+ * 3. User completes auth with provider
+ * 4. Provider redirects here with authorization code
+ * 5. We exchange code for tokens, store them
+ * 6. If more providers in queue, redirect to next
+ * 7. If all providers done, issue FrontMCP JWT
+ */
+import { FlowBase, FlowRunOptions } from '../../common';
+import { z } from 'zod';
+declare const inputSchema: z.ZodObject<{
+    request: z.ZodObject<{}, z.core.$loose>;
+    response: z.ZodObject<{}, z.core.$loose>;
+    next: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
+declare const stateSchema: z.ZodObject<{
+    providerId: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    errorDescription: z.ZodOptional<z.ZodString>;
+    providerState: z.ZodOptional<z.ZodString>;
+    federatedSessionId: z.ZodOptional<z.ZodString>;
+    federatedSession: z.ZodOptional<z.ZodUnknown>;
+    providerTokens: z.ZodOptional<z.ZodUnknown>;
+    providerUserInfo: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+declare const outputSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"redirect">;
+    status: z.ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, unknown, z.core.$ZodTypeInternals<301 | 302 | 303 | 307 | 308, unknown>>>;
+    location: z.ZodString;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            strict: "strict";
+            lax: "lax";
+            none: "none";
+        }>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodNumber;
+    body: z.ZodString;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            strict: "strict";
+            lax: "lax";
+            none: "none";
+        }>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, z.core.$strip>>>>;
+    kind: z.ZodLiteral<"html">;
+    contentType: z.ZodDefault<z.ZodLiteral<"text/html; charset=utf-8">>;
+}, z.core.$strip>]>;
+declare const plan: {
+    readonly pre: ["parseInput", "loadFederatedSession", "validateProviderCallback"];
+    readonly execute: ["exchangeProviderCode", "storeProviderTokens", "handleNextProviderOrComplete"];
+};
+declare global {
+    interface ExtendFlows {
+        'oauth:provider-callback': FlowRunOptions<OauthProviderCallbackFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "oauth:provider-callback";
+export default class OauthProviderCallbackFlow extends FlowBase<typeof name> {
+    private logger;
+    /**
+     * Get LocalPrimaryAuth instance with type safety
+     * @throws Error if auth is not LocalPrimaryAuth
+     */
+    private getLocalAuth;
+    parseInput(): Promise<void>;
+    loadFederatedSession(): Promise<void>;
+    validateProviderCallback(): Promise<void>;
+    exchangeProviderCode(): Promise<void>;
+    storeProviderTokens(): Promise<void>;
+    handleNextProviderOrComplete(): Promise<void>;
+    /**
+     * Complete the federated auth flow and issue FrontMCP JWT
+     */
+    private completeFederatedAuth;
+    /**
+     * Generate a deterministic user sub from email
+     */
+    private generateUserSub;
+    /**
+     * Render an error page
+     */
+    private renderErrorPage;
+    private getStateValidation;
+}
+export {};
+//# sourceMappingURL=oauth.provider-callback.flow.d.ts.map

package/auth/flows/oauth.provider-callback.flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.provider-callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.provider-callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAEL,QAAQ,EAER,cAAc,EAOf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,QAAA,MAAM,WAAW;;;;iBAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;iBAcf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,yBAAyB,EAAE,cAAc,CACvC,yBAAyB,EACzB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,yBAAkC,CAAC;AAchD,MAAM,CAAC,OAAO,OAAO,yBAA0B,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC1E,OAAO,CAAC,MAAM,CAAwD;IAEtE;;;OAGG;IACH,OAAO,CAAC,YAAY;IASd,UAAU;IA0BV,oBAAoB;IAkEpB,wBAAwB;IAmDxB,oBAAoB;IA0EpB,mBAAmB;IAkDnB,4BAA4B;IAkElC;;OAEG;YACW,qBAAqB;IA8CnC;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAqDvB,OAAO,CAAC,kBAAkB;CAO3B"}

package/auth/flows/oauth.register.flow.d.ts

@@ -56,8 +56,8 @@ declare const outputSchema: z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;

package/auth/flows/oauth.token.flow.d.ts

@@ -108,8 +108,8 @@ declare const outputSchema: z.ZodObject<{
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
         sameSite: z.ZodOptional<z.ZodEnum<{
-            lax: "lax";
             strict: "strict";
+            lax: "lax";
             none: "none";
         }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;