@frontmcp/sdk 1.3.0 → 1.4.0

package/auth/flows/oauth.token.flow.d.ts

@@ -51,9 +51,9 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
         client_id: import("@frontmcp/lazy-zod").ZodString;
     }, import("zod/v4/core").$strip>], "grant_type">>;
     grantType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
-        anonymous: "anonymous";
         authorization_code: "authorization_code";
         refresh_token: "refresh_token";
+        anonymous: "anonymous";
     }>>;
     isDefaultAuthProvider: import("@frontmcp/lazy-zod").ZodBoolean;
     isOrchestrated: import("@frontmcp/lazy-zod").ZodBoolean;
@@ -82,8 +82,8 @@ declare const outputSchema: import("@frontmcp/lazy-zod").ZodObject<{
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;

package/auth/flows/oauth.token.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.token.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.token.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;AAgCH,OAAO,EAGL,QAAQ,EAOR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AA2CpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAkBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAcpC,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAGrD,UAAU;IA4BV,aAAa;IAmBb,4BAA4B;IAiD5B,uBAAuB;IAiDvB,oBAAoB;IAkCpB,kBAAkB;IAqBlB,cAAc;CAGrB"}
+{"version":3,"file":"oauth.token.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.token.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;AAgCH,OAAO,EAGL,QAAQ,EAOR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAgGpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAkBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAcpC,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAGrD,UAAU;IAyCV,aAAa;IAmBb,4BAA4B;IAiD5B,uBAAuB;IAiDvB,oBAAoB;IAkCpB,kBAAkB;IAqBlB,cAAc;CAGrB"}

package/auth/flows/oauth.userinfo.flow.d.ts

@@ -0,0 +1,67 @@
+/**
+ * UserInfo Endpoint — GET /oauth/userinfo
+ *
+ * Who calls: a client holding a FrontMCP-issued access token.
+ *
+ * When: after obtaining an access token via /oauth/token, to resolve the
+ * authenticated user's claims (OIDC userinfo-style).
+ *
+ * Purpose: verify the Bearer token's HS256 signature + lifetime via the
+ * auth instance's {@link LocalPrimaryAuth.verifyGatewayToken} and return the
+ * user claims (`sub`, plus `email`/`name`/`picture` when present) as JSON.
+ * Returns 401 when the Authorization header is missing or the token fails
+ * verification.
+ *
+ * This endpoint backs the `userinfo_endpoint` advertised by the
+ * oauth-authorization-server discovery document in orchestrated/local mode.
+ */
+import 'reflect-metadata';
+import { FlowBase, type FlowRunOptions } from '../../common';
+declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
+    response: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
+    next: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>>;
+}, import("zod/v4/core").$strip>;
+declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    token: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    baseUrl: import("@frontmcp/lazy-zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const outputSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    kind: import("@frontmcp/lazy-zod").ZodLiteral<"json">;
+    status: import("@frontmcp/lazy-zod").ZodNumber;
+    body: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodAny>, import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodAny>]>;
+    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
+    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
+    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+        name: import("@frontmcp/lazy-zod").ZodString;
+        value: import("@frontmcp/lazy-zod").ZodString;
+        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
+        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
+            strict: "strict";
+            none: "none";
+            lax: "lax";
+        }>>;
+        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
+        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
+    }, import("zod/v4/core").$strip>>>>;
+}, import("zod/v4/core").$strip>;
+declare const plan: {
+    readonly pre: ["parseInput"];
+    readonly execute: ["verifyAndRespond"];
+};
+declare global {
+    interface ExtendFlows {
+        'oauth:userinfo': FlowRunOptions<OauthUserInfoFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "oauth:userinfo";
+export default class OauthUserInfoFlow extends FlowBase<typeof name> {
+    private logger;
+    parseInput(): Promise<void>;
+    verifyAndRespond(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=oauth.userinfo.flow.d.ts.map

package/auth/flows/oauth.userinfo.flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.userinfo.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.userinfo.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAEL,QAAQ,EAOR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;gCAGf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAcvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAGxD,UAAU;IASV,gBAAgB;CAuDvB"}

