@frontmcp/sdk 0.7.2 → 0.8.0

package/auth/session/vercel-kv-session.store.d.ts

@@ -2,10 +2,10 @@
  * Vercel KV Session Store
  *
  * Session store implementation using Vercel KV (edge-compatible REST-based key-value store).
- * Uses dynamic import to avoid bundling @vercel/kv for non-Vercel deployments.
+ * Uses @frontmcp/utils VercelKvStorageAdapter internally.
  *
  * @warning **Atomicity Limitation**: Vercel KV does not support atomic GET+EXPIRE (GETEX).
- * The `get()` method uses separate GET and PEXPIRE calls, creating a small race window
+ * The `get()` method uses separate GET and EXPIRE calls, creating a small race window
  * where the session could expire between these two operations. For mission-critical
  * session handling requiring strict atomicity guarantees, consider using Redis directly
  * via `RedisSessionStore`.
@@ -14,7 +14,7 @@
  */
 import { SessionStore, StoredSession, SessionSecurityConfig } from './transport-session.types';
 import { FrontMcpLogger } from '../../common/interfaces/logger.interface';
-import type { VercelKvProviderOptions } from '../../common/types/options/redis.options';
+import type { VercelKvProviderOptions } from '../../common/types/options/redis';
 export interface VercelKvSessionConfig {
     /**
      * KV REST API URL
@@ -46,34 +46,34 @@ export interface VercelKvSessionConfig {
  *
  * Provides persistent session storage for edge deployments using Vercel KV.
  * Sessions are stored as JSON with optional TTL.
+ * Uses @frontmcp/utils VercelKvStorageAdapter internally.
  */
 export declare class VercelKvSessionStore implements SessionStore {
-    private kv;
-    private connectPromise;
+    private readonly storage;
     private readonly keyPrefix;
     private readonly defaultTtlMs;
     private readonly logger?;
-    private readonly config;
     private readonly security;
     private readonly rateLimiter?;
     constructor(config: VercelKvSessionConfig | VercelKvProviderOptions, logger?: FrontMcpLogger);
+    /**
+     * Validate session ID
+     * @throws Error if sessionId is empty
+     */
+    private validateSessionId;
     /**
      * Connect to Vercel KV
-     * Uses dynamic import to avoid bundling @vercel/kv when not used.
-     * Thread-safe: concurrent calls will share the same connection promise.
+     * Thread-safe: concurrent calls will share the same connection via adapter.
      */
     connect(): Promise<void>;
-    private doConnect;
-    private ensureConnected;
     /**
-     * Get the full key for a session ID
-     * @throws Error if sessionId is empty
+     * Ensure the storage adapter is connected
      */
-    private key;
+    private ensureConnected;
     /**
      * Get a stored session by ID
      *
-     * Note: Vercel KV doesn't support GETEX, so we use GET + PEXPIRE separately.
+     * Note: Vercel KV doesn't support GETEX, so we use GET + EXPIRE separately.
      * This is slightly less atomic than Redis GETEX but sufficient for most use cases.
      *
      * @param sessionId - The session ID to look up
@@ -103,11 +103,11 @@ export declare class VercelKvSessionStore implements SessionStore {
     allocId(): string;
     /**
      * Disconnect from Vercel KV
-     * Vercel KV uses REST API, so there's no persistent connection to close
+     * Vercel KV uses REST API, so this just clears internal state
      */
     disconnect(): Promise<void>;
     /**
-     * Test Vercel KV connection by setting and getting a test key.
+     * Test Vercel KV connection by checking if we can access the API.
      * Useful for validating connection on startup.
      *
      * @returns true if connection is healthy, false otherwise