package/auth/flows/session.verify.flow.d.ts

@@ -44,11 +44,11 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
             isPublic: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
             platformType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                 unknown: "unknown";
+                continue: "continue";
                 openai: "openai";
                 claude: "claude";
                 gemini: "gemini";
                 cursor: "cursor";
-                continue: "continue";
                 cody: "cody";
                 "generic-mcp": "generic-mcp";
                 "ext-apps": "ext-apps";
@@ -84,11 +84,11 @@ export declare const sessionVerifyOutputSchema: import("@frontmcp/lazy-zod").Zod
                 isPublic: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
                 platformType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                     unknown: "unknown";
+                    continue: "continue";
                     openai: "openai";
                     claude: "claude";
                     gemini: "gemini";
                     cursor: "cursor";
-                    continue: "continue";
                     cody: "cody";
                     "generic-mcp": "generic-mcp";
                     "ext-apps": "ext-apps";

package/auth/flows/session.verify.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/session.verify.flow.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,QAAQ,EAWR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAEtB,OAAO,kBAAkB,CAAC;AAoB1B,QAAA,MAAM,WAAW;;gCAAyB,CAAC;AAE3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAaf,CAAC;AAuBH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAmE,CAAC;AAE1G,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,yBAAyB,EAChC,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAyBvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,MAAM,wCAA+C;IAErD,OAAO,CAAC,OAAO;IAMf;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAoExB,UAAU;IAiDhB;;;;;;;OAOG;IAEG,gBAAgB;IAwBtB;;;OAGG;IAUG,uBAAuB;IA4BvB,+BAA+B;IAQrC;;;;;;;OAOG;IAEG,WAAW;IAyGX,UAAU;IAIhB;;;;;OAKG;IAEG,kBAAkB;IAclB,qBAAqB;CAoB5B"}
+{"version":3,"file":"session.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/session.verify.flow.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,QAAQ,EAWR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAEtB,OAAO,kBAAkB,CAAC;AAoB1B,QAAA,MAAM,WAAW;;gCAAyB,CAAC;AAE3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAaf,CAAC;AAuBH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAmE,CAAC;AAE1G,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,yBAAyB,EAChC,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAyBvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,MAAM,wCAA+C;IAErD,OAAO,CAAC,OAAO;IAMf;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAoExB,UAAU;IAiDhB;;;;;;;OAOG;IAEG,gBAAgB;IAwBtB;;;OAGG;IAUG,uBAAuB;IA4BvB,+BAA+B;IAQrC;;;;;;;OAOG;IAEG,WAAW;IA4GX,UAAU;IAIhB;;;;;OAKG;IAEG,kBAAkB;IAclB,qBAAqB;CAoB5B"}

package/auth/flows/well-known.jwks.flow.d.ts

@@ -24,8 +24,8 @@ declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [impo
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
@@ -45,8 +45,8 @@ declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [impo
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
@@ -65,8 +65,8 @@ declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [impo
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;

package/auth/flows/well-known.oauth-authorization-server.flow.d.ts

@@ -48,8 +48,8 @@ export declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonl
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
@@ -69,8 +69,8 @@ export declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonl
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
@@ -78,6 +78,7 @@ export declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonl
 }, import("zod/v4/core").$strip>]>;
 export declare const wellKnownAsStateSchema: import("@frontmcp/lazy-zod").ZodObject<{
     baseUrl: import("@frontmcp/lazy-zod").ZodString;
+    oauthBaseUrl: import("@frontmcp/lazy-zod").ZodString;
     scopesSupported: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
     tokenEndpointAuthMethods: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
         client_secret_basic: "client_secret_basic";