package/auth/session/vercel-kv-session.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-kv-session.store.d.ts","sourceRoot":"","sources":["../../../src/auth/session/vercel-kv-session.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAcxF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,EAAE,CAA+B;IACzC,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAG/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;gBAEtC,MAAM,EAAE,qBAAqB,GAAG,uBAAuB,EAAE,MAAM,CAAC,EAAE,cAAc;IAkB5F;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAkBhB,SAAS;YAgBT,eAAe;IAQ7B;;;OAGG;IACH,OAAO,CAAC,GAAG;IAOX;;;;;;;;;;;OAWG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAkHpG;;OAEG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BnF;;OAEG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C;;OAEG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKjD;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;CAW/B"}
+{"version":3,"file":"vercel-kv-session.store.d.ts","sourceRoot":"","sources":["../../../src/auth/session/vercel-kv-session.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAIhF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IAGzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;gBAEtC,MAAM,EAAE,qBAAqB,GAAG,uBAAuB,EAAE,MAAM,CAAC,EAAE,cAAc;IAwB5F;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B;;OAEG;YACW,eAAe;IAK7B;;;;;;;;;;;OAWG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAsHpG;;OAEG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BnF;;OAEG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9C;;OAEG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMjD;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;CAW/B"}

package/auth/utils/authorization-id.utils.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Derive a consistent authorization ID from a JWT token.
+ *
+ * Uses the token's signature (third part) to generate a deterministic
+ * ID that uniquely identifies this authorization without exposing
+ * the full token.
+ *
+ * @param token - JWT token string
+ * @returns 16-character hex string authorization ID
+ */
+export declare function deriveAuthorizationId(token: string): string;
+//# sourceMappingURL=authorization-id.utils.d.ts.map

package/auth/utils/authorization-id.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-id.utils.d.ts","sourceRoot":"","sources":["../../../src/auth/utils/authorization-id.utils.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3D"}

package/auth/utils/index.d.ts

@@ -1,3 +1,2 @@
-export * from './www-authenticate.utils';
-export * from './audience.validator';
+export * from './authorization-id.utils';
 //# sourceMappingURL=index.d.ts.map

package/auth/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/utils/index.ts"],"names":[],"mappings":"AAEA,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/utils/index.ts"],"names":[],"mappings":"AAEA,cAAc,0BAA0B,CAAC"}