package/auth/flows/well-known.oauth-authorization-server.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.oauth-authorization-server.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEvC,OAAO,EAEL,QAAQ,EAUR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AA4BpC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAA0E,CAAC;AAEpG,eAAO,MAAM,sBAAsB;;;;;;;;;;;gCAUjC,CAAC;AAEH,QAAA,MAAM,eAAe;;;CAGgB,CAAC;AAEtC,KAAK,eAAe,GAAG,OAAO,eAAe,CAAC;AAC9C,KAAK,sBAAsB,GAAG,cAAc,CAC1C,eAAe,EACf,eAAe,EACf,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,sBAAsB,CAC9B,CAAC;AAEF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,uCAAuC,EAAE,sBAAsB,CAAC;KACjE;CACF;AAED,QAAA,MAAM,IAAI,EAAG,uCAAgD,CAAC;AAa9D,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAChE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,UAAU;IA0BV,WAAW;CA+BlB"}
+{"version":3,"file":"well-known.oauth-authorization-server.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAEL,QAAQ,EAWR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAoBtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AA4BpC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAA0E,CAAC;AAEpG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;gCAgBjC,CAAC;AAEH,QAAA,MAAM,eAAe;;;CAGgB,CAAC;AAEtC,KAAK,eAAe,GAAG,OAAO,eAAe,CAAC;AAC9C,KAAK,sBAAsB,GAAG,cAAc,CAC1C,eAAe,EACf,eAAe,EACf,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,sBAAsB,CAC9B,CAAC;AAEF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,uCAAuC,EAAE,sBAAsB,CAAC;KACjE;CACF;AAED,QAAA,MAAM,IAAI,EAAG,uCAAgD,CAAC;AAa9D,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAChE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,UAAU;IA+BV,WAAW;CA4ClB"}

package/auth/flows/well-known.prm.flow.d.ts

@@ -25,8 +25,8 @@ declare const outputSchema: import("@frontmcp/lazy-zod").ZodObject<{
         secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
         sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
             strict: "strict";
-            lax: "lax";
             none: "none";
+            lax: "lax";
         }>>;
         maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;

package/auth/flows/well-known.prm.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.prm.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAGL,QAAQ,EAOR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;gCAKf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;gCAShB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,qCAAqC,EAAE,cAAc,CACnD,gBAAgB,EAChB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,qCAA8C,CAAC;AAa5D,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,UAAU;IAiBY,WAAW;CA+BxC"}
+{"version":3,"file":"well-known.prm.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAGL,QAAQ,EAOR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;gCAKf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;gCAShB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,qCAAqC,EAAE,cAAc,CACnD,gBAAgB,EAChB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,qCAA8C,CAAC;AAa5D,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,UAAU;IAiBY,WAAW;CAmCxC"}