package/auth/vault/auth-providers.accessor.d.ts

@@ -0,0 +1,153 @@
+/**
+ * AuthProvidersAccessor - Interface for accessing auth provider credentials
+ *
+ * This interface provides the runtime API for tools to access credentials
+ * from registered auth providers. It supports:
+ * - Credential retrieval by provider name
+ * - Lazy loading with session-scoped caching
+ * - Automatic token refresh for OAuth providers
+ * - Headers generation for HTTP requests
+ */
+import { Token } from '@frontmcp/di';
+import type { Credential, ResolvedCredential, GetCredentialOptions } from '@frontmcp/auth';
+/**
+ * AuthProvidersAccessor - Runtime accessor for auth providers in tool contexts.
+ *
+ * Available in tool execution via `this.authProviders`:
+ * ```typescript
+ * @Tool({ name: 'my_tool' })
+ * class MyTool extends ToolContext {
+ *   async execute(input: Input) {
+ *     const github = await this.authProviders.get('github');
+ *     const headers = await this.authProviders.headers('github');
+ *   }
+ * }
+ * ```
+ */
+export interface AuthProvidersAccessor {
+    /**
+     * Get a credential by provider name.
+     *
+     * @param providerName - Registered provider name (e.g., 'github', 'google')
+     * @param options - Retrieval options (forceRefresh, scopes, timeout)
+     * @returns Resolved credential or null if not available
+     *
+     * @example
+     * ```typescript
+     * const cred = await this.authProviders.get('github');
+     * if (cred?.credential.type === 'oauth') {
+     *   const token = cred.credential.accessToken;
+     * }
+     * ```
+     *
+     * @example Force refresh
+     * ```typescript
+     * const cred = await this.authProviders.get('github', { forceRefresh: true });
+     * ```
+     */
+    get<T extends Credential = Credential>(providerName: string, options?: GetCredentialOptions): Promise<ResolvedCredential<T> | null>;
+    /**
+     * Get multiple credentials by provider names.
+     * Executes all retrievals in parallel for efficiency.
+     *
+     * @param providerNames - Array of provider names
+     * @param options - Retrieval options applied to all providers
+     * @returns Map of provider name to resolved credential (null if not available)
+     *
+     * @example
+     * ```typescript
+     * const creds = await this.authProviders.getMany(['github', 'jira']);
+     * const github = creds.get('github');
+     * const jira = creds.get('jira');
+     * ```
+     */
+    getMany(providerNames: string[], options?: GetCredentialOptions): Promise<Map<string, ResolvedCredential | null>>;
+    /**
+     * Get headers for a provider (convenience method).
+     * Automatically handles different credential types:
+     * - OAuth/Bearer: `Authorization: Bearer <token>`
+     * - API Key: Uses configured header name
+     * - Basic: `Authorization: Basic <base64>`
+     *
+     * @param providerName - Provider name
+     * @returns Headers record or empty object if not available
+     *
+     * @example
+     * ```typescript
+     * const headers = await this.authProviders.headers('github');
+     * const response = await fetch(url, { headers });
+     * ```
+     */
+    headers(providerName: string): Promise<Record<string, string>>;
+    /**
+     * Get headers for multiple providers merged into a single object.
+     * Later providers override earlier ones if headers conflict.
+     *
+     * @param providerNames - Array of provider names
+     * @returns Merged headers from all providers
+     */
+    headersMany(providerNames: string[]): Promise<Record<string, string>>;
+    /**
+     * Force refresh a credential (for OAuth token refresh).
+     * Uses the provider's refresh function if available, otherwise calls factory.
+     *
+     * @param providerName - Provider name to refresh
+     * @returns New credential or null if refresh failed
+     *
+     * @example
+     * ```typescript
+     * // On 401 response, try refreshing
+     * if (response.status === 401) {
+     *   const newCred = await this.authProviders.refresh('github');
+     *   if (newCred) {
+     *     // Retry request with new credential
+     *   }
+     * }
+     * ```
+     */
+    refresh(providerName: string): Promise<ResolvedCredential | null>;
+    /**
+     * Check if a provider credential is available and valid.
+     * Does not trigger credential loading.
+     *
+     * @param providerName - Provider name
+     * @returns true if credential exists in cache/vault and is valid
+     */
+    has(providerName: string): Promise<boolean>;
+    /**
+     * Check if a provider is registered (regardless of credential availability).
+     *
+     * @param providerName - Provider name
+     * @returns true if provider is registered
+     */
+    isRegistered(providerName: string): boolean;
+    /**
+     * Invalidate cached credential (triggers reload on next access).
+     * Does not remove from persistent vault storage.
+     *
+     * @param providerName - Provider name to invalidate
+     */
+    invalidate(providerName: string): void;
+    /**
+     * Invalidate all cached credentials for this session.
+     */
+    invalidateAll(): void;
+    /**
+     * List all registered provider names.
+     */
+    listProviders(): string[];
+    /**
+     * List all available credentials (loaded in cache or vault).
+     */
+    listAvailable(): Promise<string[]>;
+}
+/**
+ * DI Token for AuthProvidersAccessor
+ *
+ * Used to resolve the accessor in tool contexts:
+ * ```typescript
+ * const accessor = this.get(AUTH_PROVIDERS_ACCESSOR);
+ * ```
+ */
+export declare const AUTH_PROVIDERS_ACCESSOR: Token<AuthProvidersAccessor>;
+//# sourceMappingURL=auth-providers.accessor.d.ts.map

package/auth/vault/auth-providers.accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.accessor.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EACnC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC;IAElH;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtE;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5C;;;;;OAKG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAE5C;;;;;OAKG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvC;;OAEG;IACH,aAAa,IAAI,IAAI,CAAC;IAEtB;;OAEG;IACH,aAAa,IAAI,MAAM,EAAE,CAAC;IAE1B;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAqD,KAAK,CAAC,qBAAqB,CAAC,CAAC"}