package/auth/instances/instance.local-primary-auth.d.ts

@@ -1,4 +1,4 @@
-import { type AuthorizationStore, type FederatedAuthSessionStore, type OrchestratedTokenStore as TokenStore } from '@frontmcp/auth';
+import { DcrClientRegistry, SessionCredentialVault, type AuthorizationStore, type ConsentStore, type DcrRegistryConfig, type FederatedAuthSessionStore, type SecureStoreBackend, type OrchestratedTokenStore as TokenStore, type VerifyResult } from '@frontmcp/auth';
 import { FrontMcpAuth, type FrontMcpLogger, type JWK, type ScopeEntry, type ServerRequest } from '../../common';
 import { type LocalAuthOptions, type PublicAuthOptions, type RemoteAuthOptions } from '../../common/types/options/auth';
 import type ProviderRegistry from '../../provider/provider.registry';
@@ -35,6 +35,21 @@ export interface ConsentMetadata {
     skippedProviderIds?: string[];
     consentEnabled?: boolean;
     federatedLoginUsed?: boolean;
+    /**
+     * Progressive/Incremental authorization: the set of app IDs this token grants
+     * access to. ONLY emitted when `incrementalAuth` is enabled for the scope —
+     * its presence turns on app-level gating in `checkToolAuthorization`, so it is
+     * deliberately omitted for non-incremental setups to preserve the historical
+     * allow-all behavior. Embedded as the `authorized_apps` claim by
+     * {@link LocalPrimaryAuth.signAccessToken}.
+     */
+    authorizedAppIds?: string[];
+    /**
+     * Custom claims from a local `authenticate` verifier (Checkpoint 3a). Merged
+     * into the access token by {@link LocalPrimaryAuth.signAccessToken} with a
+     * reserved-claim guard so they can never clobber sub/iss/exp/etc.
+     */
+    customClaims?: Record<string, unknown>;
 }
 /**
  * Extended token response from upstream providers (includes id_token)
@@ -81,30 +96,188 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
     readonly keys: JWK[];
     readonly secret: Uint8Array;
     readonly logger: FrontMcpLogger;
-    readonly authorizationStore: AuthorizationStore;
     private jwks;
     private cimdService;
-    /** Federated auth session store for multi-provider flows */
-    readonly federatedSessionStore: FederatedAuthSessionStore;
-    /** Token store for upstream provider tokens */
-    readonly orchestratedTokenStore: TokenStore;
+    /**
+     * Token storage backend selected from `options.tokenStorage`.
+     * - `'memory'` / undefined → in-memory stores (default; lost on restart).
+     * - `{ redis }` / `{ sqlite }` → adapter-backed stores that survive restart.
+     *
+     * The three stores below are constructed in-memory synchronously in the
+     * constructor (preserving the exact legacy default behavior). When a
+     * persistent backend is configured, {@link initializeStores} swaps in the
+     * StorageAdapter-backed implementations during async `initialize()`, before
+     * the server signals ready.
+     */
+    private readonly tokenStorage;
+    /** OAuth authorization-code / pending / refresh-token store. */
+    private authorizationStoreImpl;
+    /** Federated auth session store for multi-provider flows. */
+    private federatedSessionStoreImpl;
+    /** Token store for upstream provider tokens. */
+    private orchestratedTokenStoreImpl;
+    /** Remembered per-(user, client) consent selections (`rememberConsent`). */
+    private consentStoreImpl;
+    /**
+     * Local-AS Dynamic Client Registration registry (#462). Seeded with any
+     * `dcr.clients` at construction so the authorize/token flows accept those
+     * pre-registered clients without a DCR round-trip, and mutated by
+     * `POST /oauth/register`. Always present (empty when no `dcr` is configured).
+     */
+    private readonly dcrClientRegistryImpl;
+    /** Storage adapter backing the persistent stores (kept for disposal). */
+    private storageAdapter?;
+    /**
+     * Per-session encrypted credential vault (Checkpoint 3b). Backs
+     * `this.credentials` in tools and persists `authenticate()` credentials.
+     * Constructed in {@link initialize} once the storage backend is known.
+     */
+    private credentialVaultImpl?;
+    /** Per-session encrypted credential vault (Checkpoint 3b), if enabled. */
+    get credentialVault(): SessionCredentialVault | undefined;
+    /**
+     * General session-scoped secure-secret store backend (#470). Backs
+     * `this.secureStore` in tools. Constructed in {@link initialize} from
+     * `auth.secureStore`; defaults to an in-memory, AES-256-GCM-encrypted backing.
+     */
+    private secureStoreBackendImpl?;
+    /** General secure-store backend (#470), if enabled. */
+    get secureStoreBackend(): SecureStoreBackend | undefined;
+    /** OAuth authorization-code / pending / refresh-token store. */
+    get authorizationStore(): AuthorizationStore;
+    /** Federated auth session store for multi-provider flows. */
+    get federatedSessionStore(): FederatedAuthSessionStore;
+    /** Token store for upstream provider tokens. */
+    get orchestratedTokenStore(): TokenStore;