package/auth/vault/auth-providers.accessor.impl.d.ts

@@ -0,0 +1,52 @@
+/**
+ * AuthProvidersAccessorImpl - Implementation of AuthProvidersAccessor
+ *
+ * Provides runtime access to credential providers in tool contexts.
+ * Handles caching, vault storage, lazy loading, and credential refresh.
+ */
+import type { Credential, CredentialCache, CredentialFactoryContext, GetCredentialOptions, ResolvedCredential } from '@frontmcp/auth';
+import type { AuthProvidersAccessor } from './auth-providers.accessor';
+import type { AuthProvidersRegistry } from './auth-providers.registry';
+import type { AuthProvidersVault } from './auth-providers.vault';
+import type { LazyCredentialLoader } from './credential-loaders/lazy-loader';
+import { FrontMcpLogger } from '../../common';
+/**
+ * AuthProvidersAccessorImpl - Runtime implementation
+ */
+export declare class AuthProvidersAccessorImpl implements AuthProvidersAccessor {
+    private readonly registry;
+    private readonly vault;
+    private readonly cache;
+    private readonly loader;
+    private readonly context;
+    private readonly logger?;
+    constructor(registry: AuthProvidersRegistry, vault: AuthProvidersVault, cache: CredentialCache, loader: LazyCredentialLoader, context: CredentialFactoryContext, logger?: FrontMcpLogger);
+    get<T extends Credential = Credential>(providerName: string, options?: GetCredentialOptions): Promise<ResolvedCredential<T> | null>;
+    getMany(providerNames: string[], options?: GetCredentialOptions): Promise<Map<string, ResolvedCredential | null>>;
+    headers(providerName: string): Promise<Record<string, string>>;
+    headersMany(providerNames: string[]): Promise<Record<string, string>>;
+    refresh(providerName: string): Promise<ResolvedCredential | null>;
+    has(providerName: string): Promise<boolean>;
+    isRegistered(providerName: string): boolean;
+    invalidate(providerName: string): void;
+    invalidateAll(): void;
+    listProviders(): string[];
+    listAvailable(): Promise<string[]>;
+    /**
+     * Load credential from vault storage
+     */
+    private loadFromVault;
+    /**
+     * Store credential in vault storage
+     */
+    private storeInVault;
+    /**
+     * Check if a resolved credential is still valid
+     */
+    private isValid;
+    /**
+     * Generate default headers for a credential type
+     */
+    private defaultHeaders;
+}
+//# sourceMappingURL=auth-providers.accessor.impl.d.ts.map

package/auth/vault/auth-providers.accessor.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.accessor.impl.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.accessor.impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,2BAA2B,CAAC;AACjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;GAEG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IAInE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;gBAGtB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,wBAAwB,EAClD,MAAM,CAAC,EAAE,cAAc;IAKnB,GAAG,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EACzC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAwClC,OAAO,CACX,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAuB5C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAc9D,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAWrE,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAgCjE,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBjD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAKtC,aAAa,IAAI,IAAI;IAKrB,aAAa,IAAI,MAAM,EAAE;IAInB,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAYxC;;OAEG;YACW,aAAa;IA8B3B;;OAEG;YACW,YAAY;IAkB1B;;OAEG;IACH,OAAO,CAAC,OAAO;IAYf;;OAEG;IACH,OAAO,CAAC,cAAc;CAmCvB"}

package/auth/vault/auth-providers.context-extension.d.ts

@@ -0,0 +1,68 @@
+/**
+ * AuthProviders Context Extension
+ *
+ * Provides module augmentation and context extension configuration
+ * for adding `this.authProviders` to ExecutionContextBase.
+ */
+import type { ContextExtension } from '../../common/metadata/plugin.metadata';
+import { AuthProvidersAccessor } from './auth-providers.accessor';
+/**
+ * Module augmentation to add type safety for this.authProviders
+ */
+declare module '../../common/interfaces/execution-context.interface' {
+    interface ExecutionContextBase {
+        /**
+         * Access auth providers for credential retrieval.
+         *
+         * @example
+         * ```typescript
+         * @Tool({ name: 'my_tool' })
+         * class MyTool extends ToolContext {
+         *   async execute(input: Input): Promise<Output> {
+         *     // Get a specific credential
+         *     const github = await this.authProviders.get('github');
+         *
+         *     // Get headers for HTTP requests
+         *     const headers = await this.authProviders.headers('github');
+         *
+         *     // Check if credential is available
+         *     if (await this.authProviders.has('jira')) {
+         *       const jira = await this.authProviders.get('jira');
+         *     }
+         *
+         *     // Force refresh a credential
+         *     const refreshed = await this.authProviders.refresh('github');
+         *   }
+         * }
+         * ```
+         */
+        readonly authProviders: AuthProvidersAccessor;
+    }
+}
+/**
+ * Context extension configuration for authProviders.
+ * Used to register the lazy getter on ExecutionContextBase.prototype.
+ */
+export declare const authProvidersContextExtension: ContextExtension;
+/**
+ * Get AuthProvidersAccessor from context.
+ * Throws if not available.
+ *
+ * @param ctx - Execution context
+ * @returns AuthProvidersAccessor
+ * @throws Error if AuthProviders not configured
+ */
+export declare function getAuthProviders(ctx: {
+    get: <T>(token: unknown) => T;
+}): AuthProvidersAccessor;
+/**
+ * Try to get AuthProvidersAccessor from context.
+ * Returns undefined if not available (graceful degradation).
+ *
+ * @param ctx - Execution context
+ * @returns AuthProvidersAccessor or undefined
+ */
+export declare function tryGetAuthProviders(ctx: {
+    get: <T>(token: unknown) => T;
+}): AuthProvidersAccessor | undefined;
+//# sourceMappingURL=auth-providers.context-extension.d.ts.map

package/auth/vault/auth-providers.context-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.context-extension.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.context-extension.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAA2B,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAM3F;;GAEG;AACH,OAAO,QAAQ,qDAAqD,CAAC;IACnE,UAAU,oBAAoB;QAC5B;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;QACH,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;KAC/C;CACF;AASD;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,gBAM3C,CAAC;AAMF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,CAAA;CAAE,GAAG,qBAAqB,CAU9F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,CAAA;CAAE,GAAG,qBAAqB,GAAG,SAAS,CAM7G"}

package/auth/vault/auth-providers.providers.d.ts

@@ -0,0 +1,40 @@
+/**
+ * AuthProviders DI Providers
+ *
+ * Defines dependency injection providers for the AuthProviders vault system.
+ * These providers are registered at scope initialization when AuthProviders is enabled.
+ */
+import type { Token } from '@frontmcp/di';
+import { ProviderScope } from '@frontmcp/di';
+import type { AuthorizationVault, AuthProvidersVaultOptions } from '@frontmcp/auth';
+import { LazyCredentialLoader } from './credential-loaders/lazy-loader';
+/**
+ * Token for lazy loader (internal use)
+ */
+export declare const LAZY_CREDENTIAL_LOADER: Token<LazyCredentialLoader>;
+/**
+ * Provider definition type for AuthProviders system.
+ * Extended to include scope at top level for SDK compatibility.
+ */
+interface AuthProvidersProviderDef {
+    provide: Token;
+    scope: ProviderScope;
+    name?: string;
+    useFactory?: (...args: any[]) => any;
+    useValue?: unknown;
+    inject?: () => readonly Token[];
+}
+/**
+ * Create providers for AuthProviders vault system
+ *
+ * @param options - Vault configuration options
+ * @param baseVault - Base AuthorizationVault for storage
+ * @returns Array of provider definitions
+ */
+export declare function createAuthProvidersProviders(options: AuthProvidersVaultOptions, baseVault: AuthorizationVault): AuthProvidersProviderDef[];
+/**
+ * Check if AuthProviders should be enabled based on options
+ */
+export declare function isAuthProvidersEnabled(options?: AuthProvidersVaultOptions): boolean;
+export {};
+//# sourceMappingURL=auth-providers.providers.d.ts.map

package/auth/vault/auth-providers.providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAA4B,MAAM,gBAAgB,CAAC;AAU9G,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAoD,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnH;;;GAGG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,SAAS,KAAK,EAAE,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,kBAAkB,GAC5B,wBAAwB,EAAE,CA4E5B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAWnF"}