+    /**
+     * Remembered per-(user, client) consent selections, backing
+     * `auth.consent.rememberConsent`. Shares the configured token-storage backend
+     * (memory by default; Redis/SQLite when persistent storage is configured).
+     */
+    get consentStore(): ConsentStore;
+    /**
+     * Local-AS Dynamic Client Registration registry (#462). Consulted by the
+     * register/authorize flows to enforce the declarative `dcr` allowlists and to
+     * look up pre-registered + dynamically-registered clients.
+     */
+    get dcrClientRegistry(): DcrClientRegistry;
+    /**
+     * Resolved local-AS DCR config. Only `local` mode carries `dcr`; every other
+     * mode returns `undefined`, preserving the historical behavior exactly.
+     */
+    getDcrConfig(): DcrRegistryConfig | undefined;
+    /**
+     * Whether `POST /oauth/register` and the `registration_endpoint` advertisement
+     * are active. Honors an explicit `dcr.enabled`; when unset, falls back to the
+     * historical guard (enabled in development, disabled in production).
+     */
+    isDcrEnabled(): boolean;
     /** Provider configurations (indexed by provider ID) */
     private readonly providerConfigs;
+    /**
+     * Remote-mode single upstream provider id (set by {@link registerRemoteProvider}).
+     *
+     * In `mode: 'remote'` FrontMCP federates exactly ONE mandatory upstream IdP.
+     * The authorize flow auto-starts federation against this id (no in-tree login
+     * page, no provider-selection page), and tools read its token via
+     * `this.orchestration.getToken(remoteProviderId)`. Undefined in every other mode.
+     */
+    private remoteProviderIdImpl?;
+    /** Remote-mode single upstream provider id, or undefined outside remote mode. */
+    get remoteProviderId(): string | undefined;
     /** Default access token TTL (1 hour) */
     private readonly accessTokenTtlSeconds;
     /** Default refresh token TTL (30 days) */
     private readonly refreshTokenTtlSeconds;
-    /**
-     * Get the authorization store as InMemoryAuthorizationStore with type guard.
-     * This ensures type safety when using InMemory-specific methods.
-     */
-    private getInMemoryStore;
     constructor(scope: ScopeEntry, providers: ProviderRegistry, options: LocalPrimaryAuthOptions);
     /**
-     * Derive issuer from options
+     * Derive issuer from options.
+     *
+     * `FRONTMCP_PUBLIC_HOST` overrides only the HOST portion of the boot-time
+     * issuer (see `this.host` in the constructor); the scheme stays `http` and
+     * the port stays `this.port`. To override the scheme and/or port (e.g.
+     * advertise `https://…` with no explicit port behind a TLS proxy), set an
+     * explicit `local.issuer` — that is the supported way to make the boot-time
+     * issuer match what discovery advertises. JWT verification accepts an issuer
+     * array, so tokens minted under a different scheme/port are still tolerated
+     * when running behind a TLS-terminating proxy, but `local.issuer` is the
+     * supported knob for aligning the issuer with discovery.
      */
     private deriveIssuer;
+    /**
+     * Read the `tokenStorage` selection off the auth options. Only
+     * local/remote/orchestrated modes declare it; public mode does not, in which
+     * case we treat it as the in-memory default.
+     */
+    private readTokenStorage;
+    /**
+     * When a persistent token-storage backend (Redis/SQLite) is configured, build
+     * a shared `StorageAdapter` and swap the three in-memory stores for their
+     * adapter-backed equivalents. For `'memory'` (or unset) this is a no-op, so
+     * the default behavior is preserved exactly.
+     *
+     * The orchestrated-token store keeps using the JWT secret as its encryption
+     * key, so upstream provider tokens stay encrypted at rest in every backend.
+     */
+    private initializeStores;
+    /**
+     * Build the per-session credential vault (Checkpoint 3b) and register the
+     * `this.credentials` accessor + the `/oauth/connect` add-credential flow.
+     *
+     * Skipped in pure public mode (no authenticated subject / no authenticate()
+     * verifier there). The vault shares the persistent StorageAdapter when one is
+     * configured; otherwise it uses a dedicated in-memory adapter. The HMAC pepper
+     * and resume-link signing key both derive from the server JWT secret
+     * (`this.secret`), so resume URLs are framework-signed with the same trust
+     * root as the access tokens.
+     */
+    private initializeCredentialVault;
+    /**
+     * Read the `secureStore` selection off the auth options. Only
+     * local/remote/orchestrated modes declare it; public mode does not.
+     */
+    private readSecureStoreConfig;
+    /**
+     * Build the general session-scoped secure-secret store (#470) and register the
+     * `this.secureStore` accessor.
+     *
+     * Skipped in pure public mode (no authenticated subject / no session-bound
+     * secrets there). The backing comes from `auth.secureStore`:
+     * - unset / `'memory'` → in-memory, AES-256-GCM-encrypted store (default);
+     * - `{ sqlite }` / `{ redis }` → persistent encrypted store. When the chosen
+     *   persistent backing matches the configured `tokenStorage`, the SAME
+     *   StorageAdapter is reused (one connection);
+     * - `{ backend }` → a custom backing used as-is (e.g. an OS keychain) — the
+     *   framework bundles NO native dependency for this path.
+     *
+     * The HKDF pepper for the built-in encrypted backings derives from the server
+     * JWT secret (`this.secret`) unless an explicit `encryption.pepper` is set, so
+     * secrets share the same trust root as the access tokens.
+     */
+    private initializeSecureStore;
+    /**
+     * Whether the `secureStore` config selects the SAME persistent backing as the
+     * configured `tokenStorage`, so they can share one StorageAdapter. Returns
+     * false for memory/custom/undefined and for mismatched backings (in which case
+     * the secure store gets its own adapter).
+     */
+    private secureStoreSharesTokenStorage;
     signAnonymousJwt(): Promise<string>;
+    /**
+     * Cryptographically verify a gateway-issued access token (public/local/remote
+     * "gateway" modes). Gateway tokens — both authenticated access tokens
+     * ({@link signAccessToken}) and anonymous tokens ({@link signAnonymousJwt}) —
+     * are HS256-signed with `this.secret`, so this instance is the sole holder of
+     * the verification key.
+     *
+     * Enforces the signature and lifetime claims (`exp`/`nbf`, checked by `jose`
+     * by default). Issuer equality is intentionally NOT enforced: proxy/tunnel
+     * deployments legitimately present an `iss` that differs from the
+     * request-derived base URL (see {@link deriveIssuer}). Algorithm is pinned to
+     * HS256 to block `alg` confusion (e.g. a forged `alg: none` or asymmetric
+     * header). `expectedIssuer` is accepted for parity/logging only.
+     */
+    verifyGatewayToken(token: string, expectedIssuer: string): Promise<VerifyResult>;
     /**
      * Sign an access token for an authenticated user
      */
@@ -142,6 +315,8 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
         consentEnabled?: boolean;
         federatedLoginUsed?: boolean;
         pendingAuthId?: string;
+        authorizedAppIds?: string[];
+        customClaims?: Record<string, unknown>;
     }): Promise<string>;
     protected initialize(): Promise<void>;
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
@@ -151,6 +326,45 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * Register an upstream OAuth provider configuration
      */
     registerProvider(config: UpstreamProviderConfig): void;
+    /**
+     * Bridge declarative `auth.providers` (local-mode multi-provider orchestration)
+     * into the upstream-provider registry. Runs once during `initialize()`.
+     *
+     * For each declared provider we map the ergonomic `authorizeUrl`/`tokenUrl`
+     * aliases onto the canonical `authorizationEndpoint`/`tokenEndpoint`, default
+     * `name`/`scopes`, and compute the per-provider callback URL from the issuer
+     * (`${issuer}/oauth/provider/${id}/callback`). No-op when not local mode or
+     * when no providers are declared, so existing configs are unaffected.
+     *
+     * Security: only non-PII provider metadata is read here; client secrets are
+     * kept in the provider config and never logged or exposed to the LLM.
+     */
+    private registerConfiguredProviders;
+    /**
+     * Remote mode (`mode: 'remote'`): register the flat remote config as the
+     * SINGLE mandatory upstream provider. Runs once during `initialize()`.
+     *
+     * The flat fields (`provider` base URL + `clientId`/`clientSecret`/`scopes`)
+     * and the `providerConfig` endpoint overrides (`authEndpoint`/`tokenEndpoint`/
+     * `userInfoEndpoint`/`jwksUri`) are mapped onto an {@link UpstreamProviderConfig}.
+     * Endpoints not explicitly overridden are derived from the `provider` base URL
+     * using the standard OIDC paths (`/authorize`, `/token`, `/userinfo`,
+     * `/.well-known/jwks.json`) — the same convention `transparent` mode uses for
+     * discovery. The provider id comes from `providerConfig.id` when set, else it
+     * is derived from the provider hostname (mirroring `deriveProviderId`).
+     *
+     * No-op outside remote mode, so local/public/transparent are unaffected.
+     *
+     * Security: only non-PII provider metadata is read here; the client secret is
+     * kept in the provider config and never logged or exposed to the LLM.
+     */
+    private registerRemoteProvider;
+    /**
+     * Derive a stable provider id from the upstream `provider` base URL, mirroring
+     * the detection layer's `deriveProviderId`/`urlToProviderId` (hostname with
+     * dots replaced by underscores) so the id is consistent across surfaces.
+     */
+    private deriveRemoteProviderId;
     /**
      * Get provider configuration
      */

package/auth/instances/instance.local-primary-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,IAAI,UAAU,EAC1C,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAYrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAI/F;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAqCvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IArCnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;IAE1D,+CAA+C;IAC/C,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC;IAE5C,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;IAEzD;;;OAGG;IACH,OAAO,CAAC,gBAAgB;gBAQd,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IAkClC;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBd,gBAAgB;IAUtB;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IA0ClB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA+GxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,MAAM,CAAC;cA4BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAoB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAKtD;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA6DhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAsD9G;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}
+{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAI/F;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAuJvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAvJnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IAoDlC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;YACW,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAO/B,gBAAgB;IAUtB;;;;;;;;;;;;;OAaG;IACY,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB/F;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAuHxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA2CxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAKtD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAsD9G;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}

package/auth/secure-store/index.d.ts

@@ -0,0 +1,3 @@
+export { SECURE_STORE_BACKEND, createSecureStoreProviders, resolveRequestSessionId } from './secure-store.providers';
+export { secureStoreContextExtension, getSecureStore, tryGetSecureStore } from './secure-store.context-extension';
+//# sourceMappingURL=index.d.ts.map

package/auth/secure-store/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/secure-store/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGrH,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC"}

package/auth/secure-store/secure-store.context-extension.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Secure-store Context Extension (#470)
+ *
+ * Module augmentation + context-extension configuration that adds
+ * `this.secureStore` to ExecutionContextBase, mirroring `this.credentials`.
+ *
+ * `this.secureStore` exposes the general, session-scoped {@link SecureStoreAccessor}
+ * so tools (and auth UI) can read/write arbitrary user-typed secrets keyed by
+ * the configured scope (user / session / global), with the backing pluggable per
+ * deployment (memory / sqlite / redis / a custom OS-keychain backend).
+ */
+import { type SecureStoreAccessor } from '@frontmcp/auth';
+import type { ContextExtension } from '../../common/metadata/plugin.metadata';
+declare module '../../common/interfaces/execution-context.interface' {
+    interface ExecutionContextBase {
+        /**
+         * General session-scoped secure-secret store (#470). A typed accessor over a
+         * pluggable backend for arbitrary user-typed secrets. Available in
+         * `local`/`remote` auth modes.
+         *
+         * Distinct from {@link ExecutionContextBase.credentials}: `credentials` is the
+         * OAuth-credential vault (resume URLs, per-authorize rotation); `secureStore`
+         * is a general key→secret store with selectable backing.
+         *
+         * @example
+         * ```typescript
+         * @Tool({ name: 'save_api_key' })
+         * class SaveApiKeyTool extends ToolContext {
+         *   async execute(input: Input): Promise<Output> {
+         *     await this.secureStore.set('stg.api-key', input.apiKey);
+         *     const key = await this.secureStore.get<string>('stg.api-key');
+         *     const keys = await this.secureStore.list();
+         *     // …
+         *   }
+         * }
+         * ```
+         */
+        readonly secureStore: SecureStoreAccessor;
+    }
+}
+/**
+ * Context extension configuration for `this.secureStore`. Registers the lazy
+ * getter on ExecutionContextBase.prototype; resolves {@link SECURE_STORE_ACCESSOR}
+ * from the request scope.
+ */
+export declare const secureStoreContextExtension: ContextExtension;
+/**
+ * Get the {@link SecureStoreAccessor} from a context. Throws via the DI layer
+ * when not configured (see {@link secureStoreContextExtension.errorMessage}).
+ */
+export declare function getSecureStore(ctx: {
+    get: <T>(token: unknown) => T;
+}): SecureStoreAccessor;
+/**
+ * Try to get the {@link SecureStoreAccessor}; returns undefined when not
+ * available (graceful degradation).
+ */
+export declare function tryGetSecureStore(ctx: {
+    tryGet: <T>(token: unknown) => T | undefined;
+}): SecureStoreAccessor | undefined;
+//# sourceMappingURL=secure-store.context-extension.d.ts.map

package/auth/secure-store/secure-store.context-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store.context-extension.d.ts","sourceRoot":"","sources":["../../../src/auth/secure-store/secure-store.context-extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEjF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAM9E,OAAO,QAAQ,qDAAqD,CAAC;IACnE,UAAU,oBAAoB;QAC5B;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;KAC3C;CACF;AAMD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBAMzC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,CAAA;CAAE,GAAG,mBAAmB,CAE1F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,SAAS,CAAC;CAC9C,GAAG,mBAAmB,GAAG,SAAS,CAElC"}