package/auth/vault/auth-providers.registry.d.ts

@@ -0,0 +1,110 @@
+/**
+ * AuthProvidersRegistry - Registry for credential providers
+ *
+ * Manages registration and lookup of credential providers.
+ * Providers are registered at scope initialization and
+ * remain available for the lifetime of the scope.
+ */
+import { Token } from '@frontmcp/di';
+import type { Credential, CredentialProviderConfig, CredentialScope, LoadingStrategy, AuthProvidersVaultOptions } from '@frontmcp/auth';
+/**
+ * Normalized provider config with defaults applied
+ */
+export interface NormalizedProviderConfig<T extends Credential = Credential> extends Required<Pick<CredentialProviderConfig<T>, 'name' | 'scope' | 'loading'>> {
+    description?: string;
+    cacheTtl: number;
+    factory: CredentialProviderConfig<T>['factory'];
+    refresh?: CredentialProviderConfig<T>['refresh'];
+    toHeaders?: CredentialProviderConfig<T>['toHeaders'];
+    metadata?: Record<string, unknown>;
+    required: boolean;
+}
+/**
+ * AuthProvidersRegistry - Manages credential provider configurations
+ */
+export declare class AuthProvidersRegistry {
+    private readonly providers;
+    private readonly defaultCacheTtl;
+    constructor(options?: AuthProvidersVaultOptions);
+    /**
+     * Register a credential provider
+     *
+     * @param config - Provider configuration
+     * @throws Error if provider with same name already registered
+     */
+    register<T extends Credential = Credential>(config: CredentialProviderConfig<T>): void;
+    /**
+     * Unregister a credential provider
+     *
+     * @param name - Provider name to unregister
+     * @returns true if provider was unregistered, false if not found
+     */
+    unregister(name: string): boolean;
+    /**
+     * Get a provider configuration by name
+     *
+     * @param name - Provider name
+     * @returns Provider config or undefined if not found
+     */
+    get<T extends Credential = Credential>(name: string): NormalizedProviderConfig<T> | undefined;
+    /**
+     * Check if a provider is registered
+     *
+     * @param name - Provider name
+     * @returns true if provider is registered
+     */
+    has(name: string): boolean;
+    /**
+     * Get all registered provider names
+     */
+    getNames(): string[];
+    /**
+     * Get all provider configurations
+     */
+    getAll(): NormalizedProviderConfig[];
+    /**
+     * Get providers by scope
+     *
+     * @param scope - Credential scope to filter by
+     */
+    getByScope(scope: CredentialScope): NormalizedProviderConfig[];
+    /**
+     * Get providers by loading strategy
+     *
+     * @param loading - Loading strategy to filter by
+     */
+    getByLoading(loading: LoadingStrategy): NormalizedProviderConfig[];
+    /**
+     * Get providers that are required
+     */
+    getRequired(): NormalizedProviderConfig[];
+    /**
+     * Get providers that should be eagerly loaded
+     */
+    getEager(): NormalizedProviderConfig[];
+    /**
+     * Get providers that should be lazily loaded
+     */
+    getLazy(): NormalizedProviderConfig[];
+    /**
+     * Get the number of registered providers
+     */
+    get size(): number;
+    /**
+     * Check if registry is empty
+     */
+    isEmpty(): boolean;
+    /**
+     * Clear all registered providers
+     */
+    clear(): void;
+    /**
+     * Normalize provider config with defaults
+     */
+    private normalize;
+}
+/**
+ * DI Token for AuthProvidersRegistry
+ */
+export declare const AUTH_PROVIDERS_REGISTRY: Token<AuthProvidersRegistry>;
+//# sourceMappingURL=auth-providers.registry.d.ts.map

package/auth/vault/auth-providers.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.registry.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,KAAK,EACV,UAAU,EACV,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,yBAAyB,EAC1B,MAAM,gBAAgB,CAAC;AAExB;;GAEG;AACH,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,CACzE,SAAQ,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,OAAO,CAAC,EAAE,yBAAyB;IAU/C;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC,GAAG,IAAI;IAUtF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIjC;;;;;OAKG;IACH,GAAG,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,GAAG,SAAS;IAI7F;;;;;OAKG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,QAAQ,IAAI,MAAM,EAAE;IAIpB;;OAEG;IACH,MAAM,IAAI,wBAAwB,EAAE;IAIpC;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,wBAAwB,EAAE;IAI9D;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,wBAAwB,EAAE;IAIlE;;OAEG;IACH,WAAW,IAAI,wBAAwB,EAAE;IAIzC;;OAEG;IACH,QAAQ,IAAI,wBAAwB,EAAE;IAItC;;OAEG;IACH,OAAO,IAAI,wBAAwB,EAAE;IAIrC;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,OAAO,CAAC,SAAS;CAclB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAqD,KAAK,CAAC,qBAAqB,CAAC,CAAC"}

package/auth/vault/auth-providers.vault.d.ts

@@ -0,0 +1,93 @@
+/**
+ * AuthProvidersVault - Dedicated storage namespace for auth provider credentials
+ *
+ * Uses the same underlying storage (Redis/Vercel KV) as AuthorizationVault
+ * but with a separate namespace to avoid conflicts.
+ */
+import { Token } from '@frontmcp/di';
+import type { Credential, AuthorizationVault, AppCredential, CredentialScope } from '@frontmcp/auth';
+import { FrontMcpLogger } from '../../common';
+/**
+ * AuthProvidersVault - Storage layer for auth provider credentials
+ */
+export declare class AuthProvidersVault {
+    private readonly baseVault;
+    private readonly namespace;
+    private readonly logger?;
+    constructor(baseVault: AuthorizationVault, namespace?: string, logger?: FrontMcpLogger);
+    /**
+     * Store a credential in the vault
+     *
+     * @param sessionId - Current session ID
+     * @param providerId - Provider name
+     * @param credential - Credential to store
+     * @param scope - Credential scope
+     * @param userId - User ID (required for user scope)
+     */
+    storeCredential<T extends Credential>(sessionId: string, providerId: string, credential: T, scope: CredentialScope, userId?: string): Promise<void>;
+    /**
+     * Get a credential from the vault
+     *
+     * @param sessionId - Current session ID
+     * @param providerId - Provider name
+     * @param scope - Credential scope
+     * @param userId - User ID (required for user scope)
+     * @returns Credential or null if not found
+     */
+    getCredential<T extends Credential>(sessionId: string, providerId: string, scope: CredentialScope, userId?: string): Promise<T | null>;
+    /**
+     * Remove a credential from the vault
+     *
+     * @param sessionId - Current session ID
+     * @param providerId - Provider name
+     * @param scope - Credential scope
+     * @param userId - User ID (required for user scope)
+     */
+    removeCredential(sessionId: string, providerId: string, scope: CredentialScope, userId?: string): Promise<void>;
+    /**
+     * Invalidate a credential (mark as invalid without removing)
+     *
+     * @param sessionId - Current session ID
+     * @param providerId - Provider name
+     * @param scope - Credential scope
+     * @param reason - Reason for invalidation
+     * @param userId - User ID (required for user scope)
+     */
+    invalidateCredential(sessionId: string, providerId: string, scope: CredentialScope, reason: string, userId?: string): Promise<void>;
+    /**
+     * Update OAuth credential tokens (for refresh)
+     *
+     * @param sessionId - Current session ID
+     * @param providerId - Provider name
+     * @param scope - Credential scope
+     * @param tokens - New tokens
+     * @param userId - User ID (required for user scope)
+     */
+    refreshOAuthCredential(sessionId: string, providerId: string, scope: CredentialScope, tokens: {
+        accessToken: string;
+        refreshToken?: string;
+        expiresAt?: number;
+    }, userId?: string): Promise<void>;
+    /**
+     * Get all credentials for a session
+     *
+     * @param sessionId - Current session ID
+     * @param scope - Optional scope filter
+     * @param userId - User ID (required for user scope)
+     */
+    getAllCredentials(sessionId: string, scope?: CredentialScope, userId?: string): Promise<AppCredential[]>;
+    /**
+     * Build vault key based on scope
+     *
+     * Key patterns:
+     * - global: `authproviders:global`
+     * - user: `authproviders:user:{userId}`
+     * - session: `authproviders:session:{sessionId}`
+     */
+    private buildVaultKey;
+}
+/**
+ * DI Token for AuthProvidersVault
+ */
+export declare const AUTH_PROVIDERS_VAULT: Token<AuthProvidersVault>;
+//# sourceMappingURL=auth-providers.vault.d.ts.